ACRS Meeting on the Ad Hoc Subcommittee on Differing Professional Opinion Issues - October 13, 2000

                             UNITED STATES
                              Friday, October 13, 2000
                              U.S. NRC
                              11545 Rockville Pike, Room T2-B3
                              Rockville, Maryland
               The above-entitled meeting commenced, pursuant to
     notice, at 8:30 a.m..     PARTICIPANTS:
     Dana Powers, Chairman, ACRS
     Mario Bonaca, ACRS Member
     John (Jack) Sieber, ACRS Member
     Thomas Kress, ACRS Member
     Ivan Catton, Consultant
     James Higgins, Consultant
     Ronald Ballinger, Consultant
     Jack Strosnider, Division of Engineering, NRR
     Jack Hayes, Probabilistic Safety and Assessment Branch, NRR.                         P R O C E E D I N G S
               CHAIRMAN POWERS:  The meeting will now come to
               This is the fourth day of the meeting of the ad
     hoc ACRS Subcommittee on Differing Professional Opinion
     issues.  The purpose of the meeting is for the subcommittee
     to review technical issues contained in the differing
     professional opinion on steam generator tube integrity.
               The subcommittee will continue to hear from the
     NRC Staff today.  In particular, we will continue our
     discussions of damage propagation, then we'll hear specific
     discussions on design basis accidents, severe accidents and
     integrated decision-making.
               The meeting is being conducted in accordance with
     the provisions of the Federal Advisory Committee Act.  Mr.
     Sam Duraiswamy is the Designated Federal Official for this
     meeting.  Ms. Undine Shoop will be around someplace to
     assist us.
               We have received no written comments or requests
     for time to make oral statements from members of the public.
               A transcript of the meeting is being kept and it
     is requested that speakers use one of the microphones,
     identify themselves and speak with sufficient clarity and
     volume so they can be readily heard.
               Do members of the panel or the consultants have
     any comments to make before we return to the general
     discussion of damage propagation?  They all look glassy-eyed
     today.  I think you did 'em in yesterday.  They are not
     feeling too frisky this morning, I can tell.  The first
     speaker is really lucky.
               On my agenda I have Joe continuing.
               MR. MUSCARA:  Thank you and good morning.
               I do not have too much to say this morning, but
     we'll continue with the damage propagation with a
     presentation from Dr. Shack on integrity of steam generator
               CHAIRMAN POWERS:  You will have to tell us more
     about his background and why he is qualified.
               DR. KRESS:  Is he qualified to speak to us?
               MR. MUSCARA:  If I were you, I wouldn't listen to
               CHAIRMAN POWERS:  We don't in any case.
               MR. MUSCARA:  There is one comment I would like to
     follow up from the last presentation yesterday.
               I started yesterday talking about POD and the fact
     that we need a robust POD test -- do not really come up to
     100 percent, even for large flaws, and the reason I gave of
     course was the human factor, but the human factor also
     affects small flaws as well as large flaws.  If the person
     is blinking, whatever --
               Another reason we don't always get 100 percent POD
     for eddy current inspections of course is that the voltage
     can be quite low.  I am not sure how rare an event this is,
     but you can get a flaw that is long and deep and provide you
     a very small response.
               In fact, I indicated yesterday the mockup contains
     on the order of hundreds of tubes.  Within these hundreds of
     tubes we had about four flaws that were not detected by any
     of the inspectors, the reason being they were small voltage
     flaws, I believe below one volt.
               In fact, these flaws are large.  They are on the
     order of up to two inches long, 80 percent deep or deeper,
     so you can miss large flaws not only because of the human
     factor but unfortunately they have low voltage response.
               CHAIRMAN POWERS:  On the first day of our
     discussions of these phenomena we had something of an
     explanation of why you would get that.  I mean it was a
     plausibility or intuitive description that they have lots of
     these cross-ligaments in a tight flaw so they remain good
     conductivity paths.  Is that your understanding as well?
               MR. MUSCARA:  Precisely.  This is my understanding
     and speculation at this point.
               However, whenever we have a test result like this
     where it's been detected and we believe there are flaws
     there and we have sized them with our own techniques we will
     take the specimens out of the mockup and section them and
     verify what the condition is and what might be causing the
     low response, so our inspections indicated these are large
               I mean clearly we can see the length -- and by the
     other methods we believe they are deep but we will section
     some of those flaws to make sure that indeed they are deep
     and whether there are a lot of ligaments with these.
               MR. CATTON:  How well does the search for flaws
     perform when you look in the vicinity of the support plates,
     or is this a part of this study?
               MR. MUSCARA:  In the mockups?
               MR. CATTON:  Yes.
               MR. MUSCARA:  Yes, the support plate is an area of
     interest.  There are flaws there and the techniques are
     being used in the field for that kind of flaw being used in
     the round-robin.
               MR. CATTON:  What is the POD?
               MR. MUSCARA:  Well, like I say, we are just in the
     midst of pulling the data together and deciding what true
     state for the generator is and conducting these evaluations.
               At this point I really don't have the answer, but
     we cannot have all this work, not all of it finished but
     much of it finished so that we can have a topical report by
     the end of this calendar year and at that point we may very
     well have that information.
               MR. CATTON:  So it will be a part of what you do?
               MR. MUSCARA:  Oh, yes.  In fact, we have included
     with the support plate the complicating factors of the
     crevices being blocked up but also denting, with assimilated
     denting and superimposed flaws on the denting, so we made
     the test reasonable enough that it represents the field
               I think unless there are some other questions I
     would like to have Dr. Shack come up and talk about the
     integrity models.
               DR. SHACK:  Just for the record, I am Bill Shack
     from Argonne National Laboratory and I qualified to speak on
     this subject mostly because I have a bunch of competent
     colleagues at Argonne who do the work.
               Let me just hand out some toys.  This is a steam
     generator tube unflawed, pressurized to 2350 and taken to
     840C, so this is what happens in the high dry sequence to
     the unflawed tube if you get the temperature high enough.
               It would be bigger except that we have a two inch
     guard tube around this thing and so when it opens up and
     smashes into the guard tube it kind of flattens out.
               MR. CATTON:  It becomes bubble gum.
               DR. SHACK:  I passed around a sample stress
     corrosion crack yesterday that I thought everybody -- I
     assume everybody found the 360 degree circumferential crack.
               You might just want to compare what that looked
     like in your memory with an EDM notch so you can see how
     good a simulation an EDM notch is of a stress corrosion
               Let me pass this one around after I do a little
     bit of talking here.
               I am just going to briefly review a lot of work
     that was done by the NRC and industries during the '70s and
     '80s to develop verified models for failures of flawed steam
     generator tubes and I am going over that because some of the
     work that we did at Argonne was to extend that work to the
     short deep flaws.  That was one sort of shortcoming in some
     of the work that was done at PNL.  They didn't have enough
     short deep flaws, and so we wanted to go back and to extend
     the model and do a little more testing just to see how we
     were doing with the short deep flaws.
               Then into this sort of traditional failure of
     tubes under design basis conditions we have, as you have
     heard, got into an extended sort of discussion of the
     potential failure of steam generator tubes under severe
     accident conditions, in particular under these high dry
     scenarios where we have a depressurized secondary side and
     then the core melting just drives the temperatures up to 700
     or in fact if nothing else in the system fails to even
     higher temperatures.
               As I have noted, flawed tubes will fail at lower
     temperatures but even unflawed tubes under the sort of 2350
     pressure if you take them to 800 to 840C will fail rather
               Again as we get up to about 700C you can see the
     flow strength of Alloy 600 is decreasing markedly and again
     what we find of course is that in these tests, as you would
     expect the failures at low strain rates are controlled by
     creep and at high strain rates we expect them to be
     controlled by flow stress.
               We have typically found that we do better with
     creep failure models, so we, whenever we can and we have
     enough data, we try to work with the creep models.
               For a part-through crack now let me say that
     failure can mean two things.  Failure can mean -- in a part
     through crack means I have a crack that is, say,
     three-quarters of an inch long but it is not all the way
     through the wall.  It's, say, 80 percent through wall. 
     Well, I can have the failure of the ligament when the crack
     pops through the wall to create a leaking crack and that can
     occur in two ways.  That ligament can pop through but the
     length of the crack doesn't change, so that is a stable
     failure and what I end up with is a leak, and if I have a
     three-quarter inch crack that pops through I have a leaking
     three-quarter inch crack.
               Unstable failure or burst means that the crack not
     only pops through but will grow in length without any
     substantial increase in pressure or burst, and what I have
     here is a sample of a tube.  It's sort of an interesting
     one.  It is a three-quarter inch long EDM notch, which is
     sort of nice because you can make everything exactly
     precise.  It is 80 percent through-wall --
               MR. CATTON:  What kind of crack can you get with
     the EDM?
               DR. SHACK:  It's about three to four mils.
               MR. CATTON:  And the walls are very smooth?
               DR. SHACK:  Yes.  This is wide open.  This is a
               MR. CATTON:  That's what I thought.
               DR. SHACK:  But from a structural point of view it
     is a crack.  That is, this is not a ceramic -- from Alloy
     600 an EDM notch and a stress corrosion crack are the same
     structurally.  There's a difference certainly in leak rate
     because the one is far tighter than the other, but as far as
     the structural behavior goes, an EDM notch is a very good
               What you will see on this crack, you will see kind
     of a bright, shiny line at the bottom.  That is the
     remaining 20 percent ligament, and if you look real
     carefully you will see it slides off at a 45 degree angle. 
     It is a sheer lip failure -- that thing popped through.
               Then you will see some tearing at the ends of the
     crack, again on 45 degree lines as this thing is stablely
     tearing.  What happened is this one popped through at 2850
     so we got the 20 percent ligament to fail at 2850 but it
     wasn't an unstable failure.  We had to go to 3000 psi before
     we got the tearing at the ends of the crack and as it began
     to extend in length.
               Now again, what happens exactly when you start to
     get the unstable tearing is kind of unclear because in all
     laboratory systems we run out of pressure, and of course
     when we run out of pressure the system stops growing.  In a
     real plant, yes, you'll run out of pressure but you will rip
     a big hole and again after a hole gets so big it doesn't
     make a whole lot of difference.
               Once this crack is about an inch and a half long,
     the crack opening is about as big as the diameter of the
     tube and so the flow restriction is really the tube.  It is
     no longer the crack, so any crack lengths over an inch and a
     half are almost kind of -- you know, not terribly exciting.
               This is an interesting crack in the sense that it
     would not have failed, even the ligament would not have
     failed under a main steam line break, if you will allow me
     just to use pressures for the moment.
               MR. CATTON:  The mild main steam line break.
               DR. SHACK:  The mild main steam line break, where
     we just increase the pressure to 2500.  Even the ligament
     would not have failed but this is a tube that wouldn't pass
     the 3 delta p criterion, so this is in that in-between
     range, not good enough to pass 3 delta p, but it wouldn't
     have even failed the ligament under the main steam generator
     break, or shall we say the depressurized secondary loading.
               MR. BALLINGER:  What you are saying is this stuff
     is pretty tough.
               DR. SHACK:  This stuff is pretty tough.
               The bad news about Alloy 600 is it cracks.  The
     good news is it's tough as hell.
               A variety of models have been used to describe the
     failure, unstable failure of through-wall cracks and the
     ligament failure.  Most of them involve this kind of stress
     multiplier factor.  It is really a bulging factor and you
     will notice that the axial tube here fails in a bulge way.
               What I want to note is that this bulging factor
     depends on the radius so curvature counts here and one of
     the things that we will see, and we should keep in mind, is
     that tubes are much weaker to axial cracks, because we have
     this R-factor, and you can sort of see if I go to a flat
     plate as R gets very large, this bulging factor goes down,
     down, down and in fact I should have brought the flat plate
     solution and one of the interesting things about a
     cylindrical tube is that it has got a curvature in the hoop
     direction and it is a flat plate essentially in the axial
     direction, so that in fact axial cracks under the same
     stress will open up a lot more than circumferential
               If I have, for example, a quarter-inch flaw in the
     axial direction it will open about six times wider than the
     same quarter inch flaw in the circumferential direction
     because again under pressure loading I have a two-to-one
     pressure ratio and I have a multiplier of about three
     because of the curvature effect for the dimensions of this
     tube, so again even if I had the same loading in the axial
     direction that I had on the hoop direction the hoop crack
     would open up about three times as much as the axial crack.
               DR. KRESS:  Bill, what is the V in that equation
     or the Greek letter?
               DR. SHACK:  Here?
               DR. KRESS:  Yes.
               DR. SHACK:  Pousson's Ratio, .3.
               DR. KRESS:  Pousson's Ration, okay.
               CHAIRMAN POWERS:  Okay, keep going.  What is C?
               DR. SHACK:  C is the half crack length.  R is the
     radius of the tube and T is the thickness of the tube.
               CHAIRMAN POWERS:  And the bulging factor is this
     M --
               DR. SHACK:  M.
               CHAIRMAN POWERS:  -- which is not dimensionless?
               DR. SHACK:  Yes, it is dimensionless.  That lambda
     is a dimensionless quantity -- C over square root of RT.
               DR. KRESS:  Right.
               CHAIRMAN POWERS:  Okay.
               DR. SHACK:  In Christian units inches over square
     root of inches squared.
               For part through-cracks, we have a similar
     formulation, but we have a different expression for the
     bulging factor, and we won't worry too much about that.
               There is a fairly extensive database that goes
     through the burst pressure and the ligament failure
     pressures to validate those correlations.
               And, again, you'll notice, unlike the voltage
     correlations, when you go to a more mechanistic correlation,
     I can put 3/4, 7/8 and 11/16ths inch tubing all in the same
     plot, if I non-dimensionalize with the square root of RT,
     and I non-dimensionalize the burst pressure.
               DR. CATTON:  So what do you think is work with the
     data that we looked at yesterday?  It's just not presented
               DR. SHACK:  With voltages, you can't
     non-dimensionalize.  There's nothing wrong with it; it's
     just that you'll need separate correlations for 3/4-inch,
     11/16ths, and 7/8ths-tubing.
               DR. CATTON:  I don't understand that.
               DR. BALLINGER:  If you knew the crack length
     exactly --
               DR. CATTON:  So that's the problem; I don't know
     the crack length.
               DR. SHACK:  The problem is that you don't know the
     crack length.
               DR. CATTON:  Okay.  I don't know what's causing
     the particular voltage reading, okay.
               DR. SHACK:  The way I like to look at these things
     is sort of a geometry failure map here, and I'm looking at
     what happens to the whole range of flaw geometries that I
     could have in terms of the length of the crack and the depth
     of the crack.
               And everything below this curve, all cracks here,
     will have no failure at normal operating pressures, so I can
     have three-inch crack, 85 percent through the wall, and
     under normal operating pressures, that crack is going to sit
     there with no problems.
               If I have a crack that's one inch long, it will
     pop through when it gets to be a little over 90 percent
     deep, so it will pop through.  But it will pop through
     stably; it will pop through to give me a one-inch,
     through-wall crack that will not grow in length, but will
     sit there and will leak at some rate, and we'll talk about
     leakage later.
               However, if I had a three-inch crack that got to
     about 87 percent deep, it would pop through and it would
     start to run unstably until -- but again, three-inch crack,
     once it popped through and opened up, I'm dead anyway.
               DR. KRESS:  Are those lines pretty thick?
               DR. SHACK:  No, those lines -- Yes, I should
     mention that.  The lines here, think of them as about an
     eighth of an inch fuzzy line will cover the range of stress
     of material properties that I have in the tubing.
               So draw them with a magic marker kind of thing.
               DR. BALLINGER:  Does that include the vertical
               DR. SHACK:  Yes, the vertical line will also
     shift, depending on how things go.
               Now, on some of the plots where it has mattered,
     I've sort of shown the 95/95; on the plots where I haven't
     shown it, just think of fuzzy lines.
               Now, if I go to a main steam line break, the
     geometry picture changes a little bit.  Again, I need a
     crack that's something over 70 percent through-wall of any
     length to fail under the main steam line break conditions.
               If I have shorter cracks, again, let's take a look
     at the quarter-inch crack.  That has to be about 95 percent
     through-wall to fail, even under a main steam line break.
               So, again, if we're talking about short cracks
     popping through and leaking under these conditions, we're
     talking about short, very deep cracks.
               Again, anything below 85, you know, I need a
     fairly substantial crack if it's not going to be at least 85
     percent through-wall.
               DR. CATTON:  When you run these tests, everything
     is nice and quiet, and the tube is sitting there.
               DR. SHACK:  We'll talk about that.
               DR. CATTON:  If you shake it just a little bit?
               DR. SHACK:  We'll talk about that.
               DR. KRESS:  That's saying under one inch never has
     an unstable burst?
               DR. SHACK:  On a main steam line break, right.
               DR. BALLINGER:  How is the vertical line
     determined?  How is the dividing line determined?
               DR. SHACK:  Well, I have essentially a
     through-wall crack margin and a pop-through margin.  When
     the pop-through pressure exceeds the unstable growth
     pressure, that's when I get --
               DR. BALLINGER:  So it's experimentally determined?
               DR. SHACK:  No, no.  It's analytically determined,
     but it's also verified.  Either the curve that you showed
     there, showed the burst correlation versus the ligament
     failure correlation, so this is one case when I know the
     geometry, I can predict the stuff, you know, quite
               CHAIRMAN POWERS:  Yesterday at some point in the
     discussion we had a rule of thumb about crack depth being a
     fifth of the length quoted to us for -- it was for
     estimation purposes.
               Is there some range of validity of those kinds of
     rules of thumb?
               DR. SHACK:  I think that was trying to estimate
     the shortest crack that would go through wall, and that
     doesn't strike me as an unreasonable number.  In a case like
     this where there is no particular microstructure, to somehow
     focus the crack growth and take it through, and that really
     follows almost from fracture mechanics type arguments when
     you look at the kind of growth that you could get in the
               Now, we can get longer cracks, you know.  You can
     obviously get cracks that are longer than five times the
     depth, but I think that's a reasonable number for short
     through-wall cracks.
               But again, let's look at some of the consequences
     of short through-wall cracks in a little bit, after I get a
     little further along.
               DR. KRESS:  Look at these curves, Bill, where does
     the 40-percent through-wall in the rule come from?
               DR. SHACK:  Okay, we're just about to get there.
               DR. KRESS:  Oh, I'm sorry.
               DR. SHACK:  Because, again, this is normal
     operating pressure, main steam line break.  But we're
     looking for a three delta-P margin, and, you know, you're
     always asking what is the margin?
               Well --
               DR. KRESS:  Here, you really know what it is.
               DR. SHACK:  Yes.  The NRC has determined that
     three delta-P is it.  You know, we go no lower.  And the
     answer, of course, is that an unflawed tube has a margin
     that's probably nine times delta-P.
               And you've allowed that to decay, but the margin
     -- you know, you've said that it will go no lower than three
               And you will notice that three delta-P, now, we
     had sort of a 60 percent based on wastage, but again, you
     get about the same number for a long crack.  A short crack
     can obviously tolerate a much deeper kind of thing, so,
     again, short, deep flaws are not a problem.
               DR. KRESS:  But you go ahead and assume there's
     long cracks?
               DR. SHACK:  Yes, but if you're going to assume
     there's a long crack, then the 40-percent through, so, you
     know, if you were -- if you were changing your 40 percent
     rule, you might -- and if you thought you could predict the
     crack depth, and you thought you could predict the crack
     growth, then you might, in fact, do it based more on this
     whole overall curve.
               But, again, they've kind of argued that, you know,
     you take a kind of an average, a worst-case kind of thing,
     and you'll end up with the 40-percent through-wall.
               DR. KRESS:  But still this is 65 percent.
               DR. SHACK:  Yes.
               DR. KRESS:  It's not 40.
               DR. SHACK:  My guess is that they calculated the
     60 percent based on a code minimum yield stress for Alloy
               DR. KRESS:  I see.
               DR. SHACK:  I calculate -- Westinghouse did a very
     nice job collecting yield and low stress data on all the
     heats of Alloy 600 out there, and so I'm using sort of 95/95
     and mean stress values on those kinds of yield stresses,
     rather than code minimum, so, you know, a regulator may well
     use a code minimum, but I'm a researcher, so I'm allowed to
     be more realistic.
               That's all very nice, but in many ways, we're
     leak-rate-limited.  You know, if you look at those curves,
     you need big mother flaws to fail unstably, so in many ways,
     it's leak rates that control these things.
               And so what I've shown here is a crack opening
     area versus crack length.  And you can sort of see that
     things start to get exciting here under normal operation
     conditions when you get out to about an inch, and they get
     very exciting when you get out to about an inch and a
               And, again, you begin to see a significant effect
     of yield strength on the crack opening area that you get
     from the longer cracks.  And for reference here, I've sort
     of shown the crack opening that corresponds to when you just
     sliced the tube off and you've got the ID area in relation
     to this crack.
               And this curve is just this curve on a log scale
     so you can really see what's happening down here in this
     short crack range.
               And, again, how do we calculate these?  Well, we
     calculate them from linear elastic fracture mechanics.  We
     use a particular model, due to Zahoor.
               We've done essentially finite element analyses to
     verify this model; we've done tests where we do essentially
     room temperature leak tests so we can get a flow through a
     crack and, you know, measure the area of the crack that way,
     and then compare it with what we predict from the model.
               We've take pictures of these cracks, scanned them,
     digitized them, taken pictures of them.
               And, of course, like all fracture mechanics
     models, they're better, the smaller the deformation.  You
     know, these are all small deformation models, so that the
     smaller the opening, the better.
               But it is remarkable how well it does.  We had one
     of these little sort of freebie jobs we did for the Swiss. 
     They wanted some ruptured tubes.  They were going to use
     them for a test.
               And, of course, being the Swiss, they didn't ask
     for ruptured tubes; they wanted ruptured tubes with an
     aspect ration of the crack opening to the crack length, and
     they specified it.
               So, you know, you're sitting here with a curve
     that's about to go vertical, and you're trying to hit the --
               DR. KRESS:  You're trying to stop on that aspect.
               DR. SHACK:  You're trying to stop on the dime to
     match the Swiss thing, and, of course, you know it -- but
     the amazing thing is, that even for these rather large
     openings, we were able to do a very good job at predicting
     them from our model, and so we supplied designer ruptures to
     the Swiss.
               DR. KRESS:  Now, when you do a finite element
     around a crack like that, you have to get very small?
               DR. SHACK:  Yes, I can do the Zahoor analysis in
     an Excel spreadsheet, you know, and the calculation takes
     one blink of an eye.
               DR. KRESS:  But in your finite element, does the
     crack end up at a short vortex?
               DR. SHACK:  No, it will round off.
               DR. KRESS:  It rounds off?
               DR. SHACK:  Yes, especially in these.
               VOICE:  [Off microphone.]
               DR. SHACK:  To look at the flow through these
     cracks, there are a couple of things of interest, so
     obviously the first thing if interest is the crack opening
     area.  That tells you how big the hole is.
               But the other thing I want to know, is what's the
     L over H?  And, again, a lot of work was done on this for
     stress corrosion cracks in piping, but stress corrosion
     cracks in steam generator tubes are a little different,
     because sometimes they look like holes, and sometimes they
     look like long thin tubes.
               So, if I've got a short crack, I've got an L over
     H, depending on whether I'm in main steam line break of
     something over a thousand, or, you know, 500, so I'm looking
     down a very long narrow tube.
               If I've got a crack that's more like half an inch
     or three quarters of an inch, I've basically got a hole. 
     And so you get sort of different fluid mechanics models from
               The other thing that's interesting to look at --
     and this is a plot that is not in your book, but it was
     handed out as a separate viewgraph today -- and that's the L
     over D for a leaking jet.
               And, again, one of the things that's of interest
     when you have a jet, of course, is the diameter of the jet
     versus the distance it has to go before it impacts the
               And so we if we look at the L over D for a jet of
     dimension .125 inches, since we had some concern about
     cutting from steam jets of cracks of 1.25 inches or smaller,
     we see for a 1.25 inch crack, the L over D is 2000.
               DR. KRESS:  What are you talking about here?
               DR. SHACK:  The .25 inches to the next tube
     divided by the diameter of the exit jet.
               DR. KRESS:  Okay.  That's just geometry.
               DR. SHACK:  Just geometry, just geometry, but it's
     an important geometrical parameter to keep in mind.
               DR. KRESS:  Okay.
               DR. SHACK:  So for a .125 inch crack, it's 2000,
     if I look that the L over D.  Just as a point of reference,
     the CFD calculations you were looking at yesterday were for
     an L over D of eight.
               DR. CATTON:  Was it because they picked a really
     big hole?
               DR. SHACK:  Yes.  They're fluid mechanics guys,
     and they don't know how big a crack opens up.  They picked a
     .5 millimeters that seemed like a good idea at the time. 
     Then they doubled it to 2.5.
               DR. KRESS:  These were rectangular holes.  Is the
     D there just the width of the --
               DR. SHACK:  We're talking slots here.  Even a
     quarter inch crack is an infinite slot when you look at the
     crack opening here.
               DR. KRESS:  So when you say D, that's just the
     width of?
               DR. SHACK:  The width of the opening, right.
               Coming back to this crack opening area, let's just
     talk a little bit about leak rates through these cracks.
               We mentioned a model called Crack Flow that
     Westinghouse uses.  One of the simple-minded calculations is
     just a simple pressure drop, you know, orifice model.
               And the nice thing about that is, it gives you a
     bounding leak rate.  So if I take the full delta-P and I
     divide it by rho, take the square root of two times that,
     times .6, I get an orifice flow equation.
               And if I apply that to .125-inch crack, I find I'm
     leaking .03 gpm.  So I'm not sending a whole lot of liquid
     out of this crack, and, of course, it gets smaller at a
     fairly rapid rate for cracks less than .125.
               Now, in fact, of course, since my L over H ratio,
     which I have shown here on this plot, even under a main
     steam line break for this .125 inch crack, is about three or
     four hundred.  There is, in fact, a significant pressure
               DR. CATTON:  With pressure ratios like that,
     shouldn't you use compressible flow equations?
               DR. SHACK:  Yes, but the non-compressible flow is
     a conservative estimate, so my .03 gpm is a conservative
     estimate.  I'm just -- there is a variety of models.  We
     talked about Crack Flow, and, again, a lot of work has been
     done on this in connection with stress corrosion cracking.
               There's a model -- you know, Westinghouse has
     Crack Flow, the NRC has Squirt.  Professor Schrock has a
     code called Source.  EPRI has a code called PICEP, and
     PICEP, Squirt, and Crack Flow use the -- again, you have to
     do compressible flow models here.
               And as Dr. Hopenfeld mentioned, there's a
     non-equilibrium thing.  There's a -- you start out as
     liquid, and they flash to steam, but, in fact, you can get a
     metastable state where the flashing doesn't occur when you
     -- and it's not a thermodynamic equilibrium at all times.
               And PICEP and Crack Flow use the Henry model for
     discussing that transition from the non-equilibrium
     situation to the equilibrium situation.
               Professor Schrock has a different model that he
     developed for the NRC.  The code is called Source.  There's
     a NUREG on it.
               He's done a fair amount of careful experimental
     work, and I can leave it with the Committee, if they are
     interested.  But I think the important conclusion from
     Schrock's experiments is that when you use the Henry model,
     which is what Crack Flow uses, you're conservative.
               And he says you can be conservative up to an order
     of magnitude for the geometries that Schrock examined.
               CHAIRMAN POWERS:  Conservative with respect to?
               DR. SHACK:  Predicting mass flow through the
               DR. KRESS:  You predict more than you get?
               DR. SHACK:  You predict more than you would get.
               So, you know, again, I haven't been through Crack
     Flow to find out whether they do the sums correctly, but,
     again, based on Schrock's evaluation of it, a model using
     the Henry correlation for discussing the transition from
     equilibrium or non-equilibrium transition, is going to give
     you conservative results for the critical mass flow rate.
               DR. CATTON:  And Schrock is very careful.
               DR. SHACK:  Schrock is very careful.
               DR. KRESS:  When you say equilibrium, I'm not sure
     I understand what you mean.  I think you're talking about
     metastable state, right.
               DR. SHACK:  It's not really equilibrium.
               DR. CATTON:  They talk about there's two; you can
     talk about frozen flow, which means whatever the fluid is,
     it stays at the inlet side conditions.
               Or you talk about equilibrium flow.  There it
     thermodynamically adjusts at each stage along the flow path. 
     Or non-equilibrium flow where you can be -- the flow can go
     further down the -- it goes down the hole and is not in
     equilibrium with its pressure.
               And that becomes a much more difficult kind of
               DR. SHACK:  Yes, and Schrock does a true
     metastable thing where's got basically a time constant.
               DR. CATTON:  What people should normally do is,
     you do frozen flow, do equilibrium flow; and if they are not
     too far apart, you quit.
               DR. SHACK:  Okay, one of my conclusions from this
     is, because of the L over D ratio and the low mass flow
     through the .125 inch crack and the very large L over D for
     this thing, is that you're very unlikely to get steam jet
     cutting from these short cracks.
               The Argonne tests will be done for cracks that are
     -- for geometries that are more characteristic of a .4 to .5
     inch crack for which the L over D ratio is much smaller, and
     you get much more mass flow through the crack.
               DR. CATTON:  How small?  Is it still on the order
     of 100?
               DR. SHACK:  What, L over D?
               DR. CATTON:  Yes.
               DR. SHACK:  Yes.
               DR. CATTON:  A hundred is still low.
               DR. SHACK:  We're going to run the tests.
               DR. HOPENFELD:  Will you give me one minute?
               DR. SHACK:  Sure.
               DR. HOPENFELD:  Because this is a very subtle
     point, and I don't think I was really describing it at the
     time because of the time that I had.  I didn't get into the
     detail, but this is an opportune time to express the point
     exactly why is it important about whether it's one phase,
     frozen flow, or whatever.
               If you go back to your proprietary data, you see
     that there was this extrapolation or equation, using the
     equation of pressure and temperature, very simple square
     root type equations.
               I don't want to talk about it, but it's in your
     data there.  And there is a question, evidently, that people
     who came up with those equations wanted to make sure that
     they can justify that.
               So, what they did, they went back to -- now I can
     say what code it is.  It's Crack Flow.
               They went back there, and they used the voltage
     data to come up with some kind of effective length, because
     for the crack flow you need the length of the crack, right? 
     So they came up with some kind of a crack length as a
     function of voltage, and then they plugged that thing back
     and they got a line comparing that theoretical prediction of
     crack with the database.
               And they say, ah, well, that's fine; that looks
     very good.  Okay, and therefore we are confident in the
     database that it has some theoretical justification.
               And my point at the time was, wait a minute; you
     can't say that, because you don't know whether you had a
     two-phased flow in those tests or whether you had a
     one-phased flow or what you had, because in that crack flow
     you don't have the ten to the minus four metastability.
               And there was the point, you know, is that
     obviously can forget all the two-phase flow, and you would
     be conservative, just the way you're doing it, and just
     using an orifice equation.
               And that probably is the way to do it, but my
     point was that they are trying to justify that all that
     database --
               DR. SHACK:  But my point is that because Crack
     Flow uses the Henry Model, Schrock's results -- and, again,
     I'll be glad to donate my coffee-stained copy of Amos and
     Schrock to the panel, if they'd like to look at it -- it
     says that those results will be conservative.
               DR. HOPENFELD:  I'm not questioning the
     conservatism; I'm just trying to bring the point that the
     line that the drew to compare with the database doesn't
     really prove anything.
               It doesn't get you a better feeling that they know
     how to extrapolate from the laboratory test where the
     pressure was not the same, to the steam line break; that's
     my point.  I'm not hundred percent right, that it's more
               DR. SHACK:  No, the laboratory test was run.  I am
     almost positive that the laboratory test was run at the
     right pressure.  It might well have been run at a lower
     temperature, because, again, it's a lot easier -- I can run
     room temperature tests at 2500 psi without any difficulty.
               Running tests at 2500 psi and 300 C is a more
     expensive thing, so I suspect they were correcting for the
               DR. HOPENFELD:  No.  There was the delta-P wasn't
     the same.  The back pressure was not the same.  I suggest
     you go back there and take a look at it.
               If it wasn't proprietary, I probably would have
     picked up those points, but I suggest you go back there and
     read all of that.  There is a lot of material there.
               And you'll find out now that that's why they have
     all these corrections.  And some of them came from foreign
     data, and those were at room temperature, all very low
               So you've got to go back there and that was the
     whole point.  Besides those laboratory tests, those u-bands
     or the samples that they had at MB-2, are the tube data that
     was not run under typical conditions.  Maybe some of them
     were, but most were not.
               DR. SHACK:  I guess we could have a debate on just
     how well you could make those corrections, but onward.
               DR. CATTON:  These things are scalable from one
     pressure temperature to another.
               DR. SHACK:  I would argue that if you did it, you
     know, what you do -- the thing that's undetermined in this
     test is the crack area, the effective area.  You can
     determine that with one test under one set of conditions,
     and then use the code to essentially extrapolate to other
               L over H is just -- you know, I have assumed the
     simplest crack model.  It's L in this case is a 50 mil wall,
     and H is the crack opening.  I should mention also if you
     look at Amos and Schrock, his hydraulic diameter is 2H and
     he can't divide L over 2H correctly, but we'll assume he
     gets the thermal hydraulics right.
               DR. KRESS:  Would you repeat that?
               DR. CATTON:  I want that circled in the record.
               DR. SHACK:  Let's talk about circumferential
     cracks.  Again, the presence of a crack in a pressurized
     tube produces bending, and the behavior can depend strongly
     on whether this bending is constrained and on the fracture
     toughness of the material.
               And you end up with a fairly complicated looking
     plot that looks something like this.  And, again, if you
     take a single crack or a tube with a single crack and you
     pressurize it, what will happen is, it will bend.
               And so the failure for that is this so-called
     free-bending solution that you see right along here.
               Now, the other thing we want to note is that for a
     pressurized tube, if you're less than 100 degrees, you've
     got a crack or not, this thing is going to fail in the axial
     way, simply because of the 2:1 pressure ratio you have in
     the tube.
               So, you know, circumferential cracks don't even
     start to enter the picture here until you've got 100
     degrees, and then it matters whether you've got the
     free-bending solution or what I have called the
     fully-constrained solution that is when you constrain it
     against bending.
               You could do that with a teflon line or in a tube. 
     The easiest way to do it, experimentally, is to put two
     symmetric cracks, one on each side of the tube, and then
     you'll essentially have a fully-constrained solution and it
     will look like this.
               And so you'll be able, at any particular load --
     or you can have a much bigger crack before you get failure
     if you've got the symmetric loading, than you do if you have
     the free-bending case.
               Well, in the steam generator, we don't have free
     bending, and we don't have fully constrained conditions. 
     We've got a tube support plate, you know, some couple of
     feet above this thing, and we've got a tube, so this tube
     has some flexibility.
               And this is all covered in this Parameter C that
     we have here.  This is sort of a stiffness measure, and it
     measures how much restraint you have, that that's a function
     of the stiffness of the tube and the length that you have
     between the supports.
               In fact, the condition, if you assume it's simply
     supported at both ends, or you assume it's constrained and
     built in at both ends, if you look at steam generators, you
     will find that this value of C is really somewhere between
     .3 and .5.  That would be a typical value.
               And so that means that your curve sort of looks
     like this.
               DR. KRESS:  What are you plotting?
               DR. SHACK:  I am plotting the pressure versus the
     crack angle.  And I want to know at what pressure will this
     crack begin to extend unstably to grow?  So it says under
     normal operating conditions, I can have a crack that's 340
     degrees through-wall, before it begins to extend.
               DR. BALLINGER:  We have an emaciated version of
     that figure in the handout, at least mine is.
               DR. SHACK:  Oh, how interesting.
               DR. KRESS:  That's why I was asking you.
               DR. SHACK:  That's what happens when you send
     McIntosh figures to people printing them from Word and a PC.
               CHAIRMAN POWERS:  I'm going to have to confess
     that even in the fully-developed McIntosh version of it, I'm
     a bit lost on this figure.
               DR. SHACK:  Okay.
               CHAIRMAN POWERS:  You're not plotting pressure
     against something; you're plotting something normalized.
               DR. SHACK:  Right, the pressure over the burst
     pressure of the unflawed tube.  And so think of a curve that
     comes from about here down to here, and then it goes to
               That's the failure curve for a steam generator
     tube with a circumferential crack.
               CHAIRMAN POWERS:  Okay, now, on these squares and
     diamonds and circles, are those datapoints or simply
     indicators of some calculation?
               DR. SHACK:  No, that's -- I will get my staff to
     get out of the bad habit of putting symbols on curves that
     are purely calculations.
               DR. CATTON:  Those are purely calculations?
               DR. SHACK:  Those are purely calculations.  So
     those are calculated curves for a range of stiffnesses. 
     This would correspond to the distance of the tube support
     plate, to the -- from the tube sheet, and, again, as I say,
     for a real steam generator, the number is about .3 to .5.
               DR. CATTON:  For a given steam generator tube, you
     can calculate to C?
               DR. SHACK:  Yes.  I didn't think you -- I can give
     you the formula for C, but this is a viewgraph.
               DR. CATTON:  I understand.
               CHAIRMAN POWERS:  What is the sigma, sub-Y over
               DR. SHACK:  That's essentially the ratio of the
     yield stress to the flow stress in this material, and we've
     got a power exponent, so it's a power law hardening material
     with a power hardening exponent of .18.  We're allowing
     plasticity in this solution.
               DR. BALLINGER:  This flow stress is done by the
     yield plus ultimate over two?
               DR. SHACK:  Over two, right.  Again, I can give
     you a detailed reference for the solution for the
     circumferential support.
               CHAIRMAN POWERS:  Is ultimate over 2, so the ratio
     of the yield to that obscure thing is a half, which means
     ultimate and yield are the same?
               DR. SHACK:  No, no.
               DR. KRESS:  That is a material property is what
     you are saying?
               MR. BALLINGER:  No, that is a rubric.  Yield plus
     ultimate over 2 happens to work.
               DR. SHACK:  I will take it back, I am not sure --
               DR. KRESS:  It is just the average.
               DR. SHACK:  This is something describing the power
     law hardening curve that was used for these calculations. 
     This is -- we have done this three ways, with an elastic,
     perfectly -- or an elastic, rigid plastic material, an
     elastic tangent modulous material and a power law curve. 
     Exactly what this power law is, I will have to back and
               MR. BALLINGER:  The yield plus ultimate over 2 is
     used in general in all these calculations.  It just happens
     to work.
               DR. KRESS:  It just happens to work.
               MR. BALLINGER:  It just happens to work.
               DR. SHACK:  And Westinghouse and I, we will fight
     over whether it is .5, .55 or .595.
               DR. KRESS:  But this is because you are failing in
     flow plasticity.
               DR. SHACK:  Plasticity.
               MR. BALLINGER:  Plastic, it is a fully plastic
     case and so yield plus ultimate over 2 is about an average
     value for the flow stress.
               DR. KRESS:  About an average between, yeah.
               MR. BALLINGER:  And it works for strain hardening
               DR. KRESS:  Right.
               DR. SHACK:  Yeah.  I will have to go back and
     check this.
               DR. KRESS:  See, you have to explain these things
     to us thermal-hydraulicists.
               DR. SHACK:  But the important thing is that you
     can have extraordinarily large circumferential cracks in
     this material.
               Now, let's go back to the main steamline break and
     some of the additional loads where, you know, I am only
     calculating the pressure loads here.  You know, these tubes
     are thin wall tubes, so any axial force that I put on it
     doesn't produce any hoop stress.  If I have an axial crack,
     without any change in hoop stress, I am not going to -- I
     can change the axial stress, I am not going to do anything
     to open that crack or to fail cracks in that direction.  I
     mean that is one of the fundamental assumptions of linear
     elastic fraction mechanics is that I can have Mode 1, Mode 2
     and Mode 3 cracking and they are independent.
               DR. KRESS:  So I don't have to worry about thermal
     stresses then?
               DR. SHACK:  You do if you have thermal stresses
     that will give you hoop stresses, but if you have thermal
     stresses for axial cracks, if I have axial loads,
     essentially, they have no effect on the axial crack.  Now,
     that is not quite true, there is kind of a second order
     effect in this curvature thing, if you notice that bulge. 
     If I put an axial tensile load on here, I actually restrain
     this tendency bulge by kind of a cable sense.  And if I put
     a compressive force on here, I would make it go a little bit
     more.  So there is a second order effect in a circular tube
     under bulging because of that load, but that is a second
     order effect, you know, it is pretty small.
               DR. KRESS:  That is when it already starts to go,
     as opposed to whether it will go at all.
               DR. SHACK:  Right.  Well, it could even have a
     small effect on whether it starts to go, but I mean you
     would really have to believe your calculations out to more
     significant figures than I believe these models to worry
     about that.
               So I would argue that for the axial cracks, the
     additional loads I might get under the main steamline break
     will have very little effect on the crack opening or any
     potential failure of those axial cracks.
               MR. BALLINGER:  The only complication might be in
     the U-bend.
               DR. SHACK:  The U-bend.  Well, again, we are
     talking here 95-05 considerations, where we are in a
     different beast.
               DR. CATTON:  The vibration caused by the event,
     that is going to rattle them in every way.
               DR. SHACK:  But it is not going to put in this
     kind of mode, the bulging mode for a circular tube.  I am
     going to have all sorts of bending modes, but all bending in
     long, thin wall tubes produces axial stresses, you know, and
     that is not true if I bend it enough to make it into a
     U-bend, you know, if I turned it into a pretzel.  But, you
     know, these have been designed for these loads, I am not
     going to get that kind of plastic deformation.  You know, I
     don't expect the steam generator to come apart and the thing
     to bend over in a 90 degree bend.  But, otherwise, I am not
     -- I don't get coupling between the axial and the hoop
               So the axial cracks, I don't really expect any
     real major effect of the additional loads that I get from
     the main steamline break.
               Circumferential cracks, well, in the 95-05
     context, --
               DR. CATTON:  When you make these arguments, what
     kind of loading do you have in mind taking place inside the
     generator?  I can envision --
               DR. SHACK:  I am assuming it is not large enough
     to fail the tube intention, yes.  I mean if I had loads big
     enough to fail the tube intention, I don't care whether I
     have an axial crack or not.  And, again, you know, the
     blowdown loads here are not -- I don't exactly know what
     they produce.
               I know these things were designed for them, and I
     know the way the code designs it, so I am assuming it was
     designed to have perhaps a limited amount of plastic
     deformation.  You know, they would have somewhat relaxed
     design criteria.  You know, it wouldn't be pressure vessel
     stresses, but it would be limited to some level.
               Now, again, you can't make quite the same argument
     on the circumferential stresses because I have axial
     stresses now, and they act on circumferential cracks.  But
     in the 95-05 context, again, you have some circumferential
     cracking in the tube support plate, but it is really
     predominantly axial cracking if you look at all the
     metalography.  Much of the circumferential cracking is this
     so-called cellular cracking, which is a kind of cousin to
     IGA.  Much of it probably is fairly shallow, is not
               So, again, you have got -- and, as I mentioned, if
     I had the same size axial crack throughwall, and the same
     size circumferential crack throughwall, it would take three
     times the stress on the axial, to open up the
     circumferential crack as much as it would the axial crack of
     the same length.
               DR. KRESS:  Why is it?
               DR. SHACK:  Because one is in a curvature and one
     is in a flat plate.
               DR. KRESS:  Oh, I understand that part.  But why
     is it you get more axial cracks, a lot more axial cracks
     that you do circumferential?
               DR. SHACK:  Oh, because I have got a 2 to 1
     pressure ratio in the tube.  You know, in the tube support
     plate especially, the stresses, unless you have big dents,
     which is a separate problem, is really the 2 to 1 pressure
     stress that I have.
               I get most of my circumferential cracking in these
     things at places like the roll transition, where I put in
     residual stresses which can be just as large in the one
     direction as they are in the other, but overall, I mean that
     is why can tolerate these mother cracks.  You know, there is
     nothing, this material is non-isotropic.  It is not stronger
     in the axial direction than it is in the hoop direction. 
     You get a head start because I am only putting half as much
     load on it in the one direction as I am in the other.
               Now, the other thing that does come in is the fact
     is that in this direction it is a flat plate, and in this
     direction --
               DR. KRESS:  It is a curve.
               DR. SHACK:  It is curved.
               DR. KRESS:  That is what I thought you were
               DR. SHACK:  Yeah, and you get both of those
     working together to make a difference.
               CHAIRMAN POWERS:  Bill, I must be particularly
     dense today, or maybe typically dense, but you come to a
     conclusion down here at the bottom of this that says that,
     gee, even under MSLB conditions, throughwall cracks remain
     stable until greater than 300 degrees extent.  Is that just
     an assertion, or am I to derive this out of this figure?
               DR. SHACK:  Main steamline break hits the
     instability line at 312 degrees.
               CHAIRMAN POWERS:  Okay.  Now, I didn't understand
     that that was an instability line.
               DR. SHACK:  Yeah.  The instability line, again,
     comes down line so.  So if I had very, very high, high axial
     -- and that is the other thing now here, again, --
               DR. KRESS:  Below that, you get the crack may go
               DR. SHACK:  I am assuming this crack is
     throughwall already.
               DR. KRESS:  Already.
               DR. SHACK:  And all I want to know, if it is going
     to get longer.
               DR. KRESS:  You are just trying to make it bigger.
               DR. SHACK:  I am just trying to make it grow.
               DR. KRESS:  Okay.  So, below that, it is stable at
     the size it is.  And above that, it is going to run.
               DR. SHACK:  Right.  So, again, if I had a 200
     degree crack, I can put an awful lot of extra load on this
     thing.  Again, I don't know how much I get in these things,
     but I can put an awful lot of extra load.  And I really
     don't think that Gary and Jack are going to allow people to
     operate with 200 degree cracks circumferentially.
               CHAIRMAN POWERS:  The problem is that their
     detection ability of sort of circumferential cracks is much
               DR. SHACK:  But, again, in the 95-05 context, big
     circumferential cracks are very, very unlikely and have
     never been seen.  You know, big circumferential cracks occur
     at the tube support plate, I mean the tube sheet, the roll
               DR. KRESS:  Now, this whole discussion has to do
     only with circumferential cracks, right?
               DR. SHACK:  Yeah, I did failure for the other
     cracks back in this diagram.
               DR. KRESS:  That was the unstable.
               DR. CATTON:  We also had to put an adjunctive in
     front of MSLB, "mild."
               DR. KRESS:  But on the other diagram, the previous
     one, Bill, go back to the previous curve.  I am doing it,
               CHAIRMAN POWERS:  Well, that is good because I am
     totally perplexed on these figures.
               DR. KRESS:  Where is your P for main steamline
     break?  Oh, you have got main steamline break calculated
     separately, okay.
               DR. SHACK:  Right.  Then I show the three curves
     together here to show you the sort of different ranges of
     crack geometries that are of interest if you are in the
     operating range, in the main steamline break range, or the 3
     delta P.  So the 3 delta P requirement essentially removes
     this range of cracks.
               DR. KRESS:  So the conclusion we draw from this
     main steamline break figure is that you have to have pretty
     deep cracks, like 75 percent throughwall, before a main
     steamline break increases its flow area.
               DR. SHACK:  Right.  Well, you have to have more
     than -- you have to have 75 percent throughwall before the
     crack will even pop throughwall.
               DR. KRESS:  Oh, yeah, that is right.
               DR. SHACK:  And, again, so if I had a long enough
     crack at 75 percent, I would go through the wall, and I
     would go -- but it so long, I don't care whether it is
     unstable or not.  You know, a leak that big is -- I am
     already dead.
               DR. KRESS:  You are already dead.
               DR. SHACK:  Here, to get a leak from smaller
     cracks of interest, I have to be .8 to .995 throughwall.
               DR. KRESS:  Which kind of tells you you don't need
     to worry about main steamline break imposed loads for either
     axial or circumferential.
               DR. SHACK:  No, no, that is not the message.  The
     message is that only certain cracks fail.
               DR. KRESS:  Oh, I see.
               MR. BALLINGER:  The fact is that you can miss a
     long, 2-1/2 inch crack --
               DR. KRESS:  You can miss it, it might be there.
               MR. BALLINGER:  that is 70 percent throughwall.
               DR. KRESS:  And it is going to go through and
               MR. BALLINGER:  And then it will rupture.
               DR. SHACK:  Again, here is my implications from
     all this again.  I have left everybody confused, but here is
     what I draw from this anyway.  I am going to argue that,
     again, talking more generally now, not in the 95-05 context,
     that the primary mode of interest is this stress corrosion
     crack.  It is going to be associated with regions of high
     residual stresses or aggressive chemistries.
               The places that I am going to find that are the
     tube support plate where I have crevice conditions that
     promote aggressive chemistry.  The roll transitions, again,
     I have got high residual stresses there, I can get cracks on
     the ID, I can get cracks on the OD, I can get axial and
     circumferential cracks.  Roll transition is a bad place.
               Small radius U-bends, I get residual stresses
     introduced during the fabrication process simply in bending
     this thing around to make a U-bend, and as that radius gets
     tighter, the stresses associated with that operation get
               DR. KRESS:  Are these steam generators small
     radium U-bends?
               DR. SHACK:  Yeah, this is -- think Row 1, Row 2.
               DR. KRESS:  Row 1, all the ones right in.
               DR. SHACK:  Yeah, right.  You know, are the tight
     ones, I could have said it that way.  You get additional
     stresses if you have got hour-glassing of the flow slots by
     denting and you move the legs of those things together.
               And, again, I would argue that the cracks in the
     small radius U-bends have the greatest potential for gross
     failure.  In the tube support plate, your cracks are limited
     by the thickness of the tube support plate and opening and
     leakage is constrained by the tube support plate, except
     perhaps in main steamline breaks.
               The high stress transition at the roll transition
     is limited in extent, it is typically less than 10
     millimeters.  So I am going to get axial cracks that are
     fairly limited in length, although I can get big
     circumferential cracks, but I have argued that I can
     tolerate pretty big circumferential cracks.
               So, of the three main regions here, the small
     radius U-bend, as Ron said, I can have a four to five inch
     long crack, I have got a high stress region that is long in
     the small radius U-bend, so I can get a big crack.
               Now thoroughly confusing everybody, let's move on
     to high temperatures, where I can really do it.
               MR. STROSNIDER:  Bill -- this is Jack Strosnider. 
     I was wondering if I could just interject a though before
     you do move on to that.
               I mentioned yesterday when we talked about the
     steam line break issue that I didn't see this necessarily as
     a Generic Letter 9505 issue.  I thank Bill.  I think he has
     provided some quantitative arguments in that regard.
               When I first looked at this issue, the thing that
     comes to mind is exactly what Bill said.  My concern would
     be stress corrosion cracking at the top of the tube sheet in
     the roll transition where we have had some significant
     circumferential cracking.
               The one thing I wanted to make you aware of is --
     or a couple of things -- is inspections that licensees are
     doing they are using rotating pancake coil probes at the top
     of the tube sheet.  If they know they have got that cracking
     going on, they basically do 100 percent.  In their initial
     inspections by EPRI guidelines they would be doing 20
     percent and if they find something they expand it to 100
               The other thing I would mention with regard to the
     fracture analysis here is Bill -- the analysis that is
     presented here is dealing with planar cracks.  Actually when
     you look at these cracks that are occurring in the roll
     transition they are not really planar.  They tend in that
     residual stress field of about a quarter to three-eighths of
     an inch to be offset as you go around the tube and actually
     some of the testing of those tubes in situ and where they
     have been removed show that they have very, very high
     failure strengths because of the ligaments that are there,
     that they will leak, all right, and quantifying that leakage
     is another question, but in terms of actually failing it
     they do --
               DR. SHACK:  Just to expand that little bit, Joe
     showed you a figure yesterday, it's in his presentation, of
     a probably more realistic depiction of circumferential
     cracking at a roll transition where he had four parallel
     rows of cracks sort of spread out across the roll transition
     and they went 360 degrees but they were segments, so -- and
     as Jack said, when the guy does the normal kind of
     inspection he is going to see that as a 360 degree crack. 
     It is going to look horrendous to him but when you see the
     detailed resolution of that thing, it is really a whole
     bunch of short little cracks and I suspect if we blew that
     tube up we would find it probably had a pressure stress of
     6,000 to 7,000 psi.
               The other thing that we have seen --
               CHAIRMAN POWERS:  Well, let me interject here.
               If you expect us to take this into account we're
     going to have to see the data and if you are arguing for
     taking a stand on high pressure we are going to have to see
               MR. BALLINGER:  The actual field experience has
     been that apart from fatigue failures there has not been a
     tube rupture, correct me if I am wrong, due to a
     circumferential crack other than fatigue.
               CHAIRMAN POWERS:  We have got 11 incidences of a
     tube rupture.  That does not constitute a database that
     seems to preclude this.
               MR. BALLINGER:  I said field experience, not
               MR. STROSNIDER:  I think we can provide some data
     from the Maine Yankee experience I think where they did
     some, my recollection is some in situ and maybe some pulled
     tube tests and they did some metallography on this.  We will
     have to pull that out for you.
               The final comment just for you to be aware of is
     that with regard to circumferential cracks at the top of the
     tube sheet and for cracking in the U-bend and some of these
     areas we are talking about the plugging criteria is plug on
     detection and anything that is detected is removed from
               Then you get back to what is the threshold of
     detection and we had some discussions on that yesterday, all
     right, and so anyway I just wanted to interject those
     thoughts and we can provide some information on the cracking
     at the top of the tube sheet.
               CHAIRMAN POWERS:  It seems to me that in our
     discussion the probability of detection would -- I came away
     with the impression that you difficulties in detection are
     precisely in the areas that this slide says are our greatest
     concern, the U-bend and the top of the tube sheets.
               DR. SHACK:  We have got the tube support plate
               MR. STROSNIDER:  And I would also point out that
     with rotating pancake coil inspections at the top of the
     tube sheet and the inspections that people are doing there,
     and again recognizing the forgiving nature of those
     particular defects I think we are in pretty good shape
               Clearly there are some issues in the U-bend.  We
     got Indian Point 2 in February where there was clearly a
     threshold of detection problem.  The crack that failed was
     there in the last inspection but the quality of the data was
     so noisy that they didn't pick it up, and that is something
     we are dealing with.
               The industry is currently working to incorporate
     some noise criteria if you will into the EPRI guidelines and
     we are working on a generic communication on that same
               CHAIRMAN POWERS:  And one can't help but wonder
     how many more of these discoveries we have to make before we
     come away with the enthusiasm that we should on this
     detectability issue.
               MR. STROSNIDER:  Well, the only point I would
     make, and I think Ken Karwoski -- you can paint a very dark
     picture if you want, but I would also go back and look at
     the actual data on the decrease in the number of leaking
     tubes, the decrease in the number of tube failures.
               If you look at those failures that we are talking
     about, it is a large number up through 1993 and one since
     then.  It may not be statistically significant but I would
     suggest that the advances that we have been talking about in
     the inspection methods and the programs that are being
     implemented are having an effect, so I wouldn't paint too
     dark a picture.
               CHAIRMAN POWERS:  I would be interested in looking
     at the number of tube rupture accidents that we have had on
     a per year basis and see if that has come down equivalently.
               MR. STROSNIDER:  Say that again?
               CHAIRMAN POWERS:  The number of tube rupture
     accidents that we have had --
               MR. STROSNIDER:  One for five years --
               CHAIRMAN POWERS:  Which is about the same rate
     they have been going on before, so I mean nothing has
     changed on that.
               MR. STROSNIDER:  It doesn't matter whether it is a
     40 percent through-wall criteria or --
               DR. SHACK:  Well, as Jack pointed out, the
     criterion here is not 40 percent through-wall.  It is plug
     on detection.
               MR. STROSNIDER:  Right, but the point I made is
     that the data, I agree, may not be statistically significant
     in terms of the change of the rate of tube ruptures but I
     would suggest t hat if you look at the frequency of
     ruptures, if you look at what happened in the '70s and '80s
     and you look at what happened in the '90s and you add a
     little bit of knowledge about the new inspection methods,
     the use of the plus-point probe, the 100 percent
     examinations, the scope of what is being done, all right, I
     can't show it as statistically significant but I would not
     want to discount it.
               MR. CATTON:  I think before you completely close
     it out, we have got to find out what happens with GSI 188. 
     That is really where it's at.
               For mild MSLBs you give a very convincing
               MR. MUSCARA:  I want to go back to this issue on
     the detection of circumferential cracks.
               You mentioned previously now that we know that we
     expect cracks at the top of the tube sheet we can at least
     do inspections in those areas, not with bobbin coils but
     with pancake coils.
               As I mentioned yesterday we are doing quite a bit
     of work to quantify inspections in that area also and what
     we find is, yes, there's difficulty detecting small
     circumferential cracks but the largest circumferential
     cracks PODs do not do that -- it's fairly high -- and so if
     we are talking about a 340 DB crack that you need to open
     up, those are not missed.  The smaller ones, yes.
               DR. SHACK:  I didn't mention it and I can't find
     the transparency at the moment -- oh, here it is -- the
     other thing you want to note is that the leak rates --
     again, this notion that these big cracks -- these leak rates
     are still fairly small through these cracks again out to
     100, 150 degrees.
               You are not getting a lot of leakage out of the
     circumferential cracks.
               CHAIRMAN POWERS:  Bill, I guess I really am dumb
     today.  You've got a plot of a quantity that on the
     appearance of it is nondimensional.
               DR. SHACK:  Yes.
               CHAIRMAN POWERS:  Okay.
               DR. SHACK:  It is the area over the flow area of
     the tube.
               DR. KRESS:  There's sort of a leak rate.
               DR. SHACK:  Sort of a leak rate.  Multiply by 600
               MR. BALLINGER:  Is that where it is normalized to?
               DR. SHACK:  That is the one number that everybody
     seems to be able to agree on is that if you have the tube
     cut you will get 600 gpm.
               We'll figure over CRACKFLOW and Henry versus time
     relaxation but 600 gpm out of the end of the tube seems to
     be a number we can all agree on.
               CHAIRMAN POWERS:  But if I do that, then I get
     some reasonable numbers, don't I?
               DR. SHACK:  Yes.  Those are big cracks though.
               CHAIRMAN POWERS:  I guess I don't understand why
     it is small.  I mean when I do the multiplication I don't
     come up with a small number.
               DR. SHACK:  It is a small number --
               CHAIRMAN POWERS:  The flow relative to 600 I'll
     agree but --
               DR. SHACK:  It is also small for a 150 degree
     crack.  That is a big crack.
               Let's go on to high temperatures.
               We are looking at the failure steam generator
     tubes during a severe accident.  We have got -- we have done
     these tests. Essentially we wanted to bound the kind of
     things that we're predicting -- I will learn to spell this
     thermal hydraulic one of these days --
               DR. SHACK:  -- which sort of predict that we have
     a range of something like 3 to 13 C per minute, kind of a
     heatup rate.  If these ramps are sufficiently rapid we could
     depend only on the burst properties and they'll be history
     dependent.  We could use a flow stress model.
               If they are sufficiently slow we have to take into
     account the pressure and temperature history.  We use a
     creep rupture model.
               The thing that we have noted, at normal operating
     pressure we account for crack geometry through a stress
     magnification factor, MP.  We have an extensive database to
     validate that at those temperatures, but we find from
     analyses that if we take the kind of stress-strain curve
     that we expect to get at 300 C and the kind of stress-strain
     curve we expect to get at a much higher temperature, much
     less strain hardening, we find that it doesn't make a whole
     lot of difference in the MP that we calculate, so that MP is
     really a measure more of geometry than material properties,
     and we can use it in high temperature and at low
     temperature, so that is an assertion.
               We have to sort of demonstrate then that it works.
               We are going to assume that the MP factors we
     derive from low temperature tests are applicable and we are
     going to determine failure by a creep time fraction model. 
     This is a sort of linear damage rule where we kind of scale
     the rupture time according to the stress and temperature and
     so if we run tests at one temperature and one stress and
     then we are doing a variable stress history we can
     essentially integrate that fraction of the damage that
     occurs at that particular stress and temperature and just
     sum it up until we to get to one for failure.
               The stress that is active here is the actual
     stress time, this multiplier MP that we have determined
     comes from the flaw geometry.
               What do we do for the validation tests?  We did
     isothermal constant pressure tests.  We did some tests with
     deep cracks to test how well the MP model was doing.  We did
     constant ramp rate tests where we just ramped up the
     temperature with either a constant pressure temperature ramp
     or an isothermal pressure ramp, so we did the ramp tests.
               Then we did prototypical tests under varying --
     some of them were more prototypical than others but they all
               Here are some results comparing the results we get
     from essentially the Creep Model and the Flow Stress Model.
               We're looking at two different ramps here that
     we've called the EPRI ram and the INEL ramp, and you may
     remember those from the good old days, and Steve may bring
     them up again, or he'd probably rather forget them all.
               But they were --
               DR. CATTON:  This was an increase in temperature?
               DR. SHACK:  Yes, this is -- you know, was
     essentially a projection of the temperature during the
     station blackout accident.
               And --
               DR. CATTON:  By EPRI and INEL?
               DR. SHACK:  By INEL.
               DR. CATTON:  They're probably both too low.
               DR. SHACK:  Well, the answer is, they are
     different, but we managed to predict both ramps.  We do the
     constant pressure ramp, so you give us the ramp and we'll
     predict the failure.  That's the message.
               Circumferential cracks, we don't quite as well,
     but we do it enough.
               CHAIRMAN POWERS:  Let me see if I understand.  The
     symbols here are the datapoints and the line is the
     prediction model?
               DR. SHACK:  No, the line is -- below the line,
     you're --
               CHAIRMAN POWERS:  Okay, that's 100 percent
               DR. SHACK:  That's the 100-percent correlation
               Okay, one of the other quantities of interest here
     is the crack opening area at high temperatures, because
     we're worried about leakage at high temperatures.
               So we've calculated crack opening area under 300 C
     conditions.  There were a couple of questions that came up
               Is there any creep crack growth that occurs before
     this crack goes unstable?  That is, if we've got a crack
     that's existing and we're now heating up the tube, can the
     creep crack growth just make the crack get longer, so if we
     start with a quarter inch crack at 300 C, by the time we get
     to 700 C, will it be longer than a quarter inch or will it
     just open up.
               And, again, we're petty sure the crack opening
     area is going to vary with time, and we want to be able to
     predict that.
               The analytical predictions are based on a an
     analogy between a power law plasticity model and creep
     behavior.  What we do is, we take essentially the power law
     plasticity model and we replace the strain by the strain
     rate in the creep solution.
               And we've got power law plasticity models for
     center crack plates.  The difference between the axial crack
     and the circumferential crack is the fact that you get this
     additional stress on the axial crack because of the bulging
               So what we've -- we can't do tests on an axial
     crack at high temperature without an infinite amount of
     money.  But we can pull on a tube pretty easily at high
               So what we've done is pulled on the tube at high
     temperature, but we've said that the stress we should use is
     M times the hoop stress.
               So we've essentially done the axial loading with a
     much higher stress to account for the fact that we haven't
     got the curvature, so we've replaced the curvature with
     essentially a higher stress to get an equivalent model.
               DR. BALLINGER:  Can I ask what COD is?
               DR. SHACK:  Crack opening displacement.
               DR. CATTON:  I should have known that one.
               DR. SHACK:  Okay, well, this sort of just says we
     can't do these tests on the through-wall axial crack tubes,
     and it's under internal pressure and it would take an
     infinite gas supply system.
               We thought about doing it on cracked plates, but
     then we decided that the easiest thing to do was to take our
     tubes and just put some symmetrical notches on both sides.
               As I mentioned, that puts them -- it's like a flat
     plate, but it just happens to be a repeating flat plate with
     a period of pie-D.
               So, there is it.  You've got symmetric cracks. 
     And that's basically equivalent to this flat plate solution
     with two cracks.
               And we're good, we can do flat plate solutions,
     and we like those.
               Then we did a couple of different kinds of tests. 
     We did these isothermal validation tests, where we just
     heated the temperature up to near 700-C.
               We put a load on it, and we predicted how the
     crack would open as a function of time.
               And so again we've got a constant load, we've got
     a constant temperature, and the crack is just opening up as
     time goes on.  And so you can sort of see how it's going up,
     and we've got the observations versus the predicted.
               And we've done this at two different load levels.
               CHAIRMAN POWERS:  For higher loads, you started
     with deviation?  Is there any significance to that?  I mean,
     if I went to 3,000 pounds, would I see a much bigger
               DR. SHACK:  I don't know.  We would have to run
     the test.
               CHAIRMAN POWERS:  You don't have an explanation?
               DR. SHACK:  I don't have a good explanation for it
     now.  Those we did with two 45-degree notches.  We wanted to
     go back and do some more sort of notches that we thought
     would be more protatypical, which is a .25 inch kind of
     thing, the kind of small notch that Steve worries about
     opening up and losing flow out of in the high temperatures.
               And, again, this is another one of these
     isothermal validation tests, and, again, the way we do these
     essentially, it's sitting in the furnace.  We open the
     furnace up, we peek in with the telescope, make the
     measurements, close the furnace back up.  We're doing the
               CHAIRMAN POWERS:  The High Temperature Committee
     developed better ways to do that, by the way?
               DR. SHACK:  You know, on our budgets --
               DR. CATTON:  Sometimes that's where the best work
     is done.
               DR. SHACK:  Now, we wanted to do a non-isothermal
     validation test, and in this case, we used the temperature
     ram simulating six RU.  This is probably the temperature
     ramp that Steve will show you today.  This is the one they
     believe is the -- Joe will show you.
               Now, of course, when we're doing the isothermal or
     the transient, we can't open the furnace up.  So here we
     only get one datapoint.
               You know, you hit it, baby, or you miss it, so
     here's the temperature, here's the predicted notch
     displacement as a function of temperature, but the only
     point we can validate is the one right there at the end.
               And, again, we were doing pretty well on the --
               DR. BALLINGER:  You're going to get -- an LA-600
     is going to be well behaved in that respect, because you've
     got that cliff at about 650 C where the yield strength drops
     off like a stone.
               So you're into the creep regime and it works.
               DR. SHACK:  Well, the other nice thing about this
     that we're always surprised about is, in the creep regime, a
     lot of this heat-to-heat variation goes away.
               You know, that all arises from the differences in
     the working that you've done, and you heat that up, and that
     all goes away and we're sort of left with the basic,
     fundamental crystal structure of Alloy 600, and so you get
     much less material-to-material variation in the creep
               If we just look at these things, they open up into
     rectangles.  You know, there's no creep crack growth here. 
     They don't get any longer, the suckers just move apart, and
     they turn into rectangles.
               So they started out as narrow slots and they
     opened up as wide slots.
               DR. BALLINGER:  It's tough stuff.
               DR. SHACK:  Tough stuff.
               Now, this crack opening area begins to, again,
     increase rapidly.  If you look at this crack opening area,
     it sort of goes along, along, and as Ron mentioned, you
     know, you kind of fall off this cliff around 650, and the
     action starts to take place, so that basically there's not a
     whole lot of increase in the crack opening area till you get
     out to about 650, and then it starts to take off.
               And so what we've done here is looked at --
     suppose we had a final temperature of 700 C before something
     else failed or if we had a final temperature of 750 C, you
     can predict the crack opening areas, at the crack length at
     those two temperatures.
               You can also predict the leak rate through those
     crack opening sizes, again, as a function of crack size at
     the two temperatures.
               CHAIRMAN POWERS:  It's easy to compare these
     because these are in kilograms per second, as opposed to
     gallons per minute, right?
               DR. SHACK:  Well, I had them as gallons per minute
     when I started out, but they told me that when we deal with
     gases, we do it in kilograms per second.
               Well, that was all I wanted to say -- well, let me
     just -- we've got a couple of extra ones.
               Life gets harder when you get to the real world,
     of course, because when somebody hands me a real crack, it
     never looks like a rectangle, unfortunately, and so you have
     to make some sort of judgement as to how you're going to
     model this crack in terms of an equivalent rectangle.
               And there is a discussion of how to do this, and
     there are some various procedures that we're trying, that
     people use, and we've --
               Without going through them, we're trying to
     validate those kinds of procedures by looking at, again,
     controlled shapes.  It's easy to triangles and trapezoids,
     and you kind of compare what you get in burst pressure from
     the triangular and trapezoidal notches with essentially the
     equivalent area kind of models that we're working through.
               Again, that's more of a detail, I think, than we
     need to get into here, but it is a question that has to be
     addressed.  And that's where we're going.
               Any questions?
               [No response.]
               CHAIRMAN POWERS:  Any other questions for Dr.
     Shack?  Anyone that thoroughly understands everything that
     he's told us?
               Okay, that's good.  Thank you, Bill.
               Are we -- did we exhaust the subject of crack
     unplugging yesterday?
               MR. STROSNIDER:  I don't think we have anything
     else to present in that area.
               CHAIRMAN POWERS:  Okay.  It's just listed on my
     agenda here, and I know we talked about it a lot.
               One of the issues --
               DR. SHACK:  My L over H curve is sort of a crack
     unplugging model.  It's easy to unplug cracks of L over Hs
     and too big.  The bigger it gets, the harder I would suspect
     it would be to unplug the crack.
               CHAIRMAN POWERS:  I don't pretend to understand
               One of the issues that falls under the general
     nature of crack unplugging is probably also material coming
     out of the crevice regions.
               Do you have anything that you'd like to talk about
     on that aspect of crack unplugging?  That was an area that
     we didn't explore yesterday.
               MR. STROSNIDER:  Are you talking about loss of
     material between the tubes, the plate and the tubes?
               CHAIRMAN POWERS:  Right.
               MR. STROSNIDER:  Okay, I don't know if there is
     anything for me to talk about.
               MR. KARKUOSKI:  Just in that area, the only thing
     I would add is that when we do these leak tests, these leak
     tests are performed as if that degradation is in the free
     span so if there's any material that stays around the tube,
     it would only serve to restrict the leakage.  The
     correlations are all based on free span tests.
               CHAIRMAN POWERS:  Okay.  That's actually very
               Okay, if that exhausts that discussion, then I
     think we can afford to take a break till quarter after the
               CHAIRMAN POWERS:  Let's go back into session.
               We are now going to discuss the accident framework
     for a lot of these technical issues that we have been
     covering.  We have made a distinction, appropriately I
     think, between design basis accidents and severe accidents,
     but to my mind some of these things cloud the definitions of
     the distinctions that one likes to draw between design basis
     accidents and severe accidents.    
               In particular, the essence of my challenges here,
     it seems to me is in the design basis analysis one analyzes
     a main steam line break and one analyzes steam generator
     tube rupture accidents, and one is supposed to have a plant
     that accommodates both of these.
               Now one has a situation where a main steam line
     break involves a steam generator tube rupture, which up till
     now has never been done as a design basis accident, and so
     design-basedness becomes a little more complicated.
               One of the areas that it becomes very complicated
     in thinking about actually comes back to the iodine spiking
     issue, that in the past we have said okay, let's calculate a
     spiking value looking at what the steady state coolant
     concentration is according to the tech specs.
               Now you have plants operating much lower than the
     tech spec limits though they may have not changed their tech
     spec limits.  Even if they did change them, they are still
     operating a couple more at the risk magnitude below.
               Now if one hypothesizes that the spiking factor
     that one has is inversely correlated with that coolant
     concentration, it seems that if one follows the prescription
     of design basedness, that's fine, but I still use the tech
     spec limits following that, but that is a lower spiking
     factor than one would have if one used the operational ones,
     so things get very confused between realistic and design
               Anybody that can help me understand these a little
     better I would appreciate it.  That is your cue, Gary.
               MR. HOLAHAN:  This is Gary Holahan.  In fact, the
     Staff will make a presentation on both design basis and
     severe accident issues.  Steve Long is going to start off in
     fact trying to define what we mean by design basis
               I would say something a little different from the
     way you introduced it, Dr. Powers, and that is I think that
     we are still preserving the concept of design basis, meaning
     looking at spontaneous tube ruptures and looking at steam
     line breaks, not steam line breaks with tube ruptures, but
     we are looking at steam line breaks with increased leakages
     that may be associated or expected to occur given the main
     steam line break.
               We also have severe accident analysis which looks
     at main steam line breaks and a whole spectrum of other
     possibilities, some of which are quite unlikely but much
     more serious than steam generator tube leakage.
               I think we will cover both main steam line break
     with leakage and main steam line break with tube ruptures,
     in fact, multiple tube ruptures will cover all those cases,
     but the more extreme cases we'll discuss this afternoon.
               The other issue that I would like to make sure the
     committee understands is on the viewgraph it said that Dr.
     Parry would be here this morning, but in fact he will be
     here this afternoon to talk about operator action and human
     reliability analysis in the context of the severe accident
     issues and if we have design basis human reliability
     questions, which I think are very limited conceptually, I'll
     either try to cover them this morning or relate those to
     this afternoon's discussions.
               CHAIRMAN POWERS:  I think the issues of human
     actions during design basis accidents are raised by the
     statement of considerations where there is a phrase in
     considerations that I am sure I can't quote accurately from
     memory but it is to the effect that provided several key
     operator actions are carried out, and I think that is mostly
     controlling the usage of water during the accident, and what
     happens it seems to me is the time available for making
     those key operator actions can shrink under some of the
     higher leakage assumptions associated with main steam line
     break, so I think it's just a matter of understanding how
     one decides that one can credit operator actions in light of
     the time available.
               That has been an area of some contention for some
     period of time.
               MR. HOLAHAN:  The distinction that I would like to
     make is in the design basis accident context those operator
     actions are targeted to keeping the event within the dose
     guidelines of Part 100 and so forth.  Tube ruptures -- that
     means isolating the leak.  For steam line break I guess it
     relates to the cooldown.
               In the severe accident context the operator
     actions are preventing core damage and so there are a
     different set of considerations.  As we go along we may pick
     those out, but when they look like core damage issues I am
     going to push them off until this afternoon.
               DR. BONACA:  One note however.  Although the
     design basis has the objectives you stated, the ERGs, which
     are the emergency procedures that currently the Westinghouse
     operators follow has consideration of steam line break with
     consequential failures of tubes or depressurization of the
     secondary side too.
               I think it is important that in that context if
     there is an opportunity we discuss those kinds of procedures
     because clearly the operators are being trained for
     scenarios which are not part of the design basis strictly or
     the severe accidents.  They are trained for intermediate
     situations where in fact you have to bring the system down
     to RHR and they are being trained to do that both looking
     for a subcooled condition to enter the RHR or even in a
     saturated condition, which means or implies a very large
     break and opening to the secondary side.
               I think at some point, and I don't know if we have
     any expertise on the ERGs, but that would be valuable for us
     to understand how they support the human reliability
     analysis that is presented in the NUREGs.
               MR. LONG:  I'd just thank the whole group for
     presenting the first slide.  My name is Steve Long.
               MR. LONG:  We want to rearrange the order a little
     bit here.  Joe Donoghue would be up next to talk about the
     ability of thermal hydraulic codes and then I would be up to
     talk about the equilibrium between ECCS flow and leak flow,
     and then we have deferred the next issue, on operator
     actions, to this afternoon, and then Joe Donoghue would be
     up again.
               We have decided to simply this process.
               I will go through the description of the
     relationship between the flow from the ECCS system and the
     flow out the leaks and then we will let Joe do the rest of
     the subjects this morning.
               The first thing, I think it is important to
     understand the intent of the review that we did in NUREG
               MR. HIGGINS:  Steve, before you get off into that
     detail, I had just one additional clarification on design
     basis versus the other things.
               Yesterday we talked a little bit about whether or
     not this Generic Letter 9505 with the alternate repair
     criteria and the analyses associated with that really
     constituted a new design basis accident, new design basis
               I guess I am still not clear whether you consider
     that that is or not or you are just changing the analysis
     method but you don't really call that a new and different
     design basis accident?
               MR. HOLAHAN:  I would call it the same design
     basis accident with -- the only thing that is substantially
     different is the main steam line break, instead of having a
     1 GPM leak now has leakage based on the likelihood of a
     number of cracks opening, so I would say it is the same
     design basis event with a different set of assumptions -- so
     it is main steam line break with leakage and a calculation
     done to show that it means the Part 100 guidelines.
               That analysis is part of the design basis.  It is
     part of the licensing basis, because, you know, a license
     amendment ends up described in the FSAR just like the
     original 1 GPM case.
               MR. HIGGINS:  Thank you.
               MR. LONG:  To try to draw that out a little bit
     further, first of all, this was done before risk informed
               The intent is to not apply this type of permission
     to leave a particular type of flaws in service to anything
     other than what we expect is going to be a confined area of
     the tubes within drilled hole tube support plates.
               It doesn't apply to egg crates.  It doesn't apply
     to free span.
               There's a problem with analyzing exactly how the
     tube support plate would behave during a main steam line
     break, so on the one hand, there is an effort to act as if
     the tube support plate were to completely move off the
     flawed portion of the tube and Generic Letter 9505 requires
     that the probability of those flaw rupturing be small and
     that the amount of leakage that would come out of those
     flaws be such that you could still meet the Part 100 part of
     the regulation.
               So, as Gary said, we are not supposed to have a
     steam generator tube rupture as a result of a main steam
     line break, and the specification there was that the
     probability not be greater than, the conditional probability
     not be greater than .01.
               Is that a new accident or is it a specification of
     how improbable it has to be that there is a new accident?
               You can, I guess, take your pick on your
     interpretation of that, but I think the intent there was
     really to try to keep within the guidance that we had for
     having a low probability of failure under design basis
     accidents and leakage that was within the guidelines for
     design basis accident for dose from design basis accidents.
               On the other hand, there was at the same time a
     feeling that you would most probably have the tube support
     plates actually confined to those portions of the tubes that
     were degraded, so when we looked at it from a risk
     standpoint we did not see a high probability of something
     that would move the plates off, so at the time we did NUREG
     1477 we really didn't have a risk assessment in 1477.  The
     risk assessment is counting on the plates remaining in a
     position that confines the crack sufficiently.
               That has been a difficulty for us in dealing with
     the industry because the industry is frequently saying,
     well, we analyze these cracks as if they were in the free
     span; why can't we have permission to have them in the free
     span?  That brings up a bunch of issues that we really
     didn't deal with because we were relying on them not being
     in the free span, and we will get into some of those issues
     this afternoon.
               It gets a little difficult when we use shorthand
     in terms of whether or not something is a design basis
     accident or a severe accident.  There's different uses of
     those words and different groups of jargon and it is often
     allowing you to make an erroneous leap into something not
     intended, and we will just have to keep reeling those in if
     they get made throughout the rest of the conversations.
               Are we ready to go for the next slide, next
               The committee asked for a justification of the
     assumption that the maximum leakage rate would reach an
     equilibrium with the injection flow during the main steam
     line break that induced tube leakage.
               The explanation for this has to go back to the
     context in which the assumption was made.  The original DPV
     document indicated that there might be a problem with not
     being able to detect flaws that were more than 40 percent
     through-wall and therefore it requested that licensees
     either abide by the 40 percent through-wall criteria or in
     some way demonstrate that they could meet a main steam line
     break with 80 percent of the tubes ruptured.
               That was dealt with by the Office of Research for
     awhile, trying to figure out how many flaws might go
     undetected in the free span and how many of them might leak,
     how much they might leak, and some efforts were made based
     on some assumptions about flaw growth rate to determine what
     amount of leakage rate could exist under these
     circumstances, and the numbers were quite high.  They went
     up around 10,000 GPM for a large number of flaws with large
     growth rates.
               That was the point at which we picked this up.
               We were trying to put it into a context where we
     could start thinking about the risk.
               The difficulty was trying to figure out how you
     would get that much of a flow rate, because if you can
     somehow break the flaws that much you are well down into the
     LPSI injection path that is essentially a large LOCA outside
               Without going into human errors or human success
     probability and dealing with large LOCAs outside
     containment, I just want to go to the justification of the
     assumption that you asked about.
               And it basically goes to the thermal hydraulics of
     a main steam line break, and I'm just going to put up a
     sketch because the things that are available as graphs
     didn't show very well, and I hope this shows.
               Okay, if you look at what happens as a function of
     time to the pressure in the RCS and the pressure in the
     steam generator, when you break open the steam generator,
     the fluid in the steam generator is at saturation, so it
     doesn't just drop as if it's sub-cooled with a little bit of
     cover gas.
               It evaporates; it boils, so it holds pressure up
     until it cools itself by boiling and it depletes.
               And that cooling brings down the RCS pressure
     along with it, so that the differential pressure in this
     part really stays approximately the same until you've really
     stopped the cooldown process.
               At that point, you've tripped your reactor coolant
     pumps, but you still have decay heat.  But the major
     repressurization process is that you're pumping in emergency
     core cooling water, and you may be trying to turn on heaters
     in the pressurizer when you get level back to where you can
     heat something.
               So, at some point, you start getting a higher
     delta-P.  And it progresses in a reasonably quick manner,
     but not an instantaneous manner, to a higher delta-P.
               The question was, what would happen in the cracks
     under this kind of a scenario?  And neglecting the idea that
     there are cracks and they might open for a minute, just
     thinking about if there was a hole that suddenly appeared at
     this point, it's very similar to a LOCA in the sense that
     you're trying to pump water in and the leak is removing
               So you have a curve for the leak rate that's a
     function of the pressure that's driving water out of the
     leak, and you also have a function for the amount of water
     that can be put in by the centrifugal ECCS pumps.
               So, at low pressure, the leak is not going to be
     putting out much and the pump is quite capable of pumping in
     a lot of water, and as the pressure goes up, the pump is
     going to be going to less and less input, and the leak is
     going to have more and more driving force at the fixed area
               So typically for LOCA analysis, you get to
     whatever this pressure is, and it equilibrates there, at
     least temporarily until you change something else in the
               So that's the kind of thought process that I want
     to go to, but then I want to add the idea that the cracks
     start with a very small hole and are increasing that hole
               So this is now not this curve, but as you increase
     the pressure, you may be doing something like this as you
     make the hole larger, as well as make the pressure greater
     for driving fluid through those holes.
               If you're starting off at a delta-P that's very
     similar to what has been experienced for a long period
     during operations, you know that the holes aren't opening up
     very rapidly there.
               However, the tests that have been done at the
     National Labs, where they have taken cracked tubes, put them
     into a test apparatus and stepped up the pressure, and had
     hold times in the pressure inside the tube, have shown cases
     where the tube may sit at a constant pressure without
     leaking, and then suddenly without increasing the pressure,
     it will start to leak, something will actually let go and
     the leak will occur.
               Or you may find that something that is already
     leaking and is being held at constant pressure, will slowly
     increase leak rate or maybe it will make steps in leak rate.
               Now, we've seen all of these things occur.  These
     are happening, though, at small leak rates, and the leak
     rates are staying small for one particular crack.  It's not
     a rupture, it's just a change in the crack opening area that
     may not be a single value as a function of pressure.
               And I think this is one of the major points in the
               And we tried to put that in the context of the
     scenario where the delta-P in the reactor coolant system is
     increasing, and we are envisioning a very large number of
               What we were envisioning was that these cracks
     would not all behave in unison, so that if one of them would
     pop, every one of them would pop at exactly the same moment.
               And the wording is down here in the slides, but
     rather than put it up and read it to you, let me just try to
     talk my way through it.
               The picture I was trying to come up with is
     something that would tell me how far I could expect to open
     the cracks before I'd really lose the driving force for
     opening them any more.
               And the logic was this:  That if your delta-P is
     going up in time from a value where essentially there
     weren't any cracks open, and cracks begin to open, that the
     delta-P is going up because you're putting water into the
               And as you open more cracks, you're removing more
     water, and eventually you should reach an equilibrium
     similar to what's going on here, but not necessarily at the
     original hole size.  You're increasing this curve just more
               So you'd eventually come to some equilibrium point
     higher than your normal delta-P across the steam generator
     tubes, where you're putting water out at the same rate that
     the ECCS pumps can put water in.
               Okay, still, that's a constant pressure
     differential higher then they have been experiencing before. 
     Maybe they can continue to pop and tear open a little bit
               So for that process, again, if you increase the
     area more, you raise the curve up, so it's now running up
     here, rather than down there.
               The pressure drops, more water comes in from the
     ECCS system, and you can envision that perhaps reaching a
     point where so many things have opened up that you've gotten
     all the way back down to the normal delta-P, in other words,
     you now have essentially zero pressure on the secondary
     side, your reactor coolant system is now at a pressure that
     was equivalent to the pressure difference between the steam
     generator and the RCS previously.
               At that point, we didn't see any reason to open up
     the cracks any further.  They were stable at that point.
               Usually in the laboratory, if you've pumped a
     crack to the point where it starts to leak, and you drop the
     pressure substantially, the crack pretty well stabilizes; it
     doesn't continue to come apart, unless you've lowered the
     peak pressure differential that it's in.
               So the argument is essentially that we don't see
     any mechanism for the delta-P in the system to open cracks
     beyond the point that the ECCS pump could support when the
     ECCS pump back pressure is equal to the original steam
     generator delta-P.
               CHAIRMAN POWERS:  But this is a conclusion one
     raises because you're looking at a very quiescent system?
               MR. LONG:  There's --
               CHAIRMAN POWERS:  When we look at a system that's
     producing sonic booms and pressure pulses and things like
     that, maybe those arguments aren't so strongly made.
               MR. LONG:  Okay, well, first of all, the sonic
     booms and so on should be stopping in time, somewhere down
     in here.  So in terms of timing, we're not expecting that to
     necessarily be concurrent with what I was just talking
               So the limitation on this is, if during this part
     of the process here, you're talking about the new generic
     issue designation that cracks that have been initiated as
     stress corrosion cracks, are now being fatigued by
     vibration, that's a different phenomenon.    
               And the thing you've asked me to justify was not
     intended to try to cover that kind of phenomenon.
               Now, earlier on in the process, when we were doing
     NUREG 1477, I was talking to Joe Hopenfeld about this and
     some other things, and he was discussing vibration as being
     one thing that would open them.
               At least insofar as I was hearing it, I was
     hearing it as vibration being able to shake the plugs out of
     cracks that were plugged with crud or something of that
     sort, as opposed to the fatiguing issue.
               So to some -- let me just finish the sentence.  To
     some degree, if you're dealing with cracks that are not
     being increased in size, you can go up into this section of
     the curve and say, well, if I'm starting to leak here, then
     what I'm going to do is drop this pressure even faster on
     the RCS.
               And I'll be dropping my strain again.  The
     difficulty we had was we didn't have a mechanism that we
     could use to show us how much we could open these tubes,
     other than the strain from the pressure.
               We talked about things, and I think a lot of
     people in this room had to put up with me asking them
     questions about if we had a large number of cert cracks and
     there was a displacement by the upward force, can you
     essentially pull apart a large number of cert cracks?
               We were looking for things that weren't
     self-limiting in some way, but we didn't find something that
     we could physically credit and put a conditional probability
     to and put into a risk assessment.
               So, essentially, this is the description of what
     we were thinking of the time, and what we think it was good
     for and what we think it wasn't good for.
               I'll answer questions on that and turn it over to
     Joe Donoghue.
               DR. HOPENFELD:  I have a minor comment.  In that
     original document, there was a description of that droplet
     eating the adjacent tubes, if you remember.
               MR. LONG:  That's also true, and we at that point
     were not thinking about the droplets eroding the tubes under
     main steam line conditions.
               We were worried about it under hotter temperature
     conditions.  And so we weren't crediting that one, either,
     for this particular analysis.
               MR. STROSNIDER:  Steve, this is Jack Strosnider.
               For the system response that you're talking about
     here, does it really matter how the leakage -- where it
     comes from?
               I mean, you were talking about assuming that
     there's a hole and that there is some leakage, right.  And
     this idea of the system equilibrating at some point, does it
     matter if it comes from 9505 leaks or if it comes from
     hyperation or anything else, right?
               I think you were trying to address the issue more
     of a system response to a leak; that's the point.
               MR. LONG:  Well, there is a difference.  If the
     only thing that's creating the additional leakage is the
     additional delta-P, then what the tubes have demonstrated is
     an ability to survive that for a long period of time.
               If there's no other driving mechanism besides that
     elevated delta-P, you can make this limitation and say if
     it's your ECCS pumps that are providing that delta-P, you
     can follow your pump curve and figure out how much your flow
     rate is going to be at worst, that you would have to deal
     with, and how fast that will deplete the RWST and so on.
               If you have something that's mechanically damaging
     the tubes, even though it requires a delta-P to do it, it's
     a new damage mechanism, you know, some sort of additional
     tension or vibration or whatever that might, along with a
     delta-P, create more damage to the tubes than they have been
     seeing when they were in a quiescent condition at a delta-P.
               You might break them open further, and you might
     get more flow rate.  You might go farther, but --
               DR. CATTON:  But that poor flow rate is still
     going to be a function only of a delta-P.  That's just that
     it now is the square root of delta-P, and now it's going to
     become maybe proportional to delta-P, because two things are
     happening:  The area is getting bigger, so it's just a more
     complicated control valve; isn't it?
               MR. LONG:  It's more complicated than I predict a
     limit on, is my point.
               DR. CATTON:  Still, if the pressure drops back
     down, it's going to shut back down; it's going to slow down.
               MR. LONG:  If what you're doing is -- I'm
     speculating here.  If --
               DR. CATTON:  Well, I was, too.
               MR. LONG:  If you have fatigue cracks -- if you
     have cracks that are growing by fatigue, you know, from the
     vibration, and the fact that they're pressurized internally,
     what's the limit on how much you can open cracks in the
     system?  How much delta-P do you need to keep opening the
               Just because you've gotten down to the delta-P
     that they were stable at before you had the vibration,
     doesn't mean that the with the vibration continuing, they
     would remain stable under that condition.
               DR. CATTON:  So when you look at this curve,
     wouldn't that just mean that you wind up staying down at the
               MR. LONG:  You're saying that this winds up down
               DR. CATTON:  The pressure doesn't go back up.
               MR. LONG:  Okay, but if you found that you've
     leaked and then you go back up, then what you're really
     saying is -- and there's still a delta-P along here that's
               DR. CATTON:  You empty your IWRST and you're in
               MR. LONG:  Well, that's part of it, but I don't
     think you can say you'd stay there.
               If you had the same delta-P that you started with
     or just a little bit more, and you're shaking the tubes.
               DR. CATTON:  The more open space you've got
     between the two systems, the smaller that delta-P is going
     to get.
               MR. LONG:  Right, so what you're really saying is
     not that I get here, but that this comes down here.
               DR. CATTON:  That's right.
               MR. LONG:  That's my point.  I don't know how low
     to say this would go.
               DR. CATTON:  It depends on how big the area is. 
     If you make it big enough it will go all the way.
               MR. LONG:  It depends on how much damage you get
     from the vibration.  So my limitation on this is that I
     can't say that the flow from ECCS pumps at a particular
     value, which is this delta-P, is the maximum flow I expect
     from the primary to the secondary.
               I've got to take into account, the damage in some
     other way, if that is the damage mechanism.
               DR. BONACA:  I have a question that I would like
     to ask:  It seems to me that we can argue about the damage
     mechanism forever, because there is a position that says we
     are going to have as much damage as you want and as much
     leakage as you really can postulate on many tubes.
               And there is a position they are presenting where
     the leak is self-containing, and this must be a leak on the
     order of one tube, maybe two tubes, because you're showing
     pressure coming back up.
               And if you had much substantial more failure
     there, pressure would not come up, back again.  I mean, it
     would stabilize somewhere pretty low.
               It seems to me that if we are trying to ask the
     question, will the operator be able to deal with the
     leakage, whatever leakage will come out, and what kind of
     range for this kind of damage, it's such that the RWST will
     not be emptied, and we will not come to a containment bypass
               That's a central question, it seems to me, and so
     the issue is have we looked at other flow rates that would
     result from larger breaks or a larger number of breaks?
               I mean, I have been reading a lot of these
     reports, particularly NUREG 1477, and the INEL report, and
     they seem to present a model where they have looked at up to
     20 tubes failing.   
               So I would like to hear about that.  I mean, if we
     concentrate on the issue of will it happen or not happen,
     we're going to be left with the dispute in place.
               MR. LONG:  One of the interesting things that
     happens to me as I try to put all these things together into
     a risk assessment is every time we run into one difficult
     question, there is always the urge to bypass that question
     by going to another area of study, and that turns out to
     have a difficult question as well.
               So if we assume that the flow rate will go to a
     very large value, the other limit on that value that you can
     postulate is essentially the size of a hole that is in the
     main steamline as a flow restrictor, and that is a pipe
     that, depending on the size of the plant, I understand is
     from like nine to 16 inches in diameter, that would
     basically run through the containment wall from a point that
     is high up in the RCS.
               We have thermal-hydraulic analyses that would
     indicate how the plant system would behave under those
     conditions and, essentially, it depressurizes quite rapidly. 
     It gets quite cool because you are doing a wonderful job of
     cooling, and you are depleting the RWST very quickly.
               If you look at the conditions, you are at RHR
     entry conditions when you have a very massive leak like that
     rupture.  The question then becomes one of human error
     probability, or even feasibility, if you look at the
     guidelines.  Can you actually turn on RHR under those
     conditions?  And it doesn't become just a matter of looking
     at the procedures and the time available, you have to start
     asking questions at this point about, well, where did all
     that water go?  If you have just emptied pretty much a steam
     generator and the reactor, and two-thirds of your RWST out
     into the plant somewhere, can you go turn on RHR?  It
     usually requires you to do something outside the control
               MR. HIGGINS:  But, Steve, if we get into these
     discussions now, haven't we left design basis accident space
     and entered severe accident space?
               MR. LONG:  Yes.  So, well, that is the --
               MR. HIGGINS:  And I didn't know if you had
     transitioned in your presentation yet.
               MR. LONG:  That was the point, we are going to be
     talking on the hairy edge the whole time for the rest of the
     day, and I don't think we can just keep saying, well, that
     is a severe accident, we will talk about it later.  We have
     to talk about the transition.
               DR. BONACA:  The reason why I asked you the
     question, however, wasn't that I say that you have to
     assume.  We are trying to understand what are the
     limitations of the combined power plant systems and operator
     that will probably give us success up to a certain break
     size.  And then we will judge as reasonable people how
     credible that size of rupture is going to be, and if it
     bounds the concerns that have been expressed about damage,
     or if it doesn't bound.
               And, for example, one could say that if you
     postulate a failure of 10 or 15 tubes, and you could make a
     case where you can still give some success to the operator
     in preventing the bypass, it would be more comforting than
     saying that the operator cannot cope even with two tubes. 
     Okay.  So I would like to just simply see if we can, at some
     point, understand that, because I think that is an important
     issue, and it tells us what we are dealing with insofar as
               MR. LONG:  I think you are correct in wanting to
     look at the human error probability part of this, and when
     we get into the discussion later this afternoon, I will show
     that I think that is an important aspect.  I think it is a
     dominant aspect for a lot of these things, not just the one
     you are talking about now.
               However, trying to use human error probability
     calculations to narrow your focus for thermal-hydraulic
     calculations doesn't -- usually it works the other way
     around because we are a little more precise with the
     thermal-hydraulics than they are with the human error
               But it is a problem of can you get information
     together to bound the issue or not, and it is a struggle
     here.  And one of the things I think you have to go back to
     is, is there a credible method for making a large hole,
     rather than just assuming a large hole?  In the design
     basis, we have chosen to assume large holes and required
     licensees to do fairly significant demonstrations that they
     can cope with those large holes in those places.  But one of
     the ones we never did require them to cope with is a large
     hole that takes the RCS fluid to somewhere where it cannot
     go into the recirc path, and that is something we have known
     as a concern since the reactor safety study in the '70s.
               I think one of the things you have to do in trying
     to bound this whole question is approach all the pieces, not
     just leave one go and try to do it with a few that remain. 
     And I think you have to look at, what do we think we can
     really expect to get in the way of a hole size?  What is
     credible?  Because if it is really a credible hole that we
     haven't considered before, maybe we need to change the
     design basis to include it.
               On the other hand, when you get into risk, if you
     think it is plausible, but not really high probability, you
     may be able to handle, put in some of the rest of the
     features and decide that the risk is low enough overall to
     not have to go any further in the analysis.  A risk model
     does not define all things to a fine degree, a risk model
     usually goes as far as you need to go to make a decision and
     stops, hopefully, just a little bit beyond there, as opposed
     to just short of there, to support the decision.  And it is
     hard enough to get to that point.
               MR. HOLAHAN:  Let me come back a bit.  We are
     talking about design basis, we are not speculating about
     some, you know, future design basis.  What we are talking
     about is design basis, you know, as it is allowed in 95-05
     or other situations, and none of these cases allow main
     steamline break with tube ruptures.  Okay.
               We are talking about leakage rates, you know, a
     few GPM may be 100 GPM.  That is why these cases look like
     repressurizations, okay.  In the severe accident analysis, I
     keep coming back to saying we will discuss it this
     afternoon, we looked at single and multiple tube ruptures,
     okay.  We have not decided that those should be part of the
     design basis.  In fact, I think we will never probably
     decide those should be part of the design basis, because we
     probably don't want those to be likely enough to be
     considered part of the design basis.  We would like to
     preclude tube ruptures, and, certainly, multiple tube
     ruptures, given a main steamline break.
               The fact that we analyzed them doesn't mean that
     we want them in the design basis.  You know, we analyze
     things beyond the design basis, that is what severe accident
     risk analysis is about.
               So I think you need to think of this design basis
     discussion in the context of relatively small leaks.  The
     original design basis for a long time was like 1 GPM.  Now,
     we are talking about 95-05 having cracks open up and, in
     fact, probably at very small leakages, but because we can't
     really analyze those and assure that the leakages are very
     small, you know, we look at them as though they are freespan
     cracks and they are not confined and all of that.  But these
     are still leakages of a few GPM, 10 GPM, 30 GPM, you know,
     in some of the more extreme cases, maybe up to 100 GPM, but
     none of them looks like a tube rupture.
               DR. CATTON:  What about tube rupture with a stuck
     open relief valve?  This is kind of similar, your mild
     steamline break where nothing much happens.  How different
     is it?  There you are going to have your 600 GPM and you are
     going to have it open to the atmosphere.
               MR. HOLAHAN:  And, in fact, we analyzed those as
     some of the more likely severe accident challenges, but
     those are not in the design basis either.
               DR. CATTON:  You mean the steam generator tube
     rupture was an open relief value, was not --
               MR. HOLAHAN:  It was not in the design basis.
               DR. CATTON:  But that happened, that has happened. 
     Didn't it happen at Ginna?
               MR. HOLAHAN:  No.
               SPEAKER:  I think they were able to close the
     relief value.
               MR. HOLAHAN:  The main -- the safety valve on the
     steam generator leaked for some continued period of time,
     but it didn't stick open.
               DR. CATTON:  Pretty close.
               MR. HOLAHAN:  I spent three weeks in snowy
     Rochester checking out that particular issue in 1982, and
     the valve was pretty well seated but leaking.
               MR. LONG:  A lot of the plants have a requirement
     for being able, with a single failure, to prevent overfill
     of the steam generator.  Now, there is a human error
     associated with not succeeding in doing that.  So when we
     look at the severe accidents, that is included as a
               It is more a matter of how many tubes do you have
               DR. CATTON:  No, I understand that.  I understand
     that.  I just thought maybe you were part-way there.
               DR. BONACA:  Just to complete my thought, however,
     since we had it, I agree that there is a design basis issue
     and there is a severe accident issue.  But I see two
     different types of severe accident issues.  One is one where
     you have a severe accident like a station blackout, and then
     you are questioning whether or not the surge line or the
     tubes will fail first.
               Now, there is nothing the operator can do about
     that issue at that point.
               MR. HOLAHAN:  Well, in fact, --
               DR. BONACA:  Let me just finish.
               MR. HOLAHAN:  Go ahead.
               DR. BONACA:  The other is the scenario where I
     have a steamline break, which may happen, and I may have
     tubes failing that may be beyond the design basis and I
     ignore that.  And we are training the operators right now to
     operate with ERGs with very specific directions, scenarios
     where you have steamline break and tube failures, okay. 
     There is a full range of analysis being performed behind.  I
     am trying to understand how credible that is, because this
     is a more significant issue in my mind.
               We have operators who are now in the control room
     trusting that the ERGs will lead them some success under
     this kind of condition.  That is why I am introducing, I
     guess, a third kind of scenario in between, is the one where
     you have a design basis moving into a severe accident, but
     you have a full body of license documents, I don't know how
     licensed the ERGs are, but they are certainly used there,
     that at least pretend to be able to cope with those
               And that is why I am trying to understand, you
     know, as part of this presentation today, how these ERGs can
     or cannot be successful.
               MR. HOLAHAN:  And have analyzed both types of
     those issues, both -- what we call the high dry sequences,
     core damage leading to tube failure, and, also, what would
     start out as a traditional design basis event and then
     exceeding the design basis conditions and going to core
               In the context of design basis versus severe
     accidents, we call both of those examples severe accident
     cases, okay, because you won't find either of them in FSAR.
               DR. KRESS:  Gary, let's pretend that we were back
     in the Dark Ages where all we had was design basis and
     didn't have risk and severe accidents, except we kind of had
     them in the back of our mind.  We defined these design bases
     as in terms of probably some perceived frequency at which
     they might occur.
               MR. HOLAHAN:  Yes.
               DR. KRESS:  But looking at the design basis of,
     say, a main steamline break, we had specified in that design
     basis, that it leak at the tech spec leak rate.
               Now, the reason that specification was in there,
     though, was because we had another something in the rules
     that said you will not exceed -- cracks that are more than
     40 percent throughwall you will plug.  Now we are talking
     about changing that part of the rules, and we don't have
     anything about risk and stuff in there, but we change one
     part of the rule, it seems to me like we have already
     changed the design basis accident.  And you may have changed
     it to the point where you might have to talk about changing
     the leak rate.  And if you change it enough, you might have
     to talk about an induced steam generator tube rupture.
               It seems to me like we already changed the design
     basis accident, and the question is, how much are we going
     to change it?
               MR. HOLAHAN:  Well, I agree that if, in fact, we
     were to allow leak rates sufficiently large so that the
     events don't look like -- it doesn't look like a main
     steamline break, it looks like a much more complicated
     event, it looks like a steamline break and a tube rupture,
     or it looks like a small LOCA, then, in fact, we would be
     having a different event.
               But we are not talking about allowing such
     leakages.  And I don't think we want to go there.
               DR. KRESS:  Okay.  But what I thought was, if you
     change the rules about how you deal with the steam generator
     tubes, it might very well be that you have no control over
     what leakage you are allowing.
               MR. HOLAHAN:  No, no.  I think, in effect, what we
     have done is very carefully, in 95-05, looked at the
     increased leakage implications associated with change.
               DR. KRESS:  You say there is now another part of
     the rule that does give you a reason to specify a leak rate
     as part of the design basis.
               MR. HOLAHAN:  Yeah.  And I think that is part of
     what you heard for the last day or so, is that the dose
     calculations -- and as early as Jack Hayes' calculations
     from yesterday, the dose calculations are done with
     substantially higher leak rates for a plant that is using a
     95-05 process.  But we are not allowing those leak rates to
     be sufficiently high that, in fact, they were creating
     different accidents.
               DR. KRESS:  Not allowing them under -- at some
               MR. HOLAHAN:  Not allowing them as expected
               DR. KRESS:  Expected results.
               MR. HOLAHAN:  As an expected part of the design
               MR. LONG:  You put your finger on one point, and
     that is that, initially, there was no understanding of a
     difference between the normal operational leakage from the
     steam generators and the accident leakage.  People weren't
     thinking cracks that would open.  They were thinking tubes
     that could only stand about 10,000 psi, and they might have
     pinholes or there would be wastage that you checked and you
     patched before it got less than 4,000 psi in strength.
               And when we divorced the accident leakage from the
     operational leakage, the accident leakage doesn't appear in
     the tech specs now, it is a value that is put into the
     Chapter 15 analysis.  So what is happening is people are
     lowering what is in the tech specs, which is the iodine
     concentration and the coolant and then through the Chapter
     15 analysis, they are increasing the leak rate.
               There is no real limit on how far that leak rate
     can go.  You know, if they are operating at 10 to the minus
     4th mikes per cc, and the limit, the assumption is 1, and
     the Chapter 15 analysis for 1 GPM, and they are still not at
     30 rem to the thyroid in the control room, you know, you can
     get the leak rate up to 10,000 GPM and still meet Part 100.
               So what Gary is saying is, well, when we grant
     these things, we are granting them on a case by case review
     and we don't intend to grant something with that high a leak
     rate.  We have gotten up to 132 in Byron 1 at least, I don't
     know about Braidwood, for one cycle, or the last part of one
     cycle.  I was nervous when we got to 132, and I wanted to
     ask, what do we think the real leak rate is if these cracks
     are, you know, contained in crud-encrusted tube support
     plates?  Especially if you shake those tube support plates
     with a main steamline break.
               We know that the French have done some studies. 
     You asked about the crud.  The French have done some studies
     where they have harvested tubes with the support plates
     intact, drilled a hole through the support plate, the crud
     on the tube, and plugged the support plate.  So what they
     have is an opening into the crud.  And they have
     demonstrated it is pretty tight until you move the support
     plate with respect to the tube some distance, and then
     apparently you crack the crud and you do get some flow.  It
     is still nothing like the leak rate that you would get if
     that hole was in the freespan.
               And, in addition, it is a hole you drilled.  If it
     was a crack and it was essentially in a tube that was being
     dented, and that is the reason you had the crack, the crack
     may not be able to open and create that hole.
               So we don't really have a way of calculating the
     leakage as long as that crack remains within the tube
     support plate.  But we are counting on it being lower than
     the value we calculate as if it is in the freespan.  And
     there is not a very strong knowledge base to tell us how far
     we can go in this pseudo leak rate in the Chapter 15
               CHAIRMAN POWERS:  Do you have the description of
               MR. LONG:  If Emmett Murphy was here, I'd be glad
     to say yes, but I'm not sure I know of anybody else in the
     audience that has them right now.
               We'll try to make sure we get them for you.
               MR. HIGGINS:  Steve, most of the discussions we've
     been having relate to the main steam line break and then
     what happens with the possibly-induced leakages.
               If you use the stuck-open relief valve as another
     initiator, rather than the main steam line break, does the
     main steam line break bound that, or do you need to
     separately look at the stuck-open steam generator relief?
               MR. LONG:  When you say bounded, in what sense?
               MR. HIGGINS:  That you don't need to look at that
     and analyze that separately.
               MR. LONG:  Well, when you get into the accident
     sequences and event tree, they're different.
               MR. HIGGINS:  I'm talking design basis.
               MR. LONG:  Well, this is what I mean by in what
     sense?  If you're asking, do you get the same kind of
     vibration in the tubes when you use blowdown to a stuck-open
     safety valve, I don't think you get that.
               The repressurization is slower.  We've done it a
     few times already.
               I would expect that to be a more benign problem
     from the standpoint of the blowdown effect.
               On the ohter hand, it's something where -- I've
     taken the graph down now, but it's something where the
     operators have had a tendency to repressurize the system and
     increase the delta-P.
               MR. HOLAHAN:  In the context of the question, the
     design basis, the question is, would it produce higher doses
     in design basis?
               MR. LONG:  That's the reason I asked in what
               You're saying -- if the question is, would the
     doses be higher or lower --
               MR. HOLAHAN:  Than a main steam line break.
               MR. LONG:  Probably, I think they would calculate
     in as the same in a design basis.  I think they'd just
     assume that the secondary side is open to the environment.
               They would assume that the secondary side is
     voided, is depressurized, so there's no scrubbing.  And I
     would assume they'd get the same answer.
               I don't think they have gone into the physics in
     any greater detail.
               DR. HOPENFELD:  Can I make one comment?  Is that
     okay with you, Steve?
               MR. LONG:  Sure.
               DR. HOPENFELD:  I'd just like to put it in
     context.  And what Mr. Holohan said is very true, that 9505
     is limited to very small leakages.
               In fact, that was really the main reason why I
     converted that DPV to a DPO in July of '94, just before that
     9505 went on the street.
               And if I remember correctly, I had a discussion
     there, and I said, well, anything below 100 or 200 gpm is
     not of concern to me, because the operator will take care of
               The whole issue was, what we're doing is just as
     you describe now, but look what happened.  We were 94 and we
     basically accepted htat idea that we don't have to go beyond
     these small leakages.
               And so we have the six years of all that time
     that, you know, that we sort of accepted it, and we haven't
     -- and that's really the main issue here, why -- I think
     we're focusing on it, and that's why 9505 is not adequate.
               But we accepted it and let it stay there, and then
     we say it is adequate and we're ruling out any leakages
     beyond one gpm or ten gmp, and I think you focused the
     discussion as to where we should be heading with this.
               MR. HOLAHAN:  Let me comment on that, because I
     think what it says is, the staff's intent is consistent with
     Dr. Hopefeld's views; that is, that we both want to keep any
     leakages, you know, following a steam line break, to be
     small values which can be shown to be things that operators
     can handle and are within the dose limits.   
               It seems to me that the disagreement is with
     whetehr, in fact, the thigns that staff has done have
     accomplished that goal.
               MR. LONG:  Yes.
               MR. HIGGINS:  Related to that, and the operator
     actions, as part of the GL 95-05 reviews, were there any
     reviews done to see if there were -- that the operators
     could still handle the differences in the accident scenarios
     between the one gpm leak and now, say, a 100 gpm leak after
     the main steam line break, and verifying that the procedures
     and the training and so forth were needed -- whether they
     needed to be changed or not, or whether any other actions
     had to be taken at the sites that are now operating under
     these new tech specs?
               MR. LONG:  Okay, I'm not sure if Joe is going to
     get into any of this.  He's shaking his head, no.
               MR. DONOGHUE:  This is Joe Donoghue.  I'll be
     talking a little bit about this, but the short answer, I
     think, is, there were no specific anlayses done fro the
     licensing actions.  We were depending on the 1477 and the
     other analyses that I will talk about.
               The conclusoins there convinced us that we didn't
     need to do more work on a site-specific basis.
               MR. LONG:  Were you asking site-specific or just
     were there studies done?
               MR. HIGGINS:  No, whether or not you needed to do
     anything site-specific for the plants that were getting
     these tech spec amendments, in order to ensure that their
     procedures and training were capable of handling these
     somewhat different design basis accidents.
               MR. LONG:  I don't believe we did that.
               MR. DONOGHUE:  I think the answer, again, is that
     some of the anlayses that I will talk about were based on at
     least one plant, because that's all we analyzed during the
               We used their procedures as the basis for the
     actions and the timing.
               That was a very brief synopsis of what was done
     but our conclusions were that overall the licensee's
     approach here was conservative.
               They tried to make sure they were calculating what
     would happen -- they used the condition that would give them
     the highest peak loads across the tube support plates.  To
     apply those peak loads to all the tube support plates in the
     generator when they took the next step to do the deflection
     analysis and they applied a safety factor to those loads
     when they did that deflection analysis.
               From that we documented in the safety evaluation
     that we considered what they had done for this license
     amendment was reasonable.  However, we made clear that this
     was not a generically acceptable approach because of the
     limitations MB-2 data.  We didn't see this as a basis for a
     qualification of this method for generic use.
               About six months later I think I was one of the
     people here again talking about this license amendment and I
     think a subcommittee of the ACRS had some comments about it,
     had some additional questions that came up on the ability to
     model the flows in the generator during the main steam line
     break and we have since used those kinds of questions to
     supplement instances where we have addressed licensees
     approaching us with this kind of request since then.
               I can think of a couple of instances where we have
     had very detailed discussions with licensees who have tried
     to pick up the methodology that was used for Byron and
     Braidwood and we have asked additional questions based on
     what we got out of this June meeting and other things that
     have come up since then and so far I don't know of any other
     licensees that have been able to apply this sort of a
     process, this modeling and methodology.
               MR. CATTON:  One of the problems is that it is a
     nonequilibrium behavior.  If you think about what happens
     before any strong flow starts, the pressure drops, then you
     convert to steam and you begin to build up the flow, and
     this sort of starts from the bottom to the end so you can
     wind up choking and unchoking.
               This was the same thing that happens when people
     considered the internal loads on the reactor following a
     break.  You get an expansion wave that travels inside.  It's
     nonequilibrium.  What begins to bring it to a stable process
     is when the nonequilibrium process is over and you start
     just converting pressure into superheat and to steam and it
     is steady.
               The loads are going to be quite different.  I
     think it is the choking and unchoking that is going to get
     you, and that is a very quick process at the beginning.
               Of course it depends on how many of these area
     restrictions you have from one end of this device to the
     other, and somehow I was a member of the committee in June
     and I don't remember the meeting but I guess if there was
     criticism of it, it was probably me.
               MR. DONOGHUE:  I definitely remember your
               MR. DONOGHUE:  Scars --
               MR. CATTON:  It is not clear to me that you can
     solve it as essentially an equilibrium process, it's not. 
     It's nonequilibrium and it's the nonequilibrium effects that
     are going to lead to the difficulties.
               You have to include them if you want to do it
     properly and I don't remember the MB test either.  I don't
     know what the internals of that thing looked like.
               MR. HOPENFELD:  Can I just make a comment on that?
     We had so many subjects the other day, but I did cover that.
               The instrumentation was part of it about the peak
     pressure, but that wasn't the main thing.
               Remember, I showed you that the volume, the vessel
     that was surrounding that slide of tubes, it was a factor of
     six or seven higher than the volume occupied by the bundle,
     so the whole flow phenomena was controlled but something had
     to do with the flow in the tubes, and that was my point,
     that you couldn't possibly benchmark RELAP against that kind
     of data.  It wasn't designed for it.
               That was the point and I showed you in the
     presentation the volume ratio and I think it is in your
               MR. DONOGHUE:  One thing I remember we did say in
     the safety evaluation was that it seemed reasonable to us
     that there were so many impediments to pressure waves making
     it back to the tube support plates because of equipment that
     is in the steam generator that compared to the MB-2 setup we
     thought, it seemed reasonable to assume that a lot of those
     loads were not going to be any bigger or much bigger or some
     phraseology like that than the differential pressures that
     were trying to be predicted.
               MR. HOPENFELD:  There is actually no reason to
     assume that.
               MR. DONOGHUE:  Well, that is assumption we made. 
     I am just stating what we documented.
               I agree, you know, the question about the
     equilibrium/nonequilibrium choice for use of RELAP was a big
     issue and we --
               MR. CATTON:  Some of those pressure spikes might
     be real.  They tried a long time ago with Semiscale, one of
     the Semiscale these they begin to get these big oscillations
     and they tried to use all of the different codes and they
     never could reproduce them.
               The problem is when the pressure goes up, you are
     condensing.  When the pressure goes down you are
     evaporating.  The thing acts like this huge volume so all of
     the frequencies are different.  Everything changes.
               MR. DONOGHUE:  Let me step back for a minute to
     again this discussion I tried to say was that -- I may be
     able to state it more clearly now -- I am not here to try to
     say that we have a basis for resolving the new GSI.
               I am just here to say that this is some work that
     the Staff is aware of that is connected to the issue and
     this is as far as we have gone and we stated in the safety
     evaluation there were clear limitations to what we were
     doing and why we had problems with this when other licensees
     have come in and tried to do this.
               The technical details here, the ability to model
     these things is certainly an issue and that's why I think we
     put all those limitations on this when we first asserted
               I have no other information to present on this
     topic.  Refer back to, I think, material you have in your
     truck-load of documents you have -- your safety evaluation
     references what the licensee did and the safety evaluation
     has the discussion about what the Staff did there and the
     things I talked about here.
               MR. HOLAHAN:  I would just like to remind you that
     this relates to something discussed yesterday, that the case
     that the Staff approved was one in which because of
     uncertainties and other issues we required the licensees
     effectively to stake the support plate by tube expansions
     above and below it so there was an additional basis for
     saying the tube sheet wouldn't move, not just the thermal
     hydraulic analysis, so you get an idea of the state of our
     comfort and knowledge by the fact that we, even though maybe
     your best judgment is that you wouldn't have a problem, we
     didn't feel that the analysis without additional actions was
     appropriate.  Thank you.
               MR. DONOGHUE:  Yes, I tried to allude to
     conservatisms and that is another one that I could have
     added to the list.
               If there are no other points to discuss, I will go
     on to the next issue that I was asked to speak to you about,
     which we have talked about to some extent already, how much
     leakage can we -- do we think is tolerable during a beyond
     design basis, even though I say during design basis
     accident, we kind of call them beyond design basis events
               This is addressed in Issue 2 of the considerations
     document.  In there we talk about reports that have come up
     repeatedly already and I will just summarize the first one,
               We have already talked about that so I won't spend
     much time, except to say that there were calculations done
     over a range of leak rates, primary-secondary leak rates,
     and the conclusion there was that the RWST inventory could
     be maintained in accordance, if the operators performed in
     accordance with the emergency response guidelines.
               The next report, and before I go into detail, I
     will just try to put some context on this report, in 1993
     when the rulemaking activity was begun, that's when the
     Staff were brought together and told to charge off in the
     direction of rulemaking, we were challenged by Mr. Thadani,
     who was at that time the SSA Division Director, to try to
     get a handle on where the risk significance lay here.
               This was at the advent.  We weren't really
     risk-informing as much as we are trying to do today or in as
     formal a manner as we are today, but he was very concerned
     about these kind of events where we are going, pushing the
     envelope or going beyond the design basis line and trying to
     understand where we have to focus our attention if we were
     going to try to put down a rule to address steam generator
               One of the first things we did was design the INEL
     that I think Dr. Bonaca has talked about where we tried to
     scope where we thought problems may be.
               One of the first things we did was analyze main
     steam line breaks with different numbers of tube ruptures. 
     It was based on -- I will talk about that later -- modeling
     assumptions, but the approach anyway was just see if there
     is a cliff somewhere that was just outside of the design
     basis envelope that we needed to really worry about in terms
     of risk to the plant, of risk to the public.
               In the end this analysis provided support for us
     to concentrate on these -- I will call them severe accident
     scenarios but the high and dry sort of things which we ended
     up spending a lot of time and effort on in conjunction with
     research and produced NUREG 1570.
               Efforts continue in that area because of the
     uncertainties that we were aware of from that 1570 work. 
     That was not the end of the process.  It continues, but for
     our purposes here I am just giving you a context for what
     the INEL report represents.
               It doesn't maybe go as far as these other efforts
     that we call severe accidents.  As I said, it summarizes the
     analyses with multiple tube ruptures and combined main steam
     line break events.
               It used the RELAP model, RELAP5 model of Surry and
     I think Steve mentioned that as part of this process we
     found that we had these same questions about what is the
     operator able to or not able to do.  The licensee for Surry
     was kind enough to send us their complete EOP package, which
     the contractor was able to reference and use and they
     answered questions for us when we got to the point that I
     think Steve mentioned, that we were trying to use a
     simulator to understand what operators could or couldn't do.
     They answered questions about their own procedures.
               In a way it is a very detailed look at one plant
     and in a way it is unfortunate because we focused so much on
     one plant at the exclusion of other designs but in the
     course of the rulemaking we had to concentrate our efforts
     somehow and that's what we did.
               One issue that I was made aware of that I was
     going to spend some time on but I might -- I will get your
     sense, Dr. Powers, on whether we wish to spend time on this,
     is the assumption that ECCS flow in the event was throttled.
               It seems like there's other issues here, but with
     the timing I might just jump to rather than discussing the
     throttling issue.
               CHAIRMAN POWERS:  Well, it seems to me that the
     critical issue is the kind of time that is available to
     recognize and respond to the event --
               MR. DONOGHUE:  Right.
               CHAIRMAN POWERS:  -- and start throttling soon
     enough.  I presume that the operator -- I mean it is safe to
     presume that the operator once he starts throttling will
     throttle appropriately.
               MR. DONOGHUE:  Well, that's the question.  I will
     just touch on it very briefly unless there's questions that
     come up.
     Just to jump to the conclusions of the report, we arrived at
     the point where we thought that, given, given the
     procedures, that the RWST inventory at Surrey was sufficient
     to handle the combined [inaudible] and multiple tube
     ruptures, that dividing line at exact number of tubes is a
     point of argument.  But it seemed like it was, was not one
     tube.  It was not even maybe a handful of tubes.  It was
     probably something a little more than that.
               Just briefly on the throttling assumptions,
     there's different configurations at different plant, but for
     Surrey, you can realign your high-pressure injection through
     charging lines and have a throttling capability.  The
     emergency response guidelines with the CROPs allow -- they
     have objectives of maintaining RWST inventory in the case if
     you have decreasing steam generator pressure during a tube
     rupture.  And in order to do that, there are guidelines for
     the reduction of injection flow.
               Um -- I'll jump to the next-to-last bullet on the
     slide.  Is that -- the wording in this bullet maybe isn't
     the best.  But from the range of one to fifteen tubes,
     different actions become more important.  For the larger
     breaks, the number larger number of tubes broke or failing,
     it's less important that the operator depressurize because
     it's happening already.  It's happening by itself.
               The other actions that are important are,
     obviously, when and how to reduce injection flow and then
     the big question -- the biggest question, I think -- is how
     and when you get onto RHR.  That's what's saving you.
               There were people that were involved in this
     analysis that still had questions when we got to the point
     where we made some conclusions about this.  However, as you
     heard already, we didn't have information that gave us
     credible means for getting to these multiple tube ruptures;
     they're very high primary, secondary leakages during the
     main steamline break.  And we took the direction during this
     rule-making trying to develop a technical basis for this of
     going off in the other direction that I mentioned before,
     the NUREG 1570 analysis.
               Talking about the timing, I did bring a couple of
     plots that came from the work that was done for the INEL
     report.  It was also -- the INEL work was also in -- the
     NUREG number escapes me.  It think it's 6365, steam
     generator tube failures, I think is the title.  Some of this
     common, some of the same analyses ended up in both reports. 
     The more complete set of analyses were in the INEL report. 
     And it was kind of a, I guess, a scoping study, a draft sort
     of document.  It didn't make it into the NUREG stage; it was
     a contractor report.
               I'll just throw up here -- I might be going
     backwards, but, all right, let me do this.  If I put up the
     one tube-rupture case, it's -- let me see the units.  Okay. 
     With one tube rupture, the RWST inventory is somewhere
     around that line.  And if you extend, if you extend that
     injection rate, that cumulative injection flow up to the
     inventory, you can see there is several hours -- I think I
     wrote down -- there's several hours that the operators have
     to respond.
               If you throttle the flow, which is what's done at
     about, at about this point, and you throttle the flow, you
     get a couple more, several more hours.  So the one tube case
     seems like there's plenty of time for operators to respond. 
     If I jump to the very limiting fifteen-tube case, you can
     see there where flow was throttling, or without throttling
     flow, you can see there's only roughly an hour before you're
     done with the RWST.
               And I'll point out that for Surrey, there's an
     ability to cross-connect to the other RWSTs that's not
     included in this analysis.  This is just the one thing.
               You can see when flow is throttled, that roughly
     doubles the time that you have.  And that is still of
     concern.  I wouldn't, I wouldn't feel confident saying to
     the operators, given a fifteen-tube -- you know,
     double-ended guillotine break of fifteen tubes would be able
     to handle things, given that short period of time, even if
     flow could be throttled.
               I think I have -- here we go.  I have a ten-tube
     case, which is getting closer to that point that one might
     think -- is that clear enough?  Yeah -- that one might think
     you could survive it.  Again, just extrapolating these lines
     up to about where the RWST flow, RWST inventory would be,
     you can see you get quite a, quite a change in the time that
     you have, from about -- oops, that's probably wrong, there
     we go -- from maybe a couple of hours to five or six hours,
     roughly, which highlights the importance of the operator
     actions to reduce flow, but made it apparent to us that it
     didn't see, even with this ten-tube failure case, that there
     was going to be that -- we weren't on a hairy edge.  If
     there was just a few hours, we'd still be concerned, as I
     mentioned on the fifteen-tube case.
               When we were doing, when the INEL was doing this
     work for us, these human error probability questions came
     up.  Steve alluded to some of the efforts that were pursued
     to address them.  I'm not gonna try to address them here. 
     I'm not even close to an expert; I'm just aware that that
     work was done.  However, when we got to a point where we
     thought we understood it well enough to get some
     risk-informed basis for what we needed to do, the work here
     was considered sufficient.
               DR. KRESS:  What happens to the peak [inaudible]
     temperature when you throttle it?
               MR. DONOGHUE:  Well.  I think you just keep the
     core covered.
               DR. KRESS:  -- keep the core covered --
               MR. DONOGHUE:  Yeah, I mean I have one plot here
     where this is fifteen tubes and no operator action, no
     throttling.  You can see that -- where's that fifteen-tube
     case with the throttling on it.  You can see that the core
     becomes uncovered and you start causing damage.  But where
     -- yeah, it's well after WST is emptied.
               MR. WARD:  Excuse me.  My name is Len Ward. 
     There's no challenge to core uncovering.
               MR. DONOGHUE:  Yeah.
               MR. WARD:  There are two LIPSI pumps operating in
     two [inaudible].  There's a tremendous amount of flow there. 
     Core uncovering is not a concern unless you have no
     injection.  And if you have no injection, you don't uncover
     until seven hours.  And that's because you basically have to
     boil off all the fluid above the top of the core, from the
     steam generator tube sheet all the way down into the vessel. 
     Roughly seventy percent of the fluid in the system is above
     the top of the core.  It takes a long time to boil it off.
               If it was flowing out critically, if the break was
     in the co-leg, it would lose it a lot faster.  So the saving
     grace, the good thing about these kinds of events are, the
     break's very high in the system and you have to boil fluid
     off.  And that doesn't challenge injection systems like
     critical flow does.  So it gives you large amounts of time
     before you would start to uncover.
               MR. DONOGHUE:  Thank you, Dr. Ward.  I will just
               MR. AOPEUFELD:  One more comment.  There's a
     German study showing that only ten tubes, and they were
     concerned about turning -- they can't throttle it, so you
     have to turn pumps on and off.  And they weren't designed
     for it.
               MR. DONOGHUE:  Well, as I mentioned for Surrey,
     there's an ability to realign the system to use the charging
     lines to, which have the ability to throttle the flow.
               In these cases, it was probably a simplifying
     assumption that the throttling was done once and we stopped. 
     I'll just point out that for the fifteen-tube case, the RWST
     runs out in a little bit more, around two hours, and that
     the boiling is going on for another three to four or five
     hours, before you end up having a core damage problem.
               As far as -- the throttling assumption I think is
     gonna be largely a plant -- it's gonna have to be, it's
     gonna have to consider plant differences, design
     differences.  It's clear.  Again, this scoping study, you
     use one plant design to see if -- which we thought was
     relatively representative of a large portion of the PWRs, to
     get an idea of if there was a large risk significance to
     these kinds of events.
               I think this afternoon, if there's other questions
     about the human error probability analysis that was done,
     that's the appropriate time to talk about it.  Are there any
     other questions about that work?  Yes?
               DR. BONACA:  The only reason -- okay, first of
     all, I thank you for the presentation.  That's the
     information I wanted to have.
               The reason why I asked directly before is that I
     did not see it discussed into the DPR consideration in a
     specific fashion, and so I was puzzled and I thought that
     you would not be presented that information, which I believe
     it's important to our judgments that we have to make here. 
     And again, I was intrigued by the fact that when we look at
     the risk analysis, this information wasn't presented at all. 
     The DPL consideration.  It is discussed under the accident
     analysis portion, but it's not considered at all into that. 
     And that was my reason for asking for that.
               MR. HOLAHAN:  I would just add that a similar set
     of analyses were done about a decade earlier, part of
     resolving unresolved safety issues 83, 4 and 5, and had a
     similar result for the one-, two- and ten-tube ruptures and
     came up with similar conclusions as to the amount of time
     available and the likelihood that operators could handle
     those cases.  And just to simplify again, in the context of
     Dr. Hopenfeld's concerns, I think what we're both saying is,
     is for a fairly small number of tube ruptures, the operators
     have time and can probably handle these.
               And in fact, I think both the staff and Dr.
     Hopenfeld would say there is a point at which the sequences
     do in fact go too fast and the situation is too complicated. 
     And whether that's ten tubes or twenty tubes, there is in
     fact some point at which that occurs.  So it seems to me
     that the main issue is, what's the likelihood of having
     multiple tube ruptures given the steamline break.  And the
     staff's conclusion is that's very unlikely and we'll discuss
     it some more this afternoon, but that same view is not
     shared by Dr. Hopenfeld.
               DR. BALLENGER:  But even if you have fifteen tubes
     ruptured, what I just heard was that -- so you run out of
     RWST water in two hours, and the operator's completely
     flustered and can't deal with it.  You've got six hours more
     before the core is uncovered.
               MR. HOLAHAN:  No.
               DR. BALLENGER:  No?
               MR. DONOGHUE:  That's a total of about six hours. 
     You have maybe three or four.
               DR. BALLENGER:  So you've got four hours.
     @@        DR. BALLENGER:  Three or four hours.
     @@        DR. BALLENGER:  You've got three or four hours
     more grace period, if you will.
               MR. DONOGHUE:  Yes.
               CHAIRMAN POWERS:  The problem is, once you concede
     fifteen, you've got to concede twenty.  Once you concede
     twenty, you've got to concede twenty-five.  I mean, one or
     two is different from fifteen.
               MR. HOLAHAN:  And I think that as the number of
     tubes would increase, in fact that amount of time available
     would decrease, because it wouldn't just be boil-off.  You
     could actually have a system blowdown if the number of
     failed tubes was large.
               MR. DONOGHUE:  If there's no further remarks about
     that, I'll go to my last topic, which I won't even try to
     say is going to be brief, even though I only have a couple
     of slides.
               We've touched on this I think earlier, the leakage
     that could develop during a depressurization event.  And
     just point out that I have one other page that I want to
     make sure you have.  It's a list of events I'll get to in a
               When we talked about this in the DPOP
     considerations document -- this I think is issue 2.  And let
     me see, break leakage.  I think we've mentioned that there
     have been depressurization events, we have not seen primary,
     secondary leakage associated with those events.  Those kind
     of events are usually association with stuck-open relief
     valves, loss of feedwater, or some combination of those,
     those kind of failures.  And when we look at the reports for
     those, some of those events -- which I'll show you the list
     in a second that I'm talking about -- we don't see a
     discussion about primary and secondary leakage.
               If there was primary and secondary leakage, there
     are steps in the procedures that the operators use that take
     that into account.  If there's contamination going to the
     secondary side, there's certain things they need to do. 
     They need to monitor for it, but there's also steps to take
     to, to try to limit the contamination.  But what's
     important, I think, is that for the events that we're aware
     of, that when plants returned to power, there was not tube
     leakage that was reported to the NRC.  We didn't see tube
     failures manifested in leakage from these type of events.
               DR. SIEBER:  Could I ask a question.
               MR. DONOGHUE:  Yes.
               DR. SIEBER:  [inaudible] had a blowdown during a
     [inaudible].  Was there an inspection or do you have any
     information related to the condition of that steam generator
     prior to its being put in service?
               MR. STROSNIDER:  Yeah, this is Jack Strosnider of
     the Staff.  You're referring to an event that we heard about
     the day before yesterday, I guess.  We've asked the staff to
     go look at the docket and see if we have anything reported
     to NRC.  I can't tell you the answer at this point, but we
     are pursuing that question.
               MR. DONOGHUE:  I would just add that I think in
     the documents that you have, there's accounts of those
     events, of that and I think and event at Robinson.  And just
     looking at those accounts, I didn't see any discussion about
     the -- you know, going back and looking at the steam
     generator.  I did look at some other information I think
     EPRI had on repair histories for tube.  And I'm not sure if
     Jack's staff has looked into that.  I'm sure they are.
               But, you know, it didn't seem like there were
     tubes repaired at -- that's just speculation on my part. 
     That's just basically absent information; I think Jack's
     staff will be able to answer that better.  But for these
     events, these are just examples of the type events that we
     mentioned in the DPO considerations document, where in some
     cases and in one case here, both steam generators lost
               The primary pressure changed, but the primary did
     not depressurize during these blowdowns and there was
     significant differential pressure across the tubes.  I
     wouldn't call these type of events are gonna produce any
     kind of dynamic events that would be something, you know,
     that could help address the new GSI.  These are just purely
     instances where you have a high differential pressure across
     the tubes.  But look at the LERS across these events, or in
     the case of [inaudible], there's a detailed NUREG on that --
               MR. HOLAHAN:  My recollection is sitting up all
     night in the operations center watching the Davis-Bessy
     cooldown.  And I think we asked some questions about whether
     there was any leakage.  And I think they did not have a
               MR. DONOGHUE:  Thank you.  So there's another
     piece of information that's helping.  We didn't see tube
     leakage after such events.  And after we -- we don't know of
     this being a problem for depressurization events.  Which
     leads to some assurance that if there's a high differential
     pressure across the tubes, even after some period of
     operation, that we're not going to see leakage develop.
               HOPENFELD:  [OFF MIKE]
               MR. DONOGHUE:  Say again?
               HOPENFELD:  [OFF MIKE]
               MR. DONOGHUE:  I'm not sure --
               MR. STROSNIDER:  That's correct. None of those,
     none of those units particularly, you know, had the generic
     letter number 505 alternate repair criteria in place.
               HOPENFELD:  [OFF MIKE]
               MR. DONOGHUE:  No, but the point is that the
     plants operated -- these plants did have some tube repair,
     although they weren't ultimate repair criteria.  And it's
     just showing that we don't have information to show us that
     the tubes are going to leak excessively after a high, high
     differential pressure is applied to the tubes.
               CHAIRMAN POWERS:  I feel, I feel absolutely
     obligated to point out that after 24 launches of the
     shuttle, we didn't have any evidence that we'd have a
               MR. DONOGHUE:  I understand --
               CHAIRMAN POWERS:  Small databases are useful for
     contradicting hypotheses, not confirming them.
               MR. DONOGHUE:  I see.  Well, we just wanted to
     present the operational information that we knew about when
     we wrote the DPO considerations document.
               CHAIRMAN POWERS:  And I think that's, that's what
     the Committee asked for and it's useful.
               MR. DONOGHUE:  Unless there's other questions or
     remarks, that's all I have for today.
               CHAIRMAN POWERS:  Are there other questions? 
     Speaker?  Seeing none, I'd like to pose a question to Dr.
     Shack.  We let him get away way too easy on this, on his
     presentation.  So we'll take just a minute or two.  Dr.
     Shack, if I ask you a question, may I suggest you just sit
     here in the designated Federal officials' seat.
               CHAIRMAN POWERS:  When you spoke, you spoke of
     both circumferential and axial cracks and presented a
     mind-numbing amount of data and analyses that suggest that
     we really understand circumferential and axial cracks in a
     fair amount of detail.  But I'm reminded of the cracks that
     people show us that show that they are not completely
     circumferential or axial in all cases.  And I'm wondering
     how -- do we have guidelines to tell us how to apply all
     that knowledge to more realistic cracks that have some
     convolution of shape that might suggest that they have some
     circumferential characteristics and some axial
               DR. SHACK:  One moment.  I suspect this is more a
     question of what the regulator is done when he's faced with
     those questions.  I think most of the time, unless one has
     better information, one makes a rather conservative bounding
     projection of the cracks, so that you're, you're almost
     collapsing cracks that are separated by ligaments onto a
     plane and using that kind of bounding analysis.  There are
     rules in the code, you know, if you could clearly
     demonstrate the separation of these segments, but in many
     cases, the resolution of the NDE isn't good enough, so you
     would end up collapsing them.
               We're looking in a research basis at what you do
     when you have a combination of circumferential and axial
     cracks together.  We -- I think that one would again take
     rather conservative estimates of how that would work, by
     projecting everything onto a single plane.
               SPEAKER:  Cosine of the angle?
               DR. CATTON:  You don't get an oblique crack?
               SHA:  There's thousands of cracks out there, you
     know.  Never's a long time.
               SHA:  I would say that most of the time, you get
     circumferential and axial cracks.  I sort of explained it to
     Dana, that one of the things you seldom see -- stress
     corrosion cracks don't grow under pure sheer, typically. 
     We've tried to grow them under torsion, which is one way to
     get a pure sheer state.  You seem to need normal stresses,
     and so they line up along principal stress axes, which in a
     tube happen to be -- it's this way.
               Now again, at a roll transition, the stress state
     is always a little more complicated and things might not be
     so simple.  But the stress patterns there are so
     complicated, my guess is you end up assuming that they're
     projected into some 360-degree plane and you'll, you'll find
     that you don't want to live with the results.
               Again, if it was a small crack at an angle, as my
     results show, you know, the 300 degrees, you're not gonna
     quibble over one short, small crack.  But if you have an
     extensive amount of cracking -- but again, it's the
     regulators who actually handle that problem.
               MR. STROSNIDER:  Yeah.  This is Jack Strosnider. 
     And just to follow up on what Dr. Shack indicated,
     typically, typically because of principal stresses in the
     pressure, the large hoop stress and that, you're gonna see
     axial cracks or circumferential cracks.  That's -- in order
     to get something that's, that's at some sort of angle, you
     need something like the ODSCC under the tube support plates,
     which is -- and even there, it, it lends itself to the
     creation of something closer to intergranular attack, as we
     said earlier.  So you've got a network of cracks.
               But as that crack develops -- and this is what's
     applicable under generic letter 9505 -- is you leave, if
     it's left in there long enough and as it develops, it will
     develop a principally, an axially oriented, dominant crack.
               You know, the one area where -- and unfortunately
     I don't have any of the staff here who can go into a lot of
     detail on this -- but my recollection is that down in the
     crevice of the tube sheet, you know, some of these plants,
     the tube are not full-depth expanded into that [inaudible]
     tube sheet.  It might be expanded three inches, and then
     you've got this 20 or 21 inch crevice.
               Down in that crevice region, where we have some
     alternate repair criteria, all right, which are based on
     depth into the, down into the tubesheets and the inability
     to pull it out, friction loads and that sort of thing, my
     recollection is that we have placed on some of those repair
     criteria, some requirements that when they do the
     inspection, they verify that the cracks do not have a
     significant circumferential portion, because they do
     sometimes grow.  In that sort of environment, they may not
     grow at perfectly along the length of the tube.  So we did
     establish some criteria there.  That's my recollection.  If
     you want more specifics on that, I'll have to get it for
     you.  But it's something like that --
               CHAIRMAN POWERS:  Yes, I'd like to --
               MR. STROSNIDER:  -- it's that sort of unique sort
     of situation down in that crevice where you might tend to
     see something, you know, like you're --
               CHAIRMAN POWERS:  Yes, I'd like to know why you,
     you asked for something particular about the circumferential
     character to the cracks, because I got the distinct
     impression from the explicit words that you could tolerate
     circumferential cracks a lot better than you could axial
               MR. STROSNIDER:  Well, I'm, I'm not sure if I
     follow everything.  Your question exactly is -- it was
     discussed this morning, circumferential cracks are more
     tolerable in the sense that you have, they have lower
     stresses on them trying to pull them apart.  In reality,
     when you look at circumferential cracks, at least at the top
     of the tubesheet, they tend to have a lot of ligaments in
     them.  That may not necessarily be true of some of the
     primary water cracks that, that show up.  But it's largely
     because of the lower stresses that are on 'em.
               With regard to these criteria down in the
     tubesheet, as I said, we have to get some more specifics for
     you.  But sort of a general concept is that the ideas, you
     want to make sure the thing doesn't pull out, all right? 
     And if you had the potential to grow a circumferential crack
     completely around the tube, then, you know, that, that, you
     know, too close to the top of the tubesheet, then you might
     have some concern about whether you've got enough tube down
     into the tubesheet to keep it in place.
               All right.  The other aspect of it is that the
     axial cracks that are in there, you know, you have to look
     at them from some sort of leakage point of view.
               So I don't know if -- does that address your
               CHAIRMAN POWERS:  Well, I mean, the question is
     enormously naĆ­ve.  You asked for some special NDA activities
     in that region for circumferential cracks.  I just wanted to
     know why.
               MR. STROSNIDER:  Well, and I in general the
     concern is that, as I indicated, you know, there's criteria
     with how high are -- I don't know which way to describe it. 
     It's a better way to picture, you know.  You don't want
     degradation too close to the top of the tube sheet because
     you want enough of the tube down into the tubesheet to
     provide the restraint.  And also, you don't want
     circumferential cracking because, because it could impact,
     you lose some of the frictional load and stuff.
               CHAIRMAN POWERS:  I guess I could understand the
     frictional load.  But my, what I understood you to say was
     that you asked for more NDE in this region because the tubes
     weren't full expanded and you had a long crevice region,
     which isn't holding the tube in except for whatever friction
     there is.
               MR. STROSNIDER:  And it's probably best if I get
     one of the staff to come provide you some detail.  But my
     recollection is that what happens is that you can allow some
     axial cracks, you know, getting closer to the top of the
     tube sheet because they're not gonna impact at the pull-out. 
     All right, but if those axial cracks start showing some
     circumferential orientation, all right, then you want to
     limit that.
               But let me make a note to get some more detail on
     that for you.
               CHAIRMAN POWERS:  Yeah, I guess I'd like to
     understand a little better because I came away distinctly
     with the impression that circumferential cracks were rare,
     even though you might have a limited capability to detect
     them, that they were just much more tolerable.
               DR. SHACK:  No.  I didn't say that, I don't think. 
     They're not rare.
               CHAIRMAN POWERS:  You didn't say that.  I got that
     from another speaker.
               MR. STROSNIDER:  I would point out --
               CHAIRMAN POWERS:  I could be equally wrong.
               MR. STROSNIDER:  I would point out one other
     thing.  And we didn't get into a large discussion about
     leak-before-break in steam generator tubes, all right.  And
     in general, we do not credit leak-before-break in steam
     generator tubes because, obviously, we've had failures where
     leakage either wasn't there or wasn't adequate for the
     operators to head off the failure.  So we, in general, we
     don't credit it.  However, if you look at all those leakage
     events that have occurred, in a large majority of the cases,
     it in fact does come into play.
               For circumferential cracks, particularly at the
     top of the tube sheet, as we indicated this morning, the
     failure loads or stresses required on those are 7,000 to
     8,000 psi.  I mean, they're, they're not a like a brand-new
     tube, but they're still pretty high.  However, they, they
     may develop a leak, and that's an area where, you know, you
     could argue that leak-before-break is the most likely
     failure mode for those.  All right, so -- they are somewhat
     more tolerant from that regard.
               MR. DONOGHUE:  Nothing else for me.
               CHAIRMAN POWERS:  Okay.  Thank you.  I think we're
     in a position now that we can take a recess for lunch until
     1 o'clock.
               [LUNCH RECESS 12:10 P.M. UNTIL 1:00 P.M.]
     .                           AFTERNOON SESSION
                                                      [1:00 p.m.]
               CHAIRMAN POWERS:  So, I'll note for this portion
     of the meeting Mr. Dudley is acting as our designated
     federal official, guiding me with an iron hand, right?
               I think at this point we are scheduled to turn to
     the simple and easily tractable issue of severe accidents. 
     And Mr. Long has drawn the short straw here.
               MR. LONG:  That was a much shorter introduction
     than I expected.
               CHAIRMAN POWERS:  Well, it didn't look like any of
     your compatriots are here to help you either.
               MR. LONG:  Okay.  We have a few of us on here. 
     I've got the first few on severe accidents.  And we went
     over a little bit of this earlier.  Severe accidents are
     pretty much the things that we were talking about earlier
     that are starting from design basis accidents, but becoming
     more complicated and perhaps going towards core damage.
               Plus things that we've always analyzed as if they
     were going toward core damage.  So I've tried to put a list
     of them up here.
               CHAIRMAN POWERS:  Let me ask you this question. 
     Would I be completely adrift if I argued that I can tell
     operationally whether an accident is severe or an accident
     is design basis by looking where the operators are working
     from the emergency procedure guidelines or working from the
     severe management action plan?
               MR. LONG:  Well, certainly they're going to start
     with EOPs before they get to the severe accident management
     plan, anyway.  So it's more a matter of how far does the
     thing progress.  Things like steam generator tube rupture
     that are supposed to be design basis accidents still have
     the possibility of becoming complicated or adding errors
     committed that will take them all the way to core damage. 
     So there's--
               CHAIRMAN POWERS:  But I can tell the difference
     between a design basis steam generator tube rupture accident
     and a severe accident involving a steam generator tube
     rupture.  If I wait long enough by seeing if the guy stays
     and his EPGs or goes to Sam?
               MR. HOLAHAN:  That the procedures are written in
     such a way that the event, you know, drives you through the
               CHAIRMAN POWERS:  Yes, I understand that.
               MR. LONG:  I guess what I'd say to try to answer
     your question is the design basis accident is one that
     pretty much doesn't go beyond what chapter 15 analyzed.
               MR. KRESS:  I think that's a best way to do it.
               MR. LONG:  And a severe accident is one that has
     gone somewhat past what chapter 15 analyzed that you now
     have core damage that's significant enough to make
     substantial radiological release from the core.  And there's
     probably a substantial gap in between those two, where the
     accident is probably beyond design basis, but not yet
               At any rate, we try to break them down into
     sequences that start along those paths, and just to sort of
     get the group of things on the table that we're going to
     talk about.  There's the spontaneous tube rupture that start
     as a design basis accident at least, and perhaps gets as far
     as core damage.
               There are sequences initiated by things that are
     within the design basis, like secondary depressurizations
     that increase tube pressure differentials and may lead to
     things beyond design basis, like rupture of tubes or leakage
     beyond the design basis values, that also have a potential
     for getting to core damage.
               There are sequences like ATWES that are not really
     design basis, also increase tube differential pressure by
     increasing primary system pressure rather than decreasing
     secondary side and we do have in PRAs going to core damage.
               And then there are the things that don't really
     involved tube rupture to get you to core damage, but -- such
     as station blackout or other things that usually loss of
     second cooling, loss of primary inventory, that may, in the
     process of getting to core damage, also affect the steam
     generator tubes and perhaps convert some of these things
     from accidents where the core damage is contained within the
     containment structure to accidents where the radioactive
     materials bypass the containment structure.
               So all of these would potentially increase risk to
     the public in terms of radiation exposure and the health
     consequences that are created by that.
               So that's the--
               CHAIRMAN POWERS:  You said increase, do you really
     mean contribute to?
               MR. LONG:  They increase the probability of is the
     best way of saying it.
               MR. KRESS:  They contribute to, Dana, but I think
     the increase would be comparing to what you would have if
     you didn't have the alternate repair criteria.
               MR. LONG:  I'm not sure what his baseline was.  In
     other words, there's the--
               CHAIRMAN POWERS:  I wasn't either.
               MR. LONG:  There's the baseline LERF, which is
     just taken as what people are calculating in their PRA, and
     that's not necessarily a complete representation of LERF. 
     We think there's some pieces missing.
               CHAIRMAN POWERS:  Gee, I can't imagine what they'd
               MR. LONG:  Well, we'll talk about them.  And then
     there's the question of if you have a licensing amendment
     request, would that change you from whatever the baseline
     was.  Maybe that baseline had to be augmented to begin with
     to something that's substantially higher.  Then we'll get to
     the last topic of the day, which is the risk informed
     decision process.
               Anyway, to just launch into the different
     sequences.  The spontaneous tube rupture sequence is one
     that's been in PRA's basically since the -- I guess it was
     Point Beach Plant, pointed out that they needed to be in
     PRAs.  I don't believe it was in WASH-1400.  And I wanted to
     start with this one because it's the one that's been
     analyzed most so far, and we can learn some things from it.
               It's been treated in all the IPEs.  Most of them
     have a number that's very close to one times ten to the
     minus two as the initiating event, frequency per year. 
     However, they have a wide range of results in the core
     damage frequency in a per year basis that results from that. 
     We don't fully understand the reasons for the wide variety
     in results.  But we look into it -- we see that for the
     results that come up on the high side, they seem to be
     dominated by human error probabilities.  And for the results
     that come up on the low side, there seem to be more hardware
     failures and less human failure represented in the dominant
     cut sets.
               MR. CATTON:  Are the ones that are on the high
     side from plants where they've had an event?
               MR. LONG:  Not necessarily.
               MR. CATTON:  Not necessarily?
               MR. LONG:  So it looks like the human error
     probability modeling process is really what creates a lot of
     the difference in the results we see in the IPEs.  And it's
     not just a matter of what number they put on the human error
     probability that appears in the model.  It's also where they
     put the human error probabilities in the model--which ones
     are represented, which ones may not be represented.
               At any rate, as modeled now, especially if it's
     the batch that have the higher values for a steam generator
     tube rupture core damage contribution, that's usually one of
     the dominant contributors to the total results in public
     health consequences, not the core damage, but to things like
     LERF-50 go to LERF, but more to population dose, cancer
     effects, other effects from that population dose.
               So that makes it pretty important to understand
     how that would be affected by licensing actions.
               Moving on to the next one.
               MR. HIGGINS:  Phil, so does the licensing action
     for 9505 change the -- either accident sequence frequency
     core damage frequency or LERF related to this type of severe
               MR. LONG:  We don't expect anything we're doing to
     increase the probability of spontaneous tube rupture --
     anything we're approving.  We're trying to keep things that
     we approve to where they would still meet the three delta p
     criterion, and you know, the intent is to not increase this
               Sort of going in the order that the questions were
     asked, but not quite.  One of the questions was about
     station blackout accidents, and really what we're talking
     about is a core damage frequency, the component of core
     damage frequency that has high RCS pressure and a dry
     secondary side.  In other words, the high dry frequency as
     we call it.  And when we say high, we don't mean necessarily
     sitting on the safety valve set point, but down to where you
     still haven't really injected your accumulators.
               There are a lot of ways of getting there.  It's
     usually mostly station blackout, but some plants are
     actually dominated by loss of DC bus or buses.  Small LOCAs
     with loss of secondary cooling.  Pretty much anything that
     allows the core to become uncovered and damaged and has the
     secondary side dry has the potential for producing a
     transport of heat to the tubes without the secondary fluid
     to cool the tubes.
               The concerns then for steam generator tube rupture
     affecting the progress of this event are the -- if a loss of
     secondary integrity occurs to the point that the secondary
     depressurizes as well as dries out, you have a delta p just
     like you would for the main steam line break, you can -- if
     you can rupture or cause gross leakage in tubes for the main
     steam line break event, you could also for some of these
               The other aspect is if the tubes are strong enough
     to withstand the delta p at normal operating temperatures,
     if they become hotter, they may still fail as the, you know,
     material weakens at the higher temperatures.
               So these perturbations by tube degradation are
     usually not included in the IPEs.  The -- some of the IPEs
     have picked up the one point four percent, I think it is,
     that was in the NUREG 1150, 4550 plant risk models as an
     expert elicitation process for what fraction of the time
     they thought there would probably be a pre-existing tube
     flaw that would be sufficient to cause the tubes to fail
     first under these conditions.  But most plants haven't
     picked up a -- anything beyond just that one number that
     came out of expert elicitation and looked at the sensitivity
     of that number to tube integrity measures that are plant
               When we did NUREG 1150, we tried to go into a
     couple of PRAs, primarily the Surrey NUREG 1150 PRA, and
     search for high dry sequences and try to get some estimate
     of the timing to see if the RCS would be pressurized before
     the steam generator or the other way around, and asked
     ourselves if we'd have a -- just a pressure-induced failure. 
     I mean, a lot of work was done to see if the failures could
     be thermally induced.
               The factors that we had to consider for RCS
     pressure involved the reactor coolant pump seals and the
     burn off rate they would have.  At least early on, there
     were a lot of large seal leak scenarios that were
     considered.  Also, if the tubes are leaking substantially,
     that's another issue with -- that I'll get into a little
     deeper later, but it has to do with RCS pressure at least. 
     Pressurizer valves may also stick partially open.  Avery did
     some studies to determine if you continued to pass either
     water or hot -- they didn't look at very hot steam -- but
     repetitive openings of valves has a tendency to cause the
     valves to not fully close, and we've run some cases where we
     stuck pressurizer valves partially open.
               These all seem to have effects that are reasonably
     important to consider, but they're complicated.  So we'll
     get into a little more of that later.
               Other things to consider are what's happening on
     the secondary side, the main steam line safety valves may
     stick.  That's been in a lot of the PRAs for a long time. 
     There are other valves, like the turbine driven aux feed
     water supply -- steam supply line.  If you run out of
     batteries, you may need to -- and can't control the
     governor, you may need to think about closing that line. 
     The MSIVs may leak.  We've had events where plants have been
     able to, you know, lose a lot of fluid through an MSIV, and
     not really notice it during their normal operation for start
     up.  The time they seem to discover this is when they have
     to do a secondary site hydro, and they realize that they
     can't pressurize the secondary site for the hydro, and then
     they go find the leak.
               The thermodynamics of the reactor coolant system
     heat up control how the heat can be transported from the
     oxidizing core, really, is the point at which this is
     important, after the core has been uncovered and heated up
     on decay heat, and it starts to get a chemical addition to
     the heat up rate due to the oxidation of the clad is about
     when these things really start to become important for over
     temperature in the tubes.
               And the thermal hydraulics of the process can be
     important here if the -- if there's full loop convective
     circulation through the tubes, especially if the tubes are
     depressurized on the secondary side, it looks like even new
     tubes, pristine tubes, will not be able to withstand the
     heat up without being the first component to fail.  They're
     thin, and the heat up process is fairly rapid.
               However, there are places where this full loop
     circulation can be blocked.  There can be water in the
     suction to the reactor coolant pump, and they call it the
     loop seal.  There can also be water left below the core
     that's blocking the down comer such that you don't really
     have a path below the down comer and up through the core.
               If you get into scenarios where you are
     depressurizing -- excuse me, drying out the core without
     depressurizing, and then you put a fairly small leak in the
     system, you have a potential for boiling away loop seals,
     getting flows re-establishing loop seals.  And this has
     turned out to be quite complicated.  So we've had -- you
     asked some questions about stylized sequences, and in NUREG
     1150 time period, we were looking at either the reactor
     coolant system stays at the safety valve or pressurizer for
     set points, or there were large leaks in the RCS, in the
     reactor coolant pump seals, and the whole thing
     depressurizes; the accumulators eject.
               We've more recently started to look at situations
     where leakage is in one or another part of the RCS -- take
     the pressure down low enough to stop cycling the pores, but
     not necessarily to dump the accumulators or at least not low
     enough to really remove the pressure from the tubes
     completely.  And this prolongs the accident.  It gets into
     much more complicated phenomena.
               There may be different delta p's among the
     generators, and within the generators the temperature may
     vary.  And I have a slide I just want to throw up here real
     quick.  But this is from the 1/7th scale test.  I don't know
     if this is a slide you'll be able to read.  At any rate, the
     -- there's 216 tubes, and the sort have been partitioned
     along this dotted line to be the tubes that were thought to
     carry flow upward and -- well, out of the inlet plenum or
     the outlet plenum, and then the rest of the tubes -- the
     outlet plenum being over here -- and then the rest of these
     tubes were carrying flow from here back around into this
     side.  And the temperature distribution on here, although
     the peak is right around in here, and you can it's, in this
     case, 178 roughly degrees.  Over here, it's maybe 143
     degrees.  Over here, it's a 145 degrees.  So there's quite a
     variation in this batch of tubes that's modeled as being the
     hot bundle.
               And when we get into trying to act -- ask
     ourselves how big does the crack have to be to cause failure
     if experiencing temperatures in the hot bundle.  Right now,
     we don't have a good way of describing the distribution of
     temperature within that hot bundle. RELAP gives us one
     number for the entire hot bundle.  So that's been a problem
     for us as well.
               So all of this has gone into our thought process
     about how to deal with the high dry frequency.  At this
     point, we're going to have discussions later on how to model
     that.  I don't want to go into it much more deeply yet. 
     We'll get back to how we used it later.  Are there any
     questions on the high dry sequences as to what they cover or
     what we're trying to include?
               MR. HIGGINS:  Are you going to get to results in
     terms of numbers, increase in delta LERF, and that sort of
     thing for 9505?
               MR. LONG:  95-05 we wouldn't expect to see any
     delta LERF.  That was part of the premise, that we weren't
     going to be increasing core damage frequency or LERF.
               MR. HIGGINS:  But wouldn't the times at which you
     get two failures change with the 95-05 criteria, so why
     wouldn't you see a difference?
               MR. LONG:  Okay.  In the -- 95-05 allows
     degradation to occur where it's confined by tube support
     lights.  And the thinking in the time was the blow down that
     you would get from the secondary side, from the things I was
     discussing -- are stuck valves, other things that we've seen
     blow downs before.  We don't expect that to really move the
     tube support plates off of those damaged portions of the
     tubes.  There is one issue that I don't think anybody has
               MR. HIGGINS:  But I didn't think you were taking
     credit for the tube support plate restricting and preventing
               MR. LONG:  Those are steam line break cases.  In
     the design basis analysis for steam line breaks, they are
     not taking credit for it.  In a risk assessment, we would be
     taking credit for it, unless we had a reason to believe it
     wouldn't be there.
               MR. CATTON:  There's another factor, too.  You
     know, even if -- although we may disagree on the mixing and
     so forth, the cracks that are going to be in the vicinity of
     the support plate, you got a huge heat sink.  So that's
     really not where you're going to heat up the tubes.
               MR. LONG:  On the support plate, I'm not sure how
     big the heat sink turns out to be.  But--
               MR. CATTON:  Well, but it is a heat sink.
               MR. LONG:  To some degree, yes.
               MR. CATTON:  So if you're going to heat anything
     up, you're going to heat the freestanding parts of the tubes
     more than you're going to heat the -- where there's a big
     solid chunk of metal.
               MR. LONG:  You're talking about the support plate,
     and not the sheet.  The sheet clearly is a big solid chunk
     of metal.
               MR. CATTON:  About two feet thick.  Even when you
     have three-quarter inch thick, that's steel, and it's a heat
               MR. LONG:  If it's there, it will prevent.--
               MR. CATTON:  It will prevent it from heating up as
     fast as it goes somewhere else.
               MR. LONG:  The one thing to think about, though,
     is if you have a bundle of tubes that are hot, and these are
     hotter than those, what does that do in differential
     expansion?  We think it will probably kind of bowed the
     tubes, but we haven't really looked at if that effect on the
     tube support plates.
               MR. CATTON:  Are those the thermal couples that
     were in the inlet of the tubes, or are they just below the--
               MR. LONG:  I believe, if you look up here, these
     are -- the dots are one inch from the tube sheet bottom. 
     The closed triangles are three inches from the tube sheet
     bottom.  I believe that's in the tubes.  And then the open
     pointed down triangles are point seven five inch below the
     tube sheet.  So there's a variety of them in here.
               MR. CATTON:  Surely, you'll explain all this
               MR. HIGGINS:  So, Steve, in this last group you've
     included both ones that would induce tube rupture by both
     thermal high temperatures on the primary side, due to the
     core damage and ones that would be induced due to the high
     delta p?
               MR. LONG:  Right.
               MR. HIGGINS:  And you're saying neither of those
     would result in increased numbers for the 95-05?
               MR. LONG:  When we did 1570, we weren't really
     thinking about the 95-05 degradation.  We were thinking
     about free spanning cracks that were in the sludge pile or
     other areas that were not confined.  And the -- at the time
     that we did NUREG 1570, the industry had asked for
     essentially a five percent conditional failure probability
     in the free span for main steam line break, because they had
     looked at NUREG 0844, and NUREG 0844 had concluded that
     basically we wouldn't back fit them if we had five percent
     conditional failure probability of tubes, given steam line
     break.  So the industry was sort of turning this -- well,
     it's not bad enough to back fit them into a performance
     criterion if they could.  We were trying, in NUREG 1570, to
     add to our knowledge base what would happen if we had that
     level of degradation.  So the numbers in 1570 are -- we
     tried to peg to something that would give a five percent
     conditional failure probability for steam line break, and
     then ask ourselves for that, what do we expect in severe
     accident conditions.
               So we weren't trying to develop something we would
     accept.  We were trying to explore what would be the case if
     this occurred.
               MR. HIGGINS:  Yeah, I guess what I'm trying to
     explore and see -- and I thought maybe we would get to it as
     we went through this was that whether or not for the various
     different types of core damage sequences that are important
     to steam generator tube rupture in 95-05, what do the
     results look like in terms of increases in core damage
     frequency or increase in LERF, and is it reasonable in
     severe accident space?  Is what you've done reasonable in
     severe accident space?  But it sounds like what you're
     saying is you don't have all those numbers?
               MR. LONG:  What I'm saying is when we did 95-05,
     actually when we did the interim plugging criteria, which
     became 95-05, the intent was not to increase core damage
     frequency or LERF at all.  And the basis for that was the
     belief that we had confinement of the damaged area, the
     degraded area, by the tube support plates.  There was a
     concern for what was considered to be a very hypothetical
     kind of main stream line break that you might move the
     support plate relative to that degradation.  We didn't know
     how to calculate the -- actually the clamping effect of the
     tubes on the support plates, given that the -- you know,
     that the -- or I should say it the other way around.  But
     the support plates are denning the tubes.  That's why we
     have the degradation, and there is quite a force per tube,
     which they have to overcome to pull them.
               So there was a feeling that realistically the
     support plates were pretty well held in place by the tubes. 
     From the design basis, they were having trouble
     quantitatively crediting it, so they did not.  And they went
     to the -- what we were considering to be a hypothetical leak
     rate and a hypothetical conditional burst probability.  Now
     there is some stuff in 1477--
               MR. HIGGINS:  Are you going to represent anything
     to -- or do we have anything already that provides some
     justification for that?
               MR. LONG:  Provides justification for the tube
     support plate not moving?
               MR. HIGGINS:  For clamping the leakage, any
     leakage that might come from failures or to prevent failures
     of those defects?
               MR. LONG:  Where's Joe?
               MR. DONOGHUE:  I'm sorry.  Which one?
               MR. LONG:  The question is, are we going to
     present anything about reason to believe that the tube
     support plates really are held in place as far as doing a
     risk assessment is concerned?
               MR. DONOGHUE:  I don't have any material on that
               MR. LONG:  Yeah, I don't -- I guess that's
     something that we could take as an action item to try to put
               MR. HIGGINS:  But you're saying that's the basis
     for your concluding that none of these core damage sequences
     show any increased in LERF?
               MR. LONG:  That was the basis for granting the --
     you know, the 95-05 plugging criteria.  Without having done
     a detailed study of the leak rate in a realistic framework. 
     In other words, when it came to what I would put in a risk
     assessment, the risk assessment was not done until after
     those were evaluated.  We had not done 1570 when the interim
     plugging criteria was out.  We had discussed it.  There was
     a qualitative feeling that for a realistic blow down, the
     tube support plates would be in place, and that's really
     what we were basing it on.  The risk -- that -- the --
     that's what we were basing the lack of a formal risk
     calculation on at that time.
               MR. BONACA:  Let me just ask a question.  I know I
     understand what happened at the time before 1570 and 1477,
     but my main concern here is -- the thrust of my question was
     because the DPO, the DPO claims that a certain scenario
     which you define severe, it's possible.  It is likely, and
     they assign a high risk frequency to it.  And that's the
     DPO.  When I read the DPO consideration, I found that the
     very scenario that they are discussing there is not being
     quantified or addressed in the DPO consideration.  The DPO
     consideration only addresses the possibility of leakage
     considering 1477 up to about a thousand GPM, with some
     assignment of risk to that -- ten to the minus six.  And
     then addresses the consequential failures of tubes resulting
     from station blackout, and then it says any more, you know,
     tube failures from main steam line break is not considered
     likely or possible.  Therefore, there is not quantification
     or that.  So it's very hard to evaluate the DPO
     consideration because there is a lack of information
     regarding how -- because it's the only denial that the event
     can happen.  And just the point I want to make is that --
     that's why, by the way, to explain it, I jumped to the INEL
     report, because the INEL report does also some human
     reliability analysis.  Now, the reason for digging into it
     for me was to understand how reliable the reliability
     analysis was, and I'm beginning to get a sense of it now.
               MR. LONG:  Okay, let me try to tease apart two
               MR. BONACA:  Yes.
               MR. LONG:  Jim has been asking about 95-05, and
     you've been asking about the DPO.  And they're not
     identical.  What we were trying to do were the NUREG 1570
     work was think about things that we thought might be able to
     fail in the free span.  In other words, another part of the
     DPO was that there are so many cracks out there we can't
     detect -- that might be in the free span, not just things
     that are detected but left in service under the support
     plates -- that, in fact, you might get a huge leak rate, if
     not actually ruptures, in the free span.  So when I was
     answering Jim Higgins' question about 95-05, I wasn't trying
     to say we didn't consider other reasons that there might be
     failures of tubes.  The -- but -- now to go to the other
               I mentioned earlier that we received from Dominion
     Engineering some estimates of populations of flaws in steam
     generators, in various types of degradations.  And the ones
     we concentrated on for NUREG 1570 were the ones that were in
     the free span, not the ones that were under the support
     plates.  And we tried to pick a distribution of those which
     turned out to be either average distribution that looked
     like it would give a conditional failure probability under
     main steam line break of five percent.  And that was
     basically one tube out of five percent, one or more.  But
     the way it works out is essentially one.
               With 1570, there was some other work done in
     parallel with that to ask, and I'll try to get to that at
     least the beginning of that in a minute here, to ask what
     are the thermohydraulics for a larger number of tubes.  But
     when it came to the risk calculation, I need the initiating
     event frequency, which would be something like the
     non-benign -- non -- what was the word you were using
     earlier this morning?  It was the gentle main steam line
     break or something?
               CHAIRMAN POWERS:  No.  It was Ivan's mild steam
     line break.
               MR. LONG:  Mild main stream line break.  So the
     wild and wooly main steam line break frequency times some
     conditional probability given that wild and wooly break that
     you would rupture a certain number of tubes.  And it was
     that second parameter, which was essentially treated as zero
     for a large number of tubes in the risk assessment, because
     if we didn't have any knowledge of a way to get a larger
     number of tubes ruptured than a few.
               MR. CATTON:  I didn't know you -- give it a
               MR. LONG:  You said give it a number?
               MR. CATTON:  Well, now you have a way to get that
     large number of tubes.
               MR. LONG:  Well, we have a hypothesis.
               MR. CATTON:  I don't know if it's real, but--
               MR. LONG:  We have a hypothesis, but the trouble
     is if you put in a conditional probability of zero, you'll
     end up about where we did in 1570 for the other types of
     degradation.  And if you put in a number - a conditional
     probability of one, you'll end up where they prioritization
     for the GS-123.
               MR. CATTON:  EDA.  I thought we were doing zero
               MR. LONG:  Which is -- well, what gets you up to
     something like, you know, 3.4 times ten to the minus four
     was it?  And that becomes a matter of opinion, where you are
     in that range if you believe that you can damage a very
     large number of tubes, without some way of quantifying the
     probability of how many tubes you would damage, you can't
     see anything more than you're in that range.  But first,
     you'd like to know that it's really possible to, with, I
     guess fatigue, grow these cracks and damage the tubes.
               MR. SIEBER:  But none of that has anything to do
     with 95-05, right?  Nothing in the free span?
               MR. LONG:  Assuming the support plates stay in
     place, then that shouldn't--
               MR. SIEBER:  Right.
               MR. LONG:  95-05 should not be affected by that
               MR. BONACA:  But, you know, typically, I mean,
     when you don't know, it's not really zero or certainty.  You
     tend to do sensitivity analysis to make -- get an
     understanding of what it could be.  Again, I thought I had
     read them in the INEL report.  They're right there.  And so
     I was trying to myself personally calculate what they could
     be -- to see what -- how reasonable this could be.  And a
     big dependency actually was operator action.
               MR. LONG:  Right.
               MR. BONACA:  Because ultimately you come back with
     pretty low with pretty low numbers anyway, if you believe
     that the operator can handle it, even if you assume
     conditional probability of tube failure to be one.  And so,
     I mean, I don't think it was that speculative.  I just -- I
     wanted to explain how -- I mean, I was looking for an
     evaluation that would answer the DPO, and I just couldn't
     see -- there was a window there that I -- didn't seem to be
               MR. LONG:  Okay.  Well, I don't think it is
     covered if you say that there may be a very high conditional
     probability of failing 10, 15, 20 tubes, because the human
     error probability in that case pretty much becomes one.  So
     you really don't have the ability to--
               MR. BONACA:  No, no, no.  We just heard this
     morning that there is significant probability of success
     after about ten tubes.
               MR. LONG:  Well, that's what I said.  If you go
     10, 15, 20 tubes, if you believe that that's possible, with
     a significant probability, conditional probability, you'd
     have to get that conditional probability down to where it
     and the initiating frequency for the wild and wooly steam
     line break, just those two together, were low enough to not
     matter to your conclusions.
               MR. BONACA:  I agree in the range.  Yes, I agree
     with you.  If you go above the 10, 15, you really -- it
     depends very much on the conditional probability.  I agree.
               MR. LONG:  So the conditional probability of
     rupturing, let's say, between 10 and 20 tubes, if it's below
     ten to the minus four, you're fine.  You don't need the
     humans to do anything to keep the net contribution of risk
               We're sort of getting over into my next slides. 
     Trying to put the question you asked about other things that
     might be initiated by something other than tube rupture, I
     believe you mean, and lead to tube rupture.  There are the
     secondary depressurizations we've been talking about. 
     There's also the primary overpressurization events, and just
     -- I think maybe I should try to go through these slides
     fairly quickly, because we've kind of talked about them.
               The potential initiators for secondary
     depressurizations are things like stuck main steam safety
     valves.  We've had a steam dump control problem in the one
     plant that doesn't have MSIVs.  That was a coning that
     resulted in blowing down the generators.  Spontaneous breaks
     in the main steam line safety valve headers.  We've seen
     those occur during hot functional testing, pretty
     operational.  It turned out to be a design problem that they
     really weren't designed for reactive loads.  So that sort of
     brings up the question if they're not designed with reactive
     loads with steam, but that's been fixed, now if we talk
     about overfill events, and you start putting the weight of
     water and the reactive loads of discharging saturated
     fluids, now do you have a problem with the breaking the
     header, as opposed to just sticking a valve.  We have right
     now a licensing action from Catawba requesting that they not
     have to deal with certain single failures on overfill, and
     we've asked them, are you confident that if you overfill
     and, you know, discharge saturated water that you are
     structurally capable of withstanding the loads.  And they
     don't know.  So they have a conditional failure probability
     of point one for those events, and they're -- it's a
     risked-informed application.  So we're pursuing that.  So
     there's a variety of ways you could get into having - not
     only an open secondary, but maybe an open secondary you
     can't recover.
               CHAIRMAN POWERS:  They put point one on the
     conditional probability of an overfill event?
               MR. LONG:  Sticking a safety.  In other words,
     they were calculating conditional probability of overfill,
     and they were looking for what would take them to core
     damage.  And their conditional probability of sticking a
     safety valve, given that they're discharging saturated fluid
     through it was point one.  And we were, and, of course, they
     have a potential for somehow recovering it if it sticks.  So
     there's questions of realism, of, you know, maybe you break
     the header and you wouldn't have a chance to recover, and
     there's also the question, can they really gag a safety
     valve while something's passing through it.
               The conditional probability of the tube rupture
     depends on the probability that there's a susceptible flaw
     in the free span and the generator that's affected by the
     blow down.  And that's something that's part of the DPO. 
     There's the question of how well can you detect the flaws
     there.  We've heard some of the POD discussions, but most of
     the detection is done with a bobbin coil.
               CHAIRMAN POWERS:  Maybe you've just been simple
     here, but it be in the free span or in the U.
               MR. LONG:  That's true.  And in the U, I don't
     think -- Jack, in the U they need to test with something
     other than a bobbin coil -- to be--
               MR. SIEBER:  RPC.
               MR. LONG:  So it has to be an RPC up there.  The
     -- I'm losing my train of thought.  I guess Calvert Cliffs
     had a problem with detecting things in the free span and
     actually did a rotating pancake coil, actually a plus point
     inspection of a large quantity of the free span, and they
     found a lot of things, they didn't find with the bobbin. 
     They then had to go back and find -- do the same thing again
     after a short period to show that those things had been
     there for quite a while, as opposed to they were suddenly
     growing in rapidly after initiation.  But it looks as though
     the bobbin coil has the kind of PODs that we were describing
     to you yesterday.  So there is a potential for missing some
     things.  It's just a matter for probability.
               MR. HIGGINS:  And the reason here, again, that you
     limit it to the free span is because you're assuming that
     the TSP will restrain any cracks that are there?
               MR. LONG:  For this case, we were assuming that
     the type of degradation allowed by 95-05 would not
     participate in the ruptures, yeah.
               Human error probabilities are real important here. 
     We've already discussed that; that depending on how much you
     rupture it, it may be possible or not possible for the
     humans to really respond in a timely way.  But even when you
     have something that's well within their capabilities, just
     like with the spontaneous rupture initiating the event,
     there is opportunity for errors of omission or commission to
     take you to core damage if you've ruptured the tube.  And
     the difficulty here is you really have to get to cold
     shutdown to terminate this event.  Whereas, if the rupture
     is spontaneous, you have the option -- the opportunity at
     least of getting down to below the main steam safety valve
     set points, and if they've closed, you basically have
     terminated your LOCA.  So this -- it's a little more
               We were assuming that mitigation of about ten full
     ruptures is possible, but we didn't try to -- we didn't have
     a frequency for that many ruptures, and we didn't really
     push hard on the human error probability there.  These
     numbers are the things you've already dug out of the INEL
     report.  But they didn't -- at ten tubes, they really didn't
     bear in the risk assessment results at all.
               And as we've discussed before, we're kind of
     sensitive to the idea that we're looking for mechanisms that
     could fail a lot of tubes, and if you bring me one, I'll
     certainly put it in the risk assessment.  But at this point,
     it's hard to put something in that you can't really credit
               CHAIRMAN POWERS:  How about blow down forces?
               MR. LONG:  Well, that's why I'm saying.  If that
     turns out to be something that looks like it has the
     potential, we'll definitely put it in the risk assessment.
               To try to be complete, let's talk a little about
     actions initiated by overpressure events.  The initiator is
     really ATLAS.
               MR. CATTON:  Before you leave?
               MR. LONG:  Sure.
               MR. CATTON:  For tubes without flaws, what
     probability of failure do you assume to the overheating by
     the hot gases?
               MR. LONG:  Right now, the way the calculations
     have been done since NUREG 1150, they're calculated on the
     temperature of the surge line and the creep carrier damage
     accumulation in the surge line.
               MR. CATTON:  So you're assuming.
               MR. LONG:  Versus the one number for the inlet
     temperature of the hot tube bundle from RELAP.  If you do
     that, you get about 20 minutes, if I believe, time period
               MR. CATTON:  Well, that's not the question.
               MR. LONG:  So I would get zero on that basis.
               MR. CATTON:  Zero?
               MR. LONG:  Zero.  Now, when I put flaw in--
               MR. CATTON:  Well, that's nonsense.
               MR. HOLAHAN:  Be clear.  You're not assuming zero. 
     You're doing the calculation and in the model, you're
     calculating the clean tube temperature and its likelihood of
     failure.  And there is a model for likelihood of failure of
     tubes with no cracks, which I think is what the question
               MR. CATTON:  That was the question and the answer
     is that the probability of failure of the intact, undamaged
     tube is zero.
               MR. HOLAHAN:  No.
               MR. LONG:  The way NUREG 1150, 4550 did it--
               MR. CATTON:  I'm not going to -- well, what did
     you do in 1570.  I know what they did in 1150.
               MR. LONG:  Okay, I was going to tell you what we
     did at that point was essentially the same thing.  At that
     point in time, we were basically trying to extrapolate from
               MR. CATTON:  Oh, okay.  Okay.
               MR. LONG:  1150 had brought up.
               MR. CATTON:  No, I understand.  I understand.
               MR. LONG:  Okay, since that time, when I try to do
     Farley, I try to take into account something about the
     distribution of temperature in the tubes, and I guess, we'll
     get into this later, because Charlie is going to talk about
     how we do the modeling of the tube temperatures.  But the
     distribution of the temperature -- RELAP does not really
     attempt to calculate the average temperature in the bundle
     and the hottest temperature in the bundle.  MAP does make an
     attempt at that.  But they do it with an average temperature
     and then they make a guess in plume assumption.
               MR. CATTON:  In either case, either MAP or RELAP,
     they're based on inadequate information.  So, I'm just
     curious as to what you do about that, when you go into your
     world of risk.
               MR. LONG:  Okay.  It probably would be better to
     ask me this when we get to talking about what I do for
     Farley, because I did try to capture that when I did Farley,
     and it would help if Charlie had a chance to do his
     presentation first.
               MR. CATTON:  I don't want to bore everybody else
     here, so I can wait.
               MR. LONG:  I recognize the problem.  I was
     afflicted with this problem a year ago, when I was really
     hard put to figure out what to do with it.  So I'd be glad
     to explore it as soon as we get everything on the table.
               ATLAS, fairly quickly, the ATLAS is a fairly gross
     model.  It assumes that if you exceed the level C service
     pressure for the reactor coolant system that something
     terrible will happen and you will damage the core.  We
     looked at ATLAS events in the Surrey model to try to figure
     out if they were part of the high dry.  It looked like most
     of them weren't, although if you had a failure of all aux
     feed, they could be.  We had some thermohydraulic cases run. 
     Len Ward ran some for us where we actually sequentially
     ruptured tubes when we reached certain pressures.  And lo
     and behold, it lowers the peak pressure in the ATLAS.  They
     would have to be fairly weak, tubes, because in the ATLAS
     situation, you probably have the main steam system up near
     the safety valve set points so it's a thousand plus PSI. 
     The primary system is, if it only goes to 3,200 PSI, you're
     maybe at 2,200 pressure differential across the tubes. 
     That's not the full main steam line break pressure
     differential.  Now, the ATLAS pressures aren't limited to
     3,200 PSI.  They may go higher.  What we assumed was the
     potential for getting core damage if you went above 3,200,
     and the potential for rupturing the tubes.  And if you get
     up -- in the way we did it in 1570, you'd add five percent
     bypass -- five percent of your ATLAS core damage frequency
     to the bypass if you were just blowing the tubes from
     pressure effect alone.  Since you, 3,200 PSI is a little bit
     below what was giving us five percent conditional rupture
     probability.  We weren't quite sure where we were in the
     average rupture probability for all ATLAS sequences.  But it
     looked like, given the frequency of the ATLAS sequence being
     low enough it wasn't really contributing much to our answer.
               CHAIRMAN POWERS:  I'm thinking about overpressure
     events -- you looked at accidents that initiated
     overpressure events.  I wonder have you thought at all about
     an event that involved the relocation of fuel in the water
     producing a shock wave?
               MR. LONG:  I've thought about it.  We haven't
     tried to calculate one yet.  The -- that's one of the things
     that gets you way out in the accident, so that if -- what
     you'd have to do to get to where you're talking about is to
     somehow have gotten the RCS out to where you have major
     relocation into a pool of water on the lower head, and not
     have a very large hole in the RCS that would, you know,
     pretty much allow that wave to--
               CHAIRMAN POWERS:  As an ardent baysian, of course,
     you see this as an extraordinarily likely sequence?
               MR. LONG:  I'm sorry.  Say this again?
               CHAIRMAN POWERS:  As an ardent baysian, you see
     this as a fairly likely sequence, right?
               MR. LONG:  I'm not a baysian.  I hate to tell you.
               CHAIRMAN POWERS:  Just PRA, and he's not a
               MR. LONG:  No, I get nervous when I see people say
     we haven't had a steam generator tube rupture yet.  So our
     probability is lower than those other guys.  We see those in
     our submittals.
               CHAIRMAN POWERS:  Well, you have had a core melt
     accident in which you relocated fuel and or water fuel, or
     plenum with no -- with the system pressurized?
               MR. LONG:  With the system pressurized?
               CHAIRMAN POWERS:  With no effect on the steam
     generator tubes?
               MR. LONG:  I guess the point is--
               CHAIRMAN POWERS:  No exploding, either.
               MR. HOLAHAN:  And when the system is at pressure
     it's probably less likely to have such a--
               MR. LONG:  So people claim.
               CHAIRMAN POWERS:  It's a -- one to push that
     database very hard.
               MR. LONG:  Let me tell you how far we've gotten in
     the thought process on this.  Frankly, we don't think our
     models are very reliable out that far.  But to try to keep
     the RCS at high pressure, you know, up around the 2,200 or
     whatever safety valve set points that far into the accident,
     you're really saying that you haven't creep failed anything
     first.  And it looks to us like you probably would.  So we--
               CHAIRMAN POWERS:  I mean, I've got a -- I've got
     one accident, which I melted fuel and PWR, and it didn't
     creep rupture anything.  Well, it did a couple of spiders up
     in above the fuel.
               MR. LONG:  Okay, it also didn't heat up the steam
     generator tubes.
               CHAIRMAN POWERS:  That's also true.
               MR. LONG:  Right.  Anyway, it apparently relocated
     some fuel into water.  I understand TMI has had a hard time
     being simulated, and it wasn't very cooperative in being
     able to be simulated by RELAP.  But to try to tell you as
     far as--
               CHAIRMAN POWERS:  But we could put out a generic
     letter -- one must only have severe accidents that are
     easily simulated by RELAP then.
               MR. LONG:  But seriously, we did -- we have had
     what probably amounts to more or less to a bull session
     about this.  We've tried to think about it.  And this is as
     far as we got; that we thought that if we really had the RCS
     at fairly high pressures that what would happen would be we
     would creep fail something before we, you know, relocated a
     lot into a, you know, a pool of water in the lower head.  We
     thought if we had depressurized substantially, hopefully
     there would be some hole.  If you pressurize, I understand
     the probability of getting a steam explosion is higher,
               CHAIRMAN POWERS:  Yeah, there is -- I mean, what
     -- the conventional wisdom is that triggering steam
     explosions becomes increasingly difficult with increasing
     pressure to the point that the trigger is equivalent to the
     yield, so--
               MR. LONG:  Right.
               MR. HOLAHAN:  Some say.
               MR. LONG:  If the majority voted to that extent,
               CHAIRMAN POWERS:  The -- I mean, the database is
     based on some droplet tests, triggering tests.  And there --
     and people smile about those and say, okay, I think I
     understand this, why it might be.  Except there's this
     obnoxious Winthrop experiment where they pressurized and it
     damaged -- the resulting explosion damaged their facility
     and they had to quit doing things.  So it's a mixed bag, and
     I understand that some of the experiments that they had done
     in recent past in, I guess, Germany or Europe anyway, that
     they too began to question this pressure inhibits triggering
     concept.  It's not -- the problem is that we just don't do a
     lot of steel and aluminum tests in high pressure systems,
     where the vast majority of our database on steam explosions
     come from.  So--
               MR. CATTON:  That's the history of the steam
     explosion, isn't it?
               CHAIRMAN POWERS:  Oh, yeah.
               MR. CATTON:  You develop convention wisdom, then
     you blow it up.
               CHAIRMAN POWERS:  That's right.  Yeah, I mean,
     that's -- I mean, that's certainly the history of the copper
     industry and the aluminum industry that they get some idea
     of what prevents these things.  They pursue that idea until
     the next explosion and then they host another conference and
     sponsor more research.
               MR. LONG:  Well, to try to tell you where we got
     to -- we were thinking about what would happen if you had
     deck tubes and a big enough hole in the RCS to have
     successfully depressurized it, and then you drop the
     relocation into the pool and created some sort of pressure
     pulse.  It's not clear to us exactly what the temperature of
     the tubes would be at that point, because when you've lost
     the density in the RCS, even if you've heated the tubes up,
     they probably cool down some just from transfer of heat to
     the rest of the structure.  But as long as the secondary
     side was somewhat intact, it doesn't look like you would
     rupture the tubes and raise the pressure in the steam
     generator high enough to open safeties.  So, the other part
     of it is you should then go back to something that looks
     like containment pressure.  So even if you fail the tubes,
     it's not clear you create a very substantial release to the
     environment from that failure of the tubes at that time.
               Now, it's really -- we haven't thought about it
     beyond there.  I -- we're having enough trouble with the
     things we are trying to think about very hard is the best
     thing I can tell you.
               Let's see.
               CHAIRMAN POWERS:  Well, I'm encouraged that you're
     thinking about this thing before you gain a great deal of
     solace in saying that I want to creep rupture myself out of
     this -- out of this problem is to do remember that TMI
     didn't creep rupture anything.  And we didn't heat up the
     steam generator tubes, either.  But is there something in
     between those two?
               MR. LONG:  We have tried to ask ourselves some of
     those questions.  TMI was sort of an intermediate pressure
     LOCA.  It wasn't sitting on the safety valve set point,
     because it was stuck open.  Yet, it wasn't down to where the
     accumulators would come in, either.  And in the license
     application that Arkansas submitted last March, they tried
     to simulate this by just lowering the safety valve set point
     to 1,400 PSI and running that for a bunch of cases.  Well,
     the difficulty is they did that earlier in the, you know,
     the transient, so they created all their loop seals,
     saturated at 1,400 PSI, and they kept it there.
               When we, instead, put -- started sticking safety
     valves open later in the transient and depressurizing
     continuously until something evaporated and created more
     pressure, it got to be quite more interesting, and I guess
     we can show you some slides, if not if you need to.  But it
     turned out when you opened the hole and how big the hole
     was, even though we just restricted ourselves to holes in
     the top of the pressurizer, it would still give you some
     forced flow past the surge line.  It still gave you a
     protracted accident, and some clearing and reforming of loop
     seals so you were getting -- as some of that water was
     evaporating and getting to hot metal, you would get pressure
     pulses and things did not look real well behaved.  The best
     thing I can is that there's a whole very poorly charted
     territory there that we don't think we can really give you
     the answers for yet.
               You asked a question about risk metrics, and I was
     assuming this was -- should we use delta LERF or go to human
     health effects from the releases.  So I wanted to give you a
     few thoughts on that.  If that was not the question, you
     should correct me soon.
               We -- we're not really sure what the definition of
     LERF is because it seems to change.  But -- so it's not
     really clear if steam generator tube failures leading to
     core damage by various paths do exactly or do not exactly
     meet the definition.  In doing the licensing work, we've
     tried to say, well, if it doesn't quite meet the definition,
     but it's close to it, it's sure a lot closer than continuing
     to accident source term.  We're going to treat it as LERF. 
     So pretty much anything that looks like the secondary site
     is open when the core is being damaged and the tubes are
     pretty much from primary to secondary, we're going to treat
     as LERF, for licensing purposes.
               If we try to go to the full level three
     consequence calculations, we still have some problems
     getting there from what we know today.  We really haven't
     fully evaluated the effects of the RCS blow down through the
     fault at steam generator, and the -- right now, the tube
     temperatures are calculated as if there's no net flow out of
     the generator to the secondary, so we have a mixing that's
     assumed from the 1/7th scale test that's in the inlet
     plenum, and that keeps the temperature down to the tubes;
     that we talked about this, I think, on Wednesday a little
     bit that if you have some substantial flow out of the tubes,
     you are no longer forcing fluid back into the inner plenum
     from the cold side.  You're sucking it out of both sides,
     and the mixing will probably go away.  The tube temperatures
     will probably go up quite a bit, and it's not really clear
     what you're doing to additional failures of the tubes. 
     We've talked a lot about jet cutting, and we think if it's a
     little leak, probably we're not in a jet cutting regime. 
     It's still not quite clear what happens if the tube that
     you're -- is about to melt that you're squirting fluid on
     across the way.
               So, we really haven't defined the size of the hole
     between the primary and the secondary as you progress
     through an accident where you're really depressurizing the
     RCS into the secondary.  So that makes it very difficult to
     find the flow rates in the secondary side--what the
     velocities are going to be, what the temperatures will
     become, what the deposition rates would be for the nuclides
     that are transported through there.  So it's very hard to
     define a source term that is really applicable to these
     accidents once you've decided that the secondary is really
     becoming opened in a gross way to the primary.  And for that
     reason, we don't think we're really ready to try to go to a
     level three until we can get to some of these, you know,
     physical phenomena better at hand, if we ever do.  The other
     part of it is, if we did go to level three, it's not really
     clear what the acceptance criteria are for the consequences. 
     Do we have a safety goal policy statement that has numerical
     objectives for close-in populations, for one-mile for prompt
     fatalities, and ten miles for, you know, latent effects like
     cancer.  But the bulk of the health effects may occur beyond
     ten miles, especially if these things are late enough to
     allow for evacuation, and many of them would be.  So,
     there's an issue of comparing what to what.
               CHAIRMAN POWERS:  I guess the reason -- real
     question that we were asking here is there anything about a
     basis coming out of the steam generator, secondary side,
     especially large releases with bigger things -- a
     substantial amount of material out there.  It would change
     our general view that LERF is a good surrogate for the
     safety goal policy statement.
               MR. LONG:  You say is there anything unique about
     them?  I mean, they're different from what you would have
     from a crack in the containment or openings around
     containment penetration bellows or something of that sort in
     the sense that you have smaller volumes with more structure
     to be transited.  I'm not an expert in that area, and I
     don't see the person that I would ask that ask that question
     here.  I don't know what to say about the difference in
     terms of the transported radioactive material.  In terms of
     timing, you can calculate when you think the releases would
     start to occur, and depending on the size of the leak from
     the primary to the secondary, it may be quite late in the
     process, so there may be something like a not early large
     release that would be a better comparison.  And I know for
     the boilers, there's an issue of late failure of containment
     that is also sort of in this category.
               CHAIRMAN POWERS:  They -- I mean they have a
     long-term station blackout.  It's kind of funny beast to
     deal with.  It seems to me that the real concern is that
     they could be very early in the accident sequence.
               MR. LONG:  These releases?
               CHAIRMAN POWERS:  Yes.
               MR. LONG:  Certainly a fast station blackout, you
     know, could be pretty early.  And if you could get to a very
     large -- you know, LOCA outside containment due to something
     like the wild and wooly main steam line break with the
     massive tube ruptures or leaks that could be fairly early,
     too, especially if you had any failures in ejection
     processes.  Right now, we model them as if everything works,
     and you've got a -- you know, flow out the RWST.  So,
     there's a wide range.  I know a lot of the IPEs originally
     came in with core damage sequences not counted because they
     resulted in core damage after 24 hours for spontaneous leaks
     -- spontaneous ruptures, I mean.  So, in that regard, it's
     late from evacuation standpoint, but it may still be early
     from the standpoint of time for settling radionuclides in
     the system.  So in that regard--
               MR. HIGGINS:  Steve, this is a -- maybe you
     haven't done this, but maybe get your opinion.  If you took
     the end of site -- a typical end of cycle leakage estimate
     from 9505.
               MR. LONG:  Okay.
               MR. HIGGINS:  And you ran a one of these risk
     metrics on it.  A delta LERF.  Which region of break I.1.174
     would you fall into in evaluating that change?
               MR. LONG:  Okay, let me answer part of that first,
     because you said region, that brings me into a couple of
     different parameters at the same time.  Research did run a
     case where they assumed a 100 GPM leak from primary to
     secondary at the time that essentially has started.  And
     they ran it all the way through with melt core, including
     the containment.  And they allowed the failure in the
     containment by the surge line failure to, you know, occur on
     the model as opposed to keeping it from occurring and seeing
     how it long the tubes to fail.  So what you really do is
     once you breach the RCS pressure boundary in the
     containment, you drop the driving force of the -- you know,
     pushing the radioactivity out the hole in the steam
     generator tubes.  And that drops the dose to the public
     quite a bit.  So Charlie's going to have to see if his
     memory is better than mine maybe if he gets up here, but it
     seemed to me for 100 GPM, primary to secondary leak rate
     size hole, assuming that hole does not become any larger
     during the accident, and the secondary was open, Charlie, we
     ended up with something like a factor over what was assumed
     to be a contained accident.  Is that right?  We can -- and
     this was assuming more than the -- 1150 assumed more than
     tech spec value of leakage from the containment to the
     environment.  So that's also a little bit of a shaky
               But it did not look like it got you into the LERF
     range, if that was the size hole, and you knew that having
     that size hole did not alter the accident so that the
     failure was still into the containment, and the reason is
     that you're not very far into the core damage phase of the
     accident before you relieve the pressure on the -- you know,
     the tube and stop driving so much through the tube wall.
               Now, when you're asking where does that put me in
     -- Reg Guide 1.174 regions--
               MR. HIGGINS:  Yeah, whether or not you cross over
     into above a ten to the minus sixth change in LERF or--
               MR. LONG:  What I'm saying is it wouldn't be a
     LERF, so you'd be doing it on core damage frequency.
               So I wouldn't think that you would, and I'd have
     to first ask what am I starting with from core damage
               MR. HIGGINS:  Okay, that's good enough.
               MR. LONG:  Okay.
               MR. STROSNIDER:  This is Jack Strosnider.  I would
     like to add one observation there, and I think you know --
     you did -- it's probably a reasonable question to say what
     region would you be in in Reg Guide 1.174 to talk about the
     delta.  That means you have to understand what the
     probability of tube rupture was before the generic letter
     was implemented.  We don't have a good handle on that, but I
     think, you know, it's -- it wasn't assessed specifically,
     but as I indicated yesterday, if you look at what people
     were doing before generic letter 95.05, before the voltage
     based criteria, they were attempting to size these defects. 
     And we talked yesterday about, you know, the ability of NDE
     to size defects.  And, of course, this was back before some
     of the methods that are available today were available.  So
     I would just suggest, and this is just my opinion that the
     probability of leakage from one of those tubes prior to
     95.05 wasn't zero.  Alright.  So, that's the delta you'd
     have to assess.  And we don't have a, you know, quantitative
     answer to that, but I think you need to consider where we
     started and where we went to.
               MR. LONG:  If it's not zero, it's pretty close.
               MR. KRESS:  Yeah, but the real delta I think to
     not be interested in is the thermally induced failure of the
     steam generator tubes so that it becomes a large leak and
     what's the probability of that compared to the probability
     of pulling the search lights.
               MR. LONG:  I agree, and I think that 95.05 has no
     effect on those cases, because they're not the vulnerable
               MR. KRESS:  I think I agree with you.  It doesn't
     matter whether you had bad tubes or good tubes, it will go
     about the same time, I think.
               MR. LONG:  Well, I'm not prepared to say that. 
     What I am prepared to say if something goes in the steam
     generator, I don't think it's the very short cracks
     underneath the tube support plates that were allowed to stay
     from 95.05.
               MR. KRESS:  I hear you.  That's why -- that's why
     I say it doesn't matter whether it's good tubes or bad
     tubes.  They both go about the same time.
               MR. STROSNIDER:  In the for what it's worth
     department, when I presented, when we had the discussion
     with CRGR on generic letter 95.05, I suggested that, in
     fact, 95.05 could be improving the situation versus what
     people were doing in the past.  And I still -- I still think
     that.  It got a little bit of debate, but nonetheless I
     think that sort of puts it in perspective.
               MR. LONG:  Well, it certainly initiated things
     like, you know, condition monitoring and -- you know,
     operational assessment processes, that I think have been a
     big help.
               I'm a little bit ahead of the agenda here by going
     into the risk metrics before some of the other subjects I
     have on, so at this point, I think probably I want to put up
     the thermal hydraulic calculational part, if Charlie's
               MR. TINKLER:  I'm Charles Tinker, from the Office
     of Research.  The objective of my presentation is to briefly
     review the severe accident analysis of--
               CHAIRMAN POWERS:  Turn things, the red light comes
     on.  Dead battery, again?
               Sam, check the switch on the bottom.
               MR. TINKLER:  Oh, there we go.  That was it. 
     Gentlemen, I'm going to have to bring my reading glasses to
     the -- again, I'm Charles Tinkler from the Office of
     Research.  The objective of my presentation this afternoon
     is to briefly review the severe accident analyses, and its
     underlying bases that was used to evaluate the
     thermohydraulic boundary conditions that might be seen by
     steam generator tubes during a severe accident.  And the
     focus is on thermally induced failures of steam generator
               MR. KRESS:  With what purpose in mind, Charlie?
               MR. TINKLER:  Well, the reason we e did these
     calculations was in support of NUREG 1570 to look at things
     like conditional failure probability of tubes during some of
     these kinds of accidents.  And actually, I kind of
     remembered our numbers of condition tube failure
     probabilities, but they were in the context of flaw
     distributions, typical average severe flaw distributions in
               MR. KRESS:  Yeah, the reason I asked the question
     though is are you looking to see if there's a significant
     risk associated with this that we have forgotten to analyze
     before so that it might be worthy of looking at a back fit
     or something like that?
               MR. TINKLER:  Well, I think the idea was to look
     at incremental risk from changes in the steam generator tube
               MR. KRESS:  These are 95.05 incremental risks?
               MR. TINKLER:  No, I don't think it was -- I don't
     think it was in connection with 95.05, but we looked at it,
     for example, on electrosleeves.
               MR. KRESS:  Electrosleeves.  Yeah, I remember
               MR. TINKLER:  Whether was there -- was there any
     incremental risk by adopting the electrosleeve repair
     process.  Did we increase the probability of a thermally
     induced tube rupture, and my own sense was that in the NUREG
     1150, there wasn't as much focus on the sequences that
     involved the secondary side depressurization, which is yet
     another failure and makes the overall sequence probability
     smaller, but there wasn't quite as much attention as we're
     devoting now to those sequences that involve the additional
     failure of the secondary site to remain intact and at
     pressure.  Because that has a two-fold effect, and I'll talk
     about this more.  It obviously increases the delta p across
     the tube, but it also increases the thermal load on the
     tubes, because the reduced pressure on the secondary side
     provides a smaller heat sink in terms of the steam on the
     secondary side, so you -- in our calculations, we can
     increase the temperature of the steam generator tubes by on
     the order of 100 degrees K -- between the pressurized
     secondary side and a depressurized secondary side.  And that
     makes a fair amount of difference in terms of the thermal
     loading on the tubes.
               Along the way, I hope to address a number of
     issues that have been -- that have been raised for a number
     of years now, and some of which are repeated in the DPO.
               I don't -- I'm going to skip -- I have lots of
     viewgraphs, so I'm going to skip through some of them.  You
     can see the outline.  We've talked -- we know what the issue
     is.  To point, too, that natural circulation and transfer of
     heat through the loops of an RCS was identified some number
     of years ago--generally, it was thought to be a good thing. 
     Gets heat away from the core.  Distributes it through the
     system.  It allows for the fortuitous depressurization of
     the system to prevent bad things like high pressure melt
     ejection and DCH and things like that.
               But if you depressurize the secondary side, by
     having a secondary side safety stick open, then you do
     produce a challenge to the steam generator tubes.
               And this is the cartoon that we normally show to
     represent the natural circulation paths.  I'm going to
     deviate a little bit just because has been raised a number
     of times.  But the question often comes up, we produce all
     these calculations that show counter current natural
     circulation and creep rupture.  How come it didn't happen to
     TMI?  Briefly, there are a few key factors that influence
     natural circulation.  First and foremost is the pressure in
     the system.  Higher pressure systems produce greater natural
     circulation.  Higher density flow to convect heat away from
     the core.  It also produces greater density differences, so
     it's two-fold effect.
               The RCS configuration.  The U-tube configuration
     steam generators are, by their nature, more likely to draw
     flow than the once-through steam generators.  It is very
     difficult to get steam to go down through a once-through
     stream generator and back up after it's dried out.  It
     doesn't happen.  The tests at the University of Maryland
     show that you can't get natural circulation so that big heat
     sink out there, isn't there.  So you have nothing to draw
     flow away from the core.  So you produce a weaker natural
     circulation pattern.  They do see natural circulation in the
     hot lake, but it's a reduced effect compared to this.
               Core blockage.  If you form blockages in the core
     region with crossed around them, there's no way to get from
     inside that material out into the loops.  And if you can
     intermittently inject water at various times during the
     transient, and float up over the core, like turning on the
     2-B pump at TMI, you shut off natural circulation.  Goes --
     there's no hot core.  You've covered it with water.
               MR. KRESS:  So, it's not surprising TMI.
               MR. TINKLER:  Well, TMI, if you look, they had
     only a few periods when they could have gotten natural
     circulation.  And this shows -- this initial -- this is the
     initial core heat up.  This is turning on the 2-B pump, and
     you can see the water level is rising back up during those--
               MR. CATTON:  They never did serve the loop seal,
     did they?
               MR. TINKLER:  Well, when they turned it on -- they
     might have cleared it briefly, but it refilled quickly. 
     Because if you got a loop seal, you can't get it.  You have
     to -- well, you can still get counter current, but counter
               MR. CATTON:  Where's it going to go, to the top of
     the candy cane and back?
               MR. TINKLER:  Yeah, that's all it's going to do.
               MR. CATTON:  That's all it's going to do.
               MR. TINKLER:  And also, at TMI, the pressure's
     low.  They had a PRV that was leaking.
               MR. CATTON:  The U over tube is too small to get
     any recirculation within it.  So--
               MR. KRESS:  With the candy cane, I'd be very.
               MR. CATTON:  You're just dead in the water.
               MR. TINKLER:  You can get a little bit in the
     candy cane.  But it's not a vigorous natural circulation,
     and during that first large period where natural circulation
     could have occurred, the pressure in the system is low.  No,
     this is a RELAP calculated pressure, but I do -- I -- we're
     pretty good on -- you know, everybody's pretty good on
     pressure.  But RELAP, it made a loop.  We've had a long
     time.  But we do this calculation pretty good.
               And if you look at TMI during this initial period
     here, this initial period, the pressure in the system is
     quite low, and it's generally acknowledged that once you get
     below about eight MPA, it's hard to get a lot of natural
     circulation and convect heat away.  So I know I was asked
     that question quite some time ago, and I generally refer to
     deviations from the typical severe accident, okay.  And
     there were deviations from the typical severe accident, like
     reflooding, but I might have neglected to mention that there
     -- that the fundamental design doesn't lend itself as much
     to that.
               But it causes me to think that maybe we ought to
     look at some of those typical TMI calculations to try to
     focus on how much natural circulation we could have gotten
     and see if we can match some temperatures a little better in
     parts of the system.
               Also, there's an A&O calculation -- some A&O
     calculations that were recently done, and these show the
     effect of system pressure.  One's sitting at relatively high
     pressure safe -- at the safety.  And one's with a leaking
     PRRV.  And this shows just the hot leg temperature.  So over
     this -- in this initial period here, the effect of pressure
     makes a pretty big difference.
               It's not meant to be an exhaustive treatment of
     it, but it at least provide a little more clarification,
     because I would agree that if you've only had one accident
     to look at, and it didn't produce the thing you say happens
     all the time, it could cause you to wonder.
               MR. KRESS:  Well, Tim, I probably run the risk
     dominant sequence.
               MR. TINKLER:  I don't want to address that.
               CHAIRMAN POWERS:  Before you go to this
     inter-circulation through the steam generator, I'd like to
     understand a little better about the free loop circulation.
               MR. TINKLER:  Okay.
               CHAIRMAN POWERS:  When Steve was talking earlier,
     I got the impression of an increased interest in this and
     that it introduced an enormous amount of complexity into
     this situation.
               MR. TINKLER:  Well, the loop seal clearing is --
     it's a -- you know, first you -- you got to do more than
     clear the loop seal.  You also got to get the water level
     below here.  Okay, the down comer skirt.  Because if all you
     do is clear this, but you don't clear this path.
               MR. KRESS:  That's another loop seal.
               MR. TINKLER:  That's another loop seal.  Right
     here.  So, but now we're able to clear both of them in a
     number of calculations as a result of boil off and just
     general water dropping in the core.  And when that happens
     you produce full loop circulation.  And the key is what's
     going on in here, because when you produce full loop
     circulation, you don't get any cold flow returning through
     the steam generator to dilute what goes into the tubes. 
     Another way to look at that is turning to page 17.  This
     shows temperatures around the loop at the time that we
     normally predict surge line failure for Surrey.  And if you
     look at the temperature coming in from the hot leg, the
     1,500 degrees K, the reason we don't instantaneously fail a
     lot of tubes real quickly is because it's being mixed with
     cold flow returning back through the steam generator tube
     bundle.  Okay, it's being mixed and diluted.  And the reason
     it's being mixed and diluted is because we have a loop seal. 
     If we didn't have a loop seal, it wouldn't be quite this
     high, because there would be other things going on.  But
     we'd have a whole lot higher temperature passing through the
     steam generator.
               So when we do calculations where we produce loop
     seal clearing, the issue is whether or not the pressure in
     the RCS has dropped low enough at the time a loop seal
     clearing occurs, because if it hasn't dropped a lot, we
     predict failure of pristine, intact unflow tubes.
               MR. KRESS:  How good are you at predicting when
     the loop seal clears?
               MR. TINKLER:  Well, we think we can predict loop
     seal clearing reasonably well.  It's a question--
               MR. KRESS:  When you have three loops?
               MR. TINKLER:  Well, it's the question of whether
     or not we can predict which loop seal clears.
               MR. KRESS:  Yeah, that's the question I was really
               MR. TINKLER:  And we don't believe that we have
     enough confidence in our prediction of which loop seal
     clears, so when we approach this probabilistically in 1570,
     we assumed an equal probability among the loops.  We didn't
     -- because we calculated loop seal clearing in some cases,
     and we typically calculated in the loop where the safeties
     haven't stuck open on the secondary side.
               MR. KRESS:  And if you're in a loop that doesn't
     have the surge line?
               MR. TINKLER:  Right, it was a loop that didn't
     have the surge line, and it was loop where the secondaries
     didn't stick open.
               MR. KRESS:  Yeah.
               MR. TINKLER:  And if you're looking at a loop
     where the secondaries didn't stick open, these sequences
     where loop seal clearing typically involve some
     depressurization of the RCS, because you're boiling water
     out of the loop.  That's what clears it, and in those
     sequences we actually had a higher pressure on the secondary
     side than on the primary side.  Okay.  So we wouldn't have
     predicted failure.  But for 1570, we ignored that.  We
     assigned an equal probability to clearing these loops, even
     though we always predicted it to occur in a loop that --
     where the secondary side was not depressurized.  So--
               MR. KRESS:  But if the secondary side is
     depressurized, and even if you were in the leg where the
     surge line was, it -- I was under the impression that you
     were -- your calculations would almost there at times show
     that you failed the steam generator before the surge line
     under those conditions.
               MR. TINKLER:  If it's a loop where the secondary
     side is not depressurized, no.
               MR. KRESS:  That's not true if it's not
               MR. TINKLER:  That's not true, because typically
     these sequences with loop seal clearing involve some
     depressurization of the RCS, of the primary side, so you're
     -- those will be loops where the secondary side will be at
     1,000 and the primary side will be at 600 or 800.  So we
     can't buckle these tubes, you know.  We predict they're hot,
     but they won't fail.
               MR. KRESS:  A different failure mechanism in that
               MR. TINKLER: Because the pressure is the other way
     now on those cases.  But when we did it, when we looked at
     for assessing conditional tube failure probabilities, we
     ignored the fact that we were actually predicting it in the
     other loops and assigned a uniform probability to its
     occurrence, because there is considerable uncertainty as to
     when you predict loop seal clearing and in what loop you
     predict it to occur.
               MR. KRESS: That's what I thought.
               MR. TINKLER: That is true.  And it was a dominant
     -- it was a dominant contributor to -- I believe -- tube
     failure probability.  It was the big deal.
               MR. KRESS: That's what I was -- I was under the
     impression of, too.
               MR. TINKLER: That is correct.
               CHAIRMAN POWERS: When you say the pressure is --
     gets with the secondary sides still pressurized, and the
     pressure in the primary is now below the pressure in the
     secondary, when does accumulator dump occur?  And when it
     does, do you then Jack the pressure back up?
               MR. TINKLER: Well, in some sequences where we had
     -- where we were modeling reactor coolant pump seal leakage,
     you would see some cases where, when we got down to
     accumulator set point, for example, we'd get some flow being
     driven into the steam generators, and that would cause them
     to, in some cases, cause those tubes to heat up fairly
     substantially.  But typically speaking, reactor coolant pump
     seal leakage and leakage in general or the RCS, unless it
     produced loop seal clearing generally didn't cause a
     problem.  If it produced loop seal clearing, then it did,
     because we gave it equal probability.  But there is a nuance
     associated with depressurization, where you get accumulator
     injection and then you force steam flow into the steam
     generator, okay, without the benefit of a lot of mixing,
     because then you're -- then you have almost -- you know, in
     those cases, you force it through both paths of the hot leg. 
     So those cases did produce some more, but it's a relatively
     short-lived transient where that occurs.
               CHAIRMAN POWERS: I was just wondering if your
     tubes were hot, and you got a dump so that it jacked the
     pressure so that you had the delta p across, you'd just get
     a rupture, even though it was a short transient.  Well, you
     know typically we don't show radical pressurizations on
     accumulator injection.  We get a little pressurization and
     then accumulator injection stops.  We had an issue where we
     looked at this where we were condensing additional water in
     the cold leg, and that was causing us to eject more from the
     accumulators.  And that's an issue we've had some
     discussions with the industry folks, because they contend
     that we inject a little too much water as a result of that. 
     Because they show a very smooth accumulator pressure
     injection transients.  Those are a little more spiky, a
     little more ragged.  So, but -- that is a nuance that has
     come up in some of the calculations.
               MR. CATTON: I don't quite understand your figure. 
     The 1504, 982, and 775, what are they?
               MR. TINKLER: Well, these are -- these are
     calculations of intermediate volumes in the inlet plenum,
     okay.  These -- this is, in effect, a mixture temperature.
               MR. CATTON: So do you feed some of the tubes 1504s
     and some tubes 9--
               MR. TINKLER: No.  No, these two streams--
               MR. CATTON: Are mixed?
               MR. TINKLER: Are mixed according to the mixing
               MR. CATTON: Which is?
               MR. TINKLER: Point nine. So 90 percent of the flow
     is at this temperature, and twice as much of it is at this
               MR. CATTON: How do you get the 982?  Where does it
     come from?
               MR. TINKLER: The 982?
               MR. CATTON: That's again a mixture.
               MR. TINKLER: That's the result of 90 percent of
     this flow being mixed with this 775, okay.  See, this cold
     flow returning through the steam generator bundle.
               MR. CATTON: Sounds really complicated.  Where did
     you get the information to base that on?
               MR. TINKLER: Well, this is -- these values were
     deduced from the 1/7th scale, in effect, deduced from the
     1/7th scale test data.
               MR. KRESS: Yeah, I'm interested in how you
     actually made that deduction.  Did you have temperatures in
     the -- certain tubes of the steam generator?
               MR. TINKLER: Well, they had rotating rake thermal
     couples in the inlet plenum.
               MR. KRESS: Okay.
               MR. TINKLER: And they have temperatures in the --
     about an inch or two in the tubes, up in the tubes, in the
     tube sheet.
               MR. CATTON: In some of the tubes.
               MR. TINKLER: In some of the tubes.
               MR. KRESS: Did you have a temperature in the hot
               MR. TINKLER: Oh, yes.  There's temperatures
     throughout the system.  You know, in the hot leg -- in the
     top and bottom of the hot leg.
               MR. KRESS: And did you have a way to deduce the
     flow rates in--
               MR. TINKLER: Yes.
               MR. KRESS: In the two counter current directions?
               MR. TINKLER: Yes.
               MR. CATTON: The flow rate was deduced by an energy
     balance.  It was not pressure.
               MR. TINKLER: But they can do a little better job
     up in the tube volume.
               MR. KRESS: I was going to use the flow rate at an
     energy balance to get the mixing fraction is what I wanted
     to do.
               MR. CATTON: You can't do that.
               MR. KRESS: You can't do that that way.
               MR. CATTON: Because it was the energy balance that
     gave the flow rate.
               MR. TINKLER: And, in part, the mixing fractions. 
     But there's also the observation of mixing from the thermal
     couple data itself.
               MR. CATTON: Well, yeah, but you see two people can
     disagree, and we disagree.  There was a meeting held at
     Argonne, which I attended, where we discussed all these
     things, and the people who were there was Viscanta, myself,
     Ishi -- was Griffith there?  You were there.
               MR. TINKLER: Yes.
               MR. CATTON: Peter Griffith.
               MR. TINKLER: Peter Griffith.
               MR. CATTON: And the way -- the conclusion by
     Viscanta and myself, Griffith was kind of neutral, was that
     you couldn't really scale this data.  There were just too
     many unknown factors.  You couldn't scale it to the full
     size.  This was the conclusion of those people.  Ishi felt
     you could scale it, but his background is two-phase flow. 
     It's not natural convection, and this is the buoyancy driven
     problem.  And in the inlet plenum, it's a highly complex,
     multi-dimensional flow.  When I looked at the temperatures,
     I could find a tube or two where the temperature was very
     high, much higher than in any of the other temperatures.  It
     was almost as if it fingered through directly into the tube. 
     So these kinds of things never became a part of this
               Well, what does all this mean?  First, if there's
     zero mixing, the tubes will surely fail.  If you have high
     mixing, the surge line will surely fail.
               MR. KRESS: Not surely because the time and
     temperature were still pretty close together.
               MR. CATTON: Even then, they're relatively close
     together, and there are a lot of things that I can talk
     about the other side, too.  The way the surge line is
     treated, the heat transfer is probably not high enough. 
     Because unless you guys have done something different in
     RELAP-5, you still used it as filter.  And the heat transfer
     coefficient to the surge line should be augmented.  On the
     other hand, there is some surge lines that come in on the
     side.  And if that's the case, then the surge line is not
     going to be heated as fast.  The more you move the surge
     line down, the more buoyancy and its effect on the heat
     transfer changes.  When it's up, you get -- it's probably
     helpful.  If it's down, it's on the other side.
               MR. TINKLER: Well, actually having a horizontal--
     of this horizontal leg on the surge line does -- can be a
     help, too, because it also helps establish natural
               MR. CATTON: Well, there are a lot of factors. 
     There's even the interaction between the two flows and here,
     the divided into two pipes.  What do you do with something
     like this.  I think you almost have to give it a -- unless
     you want to do the kind of basic research that's needed to
     address this complicated problem, you're going to have to
     give some credibility to the fact that the mixing isn't
     going to be what you think it is.  Now, I suspect that, you
     know, if you had to make a guess, you guess 50-50 chance. 
     Who knows where it's at?  It's somewhere between zero and
     one.  And it's certainly not either.
               CHAIRMAN POWERS: I come back to my baysian
     instincts, even if Steve isn't an ardent baysian, I am.  And
     they got a test here that has some flaws to it.  But comes
     back indicating relatively high mixing.  I don't no whether
     it's 90 percent or 87 percent.
               MR. CATTON: I didn't come to that conclusion when
     I looked at the data.  When I looked at the temperatures, I
     came to the conclusion that there were some tubes that were
     going to be fed almost directly the high temperature gas.
               MR. TINKLER: I guess, we -- I'd have to say, we do
     not come to that conclusion.  And, you know, this Committee
     has, I think, been provided with the results of that peer
     review, so, you know, you can take a look to see what --
     there were a number of discussions.  I think it was nearly
     unanimous that the tests were well designed and well
     executed and that they indicated mixing.  Now, we can argue
     about whether or not it's 90 percent mixing fraction or 60
     percent mixing fraction or things like that, okay, but we
     did -- we have done sensitivity studies on these parameters. 
     I'll talk about them a little more.  And you can see the
     effect of them.  Whether or not a fluid stream line can go
     unmixed from the hot leg up into the tube sheet, I guess is
     a, you know, is a concern that has been expressed.  We don't
     deny that at all.  The general indication, though, as far as
     we're concerned is that the data does not indicate unmixed
     flow.  Does that mean it couldn't occur under a range of
     conditions, including tube leakage.  Well, that's something
     that needs a little more consideration.  But, you know,
     that's the general -- that's the general view we have at
     this point.
               My first--
               CHAIRMAN POWERS: Before you proceed, now, this
     peer review that you're speaking of was the same meeting as
     Ivan was speaking of?
               MR. CATTON: That's right.
               MR. TINKLER: Yes.  Yes.
               MR. CATTON: We each, I guess we read the letters
     written by the people who attended the meeting differently.
               CHAIRMAN POWERS: Yeah, apparently so.  I guess you
     have to read them yourself to come to that conclusion.
               MR. TINKLER: Well, you know, there is some
     questions.  For example, we can't scale, in a 1/7th scale
     test, the exact flow conditions for a tube, because we can't
     make the tubes 1/7th diameter.  They'd be too doggone small,
     and the hydraulic diameter would be too big, and the
     resistance through the tube bundle would be huge.  So you
     got to have the right flow area through the -- this 1/7th
     scale tube bundle relative to the flow area in the hot leg. 
     And you have to have the right mass.  Because it's the mass
     of steel that's actually the source of natural circulation. 
     So it's hard for us to claim that we're simulating each and
     every tube.
               Now, are we producing the same kind of bulk mixing
     pattern in the inlet plenum?  We think we are.  The ACRS
     what used to be the severe accident and thermohydraulic
     subcommittee -- I'm not sure what it is now -- but we made
     presentations where we compared frood numbers in the test to
     the frood numbers in our code calculations, showing that we
     were doing a pretty good job of predicting them, between the
     plant and the experimental facility. But there are
     undoubtedly distortions in that facility that cannot fully
     accommodate, you know, the exact nature of mixing in the
     tubes.  But the other point I make from time to time, with
     varying degrees of success, is that the fluid stream lines
     are not fixed.  Fluid that comes from the hot leg in a
     single stream line, and you saw the CFD code calculations. 
     We can calculate stream lines very accurately if we want to,
     but that doesn't mean they say; that what comes out of here
     always goes to this one tube out of 3,000.  It moves around
     a little bit, this plume.  Actually, they saw evidence in
     the test that the tubes carrying hot flow and cold flow
     occasionally change a lot.  So--
               MR. KRESS: But particularly if you're in a
               MR. TINKLER: So if you got a stream line that's a
     little hotter than the average, there's no reason to think
     it stays in this tube for a particularly long period of
     time.  That plume does -- there is some oscillation to it. 
     Now if -- you know, as I say, I make that argument with
     varying degrees of success, so--
               But it -- the first summary is that we've used the
     SCDAP/RELAP code to analyze this for potentially risk
     significant scenarios.  And typically, we predict the
     failure of the hot leg or surge line before unflawed tubes. 
     We've done a number of sensitivities on thermohydraulic
     modeling.  It didn't alter the conclusion, but the margins
     are pretty small.
               I can skip through this example calculation if
               MR. CATTON: What might be -- do you have one that
     shows the time?
               MR. TINKLER: Well, I can show as part of this --
     I'm sorry, Dana, did you?
               CHAIRMAN POWERS: Well, go ahead and answer Ivan's
     question.  But the question I'm going to ask at some point
     in the discussion is that suppose we don't fail the surge
     line, is there anything about -- if we do not fail the surge
     line, you will predict a steam generator tube failure
     someplace, at some time.
               MR. TINKLER: Well, typically, if we don't fail the
     surge line, the next thing that fails is the hot leg.
               CHAIRMAN POWERS: Okay, leave them both out.
               MR. TINKLER: Leave them both out?
               CHAIRMAN POWERS: Yeah, let's just--
               MR. TINKLER: Yeah, we'll fail a tube.  Yeah.
               CHAIRMAN POWERS: Okay, is there anything about
     that tube failure that would be worsened or improved by the
     peculiarities introduced by generic letter 9505, or is it
     such a robust failure that it's like you're full loop seal. 
     You had failed a pristine tube just as likely or just about
     the same time as you would fail one that's got a few cracks
     in it?
               MR. TINKLER: I will turn to people much more
     qualified to comment on the nature of the failure than
     myself.  Someone in the front row back there, preferably Joe
     or Bill, if they could comment on the nature of that
               CHAIRMAN POWERS: Now, we do have.
               MR. TINKLER: Typically, what we assume is that
     it's a cross section of a tube for the calculation.  We have
     done some--
               MR. CATTON: Can I help you out?
               MR. TINKLER: Calculations of fission product
     inventory released off site, okay.  Not level three per se,
     but fractions of our inventory.
               MR. CATTON: Isn't 9505 restricted to that big
     thick plate on the bottom?
               MR. HIGGINS: No.
               MR. CATTON: Or even the tube support plate?  The
     heat transfer to the plate is going to be enough that that's
     going to be a cool spot along the tube.
               CHAIRMAN POWERS: Okay.  I mean, clearly we do have
     this peculiarity of the leakage flow that can change this
     whole picture here.  But I'm going to leave that out, just
     like I'm going to leave out all these surge line and nozzle
     failures, and ask if there's anything -- what I'm asking is
     how much time to devote to thinking about and reviewing all
     of these things.  If, in fact, there's -- leaving aside the
     leakage question, right now, there's nothing, I mean, it
     would fail if I had a brand new steam generator in there
     with alloy 690 and no cracks, it would fail just as much as
     it would with one that was filled with lots of non-through
     wall, non leaking cracks.
               MR. KRESS: I certainly believe within the
     uncertainties of this thermohydraulic analysis, you can't
     tell the difference.
               MR. SHACK: There's no uncertainties.  He's just
     killed the hot leg failure and the surge line failures, and
     the only thing that's left is whether the core will rupture
     or that will happen.
               MR. KRESS: No, what he's asking if there were
     uncertainties in these things is such that maybe you do at
     some probability fail the steam generator tubes first at
     some probability because of the uncertainties in everything. 
     Would you have gotten the same answer whether you had your
     tubes or not.
               CHAIRMAN POWERS: What I know is that people that
     do these calculations--
               MR. MUSCARA: For that temperature that -- you
     know, on the transient reaches 840 degrees.  So a much--
               MR. KRESS: And it doesn't matter whether they're
     cracks or not.
               MR. BALLENGER: I read 1,200.  I mean, 1,500K,
               CHAIRMAN POWERS: That's the gas temperature.
               MR. BALLENGER: That's the gas temperature.
               CHAIRMAN POWERS: It's hot stuff.
               MR. BALLENGER: It's hot stuff.
               CHAIRMAN POWERS: What I know is that people have
     tried to develop codes other than the one that was used for
     this calculation, and when they tried to model the counter
     current flow, they have to do it the same way RELAP does by
     putting in these figures, and things like this.
               MR. CATTON: It depends on how much money you want
     to spend.
               CHAIRMAN POWERS: Well, these guys didn't spend--
               MR. CATTON: A really good example of that was the
     Comik School from Argonne, and the PTS issue.  The whole
     nuclear industry uses 1020 now because they don't want to
     spend the money on the computer time.  So somebody hired a
     consultant from CHAM in Huntsville and said, gee, how many
     would I need to really do it right.  He came up with a
     number over 100,000.  So what do they do, they say, okay, we
     don't want to that.
               CHAIRMAN POWERS: Okay, well, there--
               MR. CATTON: If they're willing to do that, you can
     handle counter current flow.  The problem is one of how much
     you're going to spend on the computer.
               CHAIRMAN POWERS: These guys, you know, they're
     independent of these, and so they made different decisions,
     though inherently the model is about the same.  Okay, you
     would castigate it just as much as you do this one.  And,
     but they did it differently, and, as a result, they
     presented curves that were just like those except the labels
     were permuted.  And so I'm saying if I have that case, and I
     assume that's reality, is there anything unusual about this
     -- these steam generators now that we've allowed generic
     letter 9505 -- other than leakage.  We'll put that aside,
     because we're going to get to that one a little later --
     that have changed the positions of those curves, and I get
     the strong feeling that to the level of detail that these
     calculations are typically done, no.
               MR. KRESS: That's what I feel.
               MR. BALLENGER: I mean, is there any error.  What
     are the error bars on these numbers?
               MR. TINKLER: Well, we're going to talk a little
     more -- we'll get to that a little more.
               MR. BALLENGER: I mean, that's -- if it's 200
     degrees, and man this is--
               MR. KRESS: Yeah, that's a very legitimate
     question.  That's why I asked him that initial question. 
     Dana, I asked him that initial question: for what purpose
     are you doing this.  And that was the reason, because--
               CHAIRMAN POWERS: Well, I know the purpose he's
     doing it, because we asked him to--
               MR. KRESS: Yeah, I know, but, you know, maybe he
     has an alternative ulterior motive, but that was my reason
     or that question, because if you perceive there's no
     difference, what are you going to do with those numbers?  Is
     it a new set of risk sequences that you just forgot about
     before, and you want to see if they're important or not.
               CHAIRMAN POWERS: Well, I think the -- I mean, the
     issue that is very important is if we allow the leakage, and
     we stipulate that we believe that--
               MR. KRESS: Yeah, that may be a significant issue.
               CHAIRMAN POWERS: Everything they told us about the
     mixing and we stipulate that they simulate the Westinghouse
     data out to the third significant figure, and there's
     nothing wrong with data, and I admit that questions have
     been raised about it, but if we stipulate that and then we
     introduce this leakage over -- Now that's an interesting
               MR. KRESS: Yeah.
               CHAIRMAN POWERS: Then the question then comes
     back, again, is there anything different now if you had--
               MR. KRESS: And that is certainly different, but I
     think what you probably will find out is if you make the
     calculation of the risk that you get due to the -- assuming
     the steam generator tubes fail first, you're probably can
     make an argument of acceptable risk, but that's something
     I'm hoping they get to.
               MR. STROSNIDER: This is Jack Strosnider.  I'm not
     sure, I want to enter into this discussion.  What I'm sure
     of -- but I guess the one thing I would point out is, in my
     understanding of the events being talked about here is that
     they're not the extreme blow down events.  You know, they
     don't put those kind of loads on support plates, et cetera. 
     And we've discussed, to some extent, the pass that with
     regard to the ODSEC at the support plates.  The support
     plates will be there, so it's not clear to me that, you
     know, that's the location that's going to be critical in
     terms of tube failure.  In fact, I think it's probably going
     to be someplace else.
               MR. TINKLER: Well, actually -- but these
     temperatures are the first region above the tube sheet.
               MR. KRESS: Yeah, but it doesn't matter.  If you
     induce the leakage, it doesn't matter where the leakage is. 
     It's going to suck the -- you know, it's going to induce
     some failure somewhere else.
               MR. CATTON: It will probably suck it from both
               MR. KRESS: Yeah, but--
               MR. CATTON: If it's a big leak.
               MR. KRESS: Yeah, it will change things markedly in
     terms of its failure, even though you don't -- even though
     you think the leakage is going to be, failure doesn't
               MR. SHACK: Since we're firing off speculation
     here, I'll go with Jack.  I mean, if I put this thing in
     that collar, that thing is not going to have any gross
     failure.  You know, you're going to see one of my hippo type
     failures somewhere else in the free span of this thing.  But
     what you will get with the generic letter I think is some
     leakage through the cracks that's, you know, on the order of
     ten gallons under a main steam line break, which would
     correspond to some equivalent area, which you can presumably
     use to get a gas flow at this temperature.
               MR. KRESS: Yeah, and the question is, does that
     change this picture?
               MR. SHACK: And you'll get some -- well, the
     question is whether that additional leakage bothers you very
     much, yeah.
               MR. HOLAHAN: No.  My answer is no.  Of all the
     things we don't know, which you hear a lot of, the effect of
     9505 is not one of them.  I think we're pretty clear that
     9505 is the least important risk implication.
               MR. KRESS: So I guess the real question, from a
     risk standpoint, is whether you increase that leakage over
     and above what you say is in 9505?
               MR. HOLAHAN: Right.
               MR. KRESS: Because there's some probability of
     that being much greater.
               MR. HOLAHAN: Right.  You recognize.
               MR. KRESS: I think that's a question that will
     change the risk--
               MR. HOLAHAN: Right.  Approving 9505 allows
     effectively leakages from going from one GPM to potentially
     a little more than that.  Okay.  And in a realistic point of
     view, I think maybe it wouldn't change it all. But at least,
     to say, you know, in theory, a virtual leakage call it,
     okay, we would allow some.
               I think it has no effect on the likelihood or
     consequences of tube ruptures or multiple tube ruptures for
     any of these sequences.  Zero.  Minimal.  Negligible.  Zero.
               MR. KRESS: I think you're probably right.
               MR. TINKLER: I just showed this.  I always show
     this so I can overlay this other plot and show you that,
     indeed, it's the hydrogen generation --- the onset of
     hydrogen generation that really causes things to heat up
               MR. KRESS: Yeah, because that's where all the
     energy is.
               MR. TINKLER: That's where all the energy--
               MR. HOLAHAN: To be fair, I didn't get to see the
               MR. TINKLER: Well, let me, actually, I always show
     it on an expanded plot, too, because, you know, depending on
     what part of the transient you look at it -- if you look
     from time zero, well, it's a small fraction of the time of
     the total transient, but if you look at when things really
     start to happen, the time differential between tube failure
     and surge line failure is a larger fraction of that
     interval.  Another way of looking at the margin is, if you
     look at the time surge line failure is predicted to occur,
     and look at the temperature of the tubes at that point,
     that's 950 -- about 957.  Now, in this calculation, we
     predict the tubes to fail at about 1150, okay.  Now, Joe, I
     just checked with him, he said when he ran his tests, the
     tubes failed about 1,110K.  Alright, we got to stay on K
     here.  So 1,110 to 950, that's another indication of the
     margin.  We're actually--
               MR. KRESS: Or it's an indication of the level of
               MR. TINKLER: Well, but it's -- I mean, you say,
     15, 20 minutes, that doesn't sound like a lot of time, but I
     don't know.  There's 160--
               MR. SHACK: At 160 per minute, it's a lot of
               MR. TINKLER: At 160 -- but 160, you know, 160
     degrees sounds may be a little better when you start talking
     about the sensitivity studies.
               MR. CATTON: But I don't have to change the mixing
     very much to get that curve?
               MR. TINKLER: Well--
               MR. KRESS: And then you divide that.
               MR. TINKLER: Overall conclusions.  Now they -- I
     haven't proven these conclusions from the viewgraphs you've
     seen, so--
               MR. KRESS: These are speculating--
               MR. TINKLER: No, these are valid conclusions.  We
     just don't have enough time to -- for me to show you all the
     calculations.  But as I said, this is worth a 100 to 150
     degrees Kelvin in the tube temperatures, typically.  I think
     that's about -- in the neighborhood.  So that's just worth
     about 1,000 PSI across the tubes.  So those two factors
     combined make these kind of assumptions the most dominant
     assumptions in the calculation.  If the operator is able to
     open the PORV, this problem goes away.  We've done quite a
     few calculations that show you depressurize -- you can
     generally get down to about two and a half megapascals, and
     that's enough for this problem to go away, if you can find a
     way to reliably do it.
               Pump seal leakage.  It's biggest effect was on the
     loop seal clearing, but it may have some effects on other
     calculations, but they appear to be of less importance than
     the pump seal leakage.
               CHAIRMAN POWERS: Now, pump seal leakage is
     becoming less of a problem for plants now, because they put
     the improved?
               MR. TINKLER: Well, we did the calculations with
     the new -- with the distributions for the new pump seals. 
     But -- it's still a pretty high rate depending on, you know,
     the calculations, but with -- with -- indisputably, certain
     thermohydraulic boundary conditions and phenomenological
     issues are important in the plenum mixing.  It's clear, if
     you don't mix at all in the inlet plenum, that makes a big
     effect on your calculation.  We think there is inlet plenum
     mixing.  Heat transfer modeling makes a difference, and loop
     seal clearing makes a difference.
               CHAIRMAN POWERS: Can I ask you a phenomenological
     question?  If it takes too long to answer it, tell me so,
     because it may not be germane here.  As you have that
     counter current flow going along the pipe leading into the
     plenum, that's modeled as a fairly smooth process.  It's not
     really.  And it won't be very long smooth.  Does that
     disrupt any of this -- any of these arguments or any of
     these thermohydraulic modeling?
               MR. TINKLER: I'm not sure I understand your
               MR. CATTON: The interface between the hot stream
     and the cold stream will be both friction and heat transfer,
     and this will reduce the impact on the steam generator
     tubes, and as far as I know, when we did work on it, we
     didn't include it.  And they certainly don't by sticking it
     in pipes.
               MR. TINKLER: No, we don't, but the observation
     from the test data is that those streams are fairly
     isolated, and there is not much mixing between the streams. 
     That was the--
               MR. CATTON: It depends on the velocities.
               MR. TINKLER: It does, but I can only tell you that
     the general conclusion from that test data was that it is,
     those streams are fairly well isolated.  Now we did
     calculations to model heat exchange between the two streams. 
     That makes it better.  That's good for us.  It lowers that
     average temperature going into the steam generator, getting
     a little more mixing, a little more heat transfer between
     those two streams, lowers our peak tube temperature.  That's
     to the good, and we do calculate -- we did calculations that
     maybe I'll get to you that will show you -- that will at
     least show the numbers.
               MR. CATTON: But it's kind of like Los Angeles,
     Dana.  You know, if yo fly in there, you can see the top of
     the smog layers just as smooth flat surface.  And it's
     diffusion controlled.  So whatever you do, because the hot's
     above and the cold's down below, you transfer it from one to
     the other, it's going to be -- I mean, everybody's flown
     into Los Angeles.
               CHAIRMAN POWERS: Just to be indulgent, since I'm
     the chairman, I get to do these things.
               You know, you got aerosols in the hot stuff that
     want to go down.  And they go down pretty good rate.
               MR. CATTON: That's okay.  But that's a little bit
     different.  I mean, I -- that's still a bit different.
               MR. TINKLER: That's -- you know, I had thought
     about it.  But you know, they actually did some tests in the
     1/7th scale to look at the effect of aerosol deposition in
     the hot leg.  They primarily looked at it from the
     standpoint -- they didn't actually -- I take that back --
     they didn't model aerosol deposition, they put a heat source
     on the pipe to see if that disrupted the natural
               CHAIRMAN POWERS: Oh, and that's a good piece of
               MR. KRESS: I suspect you were also using steam,
     and you got through telling us that this temperature really
     took off when it was the hydrogen generation part, and I
     don't know how hydrogen would behave under those conditions,
               MR. TINKLER: Well, we -- you know, we have
     hydrogen in our calculations, and they did inject a simulant
     for hydrogen in the 1/7th scale tests.
               MR. KRESS: Oh, I didn't know that.
               MR. TINKLER: Yeah, they had, there were five
     separate phases to their -- you know, their high pressure
     test program.  I think one of them included a lighter gas
     than sulfurhexaflourine.  So--
               MR. HOLAHAN: I mean, there's absolutely a minimal
     amount of racinium.
               CHAIRMAN POWERS: A minimal amount of what?
               MR. HOLAHAN: Of racinium.  Just thought I would--
               CHAIRMAN POWERS: Oh.
               MR. HOLAHAN: Throw that in.
               MR. KRESS: That's what I was expecting, yes.
               CHAIRMAN POWERS: It's an all steam system, so that
     we wouldn't expect it--
               MR. TINKLER: Actually, I thought you were
     prompting that -- I don't know whether there was something
     later on in this sequence that might make this sequences a
     little different.  The chimney effect if you fail something
     and later fail the vessel.
               Code validation.  We've talked about this, so I
     won't dwell on it, but, you know, we didn't -- we didn't
     just start doing these kinds of calculations.  We've been
     doing them a long time.  And the folks at INEL, Len Ward and
     Darryl Knudsen, who's here in the audience today, whose done
     more of these calculations than anybody in the world,
     probably everybody else in the world combined, actually. 
     We've done a lot of them.
               CHAIRMAN POWERS: I think we're willing to
     stipulate that.
               MR. TINKLER: Okay.
               CHAIRMAN POWERS: I wonder if we could -- just a
     few to -- schedule a little bit, take a recess at this
     point, come back and discuss this effect -- the section of
     effective leakage on inlet plenum mixing.
               I mean, I don't want to take out things that you
     think it's important for us to hear.
               MR. TINKLER: No.  No.
               CHAIRMAN POWERS: But on the validation of the
     model and the basis for it, I think -- we're willing to
               MR. TINKLER: Sure.  Okay.
               CHAIRMAN POWERS: Those things and then move to the
     issue that's part of our contention, which is the effect of
     leakage on the mixing.  With your indulgence, and I
     appreciate that, we will return at a quarter after and
     resume on this section.
               CHAIRMAN POWERS:  Let's come back into session.  I
     apologize for interrupting your presentation, Charlie.
               MR. TINKLER:  Okay.
               CHAIRMAN POWERS:  And, again, if there is material
     that I suggest we jump over and you think it is critical, --
               MR. TINKLER:  Well, I would just like to very
     briefly talk about the sensitivity studies --
               CHAIRMAN POWERS:  Sure.
               MR. TINKLER:  -- that show what the effect of some
     of these parameters that are of debate.
               We talked about the parameters that influence
     mixing and the temperature in the tubes.  Some of the
     parameters identified early on were the number of tubes
     carrying hot flow, the mixing fraction, the recirculation
               We went back and looked at the range of values
     deduced from the 1-7 scale test data and varied those
     parameters for the calculation.  Single sensitivities varied
     over the range showed a change in the tube temperature on
     the order of 20 degrees or less, so they didn't seem to have
     a large effect.
               DR. KRESS:  Those are kind of weird looking ranges
     to me, .76 to .89.  How did you arrive at what to choose for
     those?  29 percent, why not 30 or --
               MR. TINKLER:  Well, we took the numbers that were
     evaluated from the 1-7 scale test without rounding them up
     or down, or --
               DR. CATTON:  So there is no consideration of the
     possibility that --
               MR. TINKLER:  They could be different.
               DR. CATTON:  Rare probability that there was some
     error in the scale.
               MR. TINKLER:  We will address that later, and I
     will talk about that a little later.  We did some additional
     calculations in response to recommendations made by the ACRS
     and by the peer reviewers.  They said, well, that range of
     parameters you changed was pretty narrow, some of the
     comments you just heard, and why don't you change a couple
     of things at the same time?
               So, first, we changed heat transfer coefficients. 
     And, generally, whenever we changed heat transfer
     coefficients, it made things better, because --
               DR. CATTON:  It depends which one you change.
               MR. TINKLER:  Well, it depends which one you
     change.  But, remember, this is our base case.  We only had
     one where it went the other way, all the other temperatures
     got lower.  And that is because the environment in the steam
     generators is nearly adiabatic.  The tube, the difference
     between the vapor temperature and the tube temperature is
     really quite small.  So we can't change a heat transfer
     coefficient and make the tubes hotter.  We can make the
     other stuff hotter but we can't make the tubes hotter.
               MR. BALLINGER:  What you are saying is is that
     this calculation is not -- is dominated by something other
     than what you varied?
               MR. TINKLER:  Yes.
               DR. CATTON:  It is dominated by the mixing.
               MR. TINKLER:  Yes.
               MR. BALLINGER:  Completely.
               MR. TINKLER:  Yes.  Although, if we increased the
     heat transfer coefficient at entrances more than 1.3,
     because you could argue that maybe that is not enough for an
     entrance effect in some local geometries maybe, we could
     maybe improve the performance of the tubes relative to the
     hotleg or surge line.
               MR. BALLINGER:  But how far off could the dominant
     thing be?  What does dominate?
               MR. TINKLER:  Well, I mean if you think there is a
     probability of unmixed flow going to the steam generator
     tubes, you go back to that 15 --
               MR. BALLINGER:  So is there a real estimate of the
               MR. TINKLER:  Not yet.
               MR. BALLINGER:  Like we have going around this.
               MR. TINKLER:  Not yet.
               MR. BALLINGER:  An uncertainty on that.
               MR. TINKLER:  Not yet.  We will get to that.  We
     did a simultaneous change of parameters using the 5 percent
     confidence limits from the test, the transient test, which
     we believe to be the most relevant test for these particular
     calculations.  And when we changed everything, assumed they
     were all independent and changed them in the worst
     direction, to the 5 percent confidence limits, we increased
     the tube temperature 50 degrees.
               But that is still a mixing fraction of .73, so it
     is not like it is -- it is not like we changed the mixing
     fraction to zero.
               DR. CATTON:  Or even to 50 percent.
               MR. TINKLER:  Effect of leakage on steam generator
     inlet plenum.  Concern has been raised that steam generator
     tube leakage during severe accidents could alter mixing in
     the inlet plenum.  The 1-7 scale test did not simulate tube
     leakage.  The idea is basically that -- and I had that out
     there for so long.  Well, the argument is that you have
     3,000 tubes drawing from the inlet plenum, or, actually,
     roughly 1500 tubes draw hot flow from the inlet plenum, and
     maybe one of them now is drawing a lot more flow than all
     the other tubes.  So is it going to disturb that mixing
     pattern in the inlet plenum?
               At first observation, these tube leakage effects
     may very likely be disbursed among many tubes.  It is an
     aggregate sort of thing, it is not one tube, and if it is
     disbursed over the tube bundle, you would be hard-pressed
     that it is going to dramatically influence it.
               Leak area equivalent to a 1 GPM leak is a very
     small fraction of the tube bundle flow and the inlet plenum
     flow, the flow circulating in the inlet plenum.
               CHAIRMAN POWERS:  The numbers we discuss in
     connection with predictions from one cycle to the next and
     whatnot are all much higher than one gallon per minute.
               MR. TINKLER:  At 100 GPM, it is about 10 percent
     of the inlet plenum flow.  Now, is 10 percent spread out
     over many tubes likely to influence the inlet plenum mixing?
               DR. KRESS:  Is 10 percent of one tube likely to
     influence it?
               MR. TINKLER:  Well, I am not even sure that it
     makes it worse, frankly.  I mean drawing more from one
     location may have the influence of, you know, people use
     jets to mix things.
               DR. CATTON:  But you also have a buoyant plume
     down there somewhere, and you might just suck away the fluid
     that is mixing and then becomes the hot fluid.
               MR. BALLINGER:  You are not firing a jet into
     something, you are sucking something out.
               MR. TINKLER:  Yes, I know, I got a jet coming out. 
     It is an exit jet, as opposed to -- but, so the bulk
     velocities in the inlet plenum are not likely to be
     influenced a great deal.  The velocities at the inlet to
     that tube, if it was one tube, would be quite higher, much
     higher.  So if the mixing occurs down deep in the inlet
     plenum, then you might not expect the effect to be large,
     but if the mixing occurs up close to the tube, you know, to
     the tube sheet, it could be a more significant effect.
               DR. CATTON:  These are buoyancy driven processes,
     and there was an experiment by Myinger some time ago where
     it actually had to do with core melt, but just a small
     fractional variation in the density, he put this bubble into
     a mixture, and it just wipes everything out.  You don't need
     to do very much to completely disturb whatever the pattern
     is that is there.
               MR. TINKLER:  Well, the general issue of mixing
     and tube to tube variations is more problematic for any
     codes like this.
               DR. CATTON:  You are absolutely right.
               MR. TINKLER:  So what we have laid out in response
     to the user need received earlier this year from NRR is a
     plan to look at this specific issue using the more detailed
     CFD codes.  We have in-house expertise that has been applied
     to CFD codes, developed over several years, and we think we
     can take a look at this to at least provide insights as to
     the magnitude of the influence of this tube leakage.  Does
     it radically alter the mixing patterns?
               And we think it is promising, we think it will
     allow you to look at other things, too, other sensitivities,
     the location of the entrance of the hotleg and things like
     that on the inlet plenum mixing.
               DR. CATTON:  Do you make any distinction in the
     calculations as a result of location of the surge line?
               MR. TINKLER:  Surge line?
               DR. CATTON:  Yes.
               MR. TINKLER:  Yes.  Yes.  We distinguish between
     surge lines that are oriented with a horizontal leg or, you
     know, an initial horizontal and vertical, or just a vertical
     riser, yeah, we do.
               DR. CATTON:  So do you know where the interface
     between the hot and the cold is?  I guess -- no, I am not
     sure you do unless you have a velocity.
               MR. TINKLER:  Well, I was referring to the
     orientation of the hotleg at the inlet plenum steam
     generator.  But this, we would use this to study
     specifically the issue of inlet plenum mixing, the general
     issue of inlet plenum mixing and to gain insights as to the
     effect of tube leakage on that mixing.
               But for small leakage rates, it is clear it is a
     small fraction.  At 10 percent of the inlet plenum flow
     rate, it may not be very clear that you will be able to
     distinguish much difference either, especially if it was an
     aggregate leakage over many tubes.  It would be very
     difficult to draw a conclusion about that.  But if it is
     isolated, perhaps much more so.
               But, in any event, we do believe this will -- this
     is, you know, these are the kinds of codes that were
     developed for these kinds of issues, so we think it is a
     good application.
               CHAIRMAN POWERS:  My experience with CFD codes is,
     in truth, zero.  But my witnessing of those calculations is
     that the CFD codes do a very fine job if you have some
     experimental data to compare against.  And the kinds of
     experimental data they compare against usually are
     substantially more detailed than what I think you have
     available on this mixing in the 1-7 scale test.
               Have you given thought to the feasibility of doing
     the experimental investigations that would be useful for
     comparison of the CFD code analyses?
               MR. TINKLER:  We have.  We have thought about
     commissioning experiments to look at this specific issue. 
     One could conduct perhaps simpler experiments to look at
     plume mixing in more idealized configurations, as opposed
     to, you know, steam generators.  That was just pretty
     complicated at some level.
               But the very first step in doing this will be the
     validation benchmarking of the code against available data.
               DR. CATTON:  Which means Westinghouse, right?
               MR. TINKLER:  Well, which includes the
     Westinghouse 1-7 scale test data.  If I came back here, or
     if Chris Boyd comes back here and tells you about his CFD
     calculations, you know, a year or so from now, and he
     doesn't compare them to the 1-7 scale test data --
               DR. KRESS:  We would wonder why.
               MR. TINKLER:  You would want to know why.  So,
     now, that doesn't say that that is fully dispositive on it,
     so we are looking at that now, and we are in the first
     stages of undertaking that particular activity.
               DR. KRESS:  How are we supposed to factor that
     into our --
               MR. TINKLER:  Well, I think that --
               DR. CATTON:  You can't.
               DR. KRESS:  I know, I mean --
               MR. TINKLER:  Well, it depends on the leakage rate
     you want to consider.  If you want to consider --
               DR. KRESS:  I want to consider the leakage rate at
     least that you have in 95-05, that it allows.
               MR. TINKLER:  Up to 10?
               CHAIRMAN POWERS:  Up to 130.
               DR. KRESS:  130, 150, something like that.
               MR. TINKLER:  130.
               CHAIRMAN POWERS:  They tell me they get very
     nervous when they go to 130.  Try 130.
               MR. TINKLER:  Well, like I say, 100 GPM is about
     10 percent of the flow rate.  That is not an overwhelming
     fraction of that flow in the tube bundle or in the inlet
     plenum.  So, --
               DR. KRESS:  But it is getting up there where you
     might think it could have an effect.
               MR. TINKLER:  It could.  I guess I would be
     tempted to say it would be a greater effect if it were a
     point source as opposed to a spread over some large number
     of tubes.
               DR. KRESS:  Oh, sure.  Sure.
               MR. TINKLER:  Okay.
               CHAIRMAN POWERS:  Yeah.  But I am not sure how
     spread it is, because certainly they showed us an example of
     a tube with -- my recollection is that one cycle it was on
     the order of seven gallons per minute, and on the --
     projecting it forward to the next cycle, some higher number. 
     So I am not sure how spread it is.
               And on top of that, from what I see in these
     patterns of steam generator repairs and whatnot is that the
     most highly damaged tubes seem to come in clusters.  They
     may not be spread over the entire diameter.
               MR. TINKLER:  Well, you know, I guess I would be
     tempted to say it would be -- it would be nice to have
     experimental data upon which to draw some simulant fluid
     test to look at mixing plumes with a -- while you are
     drawing a jet off perhaps in an isolated region.  That would
     be a nice supplement to the calculations, because we will,
     in effect, be extrapolating.
               But the code, you know, I think that the code will
     have the capability to look at this issue in a reasonable
     way.  But I don't know what else that I could tell the
     committee at this point.
               DR. KRESS:  It looks like very difficult
     experiments to do because geometry is so important.
               MR. TINKLER:  It is, it is.
               DR. KRESS:  You almost have to do a full scale on
               MR. TINKLER:  Well, I would just be concerned
     about preserving the general, you know, aspect ratios and
     flow areas.
               CHAIRMAN POWERS:  But it seems to me --
               DR. CATTON:  If it were just the natural
     circulation within the plenum region, it is just one
     parameter, geometric similarity, and you can scale the Relay
     number or the Grashoff number.  But the fact that you feed
     it some amount of flow, you have probably got a Reynolds
     number in there, too.
               Water is probably the thing to use, because you
     can get a very high Relay number and it is probably going to
     be turbulent and that is going to give the CFD codes a
     headache because they still haven't really got there with
     good turbulence models.  And when it is buoyancy driven, you
     have to treat all of the Reynolds stress terms.  And it is
     doable with CFD, there is no question.  But I am not sure
     that if you pick up a commercial CFD program, you are going
     to get all that you need.  You have a very nice paper on
               MR. TINKLER:  The good news is it's single-phase. 
               CHAIRMAN POWERS:  And it seems to me that in
     wrestling with the experimental issues, which I think are
     formidable, based just on the critiques that have been
     labeled on the 1-7 scale, the overall strategy seems to me
     like a pretty good one to start with the calculations and
     calculate the bit, small, and in between, and things like
     that, and at least get a feel for what's doable.
               I think he has a real challenge in getting this
     geometrical similitude here.
               DR. KRESS:  I do, too.  I think there's a real
     challenge there.
               MR. TINKLER:  I don't know how much -- we're
     running a little behind.
               DR. CATTON:  The problem is that if you use a
     simulated fluid, and you want to get a high number, you're
     going to go to a liquid.  As soon as you go to a liquid, the
     final number gets big, and that there, the number is less
     than one, or in gases, it's at most an order of one.
               DR. KRESS:  You can't simulate all of that.
               DR. CATTON:  That creates differences in the
     mixing process, but it's on the conservative side.
               MR. TINKLER:  We are undertaking some new work to
     further resolve some of these issues of uncertainty which
     heretofore have been addressed through sensitivity studies,
     and combinations of sensitivity studies.
               We're going to look at different accident sequence
     variations.  An awful lot of calculations have been done on
     -- a lot of sensitivities have been done on the Surrey
     plant, and we're going to look more at a Zion type design.
               We will, indeed, be looking at independent mixing
     and tube-to-tube variations.  SCDAP/RELAP will be used as
     the principal tool for the system level analysis, okay?
               But we will be using the CFD codes to look at
     things like in the plenum mixing, and also tube-to-tube
     variations, because the CFD code provides the kind of
     resolution to look at those kinds of things in greater
               DR. KRESS:  Let me ask you about this new
     research, and use an eight-letter.  Does it have anything to
     do with the DPO issue?
               MR. TINKLER:  I don't think so.  I think the
     calculations that were done for NUREG 1570, 15-20 minutes. 
     There's a kind of a sense that's, you know, that's not a lot
     of time.
               Things go differently than what you think, and a
     good 15 to 20 minutes becomes minus five minutes, so --
               And I think there's a sense that as we do more and
     more of the assessment of delta risk and risk impacts, that
     we need to look at the uncertainty in some of these
     calculations, especially where the margins appear to be a
     little small, and look at them more rigorously.
               So, like I say, what we want to do is develop
     distributions for these parameters, and they may go outside
     the range of values seen in the experimental data, you know.
               Like all distributions, we'll have tails on
     distributions, and we'll argue about what those tails on the
     distributions will be, and we will peer-review this, okay?
               So, we'll have a couple of more opportunities to
     do discuss what constitutes mixing and a characterization of
               These are the parameters we've initially settled
     on, but we'll consider that also, I think, as part of the
     peer review.
               MR. HOLAHAN:  I'd like to answer the question
     about the relevance to the DPO.  I think the answer is that
     it's not related to the DPO issues.
               If anything, this sort of analysis provides you
     insights as to what is really important, and I think it
     reinforces the fact that issues like 95-05 are not dominant
               DR. KRESS:  Thank you.
               MR. TINKLER:  Actually, this is just a repeat of
     the things I said just a couple of second ago about --
               MR. HIGGINS:  Excuse me.  You said they were not
     dominant sequences, but this hasn't been done yet, so what
     do you base that on?
               MR. HOLAHAN:  I base it on that I don't see any
     relevance to what this has shown or will show to the failure
     of short axial cracks underneath the support plates.
               MR. LONG:  This is Steve Long to add a little to
     this.  In terms of relevance to a DPO, the user need was not
     -- help us with the DPO; the user need was written primarily
     because we developed a large number of issues that we were
     having difficulty with to try to move this into
     risk-informed regulation.
               I will get into some of the applications when I
     talk about some of the problems in the next slides.
               MR. TINKLER:  The Committee asked to hear a little
     bit about fission product deposition, the issue of
     deposition of fission products on the tubes, and that
     contribution to heating of the tubes, specifically in
     relationship to the work that was done and published by
               These are points that I discussed a number of
     years ago in presentations before the ACRS, but basically we
     used the Victoria Code to calculate the fission product
     release, transport, and deposition.
               The Victoria Code is specifically a fission
     product chemistry code with provisions for modeling
     transport and deposition, but the thermal hydraulic boundary
     conditions, pressures, temperatures, flow rates, are all
     provided to it by the SCDAP/RELAP calculation.
               And basically what you see here is that the
     volatile fission product release is on the order of ten
     percent decay heat.
               That's a fairly consistent number that you will
     see in a number of these calculations, at least insofar as
     the early phase of core melt is involved.
               We predicted that the fission products were spread
     among the upper plenum, hot leg, steam generator plenum, and
               I won't dwell on that, unless there are questions. 
     Similarly, I'll skip over the Victoria nodalization.
               CHAIRMAN POWERS:  It seems to me that there was
     one line that is pertinent from that slide on the Victoria
     capabilities that came up yesterday.  Maybe you weren't
               The question was raised on whether you treated --
     you definitely were here.
               MR. TINKLER:  Yes.
               CHAIRMAN POWERS:  Treated a agglomeration and
     thermophoresis --
               MR. TINKLER:  Yes, we do.  We treat that, along
     with laminar deposition, terminate deposition, settling, and
     that's pipe bends, not pipe blends, okay?
               And we can talk about some of the additional
     models that maybe one needs to consider when they model
     fission product deposition on the secondary side, as you're
     concerned about the release, but that's not the issue for
     this, but we do, indeed, model thermophoresis.
               CHAIRMAN POWERS:  One of the questions that has
     emerged in recent years on thermophoresis is a question over
     whose model is best.  And my understanding is, without a
     great deal of knowledge in this subject, is that the SOFARIS
     code being developed by the Europeans uses a different
     thermophoretic model than the Victoria Code.
               MR. TINKLER:  Well, I'm not sufficiently familiar
     with SOFARIS thermophoresis models.  I know that discussions
     of differences in thermophoretic deposition have occurred as
     a result of comparisons between some of our calculations on
     FEBUS and some of the European calculations.
               Frankly, we see oftentimes the prediction of the
     thermal hydraulic boundary condition as being more important
     to that comparison than the details of the thermophoresis
     model, because we often end up with greater differences in
     the prediction of the difference between the vapor
     temperature and the wall temperature, okay, especially when
     you're trying to predict deposition along a thermal gradient
     tube where there is relatively steep gradients.
               But, again, our steam generator tubes and the
     vapor are about ten degrees apart.  It's quite difficult to
     imagine that thermophoresis --
               DR. KRESS:  Your use of the term, laminar
     deposition, is probably going to overwhelm it.
               CHAIRMAN POWERS:  That, of course, raises another
     important thing.  I think we have to bear in mind that -- I
     think there are two things:
               I think that it is true that these calculations
     don't have thermophoresis as a dominant deposition mechanism
     throughout the length.
               And the other is that theoretically, we don't have
     a validated way of simultaneously depositing things by
     multiple mechanisms.
               DR. KRESS:  That's exactly that each of them are
     assumed to be independent, and I don't know really how you
     -- you have to -- to get thermophoresis, you have to convert
     your bulk mean temperature difference that you calculate
     with something like SCDAP/RELAP into a temperature gradient
     near the wall, actually.
               And I'm not sure how you do that in Victoria.  I
     don't know what you're inputting.
               CHAIRMAN POWERS:  I think that I do know how they
     do that.  I think they have a fully developed correlation
     and they just match them.
               DR. KRESS:  They just match each, and then they
     get a laminar layer, and that's the distance they get for
     the delta-T, okay.
               CHAIRMAN POWERS:  I think it's built into the code
     to do that.
               DR. KRESS:  Okay, you just put the heat transfer
     coefficient into the input.
               CHAIRMAN POWERS:  I think they just use a fully
     developed flow correlation.
               DR. KRESS:  They recalculate it themselves.
               CHAIRMAN POWERS:  Yes, they keep track of it as a
     function of the flow velocity.  I do know it's fully
     developed flow.  I mean, that's about all I know about it,
     and that raises all kinds of questions about whether you
     should be doing fully developed flow in these things.
               I just thought it was useful to make sure that
     that went on the discussion record here, because the
     question was raised yesterday.
               MR. TINKLER:  Yes, well, again, we don't see it as
     a dominant mechanism in virtually any parts of this
     calculation.  So, we think there's an explanation as to why
     it was cited as a dominant mechanism by others.
               Okay, I'll get to that briefly.
               DR. KRESS:  The Japanese cited it as a dominant
               MR. TINKLER:  They cited it as a dominant
               Why don't I just go right to that?  They used
     SCDAP/RELAP also to drive their code, which is ART, not to
     be confused with ARTIST, but aerosol release and transport,
     who knows.  It could be.
               CHAIRMAN POWERS:  It really doesn't sound
     Japanese, does it?
               MR. TINKLER:  No, it doesn't.  They also conclude
     that the surge line failed first, but they had a rather
     substantial fission product heating of the tubes.
               And the main reason is, they assumed that the
     temperature of steam entering the tubes not quite equalled
     -- this may be a little bit of an overstatement -- it wasn't
     quite equal to the temperature of the hot leg, but it was a
     lot hotter than ours.
               DR. KRESS:  It didn't have the mixing in there.
               MR. TINKLER:  They had a temperature difference of
     250 degrees.  They just assumed.
               And the best we can figure, after numerous
     discussions and e-mail and conversation, is that they wanted
     to conservatively estimate deposition due to possible
     thermophoretic effects.
               I guess it's also true that the entrance
     temperature to the tube bundle isn't readily apparent from
     the SCDAP output.  We don't have that intermediate volume,
     so, you know, if you're looking at SCDAP output, you've got
     a choice of these things.
               Well, we don't give you -- the output doesn't
     automatically include that mix that's then also compensated
     for by the mixing fraction and the ratio of the flows.
               So, using a higher temperature, using a
     temperature that's 15 times higher than ours produces more
     thermophoresis.  But, frankly, we just can't see any way
     whatsoever you could get that kind of temperature difference
     between the vapor and the tubes where the secondary side is
     depressurized and there's no water.
               Now, the people running the experimental facility
     in Europe, the ARTIST facility, they're contemplating
     looking at large thermophoretic deposition rates, but that
     might be associated with putting some water back in the
     steam generator where you can create large temperature
     differences, in which case you could get that.
               But the other issue -- you know, the obvious is,
     if we the temperature that much hotter going into our tubes,
     will it fail because the steam's too hot?  I don't care what
     the thermophoresis is.
               The other point is if you think this is an
     entrance effect, then it is in the tube sheet and I don't
     know, maybe I am going out on a limb here but I guess that's
     the last region I would worry about a lot due to fission
     product heating anyway.
               There the dominant mechanism was gravitational
     settling at the top because it is a long distance and
     actually Jason reminded me that it is liquid through much of
     the system, so if you did deposit a little bit at the tube
     sheet, it might be liquid.  It might drip off and go down
     into the inlet plenum and be on the bottom of the steam
               Conclusions -- we have analyzed tube heating
     during severe accidents using benchmark models validated
     against scaled experimental data.  It's undergone peer
     reviews.  Sensitivities have been examined.  We have seen
     temperature variations between 20 and 50 degrees.
               We have evaluated tube performance during severe
     accidents.  We think that further evaluation though would
     benefit from the resolution of thermal hydraulic
     uncertainties.  We have plants to undertake that work.  We
     think that a more rigorous consideration of uncertainties is
     warranted.  We think there's something to be gained by
     looking at additional sequences for different plants and we
     think there is a role for more detailed CFD modeling in this
     calculation of details related to the mixing issue.
               I do have a couple of viewgraphs on offsite
     release.  You had it in your agenda.  It wasn't really a
     part of a lot of our work.  I didn't know if you were
     interested in seeing anything about that or not.  It is
     basically the Victoria calculations that were done assuming
     a tube rupture about the time of -- we simply ignored surge
     line hotleg ruptures and modeled the tube rupture and we
     continued the calculation until we predicted the hotleg
     would have melted, okay?
               DR. KRESS:  Did you include the secondary building
     and --
               MR. TINKLER:  Not the building.
               DR. KRESS:  Not the building?
               MR. TINKLER:  We did include the secondary side of
     the steam generator.
               DR. KRESS:  Secondary side of the generator
               MR. TINKLER:  Of the generator itself, but not
     additional deposition in the --
               DR. KRESS:  Once it got out of the secondary
     side --
               MR. TINKLER:  It was out.  It was out.
               DR. KRESS:  And you looked at both the control
     room and --
               MR. TINKLER:  No.  No, we were just looking at
     fractions released.
               DR. KRESS:  Oh, fractions released.
               MR. TINKLER:  Fractions released, yes.  These are
     fractions of core inventory released.
               The reason we didn't have more noble gases
     released is because we released them through the PORV.
               DR. KRESS:  Okay.
               MR. TINKLER:  But we had about a 30 percent iodine
     release -- so -- that's a real iodine spike.
               DR. KRESS:  How come the cesium gets to be so low
     in this?  Let me see it again.
               MR. TINKLER:  Yes.  Cesium released from the core
     is only 35.
               DR. KRESS:  I have always wondered about that.
               MR. BALLINGER:  Cesium is highly soluble, right?
               MR. TINKLER:  Yes.  It's going to be cesium, most
     of it in this calculation would be cesium hydroxide.
               DR. KRESS:  You know, a lot more of it got
     retained in the primary-secondary than the iodine.  That's
     what -- that one is one that bothers me, I guess.
               MR. CHAPAROW:  This is Jason Chaparow from the
     Office of Nuclear Regulatory Research.
               The releases from the core, as you can see, are
     limited to about three-fifths of the core, if you look at
     the nobel gases and the iodine and the cesium is not far
     behind it.
               In this sequence we had, after the tube rupture we
     continued to get accumulator injections and that kept the
     lower part of the core down below about 1500 K so the lower
     two-fifths we really didn't predict much fission product
     release until this hotleg melted and you just -- the rest of
     the steam boiled off so the lower area of the core was
     predicted to be a little bit cooler, cool enough to prevent
     the fission product releases prior to hotleg melting.
               That affects all of the releases to the
     environment by almost, by 40 percent.
               MR. TINKLER:  We heat the whole system up by
     continuing this calculation.  We just get revaporization of
     iodine and it goes out --
               DR. KRESS:  Okay.
               MR. TINKLER:  -- and we did a brief comparison
     against the early, early MAAP calculations on this thing.
               For some reasons their release wasn't through the
     PORV so they had more of it go out but on the iodine release
     it is about the same.
               DR. KRESS:  But it is a large release?
               MR. TINKLER:  We consider that a significant
               Four hours though may be judged to be --
               DR. KRESS:  May not be a large early release.
               MR. TINKLER:  May not be early.  Actually the
     calculations typically produce, typically would involve some
     evaluations, so there's not much going on prompt.
               DR. KRESS:  So it may not be kosher to equate this
     directly with the large early --
               MR. TINKLER:  No, not if you are talking about
     four to nine hours, four to eight hours, something like
     that, maybe not.  Well --
               MR. HOLAHAN:  Well --
               MR. TINKLER:  Well --
               MR. HOLAHAN:  Well, it's sure not small.
               MR. TINKLER:  My comment was how early was early? 
     This surely was -- I didn't say large.  We said significant,
     but it is, the difference between significant and large in
     this case may be small.
               MR. HOLAHAN:  I think there was a comment earlier,
     maybe Steve Long made it, and that is when you have the
     choice between treating cases like this as large early
     release or as core damage with basically no release, they
     look more like the large early releases.
               DR. KRESS:  It would be prudent to do that.
               MR. HOLAHAN:  It would be prudent to do, yes.
               MR. LONG:  I wanted to clean up a couple of
               First of all, I made a comment when I was up here
     earlier about the amount of radioactive material that would
     go out from the hundred GPM size hole and the tubes if you
     went through the station blackout core damage accident
     sequence to the point where you failed the surge line, and
     then went ahead and failed the surge line in the
               I tried to grab the document during a break and
     grabbed the wrong document so I think we need to owe you
     that document.  My memory is probably not good and Charlie's
     memory is better about how much of the radioactive material
     went out from that particular case and how it would compare
     to a contained reactor accident.
               I think my memory is probably good that it wasn't
     approaching LERF but in terms of the multiples of the
     contained reactor accident releases were probably not on
               Another thing I would like to do is there was a
     question about whether or not the tubes having flaws in them
     made a difference when they would fail.  I wasn't sure if
     that was a question about if the tubes were 9505 tubes
     confined in the support plates or if they were free span
     flaws, so if they are free span flaws it will definitely
     make a difference and it depends on what is going on in the
     RCS in terms of heatup and pressure changes.
               This isn't probably the best slide that I should
     have.  It is just a slide that I happen to have.  What we
     did is we modified RELAP/SCDAP to take account of tube
     temperatures with different stress multipliers so it
     simulated tubes with different size flaws instead of looking
     just at the pristine tube.
               I think you can kind of read it from your chairs
     but the black is the weakest tube and it is something that
     is just about I would say main steam line strength or so and
     the 1X is essentially a pristine tube, so you can see the
     pristine tube is going to fail last and this is a
     sequence -- I'm sorry I don't have the other slides to show
     you the temperature and pressure differences but what is
     happening in this case is this is one of the intermediate
     pressure cases and you have some repressurizations, the
     depressurizations, and there is a question about what
     happens when you have pressure pulses also.
               What happens on the first pressure pulse is that
     you force the hot gas up into the tubes and then because
     there is not much on the outside of the tubes in a
     depressurized generator they don't cool off very quickly and
     then what happens in the next pressure pulse is that they
     are already hot and you start accumulating creep damage, so
     you start seeing this stepwise behavior.
               It gets quite complicated, especially when you
     look at this variety of different strength tubes because of
     different flaw sizes.
               Now if we start talking about the 9505 case,
     typically in the flaw distributions we see, whether they are
     9505 flaws or they are free span flaws, you see a few that
     contribute the bulk of the leakage, whether they are the
     measured flaws in the generator that it might pop at main
     steam line break or they are the projections through MONTE
               It is not typically a large number of flaws that
     would contribute just a little bit of leakage in the free
     span that gives you the big total.  It is the handful of
     flaws that are contributing most of it.
               If you start doing that realistically where they
     are confined in the tube support plates and maybe squeezed
     shut and you are heating everything up it is not clear to me
     that those cracks will even open under those conditions, but
     if they do we don't expect -- the main point here is we are
     not expecting a 132 GPM leak value to occur.
               We are thinking it is going to be closer to the
     one that we know we are permitting.  Originally when we were
     doing these we were talking about not one but six and we
     were pretty confident that something that would leak six in
     the free span that was encased in tightly-clenched crud
     would probably not leak one.
               As the number went from six to 20 to 50 to 132, we
     thought we needed to start asking the question again about
     how much it leaked through the crud.
               CHAIRMAN POWERS:  When we talk about the cracks
     contained within the top and bottom planes of a tube support
     plate, I think yesterday when we discussed those cracks we
     said that indeed there were opportunities for those cracks
     to extend above those two planes?
               MR. LONG:  We don't allow that. The question is
     can we always detect it, can they grow during the cycle, the
     intent is to not have them do that, and, somebody correct me
     if I am wrong here, but I think it's sort of immediately
     reportable if it's detected to have occurred.
               MR. STROSNIDER:  This is Jack Strosnider.
               I think what Ken Karwoski was referring to was
     there's been some metallurgical studies of pulled tubes
     which showed that the cracks extended slightly above the
     tube sheet and I think he was pointing out that there may
     have been some crud sitting on top of some of those tube
     sheets, providing that environment.
               There is a requirement for licensees that adopt
     95-5 to inform the Staff if they detect flaws extending
     outside the support plate.
               Now clearly their ability to do that is driven by
     the certainty or the confidence you have in the inspection
     but typically the length sizing is somewhat better and also
     it's my understanding when you look at the eddy current
     trace you can see the edges of the support plate so you have
     got some reference point there to work with so -- but at
     least in terms of any significant crack extension beyond the
     edges of the support plate I think we have got controls in
     place so that we don't have worry should it happen.
               MR. LONG:  I think the next step is human error
     probabilities and it's Gareth Parry.
               CHAIRMAN POWERS:  Am I correct, Gareth, that you
     have flow in special for this extraordinary opportunity?
               MR. HOLAHAN:  Let me confess to having dragged him
               CHAIRMAN POWERS:  I happen to know that he looks
     forward to every one of these opportunities.  He probably
     will send you a note of thanks.
               MR. HOLAHAN:  Having dragged him in, let me soften
     up some of the blows to the point of Gareth didn't do many
     of the analyses that he is going to talk about and I think
     he might not have done any of the analyses that we have
     talked about in the last two days.
               The people who did those analyses are either not
     available or they don't work at those places that they
     worked when they did the analysis for the Staff.  Some of
     the things that he is going to present to you were sort of
     patched together from information that are in a number of
     reports, so if the questioning gets too hard I will try to
     protect him a little bit.
               CHAIRMAN POWERS:  Well, understand that one of the
     things that we very much want to be able to respond to is
     the contention that the human error probability is taken to
     be 10 to the minus 3rd and we need to understand how that
     number came about.
               MR. HOLAHAN:  I understand and I have to confess
     that as an amateur PRA practitioner I did some of the human
     reliability analysis on one of the earliest reports.
               CHAIRMAN POWERS:  Let's see.  If we go through the
     SME qualifications --
               MR. HOLAHAN:  Not even close.
               MR. PARRY:  With that I will basically just even
     strengthen what Gary said and say that what I am really
     going to talk about is very general stuff since in fact I
     think the questions you had -- that accompanied the agenda
     were fairly general, and if it is not what you want to hear,
     please stop me and I will be happy not to tell you.
               CHAIRMAN POWERS:  One of the things that I very
     much want to understand is this 10 to the minus 3rd human
     error probability that was quoted by the DPO author.
               MR. PARRY:  That is not something that I can
     comment on -- but what I will do I think is just tell you
     the process that as an HRA practitioner you would go through
     and then maybe somebody could help you to see whether in
     fact in the analyses that such a process was in fact gone
               CHAIRMAN POWERS:  Can you give me some context to
     put to the 10 to the minus 3rd, what kinds of human
     activities have probabilities for human error of 10 to the
     minus 3rd?  Nothing I do, I know that --
               CHAIRMAN POWERS:  I hope.  Point one is on the
     best day I've ever had --
               MR. PARRY:  So you crash your car every one in 10
     times you are supposed to brake?  I don't think so.
               CHAIRMAN POWERS:  Good recovery.
               DR. BONACA:  The 10 to the minus 3 was associated
     with the failure of the operator to depressurize and cool
     down, that step.
               MR. PARRY:  For what?
               DR. BONACA:  For a steam generator -- essentially
     for a rapid cooldown caused by a steam line break on the
     secondary side followed by difference size ruptures, okay,
     in the steam generator tubes ranging between 100 to 1000 GPM
     so a fraction of the tube to about two tubes.
               I guess, just to give some background on that, it
     seems as if looking at the scenario you have some indication
     at some point in time that you have both a blowdown and
     depressurization event and also some leakage to the
     secondary side.
               The time involved here in this scenario is hours
               DR. SIEBER:  Maybe you should use two hours.  The
     whole event is --
               DR. BONACA:  No, no, that would be four, bigger
     breaks.  You know, this is only up to about 1,000 GPM.
               DR. SIEBER:  And the whole thing would be
     accompanied by a lot of noise and shrapnel preventing verbal
               DR. BONACA:  But you have the destruction
               DR. SIEBER:  Right.
               DR. BONACA:  The ERGs, which also include these
     kind of scenarios.
               DR. SIEBER:  Right.  And I guess that -- on the
     basis of those sort of conditions, if you can convince
     yourself that the scenarios, in fact, -- if the procedures,
     in fact, do help you through those scenarios to the correct
     actions, and the cues are fairly obvious and not confusing,
     then if you have that much time to react, and, presumably,
     it doesn't take that long from the depressurization, I
     wouldn't have thought that 10 to the minus 3 was an
     unreasonable number.
               You do find in PRAs human error probabilities even
     as low as 10 to the minus 5 for very protected time scales
     and for things that are obvious like initiation of
     suppression pool cooling in a BWR.  I think where you tend
     to have high error probabilities is where the conditions are
     such that the cues are not obvious, or the procedures are
     not helpful, or there just isn't much time.
               So I would have thought that 10 to the minus 3 was
     not necessarily a bad number.
               MR. HOLAHAN:  Can I go back historically?  Not
     that I want you to take away the mid-1980s calculations as
     our best current thinking, but I think they do address one
     important aspect, and that is that quoting 10 to the minus 3
     is misleading.  The analysis done in the 1980s, and the
     stuff done by INEL and by the staff in the 1990s, and you
     heard about some of the thermal-hydraulic analysis earlier,
     those analyses are very similar from the point of view of
     the thermal-hydraulic and the systems analysis, and the
     amount of time available and what needed to be done.
               In fact, in the 1980s, a value of 10 to the minus
     3 was also used, but it was used for what I would describe
     as the simplest cases, and those were the cases of a single
     tube rupture with either a main steamline break or some
     other secondary side failure in which the times available
     for operator action were in the range of 15 to 20 hours,
     okay.  And those are the cases that were ascribed to 10 to
     the minus 3.
               And looking at the multiple tube failures, in the
     range of two to 10 tube failures, times tended to be on the
     order of about five hours, and those were given a 10 to the
     minus 2 on reliability.  And cases of 10 and more tube
     ruptures, in which case the operator had actions to take
     more or less on the scale of one hour, were given .5 failure
     probability.  So when you hear the number quoted, it is not
     for the most extreme multiple tube rupture with a big
     steamline break, but it is complicated.
               DR. POWERS:  Let me ask a couple of questions.  We
     have got our expert here.  Maybe we deviate a little bit
     from your planned presentation.
               MR. HOLAHAN:  That's fine.
               DR. POWERS:  I am looking for insight on these
     numbers.  One of the -- and maybe, Mario, you are the right
     one to describe this a little better.  At least when we look
     at it, it seems to us that there are protracted times for
     all small numbers of tubes up to maybe not 15, but certainly
     10, that are hour times of timeframes.
               We have more troubles with loud noises and
     shrapnel and all kinds of things going on.  But in thinking
     about it, we said, gee, the cues available to the operator
     to understand what is going on are perhaps least at one
     tube, and if he has a long time to respond, he can easily be
     confused, but they become much more clear as we move up to a
     few tubes.  And then, as you move beyond that, you start
     losing time.  So that there might be an optimum in here of
               MR. HOLAHAN:  I am convinced the optimum is zero.
               DR. POWERS:  You are looking at a grander, on a
     larger scale optimization than I am.  Now, is this
     completely ridiculous thinking?
               DR. BONACA:  No, no.  In fact, I think that the --
     well, first of all, yeah, what Gary said is correct.  I mean
     this is in reference to NUREG-1477 where we pointed out it
     is between a fraction of a small pinhole probably and range
     all the way to maybe a tube, tube and a half, something like
     that at.  And if you look at the INEL analysis, they have
     made different assumptions, because they have more tubes and
     they go in 10 to the minus 2 and then .5.  And so there is a
     consideration of time.
               Second, the INEL report makes the consideration
     that when you go to beyond three to four tube ruptures, the
     hole is large enough that you cannot repressurize. 
     Essentially, the pressure comes down on the primary side and
     rather than coming back to the shutoff head of the high
     pressure injection, tends to stay low, and there is clear
     indication that there is a hole in the system.  And so the
     system itself drives itself to the conditions of
     depressurizing and pulling down, I mean just simply it is
     going there.
               DR. POWERS:  It is going itself.
               DR. BONACA:  And now again, even for those
     scenarios, you have hours of time still to take some action
     and, clearly, if you don't take action in two, three hours,
     then you are going to go toward depletion of RWST.  But the
     procedures, if you look at the ERGs and you read them over,
     there is a lot of consideration of that concern of RWST --
     RWST depletion.
               So they are not moot about that, they are talking
     about the need of maintaining subcooling, but also to
     prevent RWST depletion.  And so you don't pump water for
     hours and the operator simply is unaware that he is
     depleting the RWST.  In fact, he is going to be very
     concerned about that.
               And the other thing is that, which is encouraging
     to me, is that the ERGs speak about the possibility of going
     to RHR in a saturated mode, which means they are informing
     the operator even during the training that he may not be
     able to recover subcooling.  But he then can -- which
     implies that he has a large hole in the system.  Okay.
               So there are, you know, there is a lot of
     information in the ERGs to be encouraging.
               Now, the only thing that is confusing, and I want
     to point out is that, if I remember, when you have a
     steamline break, you have containment desolation, and you
     have also -- I believe you have loss of the air ejector.
               MR. HOLAHAN:  Yes, that's correct.  Yes.
               DR. BONACA:  Okay.  So there is lack of some
     indication there to make -- so that may delay at the
     beginning his determination that he has a hole in the
     system.  But I don't think these numbers, I mean are that --
     are reasonable.  10 to the minus 3, again, it is reasonable
     in a scenario that lasts for 10 to 20 hours.
               DR. POWERS:  Well, my recollection is that we saw
     a discussion.  We had -- I mean it was a discussion I think
     of perhaps the Halden reactor, where you had poor
     performance despite these times and whatnot.  I mean do we
     understand why that is?
               DR. BONACA:  Well, first of all, I think -- I am
     not sure the presentation really represented the situation
     today where the ERGs are an established symptom oriented set
     of procedures.  I daresay that in the '80s, I would not have
     the same level of confidence at all, because there was no
     structured process to recognize, for example, this potential
     for rapid cooldown and steam generator tube rupture.  But
     the ERGs recognize that very explicitly because they are
     telling you how to get there.
               And I don't know about the Halden project, if it
     is recent, and I am not sure that the operators represented
     there had, in fact, the helpful procedure structure the way
     the ERGs are.
               DR. SIEBER:  I think there is another factor, too,
     because you would end up in some kind of a callout status at
     the plant, and you would have more help than you could shake
     a stick at, including the technical --
               DR. POWERS:  That was universally recognized as a
     bad thing.
               DR. SIEBER:  Well, nowadays it is supposed to be
     organized and structured.  And what you don't want is a lot
     of people running in and out of the control room.  On the
     other hand, you have the ability to have turnovers.  You
     have the ability to do calculations.  You have the ability
     of innumerable people to critique and watch what is going on
     and provide technical assistance.
               The other thing that is not on that sequence is
     there is a lot of other things that happen, because if your
     power which causes the accident conditions, you get a
     turbine trip or reactor trip, you have about 35 things that
     you have to do to respond to that, and they are going to
     open up safety valves, which make almost as much noise as a
     break someplace in the steam system.
               If it is inside the building, all your fire alarms
     are going to go off, okay, like happened at Surry.  And so
     you are going to have enunciator lights and computers
     reeling out tons of stuff on CRTs.  And if that is
     accompanied by a tube rupture, and you don't have in control
     room N-16 monitor outputs, you are going to have a problem
     recognizing that right away, because the reaction of the
     parameters on the reactor coolant system which the operator
     begins to monitor is the same for steamline break as it is
     for a tube rupture for that first increment, until all of a
     sudden, because you are going to go pretty far down on
     pressurizer level and pressure is going to come down.  The
     plant is going to cool off pretty severely.
               So it isn't until you are into that a little bit,
     and you get that blowdown and the cooldown, you can tell
     that, uh-oh, I am on a different path than what I would
               DR. BONACA:  That's right.
               DR. SIEBER:  With N-16 monitors, which are
     required and aren't Reg. Guide 1.97, you can pick it up
     pretty quick.
               DR. BONACA:  The last comment I would like to make
     about that is that, you know, 10 to the minus 3 is always a
     very hard number to -- you know, it is a very small number. 
     But the other comfort I got in reviewing this material is
     that it comes out to an increasing CDF of 2 in 10 to the
     minus 6, and I thought, what if it were 1 in 100, it will
     come 2 in 10 to the minus 5.
               So that gave me some comfort than even with
     significant uncertainty applied to it, I would still get a
     relatively small increase in CDF.
               MR. BALLINGER:  I need to get something squared
     away in my mind.  In the case of IP-2, the staff assigned a
     probability of failure of .1 for that event, and I see 10 to
     the minus 3 here.  Operator failure.
               MR. HOLAHAN:  Failure to do what?
               MR. BALLINGER:  Failure -- now, that is what I
     want to get square away?  I mean Jack's -- well, it was
               MR. HIGGINS:  I think it is important to realize
     that we are talking about many different sequences here,
     Ron, with all the different things, because over the last
     two days we have talked about -- I mean we have gone through
     the spontaneous steam generator tube rupture.  We have gone
     through the various accident induced ones that delta P
     inducted.  And all of those have somewhat different operator
     actions associated with them considering the timing and
     considering the actions and the stresses that John was just
     describing, and those are all going to have different HEPs
     when you do the calculations.  So it is very much too
     simplified to just say that 10 to the minus 3 is the number
     used in these analyses.
               DR. SIEBER:  Another factor is that Reg. Guide
     1477, I guess it is.
               DR. POWERS:  NUREG.
               DR. SIEBER:  NUREG.  Really looks at the accident
     as -- since the Reg. Guide 95-05, assumes that the tubes
     don't rupture and just leak.  It follows the simple event
     tree of a steamline break, which is much simpler than having
     these two events going on at the same time.  And so the
     analysis in 1477 may be justified because the accident, the
     event tree that you are analyzing is simpler than one that
     has these two accidents going on.
               Actually, the question is, does the steam
     generator hold up?  And if it doesn't, it leads you into
     another sequence which hasn't been analyzed here.
               MR. LONG:  What is 1477 was intended to look at
     the DPO issue of a large amount of leakage due to cracking
     that was in the freespan.  So if you look at the event tree,
     there is no conditional probability that leakage will occur. 
     That was just put in as one.
               DR. BONACA:  As one, yeah.
               MR. LONG:  And so it didn't really appear in the
     tree.  And then the intent was to try to deal with the
     combined event.  And, initially, we simply lifted the human
     error probabilities from NUREG-0844 that Gary was talking
     about earlier, and we went through some analyses to try to
     figure out where we would leave them to be, with some
     additional effort that I described yesterday, to some
     degree, at least up to the point of what the inputs where.
               And eventually, I believe, in 1570 we used 10 to
     the minus 2 instead of 10 to the minus 3.  So we did shift,
     but we were still dealing with moderate primary to secondary
     flows, not, you know, tens of thousands of GPM, but maybe a
     thousand GPM or multiple hundreds of GPM for those events.
               MR. PARRY:  I think, though, the key really is for
     them to be able to understand the status of the plant as it
     -- particularly with the failure of both the secondary and
     the primary side and whether the procedures will lead them
     down that path.
               I think initially, the -- I only know the
     Westinghouse system, and that's from a few years back.  I
     guess initially there would be an E2, which would be the
     steam line break from the generator and then maybe
     transmission into E3 or even E1.  And eventually, they would
     end up probably doing the right things.
               MR. BONACA:  Yes.  I mean, I didn't see anything
               MR. PARRY:  They all lead down the same path.
               MR. BONACA:  Yes.  It will lead down the same
     path.  I believe tougher is going to be a small leak because
     you have a steam line break, you don't know that you have a
     small leak.  But you have plenty of time to --
               MR. PARRY:  Right.  To compensate for that. 
     Actually, in a sense, you cut straight to my last viewgraph
     with your talk, so I'm really not sure it's worth going
     through what I've written here because I think we have
     covered the issues that -- yes, there's a possibility that
     there is a confusion factor, and that's something that has
     to be taken into account.  The more confusing it is, the
     less likely the likelihood they will succeed.
               MR. HOLAHAN:  I think there has been some
     misunderstanding in the past on this point, a
     misunderstanding that the staff had intended to use the
     human error probability of ten to the minus three for some
     extreme multiple tube rupture cases, and that has never been
     done.  So I think it seems to me that the real issue is not
     how the operators would respond.  No one is going to give
     them credit for handling 100 tube ruptures with a main steam
     line break.  The real question is how likely is such a thing
     to happen?  Are there real mechanisms that would allow such
     a thing to be sufficiently likely that they need to be
               MR. BONACA:  The other thing that I think is
     confusing somewhat is that the objective has always been one
     of, you know, not emptying the ARWST.  But as Dr. Ward
     pointed out this morning, then there are hours before you go
     to core uncovery, about four hours, and so it seems to be
     very unlikely to think of an event of this kind evolving to
     the point where you're emptying the ARWST and then you sit
     there for four hours without doing anything.  I mean, I
     think in this comprehensive scenario, there are many
     opportunities to take action and --
               MR. PARRY:  Yes.  I mean, isn't there the
     contingency to refill the RWST called out in the procedures
     as well if you don't have anything in the sumps.
               MR. BONACA:  That's right.
               MR. PARRY:  Those are things you can do, and
     that's probably not taken into account in these analyses is
     my guess.
               MR. BONACA:  That's right, as well as, for
     example, connections already existing with other tanks on
     the site.
               MR. PARRY:  Right.
               MR. BONACA:  Many sites have additional RWSTs
     available for make-up.
               MR. HOLAHAN:  Since I've already confessed to be
     being a amateur HRA analyst, I would like to add three
               The issue about operating experience showing that
     operators didn't handle the events very well I think all
     relates to the design basis issue of quickly isolating the
     generators in the time frame of 30 minutes, and I think
     those are valid criticisms, that the traditional use of 30
     minutes is, in fact, not so easy for operators to figure out
     which generator has the leak and basically to isolate that
     generator in 30 minutes, because, in fact, operators,
     although they figure these things out, the real process of
     acting is more deliberate than the analysts assumed 30 years
               Second insight is, at least from the NRC's end of
     the phone calls, I've seen a number of events and many, many
     drills, and there's a great deal of sensitivity to radiation
     anywhere outside the reactor coolant system, and I think one
     of the things we're talking about is, you know, an operator
     having knowledge that there is a steam line break and a tube
     rupture and radiation signals from around the plant I think
     would, especially over the time frame of hours, would be
     something the utility would be very sensitive.
               Thirdly, the NRC operations center two floors up,
     if we're talking about 15- and 20-hour scenarios and going
     to core melt, I would have to think that we would have
     failed on our end in figuring out what in the world was
     going on in those plants, and as the director of the reactor
     safety team in the operations center, I have a hard time
     saying that we wouldn't figure it out on our end.
               MR. BONACA:  I would like just to add that I agree
     the 30 minutes objective right now is one that seems to me
     that is somewhat -- the operators almost because it's a
     requirement that has to be met.  But if there are some
     complications there, they may not pay attention to those
     because they're so focused on equalizing pressures between
     primary and isolated steam generators within 30 minutes,
     which is very challenging for them to do.
               CHAIRMAN POWERS:  Is it your perception that this
     evaluation that was done for the Halton staff -- when it
     says poor, is poor relative to a 30-minute time window which
     seems to be a completely arbitrary sort of thing?
               MR. HOLAHAN:  It's not arbitrary; it's part of the
     design basis dose calculation that Jack Hays showed you
     yesterday as leading a small fraction of the part 100.  But
     from a severe accident point of view, it's irrelevant.
               CHAIRMAN POWERS:  Okay.  Well, I guess I'm looking
     at a design basis accident point of view right now.
               MR. HOLAHAN:  What I would say is from a design
     basis point of view, the steam generator tube rupture and
     dose calculations have many, many conservatisms.  We once
     calculated about four orders of magnitude of conservatisms
     in the dose calculations, okay?  And I think we talked about
     iodine spiking and looking for the 95th percentile and the
     meteorology 95th percentile.
               Well, the one thing in that sequence that's not
     very conservative is the time to isolate the generator,
     because I think 30 minutes is certainly possible, you know,
     but experience shows that 45 minutes or an hour is more
     likely to see what happens.
               But I think if you see that in the context of the
     overall conservatism of the design basis calculations, it
     doesn't bother me very much.
               CHAIRMAN POWERS:  Design basis are always very
     confusing to me.  I mean, there seem to be times when we're
     lenient and times when we're not, times when we invoke risk
     and times when we don't.  Clearly in the design basis
     analysis, by the time the day is over, we have no idea what
     the total level of conservatism that you compose because it
     shows up in multiple places.  But you also have the same
     problem when you start granting leniency, that it doesn't
     bother you very much on these things.  You don't know how
     much of the margin you have taken away.
               MR. HOLAHAN:  But in this case, it doesn't even
     bother me very much with respect to meeting the part 100
     dose guidelines.
               I understand it's a little different when you say
     we're going to shave design basis margin because I don't
     think the risk implications are very important.  In this
     case, I think the exact time of steam generator isolation
     isn't really all that critical to meeting part 100
               CHAIRMAN POWERS:  I think I understand.
               Do you have other points that you --
               MR. PARRY:  Not really.
               MR. HOLAHAN:  I would just like to summarize on
     one point.  The numbers I read you and that Steve said had
     been picked up are at least 15 years old, that when we redid
     some of the analysis in the 1990s, we rightly thought that
     they should be re-looked at, and INEL did some human
     cognitive reliability analysis and came up with some
               But even when they did those analyses, they
     identified them as screening type analysis and they thought
     that some additional work ought to be done to, you know,
     refine the answers.
               So I think we're not saying that we know or have
     really solid information on human reliability.  I agree
     completely with Dr. Bonaca's observation that you can do
     some sensitivity studies and change the answers and see that
     it's not all that critical if the values aren't quite ten to
     the minus three, and they're certainly not ten to the minus
     three, nor have they been claimed to be ten to the minus
     three for the most severe cases that we've talked about.
               CHAIRMAN POWERS:  Gareth, I think I want to ask
     you a question.  It's going to be very difficult for me to
     put forward.  It's not a question you're going to want to
               MR. PARRY:  Then I won't.
               CHAIRMAN POWERS:  I'm going to plead passionately.
               We have this design basis time window of 30
     minutes in which we would like the operator to identify the
     leaking steam generator and isolate it.  We are told by Mr.
     Holohan that this is a challenge for them, that in fact a
     better time period for doing that isolation process might be
     45 minutes to an hour.  Jack has described to you a chaotic
     situation in which there are lots of alarms going off and
     whatnot.  At the same time, we do have a pretty good set of
               From your vast storehouse of experience and
     knowledge on these subjects, what would you guess the
     probability that the -- I don't want to call it an error
     probability -- the probability that an operator would fail
     to complete this task within the 30-minute time frame?
               MR. PARRY:  You're right, I wouldn't want to
     answer that question.
               CHAIRMAN POWERS:  But I'm going to plead so
               MR. PARRY:  And the reason I wouldn't, I think, is
     because it's so dependent on the details of the procedure
     and the training.
               But let me give you one little insight, that if we
     were analyzing -- typically if you're analyzing spontaneous
     tube ruptures and you are concerned about the isolation of
     the generator, the success criteria in most PRAs as I
     understand it, or certainly the ones we used to use, were
     not 30 minutes, it was before the steam generator
     over-filled, which typically would be on the order of an
     hour depending on the size of the leak.
               So -- and for those -- for that particular step in
     the procedure, and just the isolation, I think -- I'm trying
     to think back.  Typically we would probably have used an
     error probability of the order of ten to the minus two.  But
     at that point, then it becomes a contained accident.  And
     the worst case is if they don't do in that time, then we
     have to go down to RHR.
               So those scenarios, I think the error probability
     for that simple single tube rupture type scenario I'm pretty
     sure was a lot less than ten to the minus three because of
     the length of time available.
               MR. HOLAHAN:  Could I add something?  I just
     wanted to add something to that.
               Before I came, I went through -- we were doing
     some work for the STP process for the NRC as far as
     developing the risk-informed inspection notebooks and
     developing the operator actions and the credit for those in
     those, and I went through and looked at some of the steam
     generator tube rupture related human actions from IPEs and
     for the PWRs, there were two that were important.  One was
     this early isolation of the ruptured steam generator and the
     other one was depressurizing the primary, and they both
     typically run around ten to the minus two.  I've got some
     data here from -- I don't know -- maybe 30 plants, not all
     of which have clearly identified HEPs that you can extract,
     as Gareth knows.  But I would say in general, they average
     about between 1.0 and 2.0 times three to the minus two for
     each of those actions separately.
               MR. PARRY:  Now, what you said about
     depressurizing the primary, you're talking about
     depressurizing to RHR entry conditions.  Is that --
               MR. HOLAHAN:  Right.  Depressurizing it below that
     of the secondary, not all the way to RHR.
               MR. PARRY:  Okay.  Okay.  Just to stop the leak.
               MR. HOLAHAN:  Right.
               MR. PARRY:  Okay.
               MR. HOLAHAN:  Right.
               MR. PARRY:  Okay.
               CHAIRMAN POWERS:  One of our speakers earlier in
     the week presented a -- I guess his assessment of the
     performance of various operational teams during the course
     of a spontaneous steam generator rupture event, and I was
     trying to find it, but my recollection is that it's a litany
     of delay doing this task, doing the other task, delay doing
     the third.  Is that coached, these numbers, that you get ten
     to the minus two human error probability?  I mean, it's
     funny because, I mean, it's a time window.  The guy can do
     it successfully in 35 minutes.  Do I count that as a failure
     because it wasn't 30?  I mean, it doesn't seem right to do
               MR. HOLAHAN:  Not in PRA space, you wouldn't.
               CHAIRMAN POWERS:  Not in PRA space, but we're in
     design basis space.
               MR. PARRY:  No, we're in PRA space.
               MR. HOLAHAN:  Yes.
               MR. BONACA:  I can't remember exactly.  You
     remember the time frame for those tests?
               CHAIRMAN POWERS:  They weren't tests.
               MR. PARRY:  Yes, they were --
               CHAIRMAN POWERS:  These were events and they
     extend from the early '70s up until just a few months ago.
     They span quite a range.
               MR. BONACA:  Yes.  First of all, I would separate
     time.  I think that after --
               CHAIRMAN POWERS:  Well, the story was consistently
     the same.  It was always delay doing something, and my
     recollection of IP2 was there was a pretty good story there,
               MR. PARRY:  Did any of those events lead to
     over-filling the generator?
               CHAIRMAN POWERS:  I believe there was one of them
     at least that did lead to over-fill of the generator.
               MR. PARRY:  That one I would count as a failure
     for the isolation.
               MR. HOLAHAN:  I would consider it a design basis
     failure.  Among other things you would have released water
     as opposed to steam and so partitioning and a lot of other
     things in the analysis don't come out right.
               CHAIRMAN POWERS:  You would jump all over Ginna?
               MR. HOLAHAN:  I believe I did.
               MR. LONG:  I think part of the point here is that
     Jim has talked about the human errors for our failing to
     isolate when the -- well, in your case I guess it was the
     overfilling, it was the IPEs.
               That is not the whole step to core damage though. 
     If you look at the way the rest of the logic goes, there's
     typically another human action in there or some other
     equipment failures that you have to use to get the core
     damage so if you take the product of the human errors, that
     gets you all the way to core damage in that particular cut
     set that is just pretty much all of the operator's fault.
               The number typically comes out more like 10 to the
     minus 4 as the total product, maybe lower depending on the
               MR. PARRY:  That's right.
               MR. LONG:  That was the kind of number we were
     trying to capture when we did the event trees for 1477 and
     the sort of event lists for 0844.  It was the total process
     so that top event was operator fails to pressurize, cool
     down RHR.
               In that regard I think we are being somewhat more
     conservative than what you would see for the spontaneous
     rupture for the overall human error.
               DR. SIEBER:  I guess what I am struggling with, I
     have got 10 to the minus 3.  I have a historical inventory
     of events that I will admit goes from the Dark Ages to the
     Modern Day.
               MR. HOLAHAN:  Zero for 10 core melts.
               CHAIRMAN POWERS:  But one that excited the
     esteemed Holahan and got him agitated and he considered a
               MR. PARRY:  No, a failure to isolate the
               CHAIRMAN POWERS:  Now he considered it a failure.
               MR. LONG:  It was a failure to prevent overfill, I
     think was the issue.
               CHAIRMAN POWERS:  I think it was a failure to
     prevent release of radioactivity to the outside.
               MR. HOLAHAN:  That is before I became an amateur
     PRA expert.
               CHAIRMAN POWERS:  It is not entirely clear that
     that is a step forward on the evolutionary path.
               DR. BONACA:  Let me just say a couple of things I
     would like to say about that.
               First of all, again as I said yesterday, steam
     generator tube rupture within the constraints of what they
     are supposed to with the objectives, the 30 minutes, some of
     the most challenging sequences, because the time is short. 
     Certainly they are not going to have any help very much.
               That is control room delivery issues.  Many of
     them are dealing with other issues. For example, because of
     spurious safety injection actuation many of them are running
     with their block valves closed on PORVs on some of them, and
     then that complicates the ability of depressurizing and all
     this kind of stuff.
               So the 30 minutes becomes a real difficult time,
     okay?  Now here when I was looking at these other scenarios,
     which is very different -- you have a depressurization on
     the primary side and you have a tube rupture in addition to
     that, both of them are helping in the direction of going
     towards a target which is the one of depressurizing and
     cooling down within hours.
               That is a different story because when it passes
     30 minutes you are going to have, with an event like this
     you are going to have all kinds of help coming down to the
     control room.  Now hopefully it is not all confusing, the
     help, but people are going to begin to see things and there
     are signals around the site telling things so even if there
     was a guy who absolutely misunderstands the event, the
     others will not.
               I mean that is -- that was one consideration I had
     in the sense of how confusing is it going to be, how
     ambiguous is it going to be.
               The other issue is -- again, I don't want to
     minimize that -- I said to myself what if it was 1 in 10 to
     the minus 2 and that still would get to a number of two 10
     to the minus 5 for CDF so the contribution was still
     acceptable with the significant error range that because
     again I mean there is an uncertainty there --
               CHAIRMAN POWERS:  The truth of the matter is that
     two times 10 to the minus 5th is not what I would call
               I mean that gets me interested at least in the
               MR. LONG:  That was with guaranteed massive
               CHAIRMAN POWERS:  I keep coming back -- I keep
     coming back -- I know the consternation of most to the
     design basis issue because I think that is the issue I have
     to confront.
               Suppose that I said that I will forgive the 30
     minute window.  I don't care.  That's somebody else.  What I
     really, really want to do is I want to prevent the release
     of enough radioactivity to get the younger Holahan prior to
     his exposure to PRA excited about the radioactivity release.
               Why would I not be justified in saying that the
     failure to keep Holahan happy criterion is a .1 probability?
               MR. LONG:  Based on the empirical evidence?
               CHAIRMAN POWERS:  Yes, the empirical evidence yes.
               DR. BONACA:  For steam generator tube rupture?
               CHAIRMAN POWERS:  Yes, spontaneous steam generator
     tube rupture.  I have one that I know for sure got him
               MR. HOLAHAN:  Which didn't exceed Part 100.
               CHAIRMAN POWERS:  I understand.  I understand --
     still got you upset.  I mean it got you interested.
               MR. HOLAHAN:  It's cold in --
               CHAIRMAN POWERS:  It's not terribly cold, it
               DR. BONACA:  I wouldn't disagree with that
     estimate for the steam generator tube rupture.
               MR. LONG:  I think people have modified procedures
     a lot since then so you might get back into Gareth's
     expertise by trying to figure out what the new probability
     is if you think it has changed.  That is the issue.
               CHAIRMAN POWERS:  I think that's a very fair
               MR. HIGGINS:  Let's say it is and it may very well
     be .1 to do the thing you just described.
               Is that an issue?  I don't think so.
               MR. HOLAHAN:  Not necessarily.  As a matter of
     fact my sympathies at the moment are with Dr. Bonaca.
               I mean if we had to do it over again I would say
     we have got to be more realistic in the overall calculation
     of, you know, dose and consequences of steam generator tube
     rupture and put less demand on the operator and a little
     more demand on the meteorology and we may very well meet the
     same goals in a more appropriate fashion.
               MR. LONG:  One thing -- I'm sorry, Gareth, go
               MR. PARRY:  No, I wasn't going to say anything.
               MR. LONG:  One thing that we should mention before
     we get off the subject is that the Office of Research has a
     program and I think you have heard of that called Athena, to
     look at errors of commission and omission and procedures,
     and I think one of the things they are doing this week that
     is making it hard to get the right people in the right place
     at this time is to start looking at steam generator tube
     rupture issues with that new process.
               Also, I want to point out that Indian Point --
     Consolidated Edison has proposed breaking the steam
     generator tube ruptures, at least the spontaneous ruptures,
     into two categories, sort of like small and large LOCAs or
     small and large tube ruptures, the splits being kind of
     plant-specific, the bottom of the small being that your
     first charging pump has run out of capacity and you have to
     do something to add charging and the top of the small being
     you have no more charge to add -- you have to go to safety
     injection and then the safety injection is the -- onward is
     the larger sizes.
               I think there's some benefit to that because I
     think the human errors are probably different and the
     opportunities for making it worse are still there while you
     are in the lower leak rate --
               CHAIRMAN POWERS:  I think the opportunities to
     make it worse is the advantage of doing that.
               I mean I see it as an advantage.
               MR. LONG:  One of the other things -- we haven't
     mentioned it yet -- but if you have the secondary side
     failure first, one of the things the operators are worried
     about is the cooldown rate, and there's a lot of competing
     things in there -- keeping the core covered, keeping
     subcooling margin, trying not to get your cooldown rate to
     be too large, and they'll sometimes try to heat back up real
     quick because it is over an hour the way they see it and
     they are trying to put this all together with the Athena
     program, so I think there is some opportunity for re-looking
     at this and maybe coming out with more of a consensus on how
     to do these things, because as I pointed out earlier, just
     in the IPEs there were almost four orders of magnitude
     difference in the result of the way people were applying the
     logic to just the spontaneous rupture in the industry right
               That is not a very good, firm basis.  My next
     slide is on uncertainties and that certainly is one of them.
               MR. HOLAHAN:  I wanted to tie this issue back to
     the design basis.  I think you said you want to wrap that up
               It seems to me that there are a number of issues
     here which could use a re-look by the Staff at how the
     design basis steam generator tube rupture is treated.
               Frankly, I wasn't completely happy with our
     discussion of iodine spiking in that I think the story
     wasn't entirely convincing, although I think the licensing
     basis that we have used is reasonable but I don't think we
     told the story in a convincing way.
               I think there are a number of conservatisms in the
     design basis steam generator tube rupture that are not
     necessarily serving the public or licensees very well, which
     in my mind makes it a good candidate for risk informed
               In that context I would say you could look at
     realistic iodine spiking.  You could look at the demands you
     are putting on the operators and what makes sense and what
     is counter-productive.
               You could re-look at the conservatisms in
     meteorology and other issues and I think today we could come
     up with more sensible design basis requirements for steam
     generator tube ruptures than we have inherited over the last
     30 years.
               CHAIRMAN POWERS:  I am pretty sure I agree with
               MR. HOLAHAN:  And if a committee were to recommend
     that to me, all I would have to do is prioritize it with our
     other risk-informed activities.
               CHAIRMAN POWERS:  I understand that the committee,
     this committee, gathers facts and provides information to
     the ACRS.  The ACRS will in turn make a recommendation to
     the EDO.
               MR. HOLAHAN:  I certainly wouldn't want to
     influence that process.
               CHAIRMAN POWERS:  And let me assure you you
               MR. HOLAHAN:  Thank you.
               CHAIRMAN POWERS:  I think I understand better my
     design basis human nonconformance probability.  I think we
     have lots of fertile thinking on the severe accident side of
               I, myself, find very attractive this idea that
     there are gradations in that error probability that are not
     linear and with the magnitude of the break kind of
               Is there anything else you need to tell us?
               MR. PARRY:  No, but if you are more interested in
     human reliability there is a graduate course they give at
     the University of Maryland --
               DR. KRESS:  Who is teaching that?
               CHAIRMAN POWERS:  Anyone I know?
               MR. PARRY:  Possibly.
               CHAIRMAN POWERS:  Could I get a good grade?
               MR. PARRY:  That depends.
               MR. HOLAHAN:  I can tell you, I am not willing to
     take the test.
               MR. LONG:  I guess the next subject on there was
     uncertainties in the risk assessments.
               Shall we plunge ahead?
               CHAIRMAN POWERS:  Sure, please.
               MR. LONG:  I think we have talked about these to a
     large degree.  There are sort of three areas that I want to
     talk about.  The human error probabilities.  I think I won't
     spend any more time talking about the uncertainties in
               We have talked about the NDE detection of flaws,
     and I think you have seen the POD in that.  I will mention a
     couple of things that came out of some reviews of license
               Then there are the tube strength estimates based
     on the NDE characterizations of the flaws.
               When I wrote that slide, I think I left off
     thermal-hydraulic modeling uncertainties.
               MR. POWERS:  I didn't think there were any.  I
     thought thermal-hydraulics was a well established field of
     an exact science.
               MR. CATTON:  It's considered to be a mature
     science, but not exact.
               MR. POWERS:  It's only the participants that are
               MR. KRESS:  Geriatric science.
               MR. LONG:  When we did NUREG-1570, we tried to do
     sensitivity studies on the various things that went into the
     risk assessment.  What we really figured out was it looked
     like we were very sensitive to what the flaws were.  If you
     took a different flaw distribution, you got a different
     answer.  We were very sensitive to what the temperatures
     were on the tubes at least relative to the surge line in
     terms of heatup rate of the tube in competition.
               We were sensitive to whether you had cutting from
     small flaws or not.  In other words, the cutoff size of 0.25
     and how much you worried about the small flaws.  We knew
     that, and we reported that in the report.
               Then, as we went forward and tried to apply this
     later on, we found some other things.  In particular, with
     the thermal-hydraulics the RELAP/SCDAP output is the
     temperature of one assumed to be representative of the heat
     transfer hot tube.  I'm not sure exactly what that means in
     terms of average over the tube sheet for the different tubes
     that are carrying the flow, but when we do these
     calculations we need to know what the hottest tube is.  We
     want to know if either the pristine tube or a tube has sort
     of an undetectable expected amount of degradation in it
     since the tubes are to some degree aged and there are some
     things that are on the order of 20 percent through wall you
     probably just can't find.
               We don't really have that.  There are varying
     opinions as to how close we are to that with the RELAP
     number.  If I talk to some people, I hear, well, we're very
     close.  If I talk to others, there is some concern that we
     are not very close at all.
               So that is the beginning issue.
               The next part of it is, if somebody tells me I
     have a few flaws and they are distributed somewhere in the
     hot leg side of the tube sheet, I don't know, first of all,
     if they are in or not in the hot part of the bundle.  If I
     am told that the hot part of the bundle is 53 or 35 percent
     of the bundle, at least I have a statistic I can start using
     to try to get a probability that one of my bad flaws is
     within that region.
               But within that region there is quite a variation
     in tube temperature.  So I have difficulty in trying to
     figure out what the probability is that my weak flaw is
     going to my hottest tube or a tube that is at least hot
     enough to cause it to fail before the surge line.
               I tried in the Farley analysis about a year and a
     quarter ago to squint real hard at the distributions of tube
     temperatures like I showed you before and tried to get some
     areas that I thought were hotter by a certain amount than
     the temperature that RELAP predicts, and for that matter,
     there has to be some that are cooler as well to make that
     some sort of an average.  I purposely didn't write down the
     details because I didn't think I did well enough that I
     wanted anybody to just copy it.  In the NRC, if you are not
     careful, it will just be copied by the licensees from then
     on because it's something that they think we are going to
     approve since we did it ourselves.
               I noted that if I scaled the difference in the
     tube sheet temperatures just from what I could see from
     variation in the tube sheet, if I took the delta between the
     cold and the hot as the scaling parameter and then looked at
     the fraction of that delta, I get a different answer than if
     I took the delta from the hot leg to the tube sheet and
     looked at the variability.
               So there is a real issue here about how do you get
     a distribution of temperatures on the tube sheet.
               MR. CATTON:  I would agree with that.
               MR. LONG:  I knew you would, but I know some
     others won't.
               So it basically comes down from the mixing of the
     countercurrent flows and what we can do with those.
               MR. CATTON:  This is the same exercise that I went
     through a few years ago to the same conclusion.
               MR. LONG:  We have talked about some beginnings to
     try to get more information on that.  There is some question
     about how far we can go without doing physical studies. 
     Right now NRR has asked Research and Research has responded,
     and we have said, yes, that looks like a good start.  The
     question is, will we get to what we need to do these things
     adequately for licensing purposes.
               We have talked about the effects of leakage on the
     tubes.  We don't know where that really starts becoming
               We also talked about sort of the non-stylized
     accidents where you have leaks of different sizes in
     different places and the RCS and what effects that may have. 
     It really complicates the picture quite a bit.
               We also have a concern that we seem to get
     consistent differences between MAAP calculations and RELAP
     calculations.  Of course there are people who wrote one that
     are throwing bricks in the direction of the guys that wrote
     the other.  Mark Kenton has been doing a fair amount of work
     to try to figure out if he can make MAAP look the same as
     RELAP.  One of the things that he has picked up is he thinks
     he sees an importance in radiative heat transfer between the
     fluids and the walls.
               MR. CATTON:  What is the fluid?
               MR. LONG:  At the point he is doing it, it is high
     pressure, high temperature steam.
               There is also the differences that the licensees
     are giving us calculations with one code; we are using
     another code, and they don't tend to predict the same order
     of stuff failing necessarily, much less the same timing or
     the same temperatures.
               So we feel there is a fair amount of uncertainty
     here, and it makes it difficult to do an analysis and then
     to take that into the decision making process.
               I will go a little bit further than the slide was
     intended to go and say, when I had to do this for Farley, I
     sort of had an option of telling Farley that their
     application really didn't address Reg Guide 1.174 or to
     recognize that we really hadn't ever put out any guidance
     although we had been asked for it for years and to go ahead
     and follow the other guidance I have, which is to say, if
     you can reasonably figure it out for yourself, go ahead and
     do it.  So that is what I tried to do to see how far we
     could get.  Because Farley was so much like the Surry plant
     we have studied for a couple of decades, I thought that was
     a good basis to make the attempt.
               Other things that are pretty uncertain come from
     the creep model for the RCS components.  We are assuming
     infinitely long thin wall tubes.  Maybe the steam generator
     tubes kind of fall into that category.  But if you start
     looking at things like the surge line, which we hope will
     fail first, it has a lot of angles.  It has restraints on
     its growth.  There are welds which are probably not perfect. 
     So the destructive effects may not be the ones we are
     modeling, and if we are lucky, maybe it will fail earlier
     than we model.
               MR. POWERS:  When you model the creep rupture in
     things like the surge line, do you use damage accumulation
     in the model?
               MR. LONG:  Yes.
               MR. POWERS:  Do we have damage accumulation kinds
     of data for things that have to get that hot?
               MR. LONG:  I think somebody has failed a surge
     line in a test, right?
               MR. BALLINGER:  This is stainless steel, right, or
     is it carbon steel?
               MR. LONG:  It depends on which plant you are
     talking about.
               MR. BALLINGER:  There is a lot of data for
     stainless steels in these temperature ranges from the fusion
     program, but not carbon steel.
               MR. MAYFIELD:  This is Mike Mayfield from the
     staff.  Surge lines are going to be either cast or wrought
     stainless.  Nobody runs carbon on the surge lines.
               MR. BALLINGER:  There probably are a fair amount
     of data.
               MR. MAYFIELD:  We've broken them, literally a
     surge line we got from a canceled plant, but it was at
     normal operating pressures and temperatures rather than
     these elevated pressures and temperatures.  That is one of
     the things we have been talking about doing in this
     additional work that NRR asked us to do, to look at the
     elevated temperature response.
               MR. CATTON:  Where does it fail?
               MR. MAYFIELD:  We were intentionally flawing the
               MR. CATTON:  Is it the pipe itself that failed?
               MR. MAYFIELD:  Yes.  Where it is going to fail is
     where you have a crack in it, which in this case was in a
               MR. CATTON:  How far away from the hot leg is this
               MR. MAYFIELD:  This was in a straight piece of
     pipe.  It's wherever you put the flaw.
               MR. CATTON:  The surge leg comes into the hot leg
     where everything is very thick and welded in there.  It must
     be really tough to figure out when it's going to fail.
               MR. LONG:  Also, if you take a look at the way we
     model some of the hot legs.  If we model for plants that
     have stainless steel hot legs, we may model the safe end to
     the vessel.  The question is, is that really long thin wall
     pipe at that point that is constrained at one end by a weld
     of more capable material and on the other end by a very
     thick vessel?
               MR. CATTON:  It makes this crossover even more
     uncertain, doesn't it?
               MR. LONG:  If you start looking at the short,
     complicated shapes, I don't think we are modeling those very
     well at all.  We are using a creep damage accumulation model
     as if it's a thin wall pipe at the temperature that is the
     median temperature of the full wall thickness, if I remember
               MR. CATTON:  That's kind of a heat model for
     RELAP, isn't it, just a chunk of metal with resistance to
     the center, and the capacitance?
               MR. LONG:  Not knowing any better, I'll say yes.
               We talking at some point about the potential for
     the cracks eroding further by the flow going through them. 
     That doesn't look like a problem with recently acquired
     knowledge.  It certainly did sometime ago when we did the
     last licensing applications that involved this.  And the
     same with cutting where we were using the 0.25 inch as
     essentially a 0.25 inch through wall segment was equivalent
     to primary and secondary failure.
               So there are a lot of things going both ways,
     conservative or non-conservative.  We have had applications
     claiming that the tubes wouldn't fail during severe
     accidents even with the cracks and we have had applications
     claiming the tubes would always fail with cracks they
     couldn't detect during severe accidents.  In either case,
     the delta LERF is zero for what they requested.  It makes it
     very difficult to go through this and say we have done
     everything in a conservative manner, because then somebody
     can turn around and get the delta LERF by always failing,
     and everything it assumes is now non-conservative.
               MR. POWERS:  One of the issues I think you pointed
     out earlier is that when you have this steam generator with
     natural circulation flow you have a temperature distribution
     among the tubes of the steam generator.  You look at them,
     and you say, gee, I think these things can bow the tubes in
     the hot zone or something.  Is that what you were thinking
               MR. LONG:  I wasn't saying they would bow towards
     the hot zone.  I was saying that if you have a large bundle
     of tubes with a smaller batch of them at a much higher
     temperature than the others, they would try to elongate,
     especially if they are crimped into the support plates like
     they would be with drilled holes, but there are other plants
     where they are quatrefoils, or whatever.  Some of them are
     going to try to get longer than the ones on the periphery,
     and for that matter, the shell structure.  What we think
     they would do if they are locked is bow.  If they are not
     locked, we are probably not granting credit for confinement
     for degradation.  In other words, if it's not a drilled hole
     support plate, we wouldn't be giving them credit for the
     drilled hole support plate, and we wouldn't have flaws that
     would be growing to a free span.  For instance, Arkansas 2
     is a CE plant.  It has an egg crate type of support plate,
     and we treat those flaws as if they are in the free span.
               There are a few things that I am going to talk
     about on uncertainties further on, but I guess one thing I
     should mention is for Farley I tried to integrate these
     uncertainties as best I could to get one parameter for
     decision making purposes.  For instance, Charlie gave you
     thermal hydraulic temperature uncertainty of about 50
     degrees plus, and the way I would model that was to put into
     the Monte Carlo process an uncertainty that was plus or
     minus 50 degrees.  I did it with a Gaussian distribution. 
     When I do things like that and I am getting beyond the data,
     I will cut the Monte Carlo at the wings, so that if I am
     viewing something that looks like 5 percent to 95 percent, I
     will not let the Monte Carlo go out to three times that
     value with some real scarce frequency.
               MR. CATTON:  Why do you give it a Gaussian
     distribution when it's so uncertain?  Shouldn't you give it
     a uniform distribution?  Isn't that the way the rules go
     when you don't know it's equal?
               MR. LONG:  I didn't know those were the rules.
               MR. CATTON:  I don't either.
               MR. CATTON:  I'm just a thermal hydraulics guy.
               MR. POWERS:  When you put things on a Gaussian
     distribution, you do need to be normalized.
               MR. LONG:  When we say we normalize, I am
     basically putting 100 percent of the area under the
     distribution.  If I find something outside that, I'm just
     choosing another one and going through.
               MR. POWERS:  If the number is outside, you just go
     back and choose another one?
               MR. LONG:  Yes.  It's not right perhaps, but given
     that a flat distribution might he right too is wrong.
               MR. POWERS:  I would have funny results if I did
     that.  The check sums wouldn't work out.  The probability
     within that is one.  When you clip the wings and not
     re-normalize, when you integrate, you don't get one.
               MR. LONG:  What I am saying is, when I
     reintegrate, I effectively get one the way I did it.  So I
     wasn't worried about that part.
               MR. HOLAHAN:  You effectively add additional cases
     to cover for the ones thrown away.  It comes out the same.
               MR. POWERS:  Actually it's a nice analytic formula
     for clipped wings where Gaussian distribution is not all
     that hard to use.
               MR. LONG:  Considering that while I was doing this
     the Sun station somehow changed their link to the subroutine
     that gives me double precision random numbers to the point
     that I realized that something wasn't right and I found my
     random numbers were coming up between 0.4 and 1.8 and had to
     go back and get a Fortran instead of a C subroutine, there
     is a noticeable difference.
               MR. POWERS:  An absolute truism is never, ever,
     never, never use a system's subroutine for any numbers. 
     Ever.  There are no good ones.
               MR. LONG:  I did check them and I was getting a
     curve that looked like I wanted it to look before I used it,
     but I did that in 1996 when I wrote the program.  Then when
     I realized something was wrong in 1999, it came very late in
     the process and it was kind of disruptive.
               Trying to catch up on the schedule a little bit
     here, I think this is all I want to say about uncertainties
     right now.  The next thing was the integrated decision
     process, and I will talk a little bit more about
     uncertainties in that if we are ready to go to it.
               MR. POWERS:  We are scheduled to take a recess
     here for ten minutes or so.
               MR. LONG:  It sounds good to me.
               MR. POWERS:  Why don't we recess for 12 minutes.
               MR. POWERS:  We will come back into session.
               Next we will hear about the integrated decision
               What seems to have been badly misunderstood is we
     had a contention on the integrated decision making process. 
     I felt an obligation to allow the staff to respond to any
     contentions that they felt they would like to on the
     integrated decision making.  Looking through the viewgraphs,
     I see that you really didn't choose to respond to the author
     of the DPO but rather describe the integrated decision
     making process.  Looking through it, it looked extremely
     interesting to me.
               MR. LONG:  He did not like the Farley decision.  I
     just wanted to describe the process with a couple of slides
     so everybody is on the same page and then start talking
     about Farley.  That was the intention.  So as I said, I will
     talk about the five principles and then Farley and Arkansas.
               The five principles that I still haven't learned
     to recite in my sleep are, first of all, the proposed change
     meets the current regulations unless it explicitly requests
     some change, like an exemption;
               The proposed change is consistent with the defense
     in depth philosophy.  Here we are talking about tubes that
     are basically two of the physical barriers between the fuel
     and the public.  So that is an important one;
               That it maintains sufficient safety margins.  Here
     we are talking about strength, leak rates, et cetera;
               When a proposed change results in an increase in
     core damage frequency or risk, the increase should be small
     and consistent with the intent of the safety goal policy.
               MR. POWERS:  Do sufficient safety margins include
     the time the operator has available to respond?
               MR. LONG:  Not explicitly in the sense that that
     is not one of the safety margins that is in the design
     basis.  We talked about this.  In trying to interpret what
     defense in depth was, if your cut set comes to everything
     works fine except you are relying on the operator, that is
     not much defense in depth.  So it comes down to how much of
     the system do you really need to work right and how much
     damage can one of those barriers give you, whether it's the
     operator training or action, or whatever.
               The impact of a proposed change should be
     monitored using performance measuring strategies.  Well,
     some of these things are to take the steam generators out of
     service and throw them away and put in new ones at the end
     of the period of operation where they are requesting to not
     do another inspection.  It makes it kind of hard to figure
     out if you were right about the degradation over the last
               Then there is consideration of uncertainties and
     their potential effects on the decision, which I will try to
     touch on again.
               If we are clear on the principles, let's just dive
     into Farley.
               MR. POWERS:  Let me make sure I understand.  On
     this plus point, this is not a requirement?  This is
     guidance to people who would care to make an application
     under the guise of a risk-informed change to the licensing
               MR. LONG:  When you say a requirement, Reg Guide
     1.174 is guidance, not a requirement.  The whole process is
     voluntary.  But in it there are these five principles and
     then there are some things that the guidance says they
     should address, including the uncertainties.
               MR. POWERS:  If I came to you with an application
     in which I had not considered uncertainties or their
     potential effects on the decision and made a persuasive case
     on why that was reasonable, staff would give it the due
     consideration it deserved, right?
               MR. LONG:  I would always give it the due
     consideration it deserves as soon as we have time.  For
     instance, I mentioned earlier South Texas has an application
     in.  They have tried to argue the tube support plates will
     not move from the degraded portions of the tubes by more
     than 0.15 inches, and they made the statement that they can
     show that the probability of rupturing a flaw is 10 to the
     minus 14th, assuming they have a flaw under every one of the
     tube support plate intersections and that they all get
     exposed by 0.15 inches.  The way they did this was to take
     the 0.15 inch length on the rupture correlation and figure
     out how many sigmas there were to get down to the steam line
     break pressure and then figure the probability of getting
     there.  I believe it was 10 to the minus 20.  And then put
     in something like 47,000 intersections that all had that
     probability, and wallah, 10 to the minus 14.  So the comment
     back was we didn't think they properly considered the
     uncertainties which were really controlling from the support
     plate deflection calculation, and for that matter, the
     ability to detect the flaws going beyond the support plate.
               So, yes, we do look at the way they do things.  We
     get some amazing stuff in applications.
               MR. BALLINGER:  How much more amazing than that?
               MR. POWERS:  We got 10 to the minus 45th
     probability of welds failing in the BWR.  These guys aren't
     even in the plausible lead right now.
               MR. LONG:  They did not consider the half life of
               For Farley, this is the first time we tried to
     apply this to the steam generator tube degradation issue. 
     As I mentioned earlier, Farley really didn't address the
     principles in the reg guide, so I tried to go through and
     elicit information with questions and write up an SER that
     would be more like the guidance we never got out to the
               Based on their projection of the condition of
     their tubes at the end of the cycle, they are projecting a
     99 plus probability of withstanding design-basis accidents
     of tube rupture and, I think, steam line break pressure
     differentials.  They were projecting a 90 percent
     probability of withstanding severe accidents, which we kind
     of agreed with in the calculation.
               MR. KRESS:  What does that mean, withstanding?
               MR. LONG:  Not having a thermally induced tube
     rupture.  Pressure induced didn't matter much here if you
     believe the first bullet.
               The condition of the tubes was projected to have
     about a 50 percent probability of meeting the three times
     normal operating pressure delta P.  Deterministic process
     would normally require 95 percent, and that is really the
     reason they were putting in the application.
               I did the projected LERF, as I have tried to
     describe, putting in the uncertainties to get out one number
     as opposed to trying to get out a distribution and figure
     out what to do with the distribution against the numerical
     guidance in 1.174, and it met the guidance by about a factor
     of two.  It's not a big factor.
               MR. HIGGINS:  Which sequences did you consider for
     that, all those different types?
               MR. LONG:  Primarily, at this point I considered
     the one that remained at normal operating pressure.  We had
     discounted the LOCA sequence on the basis of their seals and
     some other thermal hydraulic changes that Charlie had made.
               MR. HIGGINS:  Was it just the high/dry ones, or
     was it the normal spontaneous tube rupture or the thermally
     induced one?
               MR. LONG:  Which question are you asking me about
               MR. HIGGINS:  Number four.
               MR. LONG:  The primary contribution to number four
     was from the thermally induced ruptures, because what they
     were projecting was degradation that really would not be
     susceptible to anything else with much probability.  They
     were 99 point something probability of not having a
     degradation sufficient to produce a spontaneous tube
     rupture.  If you put that into the equation, it doesn't
     affect the answer.
               As I point out, the impacts were not monitorable
     in this case because they were going to discard the
     generators after the operating cycle, without inspection. 
     However, the way the tech specs work right now, they are
     fairly weak because they are designed for the wastage.  What
     we did do was to use the Reg Guide 1.174 rubric to say if
     they sustained some sort of leakage or other effect on the
     steam generator tubes that indicate the degradation is not
     as projected by them to get this license change, then in
     accordance with the principles here they should go back and
     do the inspection necessary to return it to that condition. 
     So we added a little bit of tooth to the amendment that way.
               MR. CATTON:  What happened to four if I went to
     two and said that was 50 percent?
               MR. LONG:  Fifty percent?
               MR. CATTON:  In other words, I just flat don't
     know which way it's going to go.  Would that have still met
     the 1.174?
               MR. LONG:  It probably would not have.
               MR. POWERS:  It depends a little bit on what you
     define as a LERF.
               MR. CATTON:  I think 90 percent is too high.
               MR. LONG:  Too high to require or to too high to
               MR. CATTON:  Too high to believe.
               MR. LONG:  Can we go to uncertainties?
               MR. CATTON:  We just went through the
     uncertainties associated with this.  There is mixing; there
     is the fact that the hot leg is treated as a tube.  All
     these things enter in.  Where does it fall down?  I don't
               MR. LONG:  I will agree with you to the extent
     that what I was doing here was going through a calculational
     process as best I could at the time and coming up with
     essentially 90 percent of the core damage.  The high/dry
     accidents were not resulting in bypass by the calculation. 
     In doing that calculation, I did take a look at the
     variation of the temperature on the tube support sheet and
     tried to integrate that in.  I mentioned in the SER that
     that was something I tried to do and that is something where
     we needed more effort.
               MR. CATTON:  What is done is done.  I was just
     curious how much that probability of withstanding severe
     accident would have to decrease before you don't meet 1.174. 
     If you can decrease it to 60 percent?  I don't believe it's
     90 percent.
               MR. LONG:  Just trying to remember where the
     numbers came out, probably if you decreased it to something
     like 80 or 75 percent you would be over the number for 1.174
     small change.
               MR. CATTON:  So it's iffy.
               MR. LONG:  Yes.
               MR. CATTON:  I believe it's that number two that
     is part of the DPO.
               MR. LONG:  That's correct.  That is one thing that
     Joe Hopenfeld doesn't think is correct.
               MR. CATTON:  He questions that mixing and he
     questions the mixing probably because he sat in on some of
     the subcommittee meetings that took place a few years ago.
               MR. LONG:  I have to agree that I have a problem
     with the mixing as well.  Remember, this is supposed to be a
     risk-informed, not a risk-based process.  The way I
     approached this decision was not to say I know exactly what
     is going to go on there.
               MR. CATTON:  I understand.
               MR. LONG:  The way the stuff that we know fits
     together now with the logic we have this would look okay if,
     and I will get to some of the uncertainties.
               MR. KRESS:  In the Reg Guide 1.174 risk acceptance
     values, I think there is an implication in them that this is
     a permanent change that is going to last for the rest of the
     life of that particular plant.
               MR. LONG:  That's true too.
               MR. KRESS:  Here you have a temporary change that
     is going to last a short time, which tells me you ought to
     be able to relax the acceptance criteria by some equivalent
     factor.  Did that enter your thinking at all?
               MR. LONG:  Not by a particular factor, but it made
     me feel a lot more comfortable about doing this.
               MR. KRESS:  It made you feel better about it. 
               MR. LONG:  I could only be wrong for a short
               MR. KRESS:  If its remaining lifetime was ten
     years and this was only for two years, I would have taken
     the ten over two and multiplied it times that LERF and said
     I could increase that acceptance value by that much.  Or
     something along those lines.
               MR. LONG:  We are sort of getting into the
     philosophy of regulation here, but I think part of it is
     what level of benefit you are getting and what level of risk
     you are taking to get it.  We don't really trade it off that
     way explicitly, but in previous lives, dealing with other
     logical decisions, there was sort of a rate of risk and rate
     of benefit that you had to balance.
               MR. HIGGINS:  Doesn't Reg Guide 177 bring that
     into time?
               MR. KRESS:  Yes.  In fact, that is sort of what I
     would have used, the time factor that they use in 177.
               MR. POWERS:  The problem is there is no delta CDF
               MR. HIGGINS:  No, but there are delta LERFs.
               MR. HOLAHAN:  You can't do the same thing a decade
               MR. KRESS:  Anyway, I think the time at risk is a
     consideration one ought to have.
               MR. POWERS:  I guess my feeling is when you are
     talking about a cycle on a plant, 18 months or something
     like that, I think you've gotten all the time you can get
     out of me.
               MR. HOLAHAN:  I agree.  We have in the past, and I
     think maybe some of Steve's other examples have time as a
     factor.  Didn't we put time in Arkansas as a factor?  But
     when you get longer than one cycle, that is too long for me
               MR. LONG:  I guess I should say that the delta
     LERF was factored in in the sense that if it was for a
     fraction of a year, we annualized it to a year.
               MR. KRESS:  Yes, you usually do that.
               MR. LONG:  I like to think of this as more a delta
     in probability over the cycle or over a year.  There are
     other people who don't like to do their math that way, and
     we get into arguments, but to me it always seems strange to
     talk about the frequency of something that is only going to
     happen once.
               In looking at the uncertainties, I talked about
     what I tried to do with the thermal hydraulic uncertainties
     and I basically tried to give a lot of credit to the idea
     that Charlie was nearly right and put some wings on it that
     went out 50 degrees in each direction and integrate that in
     the Monte Carlo process.  There are the uncertainties in the
     mechanical properties of the materials and so on that we
     also used in NUREG-1570, so I won't go into that.  They
     weren't that important.
               The biggest problem was the flaw size projections.
     The reason Farley was asking for the license change was that
     they had had a missed signal that turned out on the next
     inspection to be a fairly significant flaw.  Now they were
     projecting to have corrected their inspection problem and
     have a much better process and nothing like what they had
     found last time should show up by the end of the next cycle
     even though they weren't going to look.
               What I did was a sensitivity study where I took
     their previously found flaw distribution and put it into the
     same calculation and came to the conclusion that that would
     not satisfy Reg Guide 1.174.  So that put it into the
     materials people's lap to try to determine if they really
     thought the inspection process had improved enough to grant
     this license amendment.  Based on what is documented in the
     SER, they reached the conclusion that Farley probably had
     been able to do that, and we granted the amendment.
               We acknowledged the uncertainty for the 0.25 inch
     crack length that was a threshold for cutting, and I won't
     go into too much detail because I described that earlier. 
     This was the application that pointed out to us that we had
     to deal not just with total crack lengths but with
     through-wall segments of larger cracks in the Westinghouse
     process for looking at the significant segment of a crack
     that would either pop through wall or lead to a burst in the
     weakest segment.
               I think that is all I want to say about Farley and
     will go into ANO-2, unless you have some more questions on
               The ANO-2 application was ultimately denied
     earlier this summer.  The reason really had to do again with
     the NDE uncertainty.  ANO-2 had a history of doing
     inspections finding either just barely met the three delta P
     or just barely did not meet the three delta P criterion,
     shortening their cycle a little bit and running and doing
     the inspection and finding essentially the same thing.  They
     were hanging in there around the 4,000, 4,300, 4,400 psi
     pressure capability, and they were projecting that they
     would be able to at least do that again if not better.
               On the other hand, they were missing flaws that
     were fairly deep and sizable in length, and we couldn't
     reconcile their projection with what they kept finding, nor
     could we find any plausible reason to believe that their
     inspection had improved with the minor methodology changes
     they had made.  So we got into a problem of projecting
     exactly what we should put into the calculation.  That was
     one of two significant problems we had.
               Ultimately we ended up asking them to back
     calculate their probability of detection and tell us based
     on their previous two inspections what they thought the
     probability of detection was as a function of flaw size,
     which in their case was essentially depth; they didn't
     include length in the detectability.
               We found that flaws that looked like they would be
     able to actually potentially challenge the main steam line
     break criterion were flaws that they would not apparently
     have a good probability of detection for.  That is really
     the basis for the denial.
               One of the things that we came up with is this
     last line here when we started looking at the uncertainty of
     the strength of a flaw as characterized by NDE.  They had
     some full tube data where they had actually burst the tube
     at a particular pressure, and they had characterized the
     burst pressure as a function of a +Point profile.
               What we really found was to get 95 percent
     confidence -- and I don't know why I've got 5 there -- let's
     put it this way.  If you projected the flaw to have about a
     4,000 psi strength, to get a 5 percent failure probability
     you'd have to go all the way down to 2,700 psi.  That is
     quite a big difference.  That's 1,300 psi.  I think that was
     the first time we realized how uncertain in terms of
     strength the NDE characterization is.
               We also had problems in the severe accident
     calculational process.  This licensee didn't come in and say
     that the tubes would just not fail; they came in and said
     the tubes will almost always fail.  It's a CE plant.  The
     way they calculated it and the way we calculated it seems to
     have a higher thermal challenge to the tubes.  We're not
     quite sure why.  We know that the tube sheet is closer to
     the top of the hot leg, that the plenum is not as deep, and
     of course the tube sheet is broader.  So there is a geometry
     difference there.
               Also, there is a higher power than we were looking
     at in Surry.
               So there are a lot of things that would tend to
     heat faster, and of course, if you are heating fast, the
     thin things tend to keep up with the gas.  The thicker
     things don't, like the surge line.  So there is more of a
     high temperature challenge in this particular plant.
               The licensee was arguing that they were very
     likely to fail tubes with flaws that were 30 or so percent
     through wall and therefore there wouldn't be any delta LERF
     if they had any larger flaws.
               MR. BALLINGER:  Run that by me again.
               MR. LONG:  What they were saying is that the flaws
     that you could expect to be present in tubes and therefore
     would probably even be in the hottest part of the plume
     would probably fail under their high/dry sequences if they
     depressurized the secondary side, and therefore having large
     flaws really wouldn't change the outcome.  So the delta LERF
     was not there.
               They had some other sequences that weren't quite
     so challenging and they had some small delta LERF
     contributions from those.
               Another thing I want to point out to you is it's
     very hard to go through these things and claim that you have
     done them in a conservative manner, because then a licensee
     will come in and turn the whole thing on its ear and
     everything that you just did that was conservative is now
     non-conservative.  If you are going to do this business, you
     can't just run everything off to the maximum on one side or
     your delta LERF goes to zero on either side.
               Another thing that happened in this calculation
     was that they had looked at some intermediate pressure
     sequences.  I mentioned earlier they did that by setting the
     set point down to 1,400 psi early in the transient and they
     ended up with some fairly benign situations for those as
     well.  It lowers the delta P across the steam generator
               When we tried to duplicate those, we had some
     problems, and frankly, at the moment I don't remember what
     they are, so I won't go into it.  That is what provoked us
     to stick the pressurizer valves open by small amounts rather
     than full open and got us into the type of thing that I
     described.  I showed you one of those stair-step creep
     damage accumulations for a variety of different tube
     strengths earlier.
               What that turned out to be for us was essentially
     calculational overload.  Instead of being able to bring the
     process to pinch points and talk about a small number of
     options of where the flaw might be and what the temperature
     might be there, we were looking at a very large number of
     potential flaws that could be affected, depending on what
     the temperature was.  We really needed to do a volume
     integral of everything all at once, and I did not have a
     calculational tool developed that would just go do that.
               We weren't ready to concede to them that
     everything would simply fail.  It looked to us as though
     this is one of the cases where MAAP turned out to be more
     pessimistic than RELAP.  We don't normally see those, but
     this was one.
               MR. CATTON:  It must have slipped by Bob Henry.
               MR. POWERS:  I'm stunned that he doesn't see those
     more often.  Usually when they find one of those, you can't
     get away from it.  They trumpet it in front of you all over
     the place.
               MR. LONG:  Anyway, what ultimately happened here
     was that we really figured that we could not deal with the
     high/dry sequences for this case.  We just couldn't
     ascertain if we thought the delta LERF was low because too
     many of them would fail, low because not many of them would
     fail, or high because it was right on the edge of the cliff. 
     Their option for resolving that was to adopt a strategy for
     depressurizing the RCS.
               I didn't bring the graph with me, unfortunately. 
     They adopted a procedure and they made a plant modification
     to allow them to carry it out.  Because the high/dry
     sequences were dominated by a loss of one dc bus and they
     had not two RVs like most plants, but they had a path from
     the pressurizer to the relief tank, it was blocked by two dc
     MOVs, one from each safety bus.  They needed to get them
     both open to depressurize.  What they had to do was come up
     with a way of whichever bus was not powered get power from
     the other bus to open the valve that was on the dead bus.
               They put in a procedure.  They put in essentially
     some very large extension cords and proposed to us that they
     would instruct the operators to depressurize at effectively
     700k or 800 Fahrenheit.  We asked them to tell us how long
     they would have to wait after that period of time in order
     to have at least a 0.25 or lower human error probability for
     actually succeeding in taking the action to depressurize
     given that they might have to go out of the control room and
     hook up the extension cords.
               They came back with a time frame that was a delay
     of like 20 to 30 minutes.  When we ran the thermal hydraulic
     calculations, we essentially looked for the indication they
     were going to have an operator assigned to stand there and
     watch for the indication on the thermocouples.  We waited 30
     minutes and 27 minutes, and RELAP opened the valve.  We
     found that it looked very capable of depressurizing rapidly
     enough to preserve the flawed tubes.
               At this point we had put into RELAP the ability to
     look at stress magnification factors, and we put in
     magnification factors up to 7-1/2, I think, which is almost
     ready to fail at normal operating conditions.  In a creep
     damage sense, that did not look like you came close to
     failing those tubes even if you depressurized the secondary
     side of the generator.  I think at the end we had actually
     melted the surge line and still hadn't brought the tubes
     that would come close to the three delta P to failure.
               So that looked like a successful process to us,
     and that looked like they were on the way to some sort of
     approval except they had the problem with the main steam
     line break type of accident and not being really able to
     demonstrate they could find the flaws that would threaten
     during that accident.
               I think that as far as I went on that one as well.
               Are there any more questions on Arkansas or on the
     integrated decision process or how it relates to the DPO?
               MR. POWERS:  I don't think so.
               MR. HOLAHAN:  From what Steve has done and from
     the complexity of the earlier discussions it is pretty clear
     that if we are doing anything as difficult as these cases,
     we are not going to do a generic analysis and say, yes, our
     generic insight is that this sequence is important and this
     one isn't.  They are far too plant specific, and in fact
     they turn out to be often cycle specific, because you have
     to have pretty good insights as to the latest inspection
     information so that you have good information on the flaw
     distributions and things like that.
               So even though we feel good about having increased
     our capability of dealing with these sorts of issues, they
     are very difficult to do, they are very time consuming, they
     are very plant specific, and one hopes not to have to do
     this sort of analysis often.  We would prefer to have steam
     generators with fewer flaws and maybe not quite being pushed
     so hard.
               MR. LONG:  I hope I have conveyed some of my
     discomfort level in trying to do these things.  They really
     are in an extremely uncertain area and it's difficult to say
     that you have done something like this in a defensible way. 
     In terms of risk informing something, I think you can
     honestly say if we are doing it today, this is our best
     guess at what the answer is in risk space, but I don't think
     we are ready to come close to being risk based in this
     particular area.
               The other thing I would like to acknowledge and
     comment on is you notice there was a backfit here to
     depressurization to avoid the LERF component from a high/dry
     sequence.  That was the thing that we supposedly did a
     generic backfit analysis on back in the days of rulemaking
     and decided that, gee, we couldn't see a backfit that would
     be justifiable on the basis of the LERF component from
     high/dry even if all high/dries are LERF.  I think that sort
     of calls that conclusion into question a little bit, because
     it really had to go to, well, how much does it cost to make
     the change that might be beneficial.  I think we have here
     an inkling that it's not too difficult to be pretty
               MR. STROSNIDER:  One other comment with regard to
     these two plant-specific amendments to make sure it is clear
     to everybody.  The degradation that was of concern was not
     involved with Generic Letter 95-05.  It was other forms of
     degradation that was driving these analyses.
               MR. POWERS:  We come now to the section of the
     agenda that involves a summary.  Before we get into that
     summary, I will relate just a little bit of an anecdote to
               As you might have suspected, I have spent the week
     having people sidle up to me and saying, how is the DPO
     stuff going?
               MR. POWERS:  And I have given them a very positive
     response.  I said to them I think it's going extremely well,
     and I think the reason it's going extremely well is we are
     getting outstanding presentations from the NRC staff and got
     an outstanding presentation from the DPO author.  Since I
     notice not all managers but several managers are here, I
     hope you will pass on to your staff and, if you have the
     opportunity, the DPO author that I think you guys have done
     a bangup job presenting this material.  It's just an
     outstanding job, and I think I have gotten that same sense
     from my entire committee.
               MR. STROSNIDER:  Thank you.  I do appreciate those
     comments.  We will feed it back to the staff.
               I noted in my introductory comments you were going
     to hear from a wide variety of disciplines and people.  I
     think that indeed we do have a very dedicated and
     professional staff.
               MR. POWERS:  I think you should be very pleased at
     the way they have been able to work together on these.  We
     see an unexpected amount of coordination between the
     disparate disciplines.
               MR. STROSNIDER:  It's a real statement about the
     movement towards risk informed.  We have got metallurgists
     asking questions about LERF and CDF, and we have got risk
     assessment people coming down and asking about metallurgy,
     and it has been very beneficial.
               MR. POWERS:  The difference is the metallurgists
     get answers.
               MR. BALLINGER:  Both are black arts.
               MR. STROSNIDER:  This suggests that I am going to
     give a summary of steam generator issues.  I'm not going to
     summarize the last three days.
               MR. POWERS:  I thought you were going to write our
     report for us.
               MR. STROSNIDER:  I would like to make some brief
     conclusionary statements and maybe just touch on a few
     thoughts that I hope people will carry away from this
               First, I want to emphasize that the staff does
     take the DPO issues and steam generator issues very
     seriously.  When I put this viewgraph together it was
     intentional in the title there where I said "DPO/Steam
     Generator Issues."  You heard a lot of stuff in the last
     three days.  Some of it is directly related to the DPO and
     intended to address that, and as I said in the introduction,
     some of it goes beyond the DPO.
               There has been and remains something of a
     challenge of identifying exactly what is in the DPO and what
     other issues the staff may have taken on as a result of some
     of the rulemaking exercises and our improved understanding
     from a risk-informed perspective and trying to move that
               Regardless of whether they are DPO issues or other
     issues that the staff is pursuing, we do take them
     seriously.  A couple examples here.
               There is an extensive amount of documentation on
     these issues.  I think somebody said 89 pounds.
               MR. BALLINGER:  To be exact.
               MR. POWERS:  And it is going up.
               MR. STROSNIDER:  There has been a lot of thought
     and a lot of work that has gone into this.  I will come back
     again to the offer and before I do finish we will talk a
     little bit about future coordination.  Where the staff can
     be of assistance in helping to point to the right reference
     and the right section of a reference to help answer any
     questions you've got, please let us know.
               Development of regulatory framework.  I didn't
     plan on getting into a lot of detail on this, but as we move
     forward in the new framework that is being developed with
     the NEI 97-06 guidelines and tech spec change framework we
     are taking these things into consideration.
               I gave a few examples the other day where, for
     example, the industry wanted tech specs that would allow
     them to establish repair criteria, that would allow them to
     establish repair methods.  We said, no, you need to bring
     those into NRC for review and approval.  The reason for that
     is we want to make sure that we can look at the kind of
     issues we've been talking about.
               With regard to the plant-specific evaluations,
     Steve just went through two of those.  I think the main
     point I wanted to make there is that the staff, number one,
     said that we were going to consider these things.  Some of
     the resolution of the way we are addressing the DPO issues
     is we said we are going to consider them in our process.
               As I said the other day, we never know what the
     next alternate repair method or the next risk-informed
     amendment is going to have in it.  We did consider them, and
     we can get into some discussions about do we have the best
     models, can we improve on them.
               The answer is, yes, we can improve on them.  But
     we did consider them, and I think we demonstrated that the
     NRC staff and NRC management is willing to make some tough
     decisions following these guidelines.  When we denied the
     Arkansas request, they shut down for something like two
     months before the scheduled steam generator replacement
     outage to perform a steam generator inspection.  That is not
     a decision that can be made lightly.  It wasn't, but we put
     it through this process.  We considered the risk insights
     and we made that decision.
               With regard to research activities, I think you
     have seen through the last couple of days that we have also
     had very close cooperation between NRR and the Office of
     Research.  Where we see that we need to make improvements,
     where we can improve in our models and where we want to do
     that in order to apply it in the licensing process we are
     asking them for assistance.  We talked about the tube
     cutting, and they came back with some very good information
     this past week to address that issue.  We have asked them
     now to look at the vibration issue, and they are doing that.
               We all have the users meet, which covers a broader
     spectrum of risk-informed issues, ranging from the thermal
     hydraulics to some of the tube failure, the surge line
     response, and whether the creep modeling there is as good as
     it should be.
               Where these issues come up we are taking them
     seriously; we are pushing toward resolution on them.  When I
     say resolution there, I guess maybe the thing to say is
     improve our understanding in some of these areas.
               Maintaining safety.  During Ken Karwoski's
     presentation he put up a viewgraph demonstrating that the
     number of tube leaks and forced outages has decreased,
     depending on when you start looking at that.  If you go back
     into the 1970s or early 1980s, there has been significant
     reduction.  But I think we do need to give some credit to
     the industry, and I think the NRC staff has also had some
     influence on that.  People are applying improved
     technologies today and I think there is some benefit there.
               Risk-informed approach.  As you can see, we are
     moving into that.  We have applied it now in several
     licensing actions.  I think those insights are helping us to
     maintain safety.  This last example where Arkansas
     identified what they could do to reduce the frequency of
     high/dry events and help out with that is a good example of
     how this is helping to maintain safety.
               I think everybody hopefully has heard and is aware
     that we have four management goals.  You can find them in
     our strategic plan:  maintaining safety, reducing
     unnecessary burden, improving public confidence, and
     improving efficiency and effectiveness in the realism of our
               Given those four outcomes, maintaining safety is
     the priority.  I hope that when people see the approach that
     we are taking that they will appreciate that that is our
               Future actions.  Shortly after the Indian Point 2
     tube rupture on February 15 the NRC initiated a lessons
     learned task force.  It's another multidiscipline,
     multi-office effort.  We expect to see the results from that
     report shortly.
               We also have a report that was done by the Office
     of Investigation which has some observations in there.
               We are taking those reports and we will be looking
     at where we can improve our processes internally, and we
     will also be looking at what areas we need to address with
     the industry in terms of improvements that can be made.
               With regard to the NEI 97-06 license change
     package, that was put on hold after the Indian Point 2
     event.  That was a conscious decision that we didn't want to
     go forward with approving that framework methodology until
     we understood the lessons learned and could factor those
     into our review.
               MR. POWERS:  One of the issues that I have been
     wrestling with is whether to try to factor in the Indian
     Point 2 event and the lessons learned into this DPO
     resolution process.  I understood you all had been resisting
     doing that, because at 89 pounds one more piece of paper did
     not seem to be an absolutely essential thing, but I would
     appreciate your perspective on whether we should or should
     not be looking at the event and anything that comes out on
     the lessons learned.
               MR. STROSNIDER:  It comes back to the comment I
     made earlier, which is that it has been somewhat of a
     challenge to define the scope of the DPO.  When you look at
     the root cause and when you look at what we are pursuing in
     this area, I would point to the inspection report and the
     proposed enforcement action that is under consideration now. 
     It has to do primarily with licensees following Appendix B,
     the quality of their program, actions they could have taken
     with regard to improving the quality of the data, following
     up after they found an indication that was similar to the
     one that failed, and some actions like that.
               I don't see that those were areas that were
     addressed in the DPO.  There are some broad issues in the
     DPO about probability of detection and eddy current testing. 
     When you go back and look at a lot of that which was raised
     in the context of initially the voltage-based approach, I
     don't see that it was something directly raised in the DPO.
               Whether you want to take a look at what is going
     on there to inform just what is going on with steam
     generators in general, that is another question.  As I said,
     we will be coming out with reports in that area in the near
               MR. HIGGINS:  Is there anything significant that
     is coming out generically from Indian Point, or is it mostly
     plant-specific items?
               MR. STROSNIDER:  The industry is doing a lessons
     learned effort on this as well as the NRC.  One of the
     things clearly that is being looked at is generic
     implications.  If you go back and look at this failure, one
     of the main contributing causes was poor quality of the eddy
     current data.  They missed a very large indication.  A
     hindsight review, knowing where it failed, they went back
     and looked at the data that had been taken in the inspection
     prior to the failure.  They were able to see this
     indication.  They went to some higher frequency eddy current
     data that made it easier to see.
               There are some techniques that can be used to
     enhance that, using higher frequency eddy current.  Some
     plants have already gone to those higher frequency probes
     and doing the U-bend inspections.  We had a meeting with the
     Nuclear Energy Institute and the Electric Power Research
     Institute.  They are going back and modifying the EPRI
     guidelines on qualification, and they are going to address
     this data quality issue.
               So, yes, there are some generic implications. 
     During this outage season when the staff is talking to
     licensees that are doing inspections we are asking them what
     they have done to address the lessons learned from Indian
               With regard to 97-06, we will be re-initiating
     that review in the near future.  I think originally we were
     scheduled to come talk to the ACRS about that.  I think it
     was at the December meeting.  Don't hold me to that.  It has
     been rescheduled.  Given the delay that we consciously took
     with regard to this review, it is going to be more like the
     March time frame, but we will be back talking about that
     framework.  We still think this is a good thing to pursue.
               MR. POWERS:  I guarantee you that if ACRS had the
     opportunity to delay anything out of December, they did.
               MR. STROSNIDER:  I mentioned that the PWR
     licensees have committed to follow guidelines.  In fact,
     they have done some update on their own to reflect some new
     improvements.  When we start talking about these condition
     monitoring and operational assessment type things, this is
     the reason that licensees are doing it.  So clearly there
     are some improvements here.
               I guess the final thing is again I want to thank
     all the committee members here.  This is a tough area.  We
     appreciate the time and energy that you are taking to look
     at it.  It's an opportunity for the staff to hopefully see
     some resolution to some of these issues, and we clearly want
     to support that.  Whatever we can do to help in your
     deliberations, please let us know.  I guess the process for
     doing that would be Undine could contact me.
               I'm afraid this probably isn't a comprehensive
     list, but I did put together some of the things I noted
     during the discussions that I think we owe you now.  I can
     run through that briefly if you would like to hear that.
               The first item is to provide some more information
     on how the Generic Letter 95-05 leakage values were adjusted
     for pressure and temperature.
               The second item is some additional discussion on
     the basis for the 10 to the minus 2nd conditional
     probability of tube failures given a main steam line break. 
     That is the criteria that is in Generic Letter 95-05.
               We were asked to provide the distributions used in
     Generic Letter 95-05 for analyst variability and probe ware. 
     We will provide those.
               We were asked in the proprietary information you
     have that shows the data points associated with the leakage
     and the burst correlations to identify which of those data
     points are from tubes that were pulled from the steam
     generators versus tubes that were manufactured in the
     autoclaves in the laboratories.
               You wanted to see the information regarding the
     Maine Yankee circumferential cracking.  We will provide some
     of the metallography and the pressure test data that show
     how those type of cracks respond to that type of load.
               We are going to see what kind of information we
     can gather with regard to the Turkey Point event that Mr.
     Spence discussed.  Specifically, we want to find out if
     there was post-event inspection done and what the results of
     that inspection were.
               MR. POWERS:  Any evidence of permanent
     deformations and things like that would be especially
               MR. STROSNIDER:  Frankly, I think there must have
     been some inspection done after that before its generators
     were declared ready to go into service.  It's just a matter
     of seeing if we can find some of the documentation.
               MR. POWERS:  It may not be very extensively
     documented.  That is the headache you have.
               DR. SIEBER:  It was 30 years ago.
               MR. CATTON:  It was 1973, wasn't it?
               DR. SIEBER:  1971.
               MR. STROSNIDER:  We are going to see what we can
               Dr. Ballinger was talking to us at the break about
     providing some clarification on some assumptions that were
     made in the Indian Point 2 significant determination
     evaluation, specifically with regard to some of the human
     reliability assumptions.  We will get back with that
               That is the list that I had.
               Steve, there was some discussion where I think you
     were committing to provide some information.  I didn't get
     that written down.
               MR. LONG:  There are two more things I have on the
               One is the consequence difference for having 100
     gpm primary to secondary leakage sized hole.  It doesn't
     change through a core melt accident that eventually fails
     the RCS and the containment.  That was the work that
     Research had done.  I was trying to guess what the
     consequence relationship was to a contained accident.  We
     will get you that.
               Also, I had made reference to some work the French
     had done, which I think is proprietary, trying to look at
     the effect of the crud in the crevice and the drill hole
     support plate.  We will get you something about that.
               MR. HOLAHAN:  I think we talked earlier about
     providing some additional information on the iodine spiking. 
     To the extent we can address some of the questions that were
     raised, for example, which data points have
     depressurizations in them, and sort out some of those
     issues, we will pull that together as well.
               MR. POWERS:  Let me share with you what I think
     our schedule is going to be, with a great deal of
     tentativeness, because, quite frankly, we won't know for
     sure until next week.  Our intention is to try to put
     together a draft report from the panel over the remainder of
     this month, which may have holes in it, but enough so that
     we can pass it on to the peer reviewers we have identified,
     who are members of the ACRS, by and large, and present it to
     them at our November meeting.  At that November meeting we
     will give them some sort of a synopsis of what we have done,
     kind of a status report of where we are.
               I am allowing in that November meeting time for
     the DPO author and the staff to make any rebuttals to things
     that they have heard about.  I've been told the DPO author
     wants to come speak.  It's not a great deal of time.  We are
     looking for fairly succinct operations.  It's going to be
     about half an hour for each side.  If you care to make any
     additional comments at that time, there is a block of time
     available there.
               MR. HOLAHAN:  Do you know what day that would be?
               MR. DURAISWAMY:  It's November 2 at 2:30 and 4:30.
               MR. POWERS:  The peer reviewers on the ACRS would
     have about two or two and a half weeks in November to
     prepare their comments and get them back to us.  The panel
     will try to revise its report to accommodate their comments
     so that we can provide a final report and maybe even a draft
     position paper for consideration by the ACRS at our December
               Again, I suspect that we will allow time for any
     additional comments at that time, but it will be relatively
     brief periods of time.  Just the exigencies of the FACA, it
     seems that I have to allow time in there, but I haven't
     figured out exactly what it is.
               In other words, I would hope that we would provide
     such a sterling report to the ACRS that they could move
     forward promptly to provide an approval letter that they
     could send to the EDO.  It is my hope that we can wrap up
     our portion of it no later than the middle of December.  I
     have no idea what schedule the EDO would operate on from
     there.  It's kind of his bailiwick.  I'm moving on a pathway
     for a prompt resolution on this right now.
               This can be upset if in our discussions tomorrow
     we find out that there is some glaring hole, but quite
     frankly, I haven't seen any glaring hole.  I think these
     things have been very complete, very thorough, and very well
     presented so that we understand where everybody stands on
     all of the pertinent issues.  I'm optimistic of meeting my
               MR. STROSNIDER:  Thank you.  This helps us do our
     scheduling and gives us some idea of how quickly we ought to
     be getting you some of this information, which we will do as
     quickly as we can.
               MR. POWERS:  I think we will probably be making
     changes in this report to the ACRS right up until December
     1.  Once the report gets to the ACRS, changing it after that
     becomes troublesome to me, aside from editorial and cosmetic
     changes.  The actual report to the EDO that they make, of
     course, is up to the ACRS.  I have truthfully no control
     over them, especially the distinguished representative from
               MR. KRESS:  That's right.  I've been known to
     throw bombs.
               DR. SIEBER:  Did the peer reviewers get all the
     documents that we got?
               MR. POWERS:  I think they have access to all the
               MS. SHOOP:  They got the first box.  They didn't
     get the second box that we gave to you guys today.
               MR. DURAISWAMY:  We'll send it to them.
               MR. POWERS:  Our peer reviewers are by discipline. 
     I'm not asking them to peer review all the documents save
     what they want to say about them.
               MR. STROSNIDER:  In your discussions tomorrow, if
     you come up with additional information or requests, we will
     get those from Undine and we will respond to those.
               MR. POWERS:  Undine will still function as the
     point of contact between the panel and everybody else
               MR. STROSNIDER:  Once again I do appreciate and
     want to express appreciation on behalf of the staff for your
     efforts in looking at this issue.  It takes a lot of time
     and energy, and we appreciate your help in addressing the
     issues.  Thank you.
               MR. POWERS:  Thank you.
               At this point what I want to do is turn to our
     consultants and ask if they have any comments at this stage
     that they would like to make orally on what they have heard. 
     We do ask that you provide us a written report.  Anything
     you would like to pass on to us at this point would be
               MR. CATTON:  Me first?
               MR. POWERS:  Why not, you being the shy and
     retiring type.  We've got to draw Ivan out a little more.
               MR. CATTON:  That's right.
               I think it has been an interesting exercise,
     particularly tracking through the sequence of reports
     written by Joe Hopenfeld.  He really got better and better
     at writing them as he went along.  I was perplexed by the
     staff's responses, because they didn't seem to change very
     much.  But the last three days I think they have done a very
     good job.  I think the response is here.  The question is
     whether or not you like the response.
               The one area is the heatup during severe
     accidents.  I think that is fraught with uncertainty and I
     have felt that for years.  I just keep saying the same
     thing, but there has not been much response.
               Mixing is an issue.  Heat transfer from one end to
     the other is uncertain, and what do you do with it?  It
     seems to me you ought to assume a 50 percent probability of
     failure of one over the other and be done with it, or you
     have got to spend a lot of money.
               The other area is the response of the system to a
     steam line break, the whole blowdown process, what happens
     inside.  This is not a new issue.  This was discussed in the
     early 1970s, and one of the consultants to the Thermal
     Hydraulic subcommittee even wrote reports on it.  He tried
     to retrieve them, but they are in Word Star, and Word Star
     doesn't translate anymore.
               I was impressed with what is done with the
     relationship between voltage and burst and voltage and leak. 
     It seems to me that just bounding would put that to rest.
               I don't see a lack of correlation like I heard.  I
     don't recall who was making the presentation, but they
     argued for using a mean value.  Leakage through these cracks
     is just like flow in porous media.  There are a whole lot of
     parameters that are at the micro level and you are trying to
     do something at the macro level, and your microscopic
     variables are delta P and flow.  Unless you incorporate the
     variables at the bottom level into the equation, you are
     never going to get it right.
               In heat transfer we are faced with three or four
     decades of variation for a same kind of problem.  I think
     you have got to choose the top or the bottom, depending on
     whether you are buying or selling.  In this case here it's
     safety.  You've got to choose whichever side of that band is
     the worst.  I think to put a mean through the curve is
     inappropriate, but that's a personal view.
               I like the process of going from the distributions
     and how you extrapolate them all the way to either leakage
     or burst.  Some of the details in between probably could be
     tightened up a bit.
               I think making measurements on the pulled tubes is
     going to help.  The interesting thing is that you use the
     voltages in situ and then you test the tubes after you pull
     them.  That can't make everything worse.  So that puts a
     conservatism in the ballgame, which I think is nice.
               The other thing I was a little bit bothered with
     is how you treat the iodine.  I don't think there is any
     question about the bottom line because there is so much
     conservatism, but whenever you justify a poor model by
     arguing conservatism somewhere else, I think you put a major
     problem in front of yourself.  You've got to deal with it. 
     You should take your best shot all the way through and then
     add a safety factor if you are uncertain, not a huge
     conservatism in one place to cover the bad modeling in
               All in all, I think it was pretty good.  I think
     the staff has really done a good job in coming to grips with
     all of the issues.
               MR. POWERS:  Ivan, I think I and the other members
     have a pretty good understanding of your concerns over the
     mixing and heatup area.  To the extent any written report
     focuses an area, the more you could offer us on the
     relationship between voltage and flow, I think that would
     help me the most.
               MR. CATTON:  I don't know a whole lot about their
     problem.  I will put something in there.  Whenever you are
     addressing a problem that is some kind of transport
     phenomenon in a heterogenous media, and particularly when
     it's hierarchical from small scale to large scale, you have
     a major headache in coming to grips with that kind of
     problem.  It is only in recent years where people are
     actually developing the tools to do it.
               MR. POWERS:  I would appreciate comments that you
     would like to make on the standards that you would expect
     within your technical domain for that kind of a problem.
               MR. CATTON:  I'll do that.
               MR. POWERS:  Thank you.
               MR. STROSNIDER:  Dr. Powers, I don't want to get
     into a whole lot of extended discussion, but we will provide
     you some additional information.  With regard to the
     leakage, we talked about using the mean value.  In fact, I
     think what is used in 95-05 is a 95 percent confidence
     value, but we will get you a clear description of that just
     to make sure that there is no misunderstanding.
               MR. CATTON:  I took a look at one of those
     figures.  I don't know where I got them, but they got the
     yellow sheet on them.  And I get a really nice relationship:
     LPH equals V.
               MR. STROSNIDER:  We will provide some more
               MR. CATTON:  On the burst, I guess that was the
     7/8 tube.  On the 3/4 inch tube if I use 2 V, it works
     really well.
               MR. POWERS:  Jim, I think I called you too
     quickly.  I need to ask the rest of the panel if they have
     any questions of Professor Catton.
               [No response.]
               MR. HIGGINS:  A general comment first.  I thought
     it was a worthwhile exercise that we all went through. 
     Looking at the stack of documents and what has happened over
     the years, I feel that the DPO has clearly been around too
     long and it's time for resolution and I think it's ripe for
     resolution also.
               I think the presentations that we got would allow
     us to resolve most of the issues.  There are clearly a few
     things hanging out there that should be addressed either by
     the staff or the industry.  There are also some things that
     have been indicated that are being worked now by Research or
     NRR that need to be resolved but are under way through the
     existing processes.  I would support and I would hope the
     rest of the committee here supports trying to resolve this
     through the efforts that we are doing over the next month or
     so and not just putting it off to some other committee.
               I broke my comments up into two areas.  One is
     design basis and the other is severe accident, because I
     think the DPO addresses both of those.
               I think the design basis cases relate mostly to
     Generic Letter 95-05 as far as the DPO lays it out, and
     think that whole Generic Letter 95-05 process is very well
     laid out and the analyses that are laid out there and the
     bases and the background for them are good.  It seems like
     the submittals that are coming in are pretty reasonable too.
               There were a lot of areas questioned by the DPO,
     and without ticking them off, it seems like the staff made
     convincing presentations on most all of those that what they
     are doing is very reasonable.
               A couple stick out as being questionable.  One
     that has been colloquially called the wild and wooly main
     steam line break is one that is clearly an issue still, but
     that looks like it's going to be treated by GSI-188. 
     Without having been able to read specifically what goes into
     GSI-188, it seems like it may be constituted a little bit
     narrowly to address all the concerns that were identified by
     the DPO and that are probably legitimate concerns.  It seems
     like it may be limited to only the residents when there are
     other displacement type of activities that have been brought
               The second area that seems to be open.  I second
     what Dr. Catton said about the iodine spiking.  It seems
     there is lacking a sufficient technical basis for the
     calculation of the 335 factor and also for the 500 factor. 
     I don't doubt that there is plenty of conservatism in the
     other areas that could account for that.  Maybe that issue
     together with the issue that we discussed quite a bit that
     Dr. Bonaca brought up on the 30 minute for operator action
     is a good reason to try to revisit the methodology for the
     design-basis recalculation of design-basis steam generator
     tube rupture analyses and to fix those.
               On severe accidents, again it looked like the
     staff has done a lot of work there and presented a fairly
     convincing argument that most of the severe accidents
     associated with steam generators have been reasonably
               It seems to me like there are three general types
     of these.  One is the thermally induced rupture after a core
     damage event; one is the spontaneous steam generator tube
     rupture; and the others are various transients that lead to
     core damage from other initiators that result in abnormally
     high DP's across the steam generator tubes.
               It seems like they have all been reasonably
     addressed, with a few comments, some of which pertain to how
     you would look at severe accidents when considering Generic
     Letter 95-05.  The reason I bring that up is because the DPO
     does bring up how you would, from a severe accident
     standpoint, consider the things that are being done in
     Generic Letter 95-05, and even though that may not have been
     brought up at the time, it is certainly appropriate in the
     current days regime of risk-informed regulation to look at
               It did not seem like the assumption of the
     restraint of the Generic Letter 95-05 by the TSP was
     adequately justified by the staff.  It may be legitimate,
     but I didn't see a good justification of it in the documents
     or in the presentation.
               Secondly, I heard also the staff say that they
     believed that the CDF and LERF increases due to the Generic
     Letter 95-05 exceptions were considered to be zero or small
     but again did not see any quantitative presentations on
     that.  It seems like that is something that should be done,
     and I'm not sure if it needs to be done generically or on a
     plant-specific basis.  Steve mentioned that it looks like it
     is being done now on a plant-specific basis, and maybe, if
     that is the case, you don't need to do it generically.
               I would have liked to have seen some generic
     presentation that considered the three different types of
     severe core damage accidents associated with steam
     generators.  You can make an argument that all of those have
     some potential of being affected by the 95-05 relaxation.
               I guess I would also comment that the discussion
     that we had on the HEPs and the concern that the DPO had, I
     didn't really see a problem with respect to what has been
     done over the various things.  Even though that is an area
     where there is considerable uncertainty and variability, I
     felt what has been done in the various studies, especially
     the more recent studies, is reasonable.
               MR. BONACA:  I'm sorry.  Could you repeat that? 
     Reasonable regarding what issue?
               MR. POWERS:  Human error probabilities.
               MR. BONACA:  Okay.
               MR. HIGGINS:  The issue that they had raised on
     the human error probabilities associated with the tube
     rupture sequences.
               There were a few other areas of the severe
     accident that were raised by the DPO that have not been
     addressed to date but are being addressed by the new
     research-related areas that are going on as a result of that
     February 8, 2000, letter.
               That's all I had.  Thank you very much.
               MR. POWERS:  To my mind all of your comments are
     very useful.  In your written report, I think it would
     probably be of most use to the committee if you could focus
     on what your thinking is about this 30-minute operator
     action under your design-basis activities.  Similarly, your
     thoughts on the HEP, the more recent studies.
               All the comments are good.  If you have an
     opportunity to focus, those are the two areas that I think I
     could use the most help from you.
               I will turn to the rest of the committee and see
     if they have any suggestions.
               MR. BONACA:  Any comments on the HEP.  Expressing
     perspectives and opinions is still a soft area, particularly
     when you get into multiple tube ruptures and so on and so
     forth, which is really the area of concern presented by the
     DPO.  Any insights on that would be useful.
               MR. HIGGINS:  Okay.
               MR. POWERS:  We are going into a fairly intensive
     activity tomorrow as a panel.  I think we need to go back to
     the contentions list and try to walk through those
     individually tomorrow, deciding what we are going to write
     and what we are going to say in something of an outline.
               I will remind you that the author of the DPO
     provided us a list of questions in addition to his
     contentions, and I think I have to treat those under the
     contention category that has been laid on the table and to
     at least deal with them.  If not as specific contentions,
     our response should address those.  So I will encourage you
     to take a look at those questions to make sure we have
               Finally, in the spirit of the point that Dr.
     Catton made that the DPO author gets better and better at
     articulating his point, he did conclude his study with two
     recommendations, that Generic Letter 95-05 should be
     withdrawn and those plants that use the alternate repair
     criteria should be shut down.  I had hoped we would not have
     to address those, but I think we will have to give a very
     clear recommendation in regard to both of those
     recommendations that he has made.  So be prepared to discuss
     those as well as the more detailed technical contentions.
               MR. CATTON:  His first one was 95-05.  What was
     the second?
               MR. POWERS:  That those plants that have the
     alternate repair criteria be shut down.
               MR. CATTON:  The 17 plants.
               MR. POWERS:  It's the ones that have the alternate
     repair criteria, and I think in his oral presentation as
     opposed to what he has written down those that don't go
     immediately to the 40 percent plug-in criteria of old should
     be shut down.  I think we have to address that.  I think we
     have to give something very explicit in the report on that.
               Do any of the members have comments they would
     like to make, any comments on the overall strategy that we
     would need to think about tonight?  We will undoubtedly find
     ourselves revising and honing this strategy a good deal
               My thought is that I will probably lose quorum
     tomorrow about one o'clock.  That is typically when I lose
     quorum on these things.
               We do have a little challenge getting into the
     building tomorrow.  We have to go by way of subterranean
               I want to think you, Jim and Ivan.  I think you
     have added to this.  I think your reports are going to add
     to this.  It is very helpful to have you here.  I look
     forward to what you have to say.  As this draft report comes
     along I will be sending you copies and looking for your
     comments and any advice that you could offer to us.  You can
     switch hats and start playing the role of peer reviewer
               Any other comments?
               [No response.]
               MR. POWERS:  Again, my sincere appreciation for
     the quality of work by the staff and their presentations and
     their managers.  I think you've made this task a lot easier
     than I forecasted it would be.
               With that, I will recess, and that ends the need
     for recording.
               [Whereupon at 6:45 p.m. the meeting was


Page Last Reviewed/Updated Tuesday, July 12, 2016