Subcommittee on Plant Operations - December 6, 2000

 1                      UNITED STATES OF AMERICA
 3                                 ***
 5                                 ***
 7                         478th ACRS MEETING
10                              U.S. NRC
11                        11545 Rockville Pike
12                             Room T-2B3
13                         Rockville, Maryland
15                     Wednesday, December 6, 2000
17              The above-entitled meeting commenced, pursuant to
18    notice, at 8:35 a.m., the HONORABLE DR. DANA A. POWERS,
19    presiding.
22              DR. DANA A. POWERS, ACRS Member
23              DR. GEORGE APOSTOLAKIS, ACRS Member
24              DR. THOMAS S. KRESS, ACRS Member
25              MR. JOHN D. SIEBER, ACRS Member
.                                                                 2
 1              DR. GRAHAM B. WALLIS, ACRS Member
 2              DR. ROBERT L. SEALE, ACRS Member
 3              DR. WILLIAM J. SHACK, ACRS Member
 4              DR. ROBERT E. UHRIG, ACRS Member
 5              DR. MARIO V. BONACA, ACRS Member
 6              DR. GRAHAM LEITCH, ACRS Member
 7              MS. MAGGALEAN WESTON, Designated Federal Official
.                                                                 3
 2              FRANK GILLESPIE
 3              MIKE JOHNSON
 4              TOM BOYCE
 5              DON HICKMAN
 6              DOUG COE
.                                                                 4
 1                        P R O C E E D I N G S
 2                                                     [8:35 a.m.]
 3              CHAIRMAN SIEBER:  The meeting will now come to
 4    order.  This is a meeting of the ACRS Subcommittee on Plant
 5    Operations.  I am John Siebert, Chairman of the Subcommittee
 6    on Plant Operations.
 7              ACRS members in attendance are Dr. George
 8    Apostolakis, Dr. Mario Bonaca, Dr. Thomas Kress, Mr. Graham
 9    Leitch, Dr. Dana Powers, Dr. Robert Seale, Dr. William
10    Shack, and Dr. Robert Uhrig, and Dr. Graham Wallis.
11              The purpose of this meeting is to discuss the
12    changes to the revised Reactor Oversight Process since
13    implementation of the pilot program.  The subcommittee will
14    gather information, analyze relevant issues and facts, and
15    formulate proposed positions and actions as appropriate for
16    deliberation by the full committee.
17              Maggalean W. Weston is the Designated Federal
18    Official and Cognizant ACRS Staff Engineer for this meeting.
19              The rules for participation in today's meeting
20    have been announced as part of the notice of this meeting
21    previously published in the Federal Register on November
22    15th, 2000.
23              A transcript of this meeting is being kept and
24    will be made available as stated in the Federal Register
25    notice.
.                                                                 5
 1              It is requested that speakers first identify
 2    themselves and speak with sufficient clarity and volume so
 3    that they can be readily heard.  I also request that
 4    speakers use the microphones provided for you, so as to aid
 5    the subcommittee's members' understanding of the information
 6    that you are providing and also to aid the Court Reporter in
 7    obtaining an adequate transcript of the proceedings of this
 8    meeting.
 9              We have received no written comments from members
10    of the public regarding today's meeting.
11              We originally had scheduled a presentation from
12    NEI, but NEI is unable to make a presentation at this
13    meeting because there are, it turns out, a lot of meetings
14    going on with the NRC and NEI has a limited staff.
15              I would like to also welcome Rich Janati, who is
16    an old friend of mine, and works for the State of
17    Pennsylvania in the Department of Environmental Resources
18    and is the State's representative, one of the State's
19    representatives for the inspection of certain aspects of
20    power reactors in Pennsylvania.
21              As you are all aware, the NRC Staff has developed
22    a power reactor licensee oversight process which is intended
23    to mesh with the concepts of risk-informed,
24    performance-based regulation.  Over the past few years the
25    Commission has directed that the Staff develop and implement
.                                                                 6
 1    risk-informed, performance-based concepts on their own
 2    volition and in keeping with the recommendations of the
 3    General Accounting Office.
 4              The direction that the Commission has taken is
 5    also in concern with modern management concepts used
 6    throughout private industry.
 7              These concepts have indeed led to general
 8    improvements in productivity, safety, economic viability,
 9    and competitiveness for many businesses in the United
10    States.  The nuclear industry in general supports these
11    management concepts and has supported them in the past, so
12    it is prudent that the Commission has embraced these
13    concepts and recognized that the institutional concepts that
14    make up our current business atmosphere are successful and
15    they are also applicable to Government regulation.
16              In today's program the NRC Staff plans to present
17    information on the implementation of the pilot program,
18    performance indicators and the significance determination
19    process.
20              I would like now to invite any members of the
21    subcommittee to express any views that they may have at this
22    time.
23              DR. APOSTOLAKIS:  Are we going to have a detailed
24    presentation of the SDP, give us an example?  We never
25    really did that.
.                                                                 7
 1              MR. BOYCE:  Well, we have got two slides.  I am
 2    not sure how detailed two slides can be.
 3              DR. APOSTOLAKIS:  Is it in this package?
 4              MR. BOYCE:  It is in that package.
 5              DR. APOSTOLAKIS:  I think it is too high level.
 6              CHAIRMAN SIEBER:  I think what you are looking for
 7    is working through a specific case.
 8              DR. APOSTOLAKIS:  Yes, that was the idea of the
 9    subcommittee meeting.
10              MR. BOYCE:  Okay.  We could have done that,
11    George, because I mean we just came off doing that with
12    Indian Point 2 in immense detail, which is kind of our near
13    term, worst case effort you might say.
14              MR. JOHNSON:  We would be more than happy to do it
15    at not this meeting perhaps, but at a future time.  We would
16    be more than happy to sit down and go through --
17              CHAIRMAN SIEBER:  And I would be just fascinated
18    to go through and understand how the fire protection SDP
19    process works.
20              DR. APOSTOLAKIS:  There is an example here in the
21    document I received from Ms. Weston on operator
22    requalification.  To read it by myself is agony but if
23    somebody explains it that would be great.
24              So there is no way we can do this today?
25              MR. GILLESPIE:  Doug, are you familiar enough with
.                                                                 8
 1    that one --
 2              DR. APOSTOLAKIS:  Or anyone.  Do you have any
 3    other example that is already on transparencies?
 4              MR. COE:  I don't have anything already on
 5    transparencies.  If you wanted to give me an hour, I can go
 6    back to the office and try to put something together.  I
 7    don't know if it would meet your needs or not.
 8              If you are interested specifically in the fire
 9    protection area, I am probably less able to provide a good
10    example in that area because, as you are well aware, it is
11    very complex.
12              DR. APOSTOLAKIS:  Any example that will be the
13    easiest for you to put together in an hour and come back. 
14    We will try to ask questions so it will delay the whole
15    thing for you.
16              [Laughter.]
17              MR. COE:  Are you more interested in the Reactor
18    Safety SDP with the Phase 2 worksheets and that sort of
19    thing?
20              DR. APOSTOLAKIS:  Yes.  I would like to see those
21    worksheets, what decisions the inspectors have to make,
22    because we have never done this.
23              All of a sudden, you know --
24              MR. COE:  Give me an hour and I can try to put
25    something together.
.                                                                 9
 1              DR. APOSTOLAKIS:  If that is okay with you guys?
 2              CHAIRMAN SIEBER:  Well, this is an appropriate
 3    time too, since NEI isn't here.  We will have time.  We have
 4    the room.  The meeting is intended to last until Noon.
 5              MR. JOHNSON:  I guess I ought to mention that one
 6    of the reasons NEI is not here is because we have -- our
 7    branch is meeting with NEI, one of our regularly-scheduled
 8    meetings.
 9              CHAIRMAN SIEBER:  On the same issue.
10              MR. JOHNSON:  Yes, on the same issue, so Don
11    Hickman, for example, who is here to talk about performance
12    indicators, we were really trying to enable him to talk
13    early on so they can get back and support that other
14    meeting, so there are some additional time constraints on
15    us.
16              MR. GILLESPIE:  Doug, pick a typical one --
17              MR. COE:  Reactor safety.
18              MR. GILLESPIE:  Reactor safety SDP -- something at
19    least proceeded through the Phase 2 worksheets to a white or
20    a decision at that point?
21              DR. APOSTOLAKIS:  Yes, or maybe led to a more
22    detailed analysis.
23              MR. GILLESPIE:  Or it goes to Phase 3.
24              DR. APOSTOLAKIS:  Yes.
25              DR. SEALE:  Could I make another suggestion?
.                                                                10
 1              CHAIRMAN SIEBER:  Yes, sir.
 2              DR. SEALE:  I think it would be perhaps
 3    appropriate to put Mr. -- what was your friend's name
 4    again --
 5              CHAIRMAN SIEBER:  Janati.
 6              DR. SEALE:  -- Janati on notice that if he has any
 7    comments that he feels that would be appropriate for the
 8    committee to hear from a perspective of the state system,
 9    when we get through I think we would be very interested to
10    ask him to make those comments.
11              THE REPORTER:  Can't hear you.
12              DR. APOSTOLAKIS:  You have to come to a
13    microphone.
14              CHAIRMAN SIEBER:  There is a microphone right
15    here -- on the side.
16              MR. JANATI:  My name is Rich Janati and I am with
17    Pennsylvania Department of Environmental Protection.  I am
18    pleased to be here today.  I am here as an observer.  I have
19    not prepared any comments or was not planning to make any
20    comments, but I will be happy to ask questions if you would
21    allow me to do that.
22              [Laughter.]
23              MR. JANATI:  Either during the presentation or
24    after the meeting.
25              DR. SEALE:  Well, just any comments at the end
.                                                                11
 1    that you might be --
 2              MR. JANATI:  I would be happy to do that.
 3              DR. APOSTOLAKIS:  Instead of asking a question,
 4    start by saying "I wonder why" --
 5              [Laughter.]
 6              DR. APOSTOLAKIS:  That's a comment.
 7              MR. JOHNSON:  Really, we are learning the process. 
 8    It's a new process and unfortunately there were no pilot
 9    plants in Pennsylvania so it is going to take us some time
10    to learn the process.  Thank you very much.
11              CHAIRMAN SIEBER:  Thank you.  Any other comments?
12              I noticed in a recent edition of Inside NRC they
13    talked about applying the oversight process to steam
14    generators and if you in the course of your presentation, if
15    you have any insights that you could tell us about, what
16    your intentions are in that area, I think that I would
17    appreciate hearing that.
18              MR. BOYCE:  Okay, perhaps after we go through the
19    SDP, reactor safety SDP, that discussion in question should
20    come up because I think it will be a little more clear,
21    particularly in light of what we are doing with IP-2 so let
22    me try and cover it during that part.
23              CHAIRMAN SIEBER:  And I understand that that is
24    all prospective at this time and no real decisions have been
25    made, and so that ought to be on the record, but I think it
.                                                                12
 1    would be interesting for the subcommittee to hear about the
 2    potential plans you might have in that area.
 3              MR. BOYCE:  Yes, we can touch upon it, but the
 4    first thing is steam generators are in fact covered by the
 5    Reactor Safety SDP today.
 6              CHAIRMAN SIEBER:  Right, okay.
 7              MR. BOYCE:  So I wouldn't want to imply that they
 8    aren't, and in fact it worked at Indian Point.  We appraised
 9    it through it.  There were multiple degraded cornerstones. 
10    We went into reactive inspection.  Reactive inspection ended
11    up in coming up with a Red finding, but then at the end we
12    can address what the future plans may be and what the pluses
13    and minuses, because no one has really decided where it is
14    going.
15              One concept to think about is if for everything
16    that comes up you decide you want to have a set of
17    indicators, you pretty soon will be overwhelmed with the
18    number of indicators you could have.
19              One of the recommendations is have indicators for
20    steam generator leakage.  Right now we do have an
21    indicator -- that is 75 percent of tech specs.  Is the
22    problem the indicator or is the problem the tech spec is too
23    high?
24              Those are the kinds of questions that are getting
25    asked as a result of the Lessons Learned Task Force.
.                                                                13
 1              CHAIRMAN SIEBER:  Well, it would be good if you
 2    could review that for us, so with that what I would like to
 3    do is ask the Staff now to begin.
 4              MR. GILLESPIE:  Let me say a few words.  We are
 5    keeping everything as static as possible, so we are here to
 6    report we have had minimal change from the last time we
 7    talked to you.
 8              It has been difficult to do, by the way.  Don is
 9    going to come on first and talk about the most visible thing
10    that you have heard complaints about or seen issues on, and
11    that is on the PI for unavailability.  He can kind of give
12    you a status on what is happening there.
13              People didn't like the scram PI so we have got a
14    slightly different PI with a slightly different name but
15    with a similar focus and that is being trialed, and so Don
16    can address some of the PI things and then he's got to get
17    back over to the NEI people who couldn't come here because
18    they are going to talk to him over there on exactly some of
19    those issues.
20              The reason we have been keeping the program
21    static, if you remember one of the major criticisms of the
22    pilot program was it was a small sample and nothing happened
23    and so because nothing happened we couldn't judge, if you
24    would, in a severe case how the program would have reacted,
25    and so this first year of initial implementation has
.                                                                14
 1    actually been an expanded sample size to include the whole
 2    industry.
 3              We have a comprehensive program that got put in
 4    place about a month ago to collect information and data
 5    which really won't yield any results until about February or
 6    March.  We are now collecting information.
 7              We do have anecdotes and they are strictly
 8    anecdotes of various instances, and Doug will probably cover
 9    one in the SDP of where we applied it and where it appears
10    to actually quite honestly have worked, but we have kept it
11    very static, so we are not here to tell you of a lot of
12    drastic changes because if we changed in midstream we
13    wouldn't be able to appraise how the program was working and
14    we felt we needed the entire industry for a full year with
15    some stabilization in it, to then step back and say now what
16    would we change in an integral way, because the whole thing
17    is linked.
18              So you will be disappointed if you are thinking yo
19    are going to hear a lot of revolutionary changes because we
20    deliberately haven't done them but we do have them
21    backlogged but we want to see how to do it.
22              MR. LEITCH:  These changes that you are going to
23    talk about, are they changes since the full implementation
24    in April or prior to the full implementation?
25              MR. GILLESPIE:  Since the full implementation in
.                                                                15
 1    April.
 2              We have a Commission paper up, for example, on the
 3    Reactor Safety SDP.  As a result of a Quad Cities inspection
 4    it was fatally flawed, so that is the one fatal flaw that we
 5    found that caused us to go back to the Commission and say,
 6    hey, this one needs to be changed and we offered the
 7    Commission a temporary solution while we get with the
 8    stakeholders again and try to rework the right kind of
 9    ground.
10              That was the one major, major flaw that did come
11    out of it.  The others we have had some tweaks to improve
12    inspection report format, to resolve smaller questions
13    around the edges, and the team will kind of go through what
14    some of those were -- but no revolutionary changes.
15              We really have tried to keep the basic program
16    stable.
17              In inspection space we have not altered scope,
18    depth and frequency of inspections.  We have really tried to
19    maintain them and take the heat for where it is not perfect
20    until we can get a full year cycle in and be able to step
21    back.
22              With that -- Tom?
23              MR. BOYCE:  Well, actually, we are going to go
24    slightly out of order.  I was just going to present an
25    overview, but I think Don Hickman is going to go first and
.                                                                16
 1    talk about performance indicators, who will dive right into
 2    that so that Don can get back and meet with NEI and keep
 3    working some of these issues that we are trying to take care
 4    of.  Don?
 5              MR. GILLESPIE:  While Don is walking up, I think
 6    you are going to see that one of the problems that has
 7    really manifested itself with the PIs, and it happened with
 8    unavailability and in the scram PI and in some of the
 9    others, everyone seems to want to have a custom PI.  In
10    fact, PE&G -- Pacific Gas & Electric -- is coming in and
11    they are going to be talking individually to different
12    people because they don't like the new scram PI alternative
13    we are testing because for their facility seaweed twice a
14    year gets backed up in their screens.  They have to do a
15    rapid down-power and they sit there and wait.
16              So even the new PIs that we are trying have people
17    already before we have tried them saying they don't like
18    them, which means some places envision a future, and George
19    will remember this from an earlier presentation, at some
20    point we have to evolve to something that is going to likely
21    have to be more plant-specific, otherwise we are going to
22    get overwhelmed with exceptions, so I will give you that one
23    upfront.
24              You were right.  We knew we had to get there and
25    it is almost like it is starting to develop on how we might
.                                                                17
 1    do it and where are the first places that it might best be
 2    tried, so there is a longer term vision we still have in
 3    mind on that one.
 4              DR. APOSTOLAKIS:  In fact, I believe there is work
 5    by others in the Agency trying to develop plant-specific.
 6              MR. GILLESPIE:  The risk-based PIs or risk-based
 7    data --
 8              DR. APOSTOLAKIS:  Yes, yes.
 9              MR. GILLESPIE:  -- and that is again a three-year
10    vision.
11              DR. APOSTOLAKIS:  Right.
12              MR. GILLESPIE:  And so I think we are pretty much
13    in synch that there is something that we need to do now in
14    sort evolving in that direction.
15              DR. APOSTOLAKIS:  Okay, very good.
16              MR. HICKMAN:  Good morning.  I am Don Hickman.  I
17    am the Task Lead for Performance Indicators and Reactor
18    Oversight Process.
19              I am here today to talk a bit about the experience
20    we have gained in the last year with the pilot program and
21    now with initial implementation and some of the things that
22    we have done with the PIs.
23              We have a process that we call the Frequently
24    Asked Question process, perhaps a bit of a misnomer. 
25    Typically they are questions asked once that we address.
.                                                                18
 1              We have over 230 of those that we have officially
 2    answered and a number in line to be answered.  Many of those
 3    resulted in clarification for the guidelines.  A few
 4    resulted in some changes.  We recognize the need to make
 5    some changes to what we were doing.  We continue to get
 6    these and we will continue to get these for a number of
 7    reasons.
 8              The first bullet on my slide talks about the
 9    complicating factors that have generated a lot of these
10    questions.  One is the variety of plant designs.  An example
11    of that would be the post-accident recirc mode of what we
12    have been calling the residual heat removal system, which is
13    a typical Westinghouse design, and it turns out the CE
14    plants have a very different means for performing
15    post-accident recirc, and so we had to address that issue
16    and come up with a definition of how they should report the
17    equipment that performs that function.
18              Another variable is the tech specs, a lot of tech
19    spec requirements that vary from plant to plant.  An example
20    of that is the way that licensees measure reactor coolant
21    system leakage.  Some plants measure total leakage and
22    unidentified leakage.  Other plants measure identified
23    leakage and unidentified leakage.  Some PWRs include primary
24    to secondary leakage in the totals.  Some don't.
25              With Indian Point it just so happens that they did
.                                                                19
 1    include primary to secondary leakage in the totals so the PI
 2    for Indian Point did fall out the bottom.  In another plant
 3    that might not have happened.
 4              Another factor is a difference in operating
 5    procedures.  We came across this with regard to the scram
 6    with loss of normal heat removal indicator and what we said
 7    was that if the indicator would count those events where the
 8    normal heat removal path through the main condenser was lost
 9    and that path includes main feedwater, and we found at least
10    one plant where -- in a boiler -- where they have been
11    instructed to when they hit double-0 on a scram if HPSI and
12    RCSI start to, just let it go, or even if they don't start,
13    the feedwater pumps continue to run, to let the level fill
14    up until they hit the trip point and trip the main feedwater
15    pumps and that they should concentrate on the other scram
16    recovery actions, so that is something that they were
17    trained to do.  They would lose main feedwater and so we had
18    to address that issue -- should it count or should it not
19    count.
20              We told them that if that is their procedure and
21    that is the way they operate the plant that that would not
22    count.
23              Those are just some of the issues and, as I say,
24    there's a couple hundred of those.
25              Another factor here is the licensee response to
.                                                                20
 1    the program.  I guess as we might have expected, we have set
 2    these thresholds and so the licensees will set internal
 3    thresholds below those to ensure they don't exceed the
 4    threshold and go White.
 5              Of course, for every layer of management there is
 6    another lower threshold and what we wind up with is
 7    licensees who want to have zero events.  They want to keep
 8    the unplanned power changes.  They want to try to not have
 9    to count every unplanned power change, every safety system
10    function failure -- all of these kinds of events, and that
11    is a problem.
12              The program wasn't designed to work that way.  The
13    program was designed to provide this normal operating band
14    in which they could operate the plant and have a certain
15    number of events that we would leave to their corrective
16    action program and we would not get involved, so those kinds
17    of issues, this desire to minimize or reduce number of
18    events to zero, has generated a lot of questions as well.
19              Probably the most significant factor, however, is
20    the unintended consequences, and those are perceived
21    differently I think by different groups.
22              The scram issue, the fact that we count manual
23    scrams, and of course INPO has not done this in the years
24    that they have been collecting their performance indicators,
25    that rose to a very high level in industry.  A few high
.                                                                21
 1    level people are concerned about the unintended consequences
 2    of counting manual scrams and the effect it might have on
 3    operators, inhibiting them from performing a manual scram
 4    when necessary.
 5              We have not been terribly concerned with that.  We
 6    have not included manual scrams in the AEOD PIs, but we
 7    always track manual scrams.  We watched those over the
 8    years.  They have remained relatively constant.
 9              Even though the automatic scrams have come down
10    significantly, the manual scrams have come down only about
11    20 or 30 percent where the automatic scrams, as you know,
12    have down significantly more than that.
13              We will continue to watch the manual scrams.  We
14    really aren't terribly concerned about an operator not
15    manually scramming the reactor when he thinks it is
16    necessary, but we have to address the industry's concern, so
17    what we are doing is --
18              DR. APOSTOLAKIS:  I am not sure it is the
19    industry's concern, you know?
20              I have seen letters from very senior people
21    complaining about this, but then I have been in meetings
22    where actual operators are and other experienced people and
23    they just dismiss the issue, that the operators will never
24    think that way, so I don't know where the senior people got
25    this idea that this will inhibit the operators.
.                                                                22
 1              MR. GILLESPIE:  George, there is a difference, as
 2    we were going through this, talking to different senior
 3    people.  The industry is definitely not a monolith on this
 4    question.
 5              DR. APOSTOLAKIS:  Exactly.
 6              MR. GILLESPIE:  There were several very, very
 7    senior, very large utilities -- Southern Company was most
 8    notable -- that came in and said we object to this, so in
 9    this case I would not want to say we had a monolithic
10    industry.
11              DR. APOSTOLAKIS:  Exactly.
12              MR. GILLESPIE:  There was an industry concern in
13    one segment of the industry but then there was Dave Garchow,
14    people at other utilities, who said this is no big deal, our
15    guys are trained.  They are going to do the right thing and
16    you have given us three scrams.  It is not zero.
17              So there is a difference of opinion out there but
18    Don's stuck addressing it.
19              DR. APOSTOLAKIS:  And it also seems to me, and you
20    touched upon it, we cannot talk about removing manual scrams
21    from the PI without at the same time without finishing the
22    sentence talk about the numbers you have put forth.
23              That three has to change, in my view.  The numbers
24    were set, the way I understand it, having certain PIs in
25    mind.
.                                                                23
 1              MR. GILLESPIE:  Right.
 2              DR. APOSTOLAKIS:  Now if you start removing things
 3    are you keeping the three and the six and the 25 --
 4              MR. GILLESPIE:  Well, let me let Don -- those --
 5    one is normal operations, the other is risk-informed.  In
 6    this case normal operations is a better indicator than
 7    risk-informed maybe, but he's got a different alternative. 
 8    He can touch upon that.
 9              DR. APOSTOLAKIS:  Very good.
10              MR. HICKMAN:  You are absolutely right.
11              If we change the indicator, we have to address the
12    thresholds and we will do that.
13              DR. APOSTOLAKIS:  Sure.
14              MR. HICKMAN:  What we are doing right now is we
15    have begun a pilot program with 21 utilities -- or 21 plants
16    to try out the replacement indicator that's been agreed
17    upon.  It is called Unplanned Reactor Shutdowns.
18              This is what Frank was referring to earlier.  It,
19    unfortunately, has a time limit in it.  It talks about 15
20    minutes from the time of commencing the insertion of
21    negative reactivity until reactor shutdown.
22              The idea is to capture the same information that
23    we captured with the old definition, which said very clearly
24    manual and automatic scrams, but without using the word
25    "scram" -- that is the concern to the senior people in the
.                                                                24
 1    industry.
 2              We will collect the first data December 21st for
 3    two months and we will run it for a total of six months and
 4    we will look at what we have.  As Frank mentioned already,
 5    Pacific Gas & Electric and Diablo Canyon have complained
 6    that 15 minutes is too short.  On the other hand, we have
 7    received complaints from another utility who said 15 minutes
 8    is too long, so we are kind of stuck in here in the middle.
 9              My gut feeling is that whenever we have a time
10    limit we set ourselves up for problems and that we are going
11    to probably see that in this indicator.  It was the best
12    that we could come up with given the constraints and the
13    time we had to do it, so we will see what happens and we
14    will you involved.
15              MR. LEITCH:  Will that new indicator also include
16    therefore automatic scrams, since they are instantaneous?  I
17    mean they are less than 15 minutes obviously.
18              MR. HICKMAN:  Yes.  It is intended to capture all
19    automatic and manual scrams.  The concern was it might
20    capture a few others, but the intent was to try to make it
21    capture exactly the same data as the old definition.
22              DR. APOSTOLAKIS:  So it is 15 minutes now?
23              MR. HICKMAN:  That is the way that it is worded.
24              It says 15 minutes from the time of insertion of
25    reactivity until -- negative reactivity until you are shut
.                                                                25
 1    down.
 2              Oh -- that would also include -- we have two
 3    indicators that count scrams.  One is just the scrams, what
 4    used to be called unplanned reactor scrams, and the scrams
 5    with loss of normal heat removal.  Both of those have been
 6    changed to be worded the same way and we'll see what the
 7    results of that will be.
 8              The other indicator in the initiating events
 9    cornerstone was unplanned power changes, and we have always
10    had more concern about that indicator.
11              Again, it has numbers and the numbers start
12    causing problems.
13              It has the 72 hour rule, and the way the indicator
14    is worded is that what is important is whether the licensee
15    has planned the shutdown or not, and we use a 72 hour rule
16    which simply says that if 72 hours have elapsed from the
17    time you have identified an off-normal condition until you
18    begin the reactor shutdown, then we consider it planned.
19              Now it does not matter what degree of planning has
20    occurred during that time.  It is simply 72 hours.
21              The other aspect of that, the other numerical
22    aspect of that is that it talks about a greater than 20
23    percent power change.
24              We've had a number of questions, a number of
25    issues about both the 72 hours and the 20 percent.  We think
.                                                                26
 1    that there have been some cases where this indicator has
 2    influenced licensees to do things they would not have done
 3    otherwise, either to perhaps wait 72 hours and try to ride
 4    the problem out, or to come down less than 20 percent in
 5    power, see if they can fix it, and if they can, then they're
 6    off free, and if they can't, they'll have to come down
 7    further to fix it.
 8              Those are the kinds of issues that we're concerned
 9    about there.  We are discussing alternatives with the
10    Industry Working Group, NEI and their representatives from
11    the utilities, and we intend to pilot an alternate indicator
12    to replace the unplanned power changes.  We would hope that
13    that would start relatively soon.
14              I should mention that we have a formal process for
15    making changes to the program.  We've made some changes
16    early on that maybe weren't thought out completely, and in a
17    few cases, have caused a few more problems.
18              What we've tried to do now is to have a very
19    structured and formal process that would be very deliberate
20    so that the changes we make are thoroughly understood and
21    piloted, and we know -- we have some idea of how they're
22    going to work before we make the changes.
23              DR. LEITCH:  In the 72 hours, I would think that a
24    lot of times, a situation comes up, an elective power
25    reduction that could be done, say, within 24 hours, or could
.                                                                27
 1    be done beyond 72 hours.  Maybe the system operator makes
 2    that decision as far as wait till the weekend.
 3              So if this situation occurs on a Friday, he might
 4    say, well, might as well do it right now, although it could
 5    have been deferred for 72 hours.  Does that enter into this
 6    expression, that it could have been deferred for 72 hours? 
 7    Or is it actually deferred for 72 hours?
 8              MR. HICKMAN:  The guidelines say that the degree
 9    of planning is measured only by the 72 hours, and not by
10    whatever paperwork or anything else that you've done.  But
11    that issue has come up.
12              We had early in the pilot program, a licensee who
13    had a problem that had occurred in the past.  He had all the
14    paperwork to fix it then available.
15              He felt that he could go out and fix it right away
16    and it would be planned.  He already planned it.  So he
17    started the shutdown before 72 hours.  And what he was told
18    was that it's the 72 hours that's the determining factor,
19    not what planning you have done in the past.  That is an
20    issue.
21              There are many cases where they conceivably could
22    do it very well, have it well controlled and well planned in
23    much less than 72 hours.
24              MR. GILLESPIE:  This is one of those cases where
25    you have to keep in mind that the indicator isn't zero.
.                                                                28
 1              DR. LEITCH:  Right.
 2              MR. GILLESPIE:  It allows for this, but the
 3    institutions have driven themselves to say, well, we don't
 4    want to use that allowance, just in case something happens
 5    later.
 6              DR. LEITCH:  Sure.
 7              MR. GILLESPIE:  And so we've got a disconnect
 8    between the theory and how we thought it would apply and how
 9    the institutions are actually applying it and driving things
10    to zero inappropriately.
11              DR. LEITCH:  This could be an unintended
12    consequence if you defer maintenance for 72 hours and you're
13    all ready to go in 24, but it's an issue of managing the
14    indicators.  That's what happens with performance
15    indicators.  People manage the indicators.
16              MR. GILLESPIE:  And they're managing them because
17    it's a just-in-case; in case something comes up I haven't
18    anticipated in six months, I don't want to already be at one
19    or two.
20              CHAIRMAN SIEBER:  It seems to me that under some
21    circumstances, and indicator like that that people are
22    trying to manage, too, might be adverse to safety or good
23    operating practice.
24              MR. GILLESPIE:  It's interesting that the
25    inspectors haven't seen this, and we get it anecdotally, and
.                                                                29
 1    it's almost like every utility talks about another utility
 2    would do it.
 3              So, it's a tough one to get your arms around,
 4    because we don't have specific instances that we can sit
 5    down and analyze and say, well, does that mean the threshold
 6    should be adjusted, if, in a practical sense, there are two
 7    or three of these a year, shouldn't we make allowances for
 8    that?
 9              And that level of detail and discussion doesn't
10    seem to quite gel on this one yet.
11              CHAIRMAN SIEBER:  On the other hand, I don't think
12    that you specifically need examples of situations that have
13    occurred that have brought decisions one way or the other.
14              It seems to me that logic would indicate that
15    there might be or could be some situations where this would
16    be adverse to safety.
17              MR. GILLESPIE:  We agree, and what we're grappling
18    with is what's the alternative to it that still gets to the
19    safety meaning we are trying to get to, but allows the
20    plants to operate.
21              CHAIRMAN SIEBER:  I can think of instances in my
22    own career where we reduced reactor power to reduce
23    radiation dose because we had sent people into the
24    containment.  And, you know, to me that was the right thing
25    to do.
.                                                                30
 1              Under this system, you get penalized for it.
 2              MR. HICKMAN:  Another issue has been brought up by
 3    NEI that under deregulation, licensee may reduce power at
 4    night at low load times to fix minor problems so that they
 5    can be sure to operate before the peak load the next day.
 6              And this might change -- might result in more
 7    power changes.
 8              CHAIRMAN SIEBER:  And you have the other situation
 9    which we had frequently where the system operator would call
10    you and say, the voltage is too high on the system, and you
11    have to cut back.  And we did that every weekend.  I don't
12    know how that fits into the grand scheme of things, but, you
13    know, we followed the letter.
14              MR. HICKMAN:  Well, this indicator has a fairly
15    high threshold.  It's set at eight, and so we allow for it. 
16    That means you have to exceed eight to go white, so we have
17    allowed a significant number.
18              CHAIRMAN SIEBER:  That would take me eight weeks.
19              DR. BONACA:  It seems that the example you gave,
20    you know, operator coming down at night to fix something,
21    and it seems almost in the definition, 72 hours as part of
22    the definition, really is the problem, rather than the
23    concept.
24              DR. KRESS:  Particularly for things that routinely
25    they do a lot.  You know, it's the same process and if they
.                                                                31
 1    do it routinely, you could probably relax that 72 hours and
 2    still call it a planned power change.
 3              MR. GILLESPIE:  That's why we're talking to them. 
 4    Do you want to address the alternatives?
 5              MR. HICKMAN:  Well, this indicator, we like it
 6    because we benchmarked this two years ago, and it showed a
 7    pretty good correlation with watchlist plants, trend-letter
 8    plants, and -- but what we used at that time was the best
 9    information we had, which was from the monthly operating
10    reports.
11              And in the MORs, licensees had to tell us about
12    changes in average daily power level of greater than 20
13    percent from one day to the next.
14              That's actually what we benchmarked, and so that's
15    one of our proposals.  Now, we've got two of them, and
16    that's one that we go back to exactly what we benchmarked,
17    exactly what licensees had been reporting in the monthly
18    operating reports for many years.
19              And that's changes in average daily power level. 
20    And we would count those any time that those occurred.
21              Those are a little more difficult to manipulate,
22    because we're not talking about a rapid power change and
23    then coming right back; we're talking about being down in
24    power long enough to make a change of 20 percent in average
25    power.
.                                                                32
 1              DR. KRESS:  That would smooth out your time
 2    problem.
 3              MR. HICKMAN:  Yes, yes.  That would solve a few of
 4    the problems.
 5              DR. LEITCH:  Does it depend on whether you do
 6    maintenance during that power reduction?  In other words,
 7    say, on a Sunday night, you just come down 20 percent
 8    because of load-carrying situation and that's one situation?
 9              But say you're in that period of time and you also
10    decide, well, the water box differential looks a little
11    high, and we'll clean the tube sheet while we're down.  Does
12    that make a difference as to whether that's an event or not
13    an event?
14              MR. HICKMAN:  It could.  In the monthly operating
15    reports, they had to report any change in average daily
16    power level, but for each one, they had to indicate whether
17    it was forced or scheduled.
18              Now, if it was an equipment problem that forced
19    them to come down, as opposed to a scheduled power
20    reduction, we could tell the difference.
21              And actually, what we benchmarked was just the
22    forced power reductions, so we could do it either way; we
23    count them all, or we could identify just the forced power
24    reductions and count those.
25              DR. LEITCH:  I see.
.                                                                33
 1              MR. HICKMAN:  Safety system unavailability is
 2    probably the most contentious indicator.  It's got the most
 3    issues associated with it.
 4              We borrowed this one from WANO for a couple of
 5    reasons:  It was available; licensees had been reporting it
 6    for many years to WANO.
 7              But as we got into it, we found some problems.  A
 8    lot of these, I think, had to do with the closer scrutiny
 9    that we were giving to the reported data with the inspectors
10    doing verification inspection.
11              So licensees became much more concerned about
12    getting this data accurate, and so a number of -- many of
13    the licensees have changed the way they calculate the -- the
14    way they collect the data, to make it conform.
15              Probably the two biggest issues in the indicator
16    are the use of fault exposure hours.  WANO does not have an
17    unreliability indicator.  So they got some unreliability
18    information into the unavailability indicator by counting
19    fault exposure hours for surveillance test failures.
20              And that causes a problem.  We've had three
21    licensee in initial implementation fail an 18-month
22    surveillance test, and so if you take half the time, they
23    have nine months of unavailable hours for the system.
24              And it's really not representative, I guess, of
25    the risk significance of that failure.  In some cases, they
.                                                                34
 1    could have recovered relatively easily.
 2              That's an issue; what do we do with fault exposure
 3    hours?
 4              The other significant issue with this indicator
 5    has to do with -- oh, the WANO indicator allows licensees
 6    not to count unavailable hours when the train is not
 7    required, even though the system may be required, the
 8    function may be required.
 9              And an example of that is -- the best example is
10    emergency diesel generators when you're shut down.  If
11    you're in cold shutdown or refueling or de-fueled, you're
12    only required to have one diesel.
13              Therefore, the other diesel can be taken out and
14    you can do anything with it that you want to, and you don't
15    have to count it.
16              That means that licensees who do diesel generator
17    maintenance while shut down, don't have to count the biggest
18    hunk of the unavailable hours of the diesel, the overhaul.
19              But those that are doing it online would have to
20    count it by those rules.  Within the last few years in the
21    90s, we have issued a couple of dozen of extended AOT tech
22    spec changes to extend the AOT to allow licensees to do that
23    work online, and they have justified that with a risk
24    analysis and the requirement in Reg Guide 1.177 says on the
25    order of five times ten to the minus seventh, incremental
.                                                                35
 1    conditional core damage probability.
 2              And they have shown that, and the argument is, if
 3    it's no risk here to do it online, then when I'm shutdown,
 4    why would I have to count it here and not have to count it
 5    there?
 6              We've addressed that issue and we have made an
 7    exemption for people who have shown by risk analysis that
 8    there is, in fact, no difference in this.
 9              But that's opened the doors and we've gotten all
10    kinds of other requests now for other things, and once you
11    open the doors, that --
12              DR. KRESS:  Well, that gets you back to this
13    plant-specific PI, I think.
14              MR. HICKMAN:  Exactly.
15              DR. KRESS:  And I think that's what it's going to
16    end up being.
17              MR. GILLESPIE:  It's surprising, and what we've
18    done in trying to -- we talked about this way, way back in
19    the beginning -- in trying to apply a consistent oversight
20    process and consistent measures to all the utilities, what
21    it's done is started to expose the inconsistencies in the
22    requirements themselves.
23              Some people have this tech spec; some people have
24    that tech spec; some people have this leakage, some people
25    have that leakage, and what it's doing is, the warts are
.                                                                36
 1    coming -- the warts in our requirements are coming out via
 2    the oversight program to some extent.
 3              And now we're trying to deal with the warts, and I
 4    think we have to be very careful that we don't deal with
 5    them incorrectly; that if the underlying problem is in the
 6    requirement, that we don't do too much adjusting on
 7    oversight and not get at the right problem.
 8              So there's a caution there and a real reason why
 9    we have a very deliberate slow process for change.  It's an
10    interesting measure to come up, and we always thought the
11    requirements would now have to consistently catch up with
12    us.
13              And they really are and that kind of insight is
14    starting to come out of this.
15              DR. APOSTOLAKIS:  Also, I think you will remember
16    that we've had the problem in the past with the definition
17    of unavailability.
18              The industry simply takes the down time divided by
19    the total time, but in PRA's that's not the unavailability;
20    that's only a component, and it includes the unreliability,
21    I believe, that the industry has.
22              And for some reason, people don't want to develop
23    a consistent set of definitions.  I don't know why, but --
24              MR. HICKMAN:  And that's a big issue within
25    industry, too.  They want to have -- to report one set of
.                                                                37
 1    data, one time, but we have a variety of different
 2    definitions between WANO --
 3              DR. APOSTOLAKIS:  Do you have any idea why they
 4    don't want a uniform set of definitions?  I don't understand
 5    that.
 6              I had a telephone conversation with some folks at
 7    Research two or three weeks ago, and they were adamant that
 8    we shouldn't do it.
 9              It's a mystery to me why we shouldn't even try.  I
10    guess these definitions are so entrenched within the
11    industry that if you try to change them, it would be a major
12    task, so it's probably easier to change the PRA, guys, and
13    say that at least in the PRA, we start talking about it.
14              But there's such a reluctance to have a uniform
15    definition that we had it also with an appendix that was in
16    one of the NEI documents, I remember, related to the
17    maintenance rule, where the definition, again, was
18    inconsistent with --
19              DR. BONACA:  And we recommended, in fact, that
20    there would be a definition provided, and that -- because it
21    was brought to us as a presentation that the lack of a
22    consistent definition, in fact undermines the benefits of
23    certain rule implementation for station blackout.
24              MR. GILLESPIE:  Yes, in this case there now is a
25    major industry effort with us, but actually the industry is
.                                                                38
 1    deriving it to come up with a uniform definition.  As it
 2    happens, the INPO-WANO piece of this is more awkward for
 3    them than the NRC piece.  In fact, the maintenance rule and
 4    the oversight definition are -- we're going to get the words
 5    changed, but they're going to be exactly the same, and
 6    there's no problem on the NRC side of things with making
 7    those two exactly the same.
 8              And the industry likes our definition better than
 9    they like INPO's and WANO's.  So they're going against their
10    own institutional momentum.
11              They were participants in developing ours, much
12    more recently than the INPO and WANO development took place,
13    and so now they're trying to harmonize the other interests
14    to the industry and the NRC's.
15              DR. APOSTOLAKIS:  So your definition, then, is
16    what, of unavailability?
17              MR. HICKMAN:  We use the definition that came out
18    of the WANO indicator, which says that the unavailable
19    hours, divided by the hours the train was required to be
20    operable.
21              DR. APOSTOLAKIS:  So it still does not include the
22    probability of the failure to respond?
23              MR. HICKMAN:  It does not, no.
24              DR. APOSTOLAKIS:  Even if it's available.
25              MR. HICKMAN:  We feel -- I personally feel a great
.                                                                39
 1    responsibility to try to work on common definitions in
 2    everything that we do in this process.
 3              And we've done that in a few areas, with the
 4    maintenance rule people, with the PRA people, people in
 5    Research, with the reporting requirements people, and in our
 6    program in a few areas.
 7              This is a big one.  The industry is pushing all of
 8    us to do something here.  The real difficulty is working
 9    with WANO.
10              INPO represents the U.S. utilities, and we can
11    work with them better than we can work with WANO where they
12    have the influence from the European and Japanese plants.
13              That is more difficult, but it's something that we
14    will pursue.  We need to pursue that.
15              DR. APOSTOLAKIS:  Now, if you have an interim
16    between tests of T, and it's unavailable for tau, then you
17    take one-half of tau over T or tau over T for the
18    unavailability?  Do you remember?  If you don't remember,
19    it's okay.
20              MR. HICKMAN:  We used T over two in those cases
21    where you have no knowledge of when it failed.  You only
22    know that I ran the test and it didn't work.  The last time
23    I know that it worked was 18 months ago.
24              DR. APOSTOLAKIS:  So you divide by two?
25              MR. HICKMAN:  So you divide it by two.
.                                                                40
 1              DR. APOSTOLAKIS:  Now, the division by two is to
 2    -- if you average the unavailability over time, and you do
 3    it, you know, in the PRA context for a long time horizon,
 4    then it makes sense to divide by two.
 5              But if you go actually and find that this
 6    component was down during this interval for a certain period
 7    of time, I don't know that you need to divide by two.  Why
 8    should I take the average?  I can find the exact
 9    availability.  It was down for 16 hours and the interval,
10    you know, was 700 hours.
11              DR. KRESS:  And if you don't know how long the
12    interval was, you'd want to multiply it by something, rather
13    than divide.
14              DR. APOSTOLAKIS:  I don't know why you have to
15    divide by two.
16              DR. KRESS:  I don't either.
17              DR. APOSTOLAKIS:  It's these details that somehow
18    we -- I mean, this comes from a PRA.  We don't like the
19    definition of PRA, so PRA is different.  But then we see the
20    one over two in the PRA, we like that, we take it and use
21    it.
22              This is like picking and choosing from
23    risk-informed regulations.  We use what we like.
24              I think we need to have a group sit down and write
25    down what exactly we mean by all these things, and why we
.                                                                41
 1    divide by two, why we don't divide by two, and have a common
 2    understanding of these things.
 3              MR. HICKMAN:  Well, you're right and you hit on a
 4    good point, that the T over two tends to dominate the
 5    statistics.
 6              DR. APOSTOLAKIS:  Sure.
 7              MR. HICKMAN:  It only takes one failure, and it
 8    dominates the statistics.
 9              DR. APOSTOLAKIS:  But its purpose was different. 
10    It was the long-term unavailability, you know, to eliminate
11    transients.
12              MR. HICKMAN:  The tradeoff comes with the amount
13    of root cause analysis you have to do.  How much time and
14    effort do I want to put into this failure to try to figure
15    out exactly why it happened, so that I can determine with a
16    high degree of probability, when the failure actually
17    occurred, rather than take in the T over two.
18              We've had licensees go to great lengths, trying to
19    do that.
20              DR. APOSTOLAKIS:  Were they successful?
21              MR. HICKMAN:  It was a random resistor failure. 
22    They sent it to a lab to try to determine the time of
23    failure of the resistor, spent quite a bit of money, spent
24    quite a bit of time, and they came up with what they thought
25    was the most probable time.
.                                                                42
 1              They had to de-energize the circuit, and when they
 2    re-energized it, they think that that's probably when it
 3    blew, and they were probably right, but they couldn't prove
 4    it, of course.
 5              MR. GILLESPIE:  George, this is one where Pat
 6    Baranowski and his team are supporting us to try to come up
 7    with the reliability indicators of some kind, so that we can
 8    get rid of this term.  No one feels comfortable with the
 9    term, versus risk-based PIs in total.  He had a near-term
10    deliverable to us to try to see if he could come up with a
11    scheme on reliability.
12              So we're hoping we come up with that, and then
13    we're kind of more in tune with the real number we want to
14    look at, how reliable is it when you go to turn it on?
15              The other piece that's interesting is that if the
16    component is that important, why do we let the surveillance
17    interval be that long?
18              Well, because the component probably isn't all
19    that important.  So that's another aspect that kind of gets
20    into are we measuring the right thing, are we judging it the
21    right way?
22              DR. LEITCH:  In the area of unintended
23    consequences, if there's too much pressure to drive down
24    unavailability, it can have an adverse effect on
25    reliability, a lot of this unavailability is for maintenance
.                                                                43
 1    on systems.
 2              MR. HICKMAN:  You're right.
 3              DR. LEITCH:  If there's too much pressure to not
 4    do that, to push that out into the future, that can have a
 5    negative impact on reliability.
 6              MR. HICKMAN:  Yes, industry has mentioned that. 
 7    Of course, this is an indicator where zero is not good.
 8              DR. LEITCH:  Right.
 9              MR. HICKMAN:  You don't want to be zero,
10    necessarily.  You want to have some preventive maintenance,
11    and we understand that.
12              We used the WANO data from the last three years to
13    set the thresholds.  When we got into the program, licensees
14    began to realize that they had not been reporting completely
15    to WANO.
16              So the thresholds may or may not be set
17    appropriately.  What we've told them is, we will continue to
18    monitor the thresholds, and if we see more up-to-date, more
19    realistic reporting pushing the thresholds, we'll look to
20    see what we can do.
21              But we need the data.  We don't know what
22    threshold to set if we don't have the right data.
23              DR. LEITCH:  We're not trying to drive this to
24    zero.
25              MR. HICKMAN:  Definitely not.  In fact, WANO, when
.                                                                44
 1    they set their goals for that, they have a lower goal and an
 2    upper goal, and they set a band.
 3              DR. LEITCH:  Right.
 4              MR. HICKMAN:  Let me go on to the next one, the
 5    safety system functional failures.  This is an indicator,
 6    copied exactly after the AEOD indicator called Safety System
 7    Failures.  We've been using that one for 15 years.
 8              It correlated very well with the watchlist plants
 9    and the declining trend plants.  It picked out every one of
10    them.
11              We're trying to reproduce the same thing with
12    licensees, making that determination on their own.  We had
13    the Idaho lab reading LARs and coding these events.
14              And now the licensees are doing that.  Probably
15    the biggest issue in this indicator is the reactor core
16    isolation cooling system.
17              That system is reportable by about a third of the
18    boiling water reactors.  The others have not in the past
19    been reporting it.
20              It is a risk-important system.  It shows up and
21    ranks very highly.  And, in fact, at some of the plants,
22    it's right behind emergency diesel generators and
23    high-pressure coolant injection.
24              So on a risk-informed program like ours, we need
25    to count RCSI, but in the past, we would not know about all
.                                                                45
 1    the RCSI failures because they weren't in LARs.  As I said,
 2    only about a third of the plants put them in there.
 3              We're now discussing with NEI in our meetings
 4    about adding RCSI to the list for reporting safety system
 5    functional failures.
 6              The way it's worded now is, to capture exactly
 7    what we did in the past, we ask them to report to our
 8    program, any of the failures that required reporting in
 9    accordance with 10 CFR 50.73, the section that says any
10    event or condition that could prevent fulfillment of a
11    safety function.
12              But some licensees didn't report RCSI failures
13    under that at all.  So we're adding that one or we would
14    like to add that one.
15              MR. GILLESPIE:  Again, an example where you try to
16    do something uniform, the inconsistencies of the past start
17    showing up; that some facilities -- I don't know if you're
18    familiar with this one, but some facilities did not account
19    or did not need to take RCSI into account in their accident
20    analysis, so they said it's not a safety system we need to
21    report, and other facilities did.
22              Well, it's safety-significant at all those
23    facilities, independent of how they did that licensing
24    analysis.  So again, so Don's caught betwixt and between
25    now.
.                                                                46
 1              DR. KRESS:  That one strikes me as not being the
 2    same character as the other unintended consequences.
 3              MR. GILLESPIE:  This one doesn't have a down side.
 4              MR. HICKMAN:  The last bullet is on the problem
 5    PIs.  All of the indicators in those two cornerstones, the
 6    barrier integrity and the physical protection, are under
 7    review.
 8              We eliminated the containment leakage performance
 9    indicator that used to be in the barrier integrity
10    cornerstone, for the reason that Frank has talked about
11    here; that is that the requirements to measure and record
12    containment leakage varied so much, and in some cases, they
13    were not even required to report as-found leakage, only
14    as-left, and, of course, as-left had to be good or they
15    couldn't start up.  So it didn't tell us a whole lot.
16              We have similar kinds of issues with RCS activity
17    and RCS leakage.  They're measured different ways, with
18    different procedures, over different time intervals and all
19    of this.
20              And the activity measurement is something we
21    expected would tell us something about integrity of the fuel
22    clad barrier.
23              But, in fact, it said it ran white at 50 percent
24    and white/yellow at 100 percent of the tech spec limit, and
25    what we're seeing is that when you have a significant number
.                                                                47
 1    of fuel pins leaking, that you don't get very close to 50
 2    percent.  You maybe get ten or 15 percent.
 3              So the threshold is set pretty high.  And if you
 4    do have leakers, you're going to do whatever you can to
 5    minimize that by maybe reducing flux or making slow power
 6    changes.  You try to manage that and try to drive that
 7    number down.
 8              So that indicator, we don't think tells us a whole
 9    lot.
10              And I already mentioned about the RCS leakage, how
11    it's measured differently at different places, and some
12    things are included at one plant and not at another.
13              The physical protection cornerstone --
14              DR. KRESS:  On the leakage, on the barrier
15    integrity, do you have an indicator -- I forget what they
16    all are, but do you have one on the unfiltered in-leakage
17    into the control room envelope?
18              MR. HICKMAN:  No.
19              DR. KRESS:  That's not one of them?
20              MR. HICKMAN:  No, that's not.
21              DR. KRESS:  Okay.
22              DR. WALLIS:  It does seem though that leakage is
23    an important thing to know about, but because it's difficult
24    to do, you have to think more about how to do it.
25              MR. HICKMAN:  I believe that we could make a
.                                                                48
 1    useful indicator out of RCS leakage, but we don't have it
 2    now.  Right now, it measures only one of three parameters
 3    that could cause the plant to have to shut down.
 4              We measure either total or identified leakage, and
 5    we had one plant that had that to zero at one time.  They
 6    had some unidentified leakage that was slowly going up.
 7              It never got really close to the tech spec limit,
 8    but if it had, we would have had a PI that showed zero, and
 9    then the plant shuts down because of RCS leakage.
10              So it's not structured very well, and perhaps if
11    we restructure it, we can get something.
12              DR. WALLIS:  That doesn't mean to say you should
13    throw away the idea.
14              MR. HICKMAN:  No, I agree.
15              CHAIRMAN SIEBER:  It seems to me that the Staff
16    about 10 or 15 years ago had an inspection module on
17    leakage, RCS leakage, and in the process of applying that
18    inspection module to PWR plants, I think a lot of utilities
19    tried to adapt their calculational methods so that they
20    would be consistent with the NRC guidance.
21              Is there an opportunity to go and sort of redo
22    that or inform licensees as to what the Staff's position is
23    on calculating leakage?
24              MR. HICKMAN:  That might be a useful thing to do. 
25    I'm not really familiar, I guess, with what you're talking
.                                                                49
 1    about.
 2              CHAIRMAN SIEBER:  Yes, it goes back quite a number
 3    of years.
 4              MR. HICKMAN:  That may be something we should look
 5    at.
 6              DR. SHACK:  Those leakage requirements are in
 7    their tech specs, so it's not simply a matter of issuing the
 8    guide.  I mean, you literally have to change the tech spec.
 9              MR. GILLESPIE:  Yes, and I think this is one of
10    the things that's going to come out of the IP-2 lessons
11    learned report.  One of the recommendations was that we
12    should develop some PIs for steam generator leakage.
13              Well, then you have to ask why?  Well, because
14    everyone reports it all over the place right now, by tech
15    spec.  It's different ways, as Don said.
16              So then I've challenged this, and my question is,
17    if the problem is the reporting requirement and the tech
18    specs, then let's fix that problem and not have a de facto
19    fix through PIs.  If we have a reporting requirement that's
20    not right, let's fix the reporting requirement and don't do
21    a de facto fix by manipulating it through oversight.
22              And so that's kind of my question that I have on
23    the table, and we're all going to be looking at those kinds
24    of questions.  Indian Point brought it to a head.  What's
25    the right leakage number?  Is it consistent?  Do we have
.                                                                50
 1    apples and apples?
 2              And the answer to all of those things was no.
 3              We shouldn't fix it the wrong way, and I think
 4    that is going to be very important.  So this is the going to
 5    be the first test of can we fix it the right way in the next
 6    year or so.
 7              DR. LEITCH:  I would think in some cases, plant
 8    instrumentation may be different plant-to-plant, so it may
 9    not be just as easy as --
10              MR. GILLESPIE:  Oh, you may not be able to monitor
11    what -- the right parameters.
12              DR. LEITCH:  Exactly.  Yeah, right, exactly.
13              DR. KRESS:  This barrier integrity cornerstone
14    seems to be a lot different animal than all your other PIs. 
15    You don't count numbers of incidences, you count amounts of
16    leakage or amounts of activity, or how close you approach
17    some figure of merit like a PTS or something.
18              It seems to me like all the plants are going
19    through some sort of process of leakage occasionally and
20    fatigue on the things, and approaching some sort of
21    degeneration of barriers to some extent, aging.  It seems to
22    me like when you are measuring performance of the plant, you
23    shouldn't be asking how many times it leaks or how much
24    leaks, you should be asking what the licensee did about it. 
25    What was their response to it?
.                                                                51
 1              Is there some possibility of changing the nature
 2    of those PIs so that it really looks at -- I think you used
 3    to look at the response to it, how did they react to it. 
 4    Did they find it?  Did they find it in time?  Did they shut
 5    down and fix it?
 6              DR. APOSTOLAKIS:  I thought that was in the action
 7    matrix.  Was that in the action matrix, what the licensee
 8    proposed to do?
 9              MR. GILLESPIE:  Yeah.  The answer to both
10    questions is yes.  And if you go back to the first time we
11    came and talked about this PI, the PIs for containment are
12    kind of like a different animal.  It is almost like a
13    measure of how much you love your containment process, okay,
14    it really is.  It is how much do you love it on a day-to-day
15    basis.  The real risk issue is, do I have a big hole and is
16    the big hole going to be there when the accident occurs?
17              DR. KRESS:  Big holes you don't know about?
18              MR. GILLESPIE:  Yeah, big holes I don't know about
19    so I can't measure them.  And we haven't gotten there, the
20    damper that is open.  In fact, 10 years ago we used to have
21    a lot of dampers left open and valve lineups.  We are
22    actually not seeing a lot of those now.  They love their
23    containments more now and they seem to be more careful about
24    those things.
25              But, yeah, it is the ongoing -- what is the
.                                                                52
 1    ongoing measure to make sure that I don't have a hole in my
 2    containment that would be there in an accident.  The only
 3    containment that gives us an easy answer to that is probably
 4    the sub-atmospherics, the couple that there are.  Because if
 5    you can maintain a vacuum, you are probably okay.
 6              We don't have a similar parameter for the other
 7    containments.  In fact, that would be the ideal parameter
 8    would be to say if you can maintain some sense of
 9    atmospheric differential, the pressure inside and outside of
10    containment, I don't have a big hole, I am in good safety
11    space.  We haven't gotten there, though.
12              DR. KRESS:  Well, let me ask you a question about
13    that.  Dana and I are familiar with the big tanks up at
14    Hanford, and one of the things they do is measure the
15    diurnal pressure changes outside and inside, and there is a
16    lag between those, and the lag has to do with the leakage,
17    how fast, how much they are leaking.  Is that a possibility
18    for containments?  I mean you would have a continuous, sort
19    of a continuous measure, rather than a vacuum.  It is the
20    same thing as looking at --
21              MR. GILLESPIE:  I honestly can say I raised that
22    and was basically ignored by my staff, early on.
23              DR. KRESS:  Shame, shame on them.
24              [Laughter.]
25              MR. GILLESPIE:  No, I did raise that, because
.                                                                53
 1    everyone measures pressure, they have got the inches of
 2    mercury, water, whatever, inside and outside.  I would like
 3    to still keep that on the table, because to me that is a
 4    real safety measure, and on a continuous basis, so I have
 5    some integrity in my containment.
 6              I have talked to Steve Floyd at NEI about it on
 7    several occasions and he keeps kind of saying, well, I will
 8    ask about it.  But then the first thing someone is going to
 9    ask, is that a safety grade barometer?  And I think there
10    are some people --
11              DR. KRESS:  Is this also a backfit?
12              MR. GILLESPIE:  Is this also a backfit?  So there
13    are some other institutional issues.  But I think that is
14    the right thing we should be getting to.  And I haven't
15    quit, I am very patient.
16              DR. WALLIS:  There is a great virtue of
17    simplicity.
18              MR. GILLESPIE:  Yeah.
19              DR. KRESS:  Can we help you?
20              MR. GILLESPIE:  Well, I think it is there.  I
21    think the guys are going to be -- that we will be talking
22    more about it, and just see if we can get there, because for
23    the oversight process, it doesn't have to be safety grade. 
24    It just has to be realistic.
25              CHAIRMAN SIEBER:  It would seem to me, though,
.                                                                54
 1    that there's a lot of things that are going on in
 2    containment.  You know, it is like RCS leakage, when you go
 3    to measure that, you have to hold the plant steady.  You
 4    can't be changing power, and you meter everything and then
 5    you come up with a calculation.
 6              On the other hand, you know, the biggest energy
 7    input into containment is the ambient temperature, the heat
 8    input, and that changes from time to time depending on plant
 9    power level and all that, and that would overwhelm some
10    subtle change that is caused by the sun shining or not
11    shining.
12              We used to be able to tell when you turned the
13    lights on in containment, that would change the pressure.
14              MR. GILLESPIE:  But, see, that could be a good
15    enough indicator.  I think Joe Murphy told me one time many,
16    many years ago that if you have anything less than about a
17    five inch diameter hole, you don't really have a problem. 
18    It was interesting that, in fact, you might get more clean
19    energy out early in the accident and may, in fact, be better
20    off.
21              So there are some concepts here.  But the idea --
22    you don't care what the pressure is, what you are trying to
23    do is see, is there always a difference?  Because it is that
24    difference in pressure that says you are not communicating
25    adversely with the outside environment.  I kind of like it,
.                                                                55
 1    but I haven't gotten anyone to totally buy in on it yet, but
 2    I haven't quit.
 3              CHAIRMAN SIEBER:  I have worked mostly with
 4    sub-atmospheric plants.  It was very easy to tell what was
 5    going on in containment.
 6              DR. LEITCH:  In a more general sense, though, it
 7    seems to me as though a lot of these performance indicators
 8    are really lagging indicators.  And I guess what I think we
 9    need to be more concerned about is a licensee's performance. 
10    And I think that is what you get at when you say, do they
11    love the containment, do they love a lot of other things as
12    well.
13              And I guess I am concerned that I don't see any
14    performance indicators on some of these cross-cutting
15    issues, which I think are more of an indication of -- more
16    of an anticipatory indication of licensee performance.  I am
17    thinking about, I think there are three cross-cutting
18    issues, human performance, safety culture, and corrective
19    action programs.  And I guess what I am wondering, is there
20    any intention of developing performance indicators on some
21    of these things?
22              I mean I think the licensee's corrective action
23    program is a very, very important part of this, and it
24    addresses some of what Dr. Kress was saying earlier, in
25    other words, how thorough has the licensee's corrective
.                                                                56
 1    action been, how prompt has it been?  And there are a lot of
 2    ways that that performance could be measured.  But is there
 3    any thought of doing that type of thing so that we try to
 4    get in an anticipatory mode rather than a lagging mode?
 5              MR. GILLESPIE:  Well, I have to question, what are
 6    we trying to anticipate?  Because one of the underlying
 7    premises of the program was our thresholds are set low
 8    enough that something is going to show up.  Crossing a white
 9    threshold is not the end of the world, yet it has become the
10    definition of significant.  It is not, in fact, safety
11    significant.
12              So our indication, and I give you an example,
13    Kewaunee, Kewaunee had problems with the sirens, they went
14    yellow.  The result of that was that the sirens had a
15    problem they didn't put in the corrective action program, it
16    had not been dealt with in a timely manner.  A reactor
17    inspection took place, identified the corrective action
18    program.  And, in fact, that site ended up going outside
19    their system to get help to improve the corrective action
20    program.
21              Which was one of the anecdotal cases which, to us,
22    kind of said, well, you know, our system maybe kind of
23    works.  It wasn't that it was the corrective action program
24    for the sirens, it was the plant corrective action program,
25    that when we reacted to that indicator, was the broken
.                                                                57
 1    piece.
 2              DR. LEITCH:  Right.  But I guess what I am saying
 3    is you had direct indications that performance indicators of
 4    the health of the corrective action program, wouldn't that
 5    be more of an anticipatory thing than waiting to see that
 6    the sirens didn't work and trace it back to the corrective
 7    action program?
 8              MR. GILLESPIE:  Well, at some point there is the
 9    threshold between the regulator and the guy running the
10    plant, and that is what our program is really groping for. 
11    And we want an indication that we are protecting the health
12    and safety of the public.  And we are not trying to
13    anticipate that.
14              DR. LEITCH:  You can only do that in the lagging
15    sense.
16              MR. GILLESPIE:  Well, lagging --
17              DR. BONACA:  But you are inspecting the corrective
18    action program.
19              MR. GILLESPIE:  We are inspecting it.
20              DR. KRESS:  Yeah, you take care of that end on the
21    inspection.
22              MR. GILLESPIE:  In fact, we have an annual
23    inspection that runs around 240 hours, which is actually a
24    lot of man-weeks, and 10 to 15 percent of every inspection
25    procedure focuses on the corrective action programs in the
.                                                                58
 1    area of the procedure.  So it is the most inspected area we
 2    have.
 3              DR. KRESS:  And those are subjective judgments,
 4    and I think the principles of these PIs here was to try to
 5    get that subjectivity out of it as much as you could.
 6              MR. HICKMAN:  Yeah, but it is not all out.
 7              DR. KRESS:  You can't get it all out.
 8              MR. HICKMAN:  I mean the biggest increment of our
 9    program is actually individually focused on corrective
10    action programs.  Now, do we have a measure for it?  No.  Do
11    we have an insight into it?  Yes.
12              DR. BONACA:  And you do monitor for that, for
13    example, the number of condition reports per year?
14              MR. HICKMAN:  Yeah.
15              DR. BONACA:  And you are looking at the fraction
16    of those which are in the top tier.
17              MR. HICKMAN:  And how many are repeats, which
18    systems they affect.
19              DR. BONACA:  And the corrective actions that the
20    utility takes for the corrective action program, actual
21    improvements and so on?
22              MR. HICKMAN:  Yes.
23              DR. BONACA:  So you do monitor that?
24              MR. HICKMAN:  Yeah.  But we don't have a measure
25    for it, that's true.
.                                                                59
 1              DR. LEITCH:  And a lot of those types that you
 2    just mentioned, repeats, age of corrective actions and so
 3    forth, would lend themselves to a performance indicator.
 4              MR. GILLESPIE:  And then you have to have all the
 5    utilities define their aging process and their priority
 6    system the same way.  And I am just giving you a sense that
 7    it is probably the biggest backfit we could ever try.  I
 8    mean that is getting right to the heart of how people manage
 9    their facility.  And to try to regulate at that level, I am
10    not sure we would be successful.
11              Right now we say you have to have a corrective
12    action program, you have to follow Appendix B.  There is a
13    lot of freedom utility-to-utility within those regulations.
14              I am not saying it wouldn't be a neat idea to do,
15    but as a practical sense, and within our mission, I am not
16    sure really how to do it.
17              DR. BONACA:  More and more it is becoming, when
18    look for license renewal, so many commitments are going back
19    to the corrective action program.  And so it becomes a more
20    and more important tool for the regulator, too, I mean not
21    only for the licensee.  I understand it is a management tool
22    for the licensee, but so many of the commitments to the
23    regulator are made through it, it is becoming really a
24    shared system it seems to me.
25              MR. GILLESPIE:  Yeah, I agree, and it dominates
.                                                                60
 1    the inspection piece, we just don't have a PI for it.
 2              DR. BONACA:  No, but the question I had is, since
 3    the inspection also ends up with the color grades and so on
 4    so forth, so that also should have some visibility, right,
 5    in the process?
 6              MR. GILLESPIE:  Oh, it does.  If you look at our
 7    web page and look right underneath the little graphic that
 8    has got the cornerstones, there is the PIs, and then the
 9    next line is the inspection results.  And it has got the
10    latest color, the latest applicable color under each one.
11              DR. APOSTOLAKIS:  Isn't the concept of a leading
12    indicator a relative one?
13              MR. GILLESPIE:  It is relative to what you are
14    trying to indicate, George.  And that is what I am really
15    saying is what we are trying to indicate.
16              DR. APOSTOLAKIS:  All of these are really the
17    performance indicators, are leading, aren't they?
18              MR. GILLESPIE:  We think these are leading in the
19    sense of public protection.
20              DR. APOSTOLAKIS:  Right.  That is my
21    understanding.
22              MR. GILLESPIE:  But they aren't leading in the
23    sense of economic protection for getting an indicator that
24    turns yellow or an indicator that turns white, or an
25    inspection finding that is white.
.                                                                61
 1              DR. APOSTOLAKIS:  That's right.
 2              MR. GILLESPIE:  And what ramifications that may
 3    have on the utility, that is their responsibility.  So it is
 4    -- that is what I am saying, it is exactly -- it is relative
 5    to what you think you are protecting from.
 6              DR. APOSTOLAKIS:  Now, if you wanted to have the
 7    indicators that Mr. Leitch talked about, then it seems to me
 8    you have to rely on the significance determination process a
 9    lot, because you would be talking about programs.  So if you
10    find something, then you go through the SDP to determine the
11    significance of that, isn't that true?
12              MR. GILLESPIE:  That's true.
13              DR. APOSTOLAKIS:  Okay.
14              MR. GILLESPIE:  And that is one of the difficult
15    things on corrective action programs.  If you take any one
16    thing, any one thing by itself, there is no synergism with
17    other things.
18              Part of the picks to this, by the way, may be A4
19    was implemented, A4 became effective as the Maintenance
20    Rule, which is fundamentally asking the question, is my
21    plant safe today in its current configuration?  That is
22    going to help, because if your corrective action program has
23    a number of out of spec, inoperable, non-functional systems
24    in it and they are backing up, you are now going to be doing
25    a daily analysis in a risk sense that sets your threshold
.                                                                62
 1    for operation that day, which will include all those
 2    backups, because it is the actual configuration of the
 3    facility on any given day.
 4              So I am coming at it a little different way.  It
 5    is say if you have a big backup of safety significant things
 6    in your corrective action program, where things are
 7    inoperable, you are going to start bumping up against A4 and
 8    the recommended limits within A4.  And that is kind of one
 9    of our backstops to the whole thing.
10              DR. LEITCH:  Are we going to hear a little more
11    about what you did at Indian Point 2?  Is that part of your
12    presentation today or later, or could we talk about that
13    now?
14              CHAIRMAN SIEBER:  Well, it seemed to me that --
15              MR. GILLESPIE:  No, I think we need the right crew
16    of people, because that one went all the way, George, this
17    one went all the way to Phase 3, went through the process of
18    the interchange between us and the licensee.
19              DR. LEITCH:  I guess my fundamental question was,
20    was that work done after the steam generator tube rupture or
21    was it predicting that they were in trouble prior to the
22    steam generator tube rupture?
23              MR. GILLESPIE:  After.  After.
24              DR. LEITCH:  It was reactive.
25              MR. GILLESPIE:  Yeah.
.                                                                63
 1              CHAIRMAN SIEBER:  I think what we ought to do on
 2    the discussion of Indian Point would be to do that after the
 3    break, you know, because we asked them to get a few things
 4    together for the us.
 5              MR. GILLESPIE:  Yeah.  This is not a cop-out, but
 6    Doug has been involved in most of the panels with the
 7    process.  On Indian Point, it was Steve Long who really
 8    chaired the panel and was kind of full-time on it and acted
 9    as kind of the headquarters PRA/SRA expert on it.  And I
10    have been to three or four presentations, and whatever we
11    said would be hearsay, and we really should get the right
12    people to kind of go over that I think.
13              CHAIRMAN SIEBER:  All right.
14              MR. JOHNSON:  If I can just add a point.  There is
15    nothing in the -- to go to the question from a different
16    way, there is nothing in the process that we set up that
17    would try to be leading of events.  That is to say that we
18    expect that there will continue to be events, and that you
19    will have PIs that react to those events.
20              The process, though, was set up with PIs and the
21    series of thresholds to enable us to step back and look at
22    what the PIs and the inspection findings were telling us in
23    a timely manner to enable us to take action to really
24    address subsequent performance declines that would result in
25    that plant being unacceptable.
.                                                                64
 1              So, and we were discussing that a little bit
 2    earlier, but I just wanted to make sure that we were clear. 
 3    There is nothing -- you know, we don't want to leave you
 4    with the impression that we tried to set up a series of PIs
 5    that would forecast, if you will, upcoming events or enable
 6    us to make sure that those events didn't happen, because we
 7    know that events will continue to occur, but what we are
 8    really focused in on is the performance of the plants and
 9    the actions, regulatory actions that we take, and licensee
10    actions that are taken to prevent that plant's performance
11    from becoming unacceptable.
12              DR. LEITCH:  I guess I thought I heard earlier
13    that you were quite impressed with these performance
14    indicators in light of the Indian Point 2 event.  And I
15    guess that's good.  It was retrospective.  I would have been
16    more impressed if somehow the indicators gave you some kind
17    of a tip-off that there may be some kind of a problem that
18    will occur at Indian Point 2, and you are saying that that
19    did not occur, right?
20              MR. GILLESPIE:  That did not occur.
21              DR. LEITCH:  So that the indicators, in
22    retrospect, were useful.
23              MR. GILLESPIE:  The indicators did not prevent the
24    leakage event from occurring, but it did give us reasonable
25    assurance that if you did have an event like that, your
.                                                                65
 1    safety systems and your crews could react appropriately and
 2    protect the public.  In that case, I mean the whole event
 3    was over in a matter of hours, if not minutes.  All the
 4    right appropriate actions were taken, all the safety systems
 5    worked.  So we are not trying to predict that leakage event,
 6    but we are trying to say that the plant will not have a
 7    public protection problem with those events occur.
 8              There is a leakage event, what, someone told me
 9    every seven years, and it really doesn't matter who does
10    anything about it.  It just seems that about seven years
11    there is one of these things.
12              DR. BONACA:  So, do you mean that that kind of
13    performance that you indicate then has nothing to do with
14    the judgment that you have on the licensee?
15              MR. GILLESPIE:  Then you go in and you look and
16    you say now, was there a program failure?  But now you are
17    after the fact.  Was there a program failure that
18    contributed to this event, that if we don't correct it,
19    would make this event happen again?  And in the case of
20    Indian Point, it was.
21              DR. BONACA:  We have discussed this before, I mean
22    as far as some of the judgments we expressed, that maybe the
23    indicators were not as useful as, for example, the
24    inspection program.  That, because the inspection program,
25    if you went really into the paths of the corrective action
.                                                                66
 1    program, it will give you insight in how the organization
 2    thinks and operates, and it may be a predictor of possible
 3    troubles in this future, while these indicators really are
 4    simply a statement of certain events, of facts, and then you
 5    have to analyze them to determine whether or not there is
 6    anything to do with the reports.
 7              MR. GILLESPIE:  Yeah, but is a total program.  The
 8    indicators, you can't have indicators of inspection.
 9              DR. BONACA:  As you know, I was more critical at
10    the time, and I am beginning to see some of the benefits of
11    the program as-is, but, still, there is an issue of the fact
12    that these are not leading indicators of anything in
13    particular.
14              One thing that, by the way, I wanted to ask you
15    was, before Dr Kress, I think, raised the issue of this
16    doesn't really recognize performance.  For example, I mean
17    you have got an example on barrier integrity, you may have a
18    border where there are examples of that, you have one pin
19    failure, and many licensees have taken the conservative
20    action of shadowing the fuel rod even early in the cycle and
21    losing, literally, four to five months of operation because
22    of that.
23              And yet if you do not shadow that pin, most likely
24    you will not even exceed these ranges of activity.  Okay. 
25    You will have probably, however, contamination that
.                                                                67
 1    licensees don't like to have.  But really, I think it is an
 2    very important indication of licensee philosophy and safety
 3    commitment, a decision to shadow or not shadow.
 4              And is there anything in the inspection program
 5    that allows for this kind of recognition to be given to
 6    certain decisions?  Or is it totally, you know, blind to
 7    those kind of decisions?
 8              MR. GILLESPIE:  No.  In fact, one of the recent
 9    changes, the most recent change to what goes into an
10    inspection report, Manual Chapter 610, now actually allows
11    or causes the inspectors to put those types of things into
12    the reports.  It is not subjective, it is not going back to
13    the old way we used to write reports, but there is now a
14    lower level of thresholds for documentation of those, so
15    that we don't lose those insights.
16              And, in fact, that is one of the indicators that
17    Don said it has kind of got a problem with.
18              DR. BONACA:  Because the industry struggles with
19    those issues.  And then if they see that there is no payback
20    whatsoever from a regulatory standpoint, and there is no
21    recognition whatsoever, why would you sacrifice four months
22    of operation or more just because you want to be as clean as
23    you can, you know, to be as responsible as you can to your
24    people.  I mean it is good motivation, but I think that
25    there should be some regulatory incentive that is always
.                                                                68
 1    important.
 2              MR. GILLESPIE:  That causes them to go that way.
 3              DR. BONACA:  Yes.  Do the right thing.
 4              MR. GILLESPIE:  Yeah.  I agree.  But our reports
 5    now do recognize that a lower level, and that was a change a
 6    month ago, I think, when we put out 0610-Star.
 7              MR. HICKMAN:  Let me just go very quickly.  The
 8    concerns about the security, the safe physical protection
 9    cornerstone, there are three indicators there.  The one is
10    the protected area, security equipment, performance index. 
11    We use the compensatory hours, the guard hours, to
12    compensate for equipment that is out of service as the
13    measure, so it is kind of a surrogate.
14              There has been some desire on the part of some to
15    actually count the number of hours that the equipment is
16    unavailable rather than the number of hours that a guard is
17    stationed.  That was done largely at the instigation of the
18    industry, because that information is readily available. 
19    They know how much time they paid the guard force for
20    overtime to do the compensatory hours.
21              We are looking at that one and what we can do to
22    make that perhaps a better indicator.  There are a number of
23    problems with it, but the funny thing about it, it is the
24    same thing I noticed when I worked in the old AEOD PI
25    program, was that despite all the flaws that some of these
.                                                                69
 1    indicators appear to have, the results came out pretty good,
 2    about as we expected.  And, in fact, we have had some good
 3    results.  We have had about two or three licensees at the
 4    beginning of initial implementation that were yellow in that
 5    indicator, and really had no idea how their equipment was
 6    performing until they saw that.  And they made quick changes
 7    to fix it.  So it has had a good impact on licensees who did
 8    not have adequate programs for security of the perimeter.
 9              But there are still complaints from industry on
10    that.  We are still looking at that one to see if there is
11    maybe a better way to do it.  Although, as I say, we had
12    identified the plants that we thought had poor programs and
13    needed to address them.
14              CHAIRMAN SIEBER:  It seems to me, though, that
15    when you are told your licensee applies a compensatory
16    measure for a failed piece of security equipment, the
17    assumption is that the degree of physical protection has not
18    declined because the comp measure was applied.  And so you
19    aren't really measuring, for example, the effectiveness of
20    physical protection, you are measuring the availability of
21    the equipment.
22              MR. GILLESPIE:  Yeah, and that is one of the
23    reasons we were able to go with the PI, because it didn't
24    measure reduced security.  We actually got comments from
25    some other government agencies involved in security of
.                                                                70
 1    infrastructure that said, well, you don't want to publish
 2    something that someone says this plant has poor security,
 3    because that kind of sets them up.
 4              CHAIRMAN SIEBER:  Right.  Here is the unlocked
 5    door.
 6              MR. GILLESPIE:  The attribute you just described
 7    made this okay as a public PI because it really was getting
 8    not at the security status of the facility, but trying to
 9    get at the operability of the equipment that was expected to
10    be there, that they were actually licensed in the security
11    plan as the norm.  So compensatory measures are becoming
12    norm.  That really wasn't consistent with the way we thought
13    the place was operating.
14              So it is an interesting quandary.  It made it
15    useful in a public PI because of that attribute.
16              CHAIRMAN SIEBER:  Right.  Now, let me ask another
17    question.  I have been to some sites where, on a regular
18    basis, the fog rolls in in the morning, and so the cameras
19    are not as effective as they might be, and sometimes the
20    security supervisor will post out because of the degree of
21    fog, so he can protect the isolation zone.  Is that counted
22    as part of the --
23              MR. GILLESPIE:  No.  Environmental factors are not
24    counted against them.
25              CHAIRMAN SIEBER:  Okay.
.                                                                71
 1              MR. GILLESPIE:  It is really trying to focus on
 2    failures.
 3              DR. LEITCH:  Just a couple of real specific
 4    questions about performance indicators.  In our handout, we
 5    got a sheet that looked like this, with various plants, and
 6    just a number of keys, the letter N, I and U are used on
 7    this.  Do you know what they stand for?  I just couldn't
 8    find that.
 9              MR. HICKMAN:  Some of them are not applicable. 
10    For example, the reactor core isolation coolant system,
11    there are plants that have isolation condensers, don't have
12    RCSI 2.0 plants.  So an N should be not applicable. 
13    Incomplete, are there some on there?  That would indicate
14    that the licensee hasn't reported all the data.
15              DR. LEITCH:  The U and the Y.
16              MR. HICKMAN:  The U.
17              DR. LEITCH:  And the Y, yeah.
18              MR. HICKMAN:  Yes.  There are some thresholds that
19    are under development.  For example, and maybe we are a bit
20    tardy at this, you might see that under Oconee.  Oconee has
21    a very different emergency power system.  We haven't yet
22    established the thresholds for Oconee with their hydro
23    units.
24              MR. JOHNSON:  Incidentally, what that page is a
25    printout, really, a printout of what is on the external web. 
.                                                                72
 1    It is a summary rolled up of all of the performance
 2    indicators that are available.  And so it is just a picture,
 3    if you will, for any stakeholder to get on and see where the
 4    performance indicators stand with respect to the plants. 
 5    And we are developing an additional page that does the same
 6    thing for inspection findings, so you can take this same
 7    kind of a look.
 8              In addition to that, you can look for an
 9    individual plant to see what that plant's performance
10    indicators and inspection findings are.
11              DR. LEITCH:  Are these columns labeled on the web?
12              MR. JOHNSON:  Yes.  In fact, the reason why I
13    mentioned that was to make mention of the fact that the
14    labels are there, and the explanations are there.
15              DR. LEITCH:  Okay.  Good.  Thank you.  And just
16    one other specific question.  Well, I am not really sure, we
17    had some information in our handout concerning simulator
18    operational evaluation.  Is there a performance indicator
19    under development there?
20              MR. HICKMAN:  There is not a performance indicator
21    under development.  We do use simulator evaluations in some
22    areas.  We use it under an emergency preparedness for
23    drills.  We allow them to use simulator drills.  That may be
24    what it is referring to.  I am not sure what you are looking
25    at.
.                                                                73
 1              DR. LEITCH:  I just noted that if I am
 2    interpreting this chart correctly, that if eight out of
 3    eight crews failed, that is a yellow, and I guess -- I don't
 4    know what would drive it to a red.
 5              MR. COE:  That is the significance determination
 6    process that has been proposed.  We have discussed it with
 7    industry, and we expect to add it to the Manual Chapter in
 8    the near future.  But that is requalification, and it is
 9    there to monitor the success and/or non-success of the
10    requalification program in testing their crews.
11              DR. LEITCH:  Am I interpreting it correctly that
12    if eight out of eight fail, you consider that a yellow?  It
13    says Y.
14              MR. COE:  Yes, Y is yellow, that's correct.
15              DR. LEITCH:  I would think that would be pretty
16    red if eight out of eight failed.  Pretty bright red.
17              MR. COE:  Right.  I think you have -- I can't go
18    through all of the basis for each of those.  The way that
19    that chart was set up, the old SDP was run, we would have to
20    have somebody from the operator licensing group that worked
21    on that come in here and explain that in more detail to you.
22              MR. BOYCE:  At this point, we can -- I was
23    actually going to present an overview of where we were and
24    set the stage.
25              I'm Tom Boyce, I'm the Acting Section Chief in the
.                                                                74
 1    Inspection Program Branch of NRR.  We went slightly out of
 2    order this morning, because we need to get Don Hickman to
 3    the NEI meeting that's ongoing right now.
 4              I was going to provide an overview, and I can do
 5    that right now, or if you wanted to take a break, we could
 6    do that, too.  And that would essentially set the stage for
 7    Doug Coe to talk about the STP after that.
 8              CHAIRMAN SIEBER:  Yes, why don't we take a
 9    15-minute break now and come back at 20 after 10:00.
10              [Recess.]
11              CHAIRMAN SIEBER:  Let us resume the meeting.
12              MR. BOYCE:  As I said, I'm Tom Boyce, and I'm the
13    Acting Inspection Chief in the Inspection Program Branch of
14    NRR.  And today we wanted to give you an overview of several
15    things, and then lead into a discussion of PIs and STP.
16              I want to talk about just initial implementation
17    status, some highlights of program feedback and how we're
18    going about obtaining some of that feedback.  The two issues
19    that we called selected issues were PIs and STP.
20              I will then give you a glimpse of where we're
21    going in the future.
22              We've completed eight months of initial
23    implementation.  The program formally kicked off on April
24    2nd, 2000, and we've been exercising every aspect of the
25    oversight process since then.
.                                                                75
 1              On the inspection side, I think we've worked
 2    through almost all of the baseline procedures.  We've had an
 3    opportunity to work through a lot of the supplemental
 4    procedures.
 5              And we've even had a chance to perform some of our
 6    special and infrequent inspections.  We've had generally
 7    positive feedback.
 8              I'm not sure that everyone shares that view,
 9    because you only hear about the highly negative things, but
10    in general, when we've done some of the surveys, the answers
11    have come back in a positive tone; the majority of the
12    answers have come back that way.
13              That doesn't mean it's uniform across the board,
14    and it doesn't mean we don't have things we need to work on,
15    but I wanted to say, in context, it's been fairly well
16    received by both internal and external stakeholders.
17              And I'll go more into how we're obtaining some of
18    that feedback.  Finally, we just completed our mid-cycle
19    assessments that are performed in November.  As you may
20    remember, we have two assessments of plant performance every
21    year where we issue a formal letter to licensees, and we
22    just completed those, and letters have just gone out, and
23    we're in the process of posting them on our external
24    website.
25              Those are our selected issues.  We've really had a
.                                                                76
 1    lot of feedback, and we've gone out of our way, I think, to
 2    try to get some of that feedback.  I was just taking a look
 3    through the package that you had been handed, and this kind
 4    of illustrates the methods we're using to collect the
 5    feedback.
 6              There's a form in here that shows what we're
 7    asking our internal stakeholders to submit comments to us
 8    on.  We've established a formal feedback process.  We don't
 9    want anecdotal comments given to us -- well, we do, but we
10    would prefer them to be formally documented, because we have
11    a group of people that are dedicated to analyzing the
12    comments, the basis for the comments, taking a look at what
13    our current program does, checking it against data, and
14    finally making changes.
15              And that's illustrated in this simplified drawing
16    right here in your handout.  This is what we've set up to
17    try and handle feedback.  And it looks complicated, but the
18    intent is to make a it a very controlled process, as was
19    alluded to earlier, where you are trying to have a stable
20    process and do the right thing, based on good data, and not
21    anecdotal information.
22              There's a copy of the feedback form that we asked
23    for stakeholders to fill out, and it's not just, well, we
24    think there's a problem with this procedure; we saw a
25    problem on one plant.  It's, we saw this problem on one
.                                                                77
 1    plant and here's some of the background; here are the
 2    specific aspects of the procedure that we think ought to be
 3    changed in a recommendation on where to go with it.
 4              We've got right now --
 5              DR. SHACK:  Excuse me, but how much of that kind
 6    of response have you gotten?
 7              MR. BOYCE:  Fairly good.  I don't have hard
 8    numbers, but I want to say that we've had 100.
 9              DR. SHACK:  It's on that order?
10              MR. BOYCE:  It's on that order of 100, and the way
11    the Regions are -- the Regions are the primary people giving
12    us that input.  And the Regions are establishing their own
13    internal processes to get us good feedback.
14              Typically, a Resident Inspector who is on the
15    front line, will identify an issue; he'll work it through
16    his Regional branch chief; Regional management will discuss
17    the issue, flesh it out, apply the right context to the
18    issue, and decide whether or not it needs to go forward for
19    a program change, and then it gets forwarded to us at
20    headquarters for us to look at.
21              DR. SHACK:  Now, does an Inspector use the same
22    kind of form if he sees a problem with the process?
23              MR. BOYCE:  Right, in general, he fills that out
24    and sends that in to the Regions, although some of the
25    Regions have adopted a different strategy that the form we
.                                                                78
 1    get ultimately is this form.  But the many of the Regions
 2    have started with the Resident Inspector on this form.
 3              We have a monthly meeting with NEI where we go
 4    through a variety of issues.  There is in your handout, a
 5    sample agenda from a recent meeting, I think, as well as
 6    some of the meeting minutes.  And that can give you a sense
 7    as to the sorts of things we discuss there.
 8              We found that very, very useful in getting a sense
 9    as to where industry is, particularly on things like
10    performance indicators.  And a lot of the things Don was
11    saying, we would hear NEI's position on, we'd be able to
12    move forward with a good resolution that way.
13              We've got something called an Initial
14    Implementation Evaluation Panel.  The Commission directed us
15    to have an independent panel take a look at our
16    implementation during this first year.  It's very similar to
17    what we did in the pilot program where we had a pilot
18    program evaluation panel.
19              And that report was published.  I think this panel
20    reviewed that, but I don't know for sure.
21              There are four meetings.  It's chaired by a
22    Regional Division Manager.  It's got representatives from
23    the two states, industry representatives, Regional
24    representatives, and several Headquarters representatives.
25              We've also had a variety of public forums.  This
.                                                                79
 1    says mid-cycle, but actually we conducted what are called
 2    the end-of-cycle reviews on our nine pilot plants back in
 3    April, and we actually issued an end-of-cycle letter as if
 4    they were under the reactor oversight process.
 5              And then we held a public forum to say this is our
 6    evaluation of the plant.  In addition, we have gone out at
 7    every site and held a meeting in the vicinity of the site
 8    where we gave the public an overview of the reactor
 9    oversight process, and the opportunity to comment and
10    provide us with input.
11              We're also in the process of conducting Regional
12    site visits where members of our Branch go out and actually
13    visit the Resident Inspectors at the sites, talk to the
14    licensees, talk to members of the public, and try to obtain
15    firsthand feedback.
16              We're going to be issuing a Federal Register
17    Notice very shortly, where we're specifically soliciting
18    feedback on a variety of issues associated with the
19    oversight program.
20              And we're going to conduct lessons learned
21    workshops, one for the public, external, and also one
22    internal for our internal stakeholders.  So I think the
23    message is, we're really trying to beat the bushes and get
24    as much input as we can to improve the process during this
25    first year.
.                                                                80
 1              And here's a look at where we're going in the
 2    future.  You're going to hear a lot more, I hope, on STP
 3    improvements and enhancements.
 4              You've heard about the Scram PI Pilot Program from
 5    Don Hickman, and also unplanned power changes and
 6    unavailability PIs.  We're trying something a little bit new
 7    on this bullet right here, where we're talking about
 8    industry trend assessment.
 9              The thinking here is that we've done a lot to
10    modify our oversight program recently.  And we're trying to
11    say, okay, let's take a step back.  Are we really making a
12    difference?
13              Is industry performance improving, holding
14    constant, or being degraded as a result of our new oversight
15    process?  You know, there an underlying assumption that
16    industry is doing a good job and that their programs are
17    effective a maintaining safety at the plants.
18              Well, it's not enough that we inspect each plant
19    and that we've got performance indicators on each plant; we
20    want to take holistic view and come up with an answer that
21    we're comfortable with that says we're doing well.
22              And there are several things that we're looking
23    at.  This is the early stages.
24              One is the AEOD PIs, because they have been around
25    for 15 years, and we're going to continue that program under
.                                                                81
 1    NRR.  And we're going to watch.  All the trend lines have
 2    come down -- well, most of the trend lines have come down on
 3    those PIs, and we're going to continue to monitor those and
 4    we're going to look for any adverse trends.
 5              We're taking a look at the accident sequence
 6    precursor program.  We're trying to develop a means to take
 7    our current set of PIs that we've developed for the reactor
 8    oversight process, and try and get a way to aggregate those
 9    PIs and look for trends.
10              Right now, they're individual, based on, say,
11    plant power changes or unavailability PIs.  Does it make
12    sense to try and pull those together and develop a whole
13    other set of PIs?
14              Anytime you try and do that aggregation, you run
15    into problems.  An example might be diesel generators.  Not
16    every plant has the same number of diesel generators, and so
17    when you try and aggregate them, your data might be skewed
18    in a direction we don't fully understand.
19              So this is something we're going to be looking at
20    the data and trying to develop.  There are other ways that
21    we can count beans and give us an indication.
22              You were alluding to earlier, that matrix which
23    shows performance indicators on a sheet, and that gives you
24    a nice overview of the how the industry is doing.  Mike
25    Johnson says we're going to develop one for inspection
.                                                                82
 1    findings as well, so we'll have an analogous matrix for
 2    those.
 3              When you have performance indicators and
 4    inspection findings, you can combine those and show where
 5    any plant is on the action matrix.  So we're going to show
 6    the action matrix and show what column of the action matrix
 7    each plant is in.
 8              And that will give you a view of the whole process
 9    and the whole industry on our website.  That's where we
10    think we're going with that.
11              Another thing we're contemplating doing and we're
12    going to be discussing with NEI this afternoon is, you can,
13    from our website, count the number of plants that are in the
14    regulatory response column, the licensee response column,
15    the degraded cornerstone column, and you can come up with
16    bean counts.
17              We have 80 percent of the plants in the licensee
18    response column; we have 15 percent of the plants in the
19    regulatory response column, et cetera, and you can come up
20    with a mosaic of where all the plants are in the industry.
21              If we have that today, we can track that sort of
22    thing down the road, and if we start to see a lot of plants
23    migrating from the licensee response column over to the
24    degraded cornerstone column, we'll be able to say
25    definitively that we have a problem.
.                                                                83
 1              So those are the sorts of things we're looking at
 2    to try and develop a method for industry trends.
 3              DR. SEALE:  You earlier made note of the fact that
 4    the industry has is own programs of concern with safety, and
 5    presumably they're in the excellence rather than the minimum
 6    compliance business.
 7              And so that makes the things they do somewhat
 8    different from the things you do.  At the same time,
 9    undoubtedly, they have they own version of the industry
10    trends assessment process.
11              Is there ever an opportunity for you, in the
12    integral form, not the plant-specific form, because I know
13    they always get nervous when you talk plant-specific, but in
14    the integral form, is there a way for you to compare your
15    industry assessments with their industry assessments?
16              MR. BOYCE:  Are you speaking of the WANO
17    indicators?
18              DR. SEALE:  More than that.  I mean, that's the
19    high level up here.  I'm talking about now that we get down
20    to the nitty-gritty assessment kind of detail.
21              MR. BOYCE:  I think if you -- the one that's
22    really available is the INPO industrywide indicators where
23    they take all of their's and aggregate them.  I think that
24    once we get our process and we do something similar, there's
25    going to be no way to avoid analyzing any similarities or
.                                                                84
 1    differences.
 2              DR. SEALE:  Yes.
 3              MR. BOYCE:  It's not that we plan on doing it, but
 4    there is no way we're going to be able to avoid it.
 5              DR. SEALE:  Somebody's going to do it for you, and
 6    if you don't have some coherence and a story as to why it
 7    isn't, then you're going to have -- both of you will have a
 8    problem.
 9              MR. GILLESPIE:  I think that when we step back --
10    we're still trying to figure out how to do ours.  So we're
11    still up at bat here.
12              DR. SEALE:  I understand that.
13              MR. GILLESPIE:  But, yes, anytime there's a
14    difference, we're going to have to do an analysis of some
15    kind of the difference.
16              And also you've said something that we kind of
17    have to watch where we go.
18              DR. SEALE:  Yes.
19              MR. GILLESPIE:  We are not pushing the same as
20    INPO is when they set industrywide goals.  They have
21    excellence goals and things like that on exposure,
22    unavailability, et cetera.
23              We have regulatory goals, and how we articulate
24    our trends is also, I think, going to be very important, to
25    distinguish between those two.
.                                                                85
 1              MR. JOHNSON:  In fact, if I could add to what
 2    Frank's saying, you know, we have the NRC performance goals,
 3    and this goes directly to one of our performance goals,
 4    which is that we're going to maintain safety; that is, that
 5    we're not going to have any significant adverse trends in
 6    industry performance.
 7              And we will end up reporting on this on an annual
 8    basis as a part of the Agency's -- we talk about it in the
 9    performance plan, the green book.  We talk about it in the
10    report that we owe to the Congress and the President at the
11    end of the year that talks about our accomplishment of our
12    performance goals.
13              And so this is one that has high visibility, and
14    we're trying to measure and make sure that we maintain
15    safety.
16              DR. SEALE:  It's going to be interesting when
17    certain elements of the public become aware of the fact that
18    excellence is not a part of the objective of the NRC.
19              MR. BOYCE:  This is where you say I wonder?
20              [Laughter.]
21              DR. SEALE:  I don't wonder; I think there's a
22    shock out there someplace.
23              MR. GILLESPIE:  This gets back to George's earlier
24    comments when he says we're trying to be predictive of what? 
25    And we did not predict the leak at Indian Point, but given
.                                                                86
 1    the leak, and the process we went through, we did find a
 2    program failure which might have been predictive of a
 3    multiple tool failure, which, in fact, would be a much more
 4    severe public hazard, which is why it was a red finding.
 5              So, in that case, we feel, from the oversight
 6    point, to some degree that it was a success; the system
 7    worked.
 8              Yet people would say, well, the system failed
 9    because you didn't predict the leak.  Well, our threshold
10    really wasn't set at that level, and right now it still
11    isn't.
12              So, that's the difference between excellence and
13    public protection, and we're trying to keep that in mind,
14    yes.
15              CHAIRMAN SIEBER:  On the other hand, I think it
16    would be near impossible for you to predict a leak, and so
17    it may not be worth the effort.
18              MR. GILLESPIE:  Well, there were some lessons
19    learned.  Now let me backtrack on what I said, because there
20    were some lessons about how we conducted the inspections
21    from two and three years ago when they did their steam
22    generator inspections and how we oversaw it.  Was there some
23    correction available?
24              It may not fix the problem.  I don't know that it
25    would have predicted the leak, but there were some things
.                                                                87
 1    where we could tighten up on how we do some reviews in the
 2    field, and the experience level of the people doing the
 3    reviews.
 4              And so that was a positive thing that we do need
 5    to fix.  And that may or may not fix the problem, but it
 6    will help, I think.
 7              MR. BOYCE:  Risk-based performance indicators:  We
 8    have alluded to that.  We just got done reviewing Research's
 9    Phase I risk-based PI development report and providing them
10    comments.  I think Research is on your agenda for early next
11    year to present this.  I don't know exactly what month, but
12    we think that effort has got an awful lot of potential.
13              There are some serious pitfalls that may or may
14    not be show-stoppers, but definitely need to be addressed. 
15    For example, the data that you're talking about for
16    unavailability, how do you gather all of that, and how do
17    you do it consistently.
18              Right now, we have 18 performance indicators in
19    our current process.  Research identified in this early
20    document, 31 potential performance indicators.
21              And getting data to feed that right now is an
22    issue.  NEI has gone on record as saying, well, we've got 18
23    that work, you know, it's a voluntary program and why do you
24    want us to collect and submit data for 31?  That's a huge
25    increase in burden, and if we're going to go in that
.                                                                88
 1    direction, we want a corresponding decrease in the
 2    inspection that we get.
 3              And so that's one early position that we need to
 4    look at closely.  And we need to say whether or not the
 5    benefit that we're getting from risk-based PIs warrants that
 6    sort of response.
 7              But we don't know where that's going, but that's
 8    one issue.
 9              DR. APOSTOLAKIS:  Now, risk-based means
10    plant-specific?
11              MR. GILLESPIE:  It is very close to
12    plant-specific.  It depends on -- what it depends on is the
13    modeling used.  Research is using what are called the SPAR
14    models.  And to the extent that those are driven all the way
15    down to the plant-specific level, you'll get your answer.
16              I think right now there's 30 SPAR models, and they
17    are on their way to 70.  But that development is again --
18              DR. APOSTOLAKIS:  I wonder what NEI means when
19    they say that the system works?  Is it that 99 percent are
20    green; is that what it means?  Well, if I were they, I would
21    say it works very well.
22              So I'm not sure that the systems works is really
23    something that we all agree to.  If you have very high
24    threshold levels, there are lots of greens.  If you're the
25    industry, of course it works.
.                                                                89
 1              It's nice, and that's the whole idea of having
 2    plant-specific indicators, and then you will have some way
 3    to discriminate.
 4              In fact, I remember several months ago, I read
 5    some comments from states and other non-industry groups
 6    where they expressed amazement that so many greens were
 7    collected.  So, I don't know that the argument that the
 8    system works, carries much weight with me, at least.
 9              DR. KRESS:  That brings to mind Graham Wallis's
10    standard question; what's the measure of whether or not this
11    is working correctly or not?  How are you going to measure
12    that?
13              DR. APOSTOLAKIS:  And if those guys have 31
14    indicators and you are using now, 18, it doesn't look to me
15    like it's an insurmountable problem.
16              I mean, maybe they can lump some of their's and
17    come up with a smaller number.
18              MR. BOYCE:  Your concerns are very valid.
19              DR. SEALE:  They're crying some crocodile tears
20    here, too, you know.
21              DR. APOSTOLAKIS:  Who is?
22              DR. SEALE:  The industry is, because I think that
23    anybody will tell you that if you go to a real plant that's
24    doing things well, that there are a heck of a lot more than
25    18 indicators they're keeping track of.
.                                                                90
 1              DR. APOSTOLAKIS:  My understanding is that INPO
 2    has made --
 3              DR. SEALE:  Yes, and so there's a little bit of
 4    disingenuousness in this added burden thing.
 5              CHAIRMAN SIEBER:  Well, that's probably true, but
 6    the difficulty is that each plant has their own set with
 7    different definitions.
 8              DR. SEALE:  I fully agree with that.
 9              CHAIRMAN SIEBER:  And trying to get them to agree
10    is 98 percent of the problem, as opposed to just doing it.
11              DR. APOSTOLAKIS:  They're getting some benefit
12    from this, Jack.
13              DR. APOSTOLAKIS:  Yes.  And that's the way you
14    manage your plant well.
15              DR. SEALE:  That's right.
16              DR. APOSTOLAKIS:  You said this was voluntary?
17              MR. GILLESPIE:  This is voluntary.  Our whole
18    program is voluntary.  The PI portion is voluntary.
19              DR. APOSTOLAKIS:  The PI portion?
20              MR. GILLESPIE:  The PI portion.  They don't get to
21    volunteer whether they want inspection or not.
22              DR. APOSTOLAKIS:  Yes, but the inspections are
23    different.  You don't just do the baseline.
24              MR. GILLESPIE:  If someone would un-volunteer,
25    then we're committed to doing a different inspection program
.                                                                91
 1    to make up for the differences.
 2              DR. APOSTOLAKIS:  Which is what you had been doing
 3    before.
 4              MR. GILLESPIE:  Right.
 5              CHAIRMAN SIEBER:  Sounds like volunteering is a
 6    good deal.
 7              DR. APOSTOLAKIS:  So are they volunteering, all
 8    units are volunteering?
 9              MR. GILLESPIE:  Oh, yes, there were no dissenters.
10              DR. APOSTOLAKIS:  No dissenters, so this is a
11    warmly-embraced volunteer program.
12              DR. BONACA:  I have a question with this now. 
13    You're going to look at the baseline inspection and assign
14    colors to those inspections, too.
15              And the question I have is, for this PI, you had
16    some criteria you used to determine the number that you're
17    accepting for each indicator.  That was essentially where
18    you didn't see in any change in risk associated with the
19    value.
20              What about the inspection?  How are you going to
21    set the criteria to go from, you know, green to white, and
22    will the result be a consistency in the sense that only 99
23    percent will be green, or is it going to be a different kind
24    of spread?
25              MR. GILLESPIE:  Maybe we've just jumped into
.                                                                92
 1    Doug's presentation where he was going to go through the
 2    significance determination process.
 3              CHAIRMAN SIEBER:  Yes, but let me ask one final
 4    question.  You talked about 31 future PIs.  Does that
 5    include the 18 that already exist, or was that an addition
 6    to the 18?
 7              MR. BOYCE:  Well, there is some overlap, but, no,
 8    it does not include those.  They're largely distinct and
 9    different.
10              CHAIRMAN SIEBER:  Okay, so that's 49?
11              MR. BOYCE:  Right, which we would not -- we have
12    -- that's one of the huge issues with implementation, is how
13    do you transition, if that's the right thing to do, and all
14    the data collection mechanisms are in place, how do you do
15    that transition?
16              MR. GILLESPIE:  One of the things that you have to
17    do is don't get hung up on the word, PI, in the risk-based
18    PIs.  It's risk-based data.
19              I don't know if you heard the hesitancy in my
20    voice when I said this before.  That would be a different
21    program than we have today.  It would be different.
22              CHAIRMAN SIEBER:  This is not the green, white,
23    yellow, red?
24              MR. GILLESPIE:  It may have colors assigned to it,
25    but you've got a different data collection process which
.                                                                93
 1    doesn't exist today, that has to be put in place in
 2    infrastructure.
 3              You've got plant-specific thresholds like the
 4    maintenance rule kind of thresholds that might be useful.  I
 5    mean, the data is there; the thresholds are there.
 6              Consistency in reporting, we need a data
 7    dictionary so that the data elements are reported
 8    consistently.
 9              It's like the next evolution of this program.  It
10    may not, in fact, be these PIs.
11              And I say that because these PIs have baggage with
12    them.  Part 50.9, and is it willful if you make a mistake,
13    and all those arguments came up.
14              If we are actually going to have a window into all
15    the operating data at a facility on all the safety systems,
16    is it fair to expect the utilities to submit that to us
17    under 50.9 with all the expense involved in that, or is it
18    data similar to what an inspector gets and writes up in an
19    inspection report, and it's the best available data?  And
20    you then get it confirmed if you're going to use it for an
21    official purpose.
22              And if it's like inspection data, but available
23    long distance, that's a whole different approach to
24    monitoring reactor safety than we're in today.  It's a
25    different scheme, and I would suggest that you can't think
.                                                                94
 1    of it in the same context of this program.
 2              You almost have to think of it as the next
 3    incremental jump.
 4              DR. APOSTOLAKIS:  It's moving to homo sapiens,
 5    right?
 6              MR. GILLESPIE:  Yes, we're still kind of walking
 7    on two's and three's, and so it would be a different vision;
 8    it would be a different mix of program.
 9              DR. APOSTOLAKIS:  But it seems to me, Frank, that
10    you said something earlier that's very relevant.  There is a
11    perception among the licensees that no matter what colors
12    you give them, they have to be green.
13              And as you said earlier, being white is not the
14    end of the world.
15              MR. GILLESPIE:  It's not.
16              DR. APOSTOLAKIS:  And I think, in fact, having the
17    vast majority of the indicators being green works against
18    the program.  Now, people might say, well, what's wrong with
19    that?  The industry is working very well.
20              Well, yes, but every now and then you have
21    something that upsets that perception.
22              DR. KRESS:  Maybe we need light green and dark
23    green here.
24              DR. APOSTOLAKIS:  I think green and white is
25    perfectly legitimate to find green and white, and then you
.                                                                95
 1    correct things and so on.
 2              CHAIRMAN SIEBER:  I think that the problem is that
 3    you have to look at it from the Chief Nuclear Officer's
 4    standpoint.  As soon as you get a white, you're talking to
 5    the Directors and the CEO and the financial people and
 6    everybody in the world.
 7              DR. APOSTOLAKIS:  You do not distort the
 8    inspection process because you have to do that.
 9              MR. GILLESPIE:  And we haven't.  That's why I
10    would really like to get to Doug.  Doug can go through an
11    example, having had a whole hour to prepare several case
12    studies for presentation to the graduate panel here, and
13    we'll see if he gets his degree or not.
14              [Laughter.]
15              MR. GILLESPIE:  I think that will illustrate the
16    leveling, because the FDP process is really the leveling
17    process for the inspection results to bring consistency.
18              And this is one of the real successes.  This was a
19    real innovation.  We had PIs before; we just didn't use them
20    the same way.
21              The real innovation is the measurement yardstick
22    for inspection results.
23              DR. APOSTOLAKIS:  I have one question before we
24    get into that:  There are some numbers that are now in the
25    books that are kind of puzzling.
.                                                                96
 1              For example, to get into the red for the
 2    initiating events, you have to exceed 25 scrams.  I mean,
 3    where did this 25 come from?
 4              MR. GILLESPIE:  Actually, I wish Don were here to
 5    take the blame.  No, it wasn't Don.
 6              That came from our risk people talking to their
 7    risk people, and focusing actually very, very narrowly,
 8    which is why there is a difference between the normal
 9    C-level, which is the green/white threshold at three, and
10    the risk level at 25.
11              If nothing else is wrong and you strictly vary the
12    number of scrams in a PRA, and everything else works, it is
13    not very risk-significant.  And, therefore, you can have a
14    whole lot of scrams and everything else is working.
15              And that was the difference between people who
16    wanted to have a measure and people who wanted to have an
17    indicator.  Those of us who wanted an indicator and not a
18    measure like the normal C-green/white threshold and say,
19    hey, that's the real meaningful threshold, when you depart
20    from normalcy, we should inquire more.
21              And the risk-informed thresholds that are lower
22    for that parameter, are just out of sight, because way
23    before someone has 25 scrams in a year, they're going to fix
24    it.
25              DR. APOSTOLAKIS:  Right, and presumably you will
.                                                                97
 1    do something.
 2              MR. GILLESPIE:  Presumably we'd be on their case
 3    pretty heavily by that time, too.
 4              That's the reason, and that is the difference
 5    between a risk measure which is purely done as a parametric
 6    kind of study for risk, with a single parameter being
 7    varied, and the normal sea level which is kind of the
 8    green/white thresholds.  And I don't know that we will ever
 9    fix that, I mean it is kind of we are stuck with it the way
10    it is right now, but that is where it came from.
11              I would like to give Doug some time because this
12    is -- he is actually a better speaker than the rest of us.
13              MR. BOYCE:  To segue into your question, Doug will
14    try and address how we separated out the wheat from the
15    chaff with our inspection findings into the more significant
16    ones.
17              MR. COE:  Thank you.  For the record, my name is
18    Doug Coe, I with the Inspection Programs Branch at NRR.  I
19    am pleased to be here.  In fact, I am real excited to be
20    here, because, as Frank mentioned, I think the SDP is in
21    fact an innovation and a quantum step forward in our ability
22    to risk-inform people's thinking.  I am going to come back
23    to that point in just a moment.
24              But to answer the question that you asked, about
25    2-1/2 years ago, Mike Johnson approached me.  He said, we
.                                                                98
 1    have got these great indicators, performance indicators, and
 2    we have got this concept and we want to set these
 3    thresholds, he said, but we have a real problem.  He said,
 4    we need something to match inspection findings in terms of
 5    their significance so that we can add these things together,
 6    in effect, in the action matrix to decide what kind of
 7    action to take.  We want these things to be more or less on
 8    the same footing and the same scale.
 9              So the performance indicators, at least in the
10    reactor safety area were built around this concept of the
11    change in core damage frequency.  And so the only real
12    answer for Mike -- of course, Mike wanted a simple tool, but
13    we will give the exact answer that was, you know, the most
14    accurate answer.  So that was the genesis of the SDP.  And,
15    of course, you know, what it meant was we had to design a
16    tool that would estimate the risk change in terms of a delta
17    core damage frequency metric, so that it can be compared to
18    the thresholds that have been established or were being
19    established at that time for the PIs.
20              You know, we also, of course, in the larger sense,
21    there is other cornerstones that aren't related to risk, as
22    you well know.  And so the idea there, as time progressed
23    and as we began developing those other cornerstone SDPs, we
24    were -- I think the idea was to try to represent the
25    significance in a way that caused the NRC to react with what
.                                                                99
 1    we thought was the appropriate amount of response relative
 2    to what we would be responding to and reacting to in the
 3    reactor safety area.  So there was a commensurate level of
 4    response, even though we couldn't actually quantify the risk
 5    value for some of those other cornerstones.
 6              But I want to make a couple of points real strong,
 7    and as I go through the couple of examples that I have
 8    provided today, I hope that it illustrates these points. 
 9    Inasmuch as the SDP was originally intended to be a backend
10    tool for an inspection finding, in other words, the
11    inspector goes out, does the inspection program, gathers up
12    a bunch of findings, brings the findings back, plugs them
13    into the SDP, turns the crank and out comes a number.  That
14    was kind of the original idea.
15              However, a number of us saw, who had been
16    struggling for a long time, feeling a little bit like the
17    guy with the bamboo cane that is kind of whacking at the
18    elephant's leg, you know, trying to get the elephant to move
19    in the risk-informed direction, we saw some real value in
20    helping to risk-inform people's thinking because, at least
21    personally, my assessment, having immersed myself in this
22    business since 1995, was that the real bottleneck, the real
23    problem was that the people who were deciding things on the
24    basis of risk insights really didn't own the risk analysis. 
25    They hadn't participated in it and, in fact, they were
.                                                               100
 1    simply looking to other people, specialists, analysts, to
 2    provide an answer, a risk answer.
 3              And, so, in fact, one way to answer Mike's
 4    question 2-1/2 years ago was say, okay, Mike, that's great. 
 5    You have established a threshold already, we will just hire
 6    a bunch of risk analysts and we will just put them to work. 
 7    And all the inspectors will give their findings to the risk
 8    analyst.  The risk analyst will be the oracle and they will
 9    come back and they will say, well, this is a green, and this
10    is a white.
11              DR. APOSTOLAKIS:  So what is wrong with that?
12              [Laughter.]
13              MR. COE:  What's wrong with that?  I will tell you
14    what is wrong with that.  Part of the effort that we have
15    tried mightily, I think, and now with greater success
16    because of the SDP, is to risk-inform inspectors' thinking. 
17    Because if they don't know, if they are not sensitive to the
18    plants, the things at a particular plant that drive risk
19    significance at that plant, then, you know, their effort and
20    their success in finding the most significant issues is
21    hampered.
22              And in the past we have tried, we have given them
23    training, and I even helped create a course, a two-week
24    course, at Frank's behest a number of years ago, which I
25    think has been somewhat successful, although it still fell
.                                                               101
 1    short.  We sent them forward.  Two weeks of training later,
 2    they knew how PRAs were done.  They had had some exposure to
 3    the IPEs, okay, because we brought those into the classroom,
 4    and we sent them out.  And we said, well, make the best use
 5    of this, do what you can.  You know, take the risk insights
 6    that you have gotten out of the IPEs, which, by the way, are
 7    10 years old, so they are not very useful anymore, and you
 8    will have to get new insights from the licensee, and use
 9    these to help find good issues.
10              Well, we sent them forward without any tools.  We
11    sent them forward without any -- well, I mean the
12    computer-based tools, we weren't able to give them training
13    on in a two-week course.
14              So what the SDP does is it provides a link between
15    the sophisticated, computer-based analyses that we have
16    created over time, and need for the inspector to have at
17    least a conceptual understanding on a high level, on a
18    functional level as to what drives risk at their plant.
19              I think we have struck the right balance, because,
20    on the one hand, our inspectors looked at our initial SDPs
21    and said this is hopelessly complex.  The analysts, on the
22    other hand, looked at our initial SDP worksheets and said
23    this is hopelessly crude.  So, given the two extremes and
24    the two perspectives, I think we have probably hit about the
25    right mark in the middle.
.                                                               102
 1              And so we have got a tool that isn't perfect, it
 2    is a gross estimator, but it forces the user to think in
 3    risk terms.  And I can't tell you how it has warmed my heart
 4    to hear not only inspectors, not only some NRC managers, but
 5    licensee PRA people that have come to me and said, this is a
 6    tool that I can use to help explain risk to my management
 7    and I have never been able to do that until now.
 8              And so, you know, I don't want to overplay this.
 9              DR. APOSTOLAKIS:  I have a question on this.
10              MR. COE:  Sure.
11              DR. APOSTOLAKIS:  The SDP documents are
12    plant-specific?  Because you said that they have to
13    appreciate the risks, so, you know, the dominant
14    contributors and all that.  So an inspector at, say, a
15    Davis-Besse would have matrixes that would reflect somewhat
16    that plant?
17              MR. COE:  Yes.  It is intended that the plant
18    equipment, the equipment that is designed for that plant,
19    and, of course the type of plant that it is, whether it is
20    PWR or BWR, and so forth, it is intended that, in fact, the
21    SDP be a fairly accurate, high level representation of the
22    plant-specific PRA that the licensee has performed, and that
23    we also try to capture in our SPAR model.
24              DR. APOSTOLAKIS:  And this is based on the IPE?
25              MR. COE:  Well, initially, we created -- you see,
.                                                               103
 1    this is a problem because we created -- the SDP initial
 2    concept was developed from the IPEs, because that is the
 3    only thing that we had available to us.  We have legal
 4    restrictions on going out and asking licensees for broad --
 5    you know, making broad requests for information to supply us
 6    with their up-to-date, most current models.
 7              So we started with that knowing that we would have
 8    to go get, on a plant-specific basis, an update, and we did
 9    that.  We formulated, early in the program, -- actually, we
10    didn't even have all of the initial worksheets developed in
11    April when we started initial implementation, but we
12    finished shortly thereafter, and we engaged in a series -- a
13    site visit to every site.
14              We sent one of our risk analysts, and sometimes
15    more than one.  We had some help from our contractor.  And
16    we gathered -- and we allowed the licensee to comment on the
17    worksheets and to incorporate things that we knew were
18    missing from the IPEs.
19              DR. APOSTOLAKIS:  So right now they are not they
20    are not based on the IPEs?
21              MR. COE:  Now they have progressed beyond the IPEs
22    and we have incorporated, or are in the process of
23    incorporating the comments and feedback that we got from
24    doing the site visits.
25              DR. APOSTOLAKIS:  Perhaps you are aware that there
.                                                               104
 1    is a letter from the Union of Concerned Scientists to the
 2    Commission to direct the staff not, as I recall, not to use
 3    the IPEs because we have told them so many times that the
 4    IPEs are not very good.
 5              MR. COE:  Right.
 6              DR. APOSTOLAKIS:  So if the Commission says don't
 7    use these IPEs, this program is not --
 8              MR. GILLESPIE:  Right.  I am watching the clock
 9    because I want Doug to go through some details, otherwise,
10    we will never really answer your questions.
11              They are plant-specific, we did have plant visits
12    with the contractors.  We have shared the booklets, and
13    there is a booklet for every plant, with the licensees.  And
14    the licensees know we are measuring them against that.  So I
15    think every licensee has done his best to make sure it
16    fairly reflects his facility.  So it hasn't been
17    unilaterally the NRC taking 10-15 year old data now.
18              Yeah, at a high level, I think we have got really
19    pretty good information.
20              DR. APOSTOLAKIS:  Okay.  So the booklets then are
21    plant-specific, but the ultimate comparison with the
22    thresholds are generic?
23              MR. GILLESPIE:  Yes.
24              DR. APOSTOLAKIS:  And we are planning to fix that.
25              MR. GILLESPIE:  Fortunately, though, we are
.                                                               105
 1    dealing with delta risk and not absolute risk.  Changes.
 2              MR. COE:  And it is important, too, to answer the
 3    concerns that are still out there and will stay out there, I
 4    think, for a while, that, you know, the quality of the
 5    analysis that we do is only justified based on whether or
 6    not we agreed upon the influential assumptions that were
 7    used in the analysis.  And part of the process that we were
 8    seeing happen here, I think, which is one of the intents is
 9    that the influential assumptions of a particular risk
10    analysis be more broadly understood by a lighter population
11    of people, including the inspectors in the field, who are in
12    a position to challenge those assumptions if they have, you
13    know, having information that they do, that they gain on a
14    day-to-day basis.
15              So, you know, it is a question of improving the
16    understanding at all levels in the organization of what is a
17    risk analysis, and what it isn't.
18              So let me just make a couple of points real quick. 
19    I have got a couple of overview slides in here.  And let me
20    just point out, you talk about a lot of green findings, and
21    that is true, however, eight months into the program now, in
22    the initial implementation, we have 16 greater than green
23    issues that have been processed by what we call the SERP, or
24    SERP, which is the SDP and Enforcement Review Panel.  This
25    is the headquarters panel that meets to look at every issue
.                                                               106
 1    that the regions send us as a white issue or greater.
 2              And these are the cornerstones along this side
 3    here.  And not too surprisingly, of course, we have got a
 4    lot of whites, a couple of yellows, and, of course, you know
 5    about the Indian Point 2 red.  The note at the very bottom
 6    is supposed to reference the physical protection cornerstone
 7    and reflects the Commission's review currently of an interim
 8    SDP that is going to be used.  So that one white issue may
 9    change after we hear from the Commission.
10              DR. APOSTOLAKIS:  So what is the first bullet, 16
11    greater than green?
12              MR. COE:  Sixteen.  If you count up these issues,
13    you will find 16 issues here, and these are all greater than
14    green, and they have all been processed by the headquarters
15    panel.  And this is simply a high level tally, the stats to
16    date, since April.  Okay.
17              And my only point, the only take-away on this is
18    simply that we have had --
19              DR. WALLIS:  I found it greater than confusing,
20    because, to me, grades go up and greater than green would
21    mean better than green, not worse than green.
22              MR. COE:  I'm sorry, I was using a mathematical
23    symbol, I probably should have used language.
24              DR. WALLIS:  Or non-green or something.
25              MR. COE:  Non-green is better.  Non-green is
.                                                               107
 1    better.
 2              DR. SHACK:  One thing that has been surprising to
 3    me is those two yellows that plug in there for what seems
 4    like a long time.  They were yellow when I first looked
 5    them.  You know, they are yellow, you know, months later.
 6              MR. COE:  Yellow inspection findings do stay
 7    yellow for four quarters, that is a characteristic.
 8              DR. SHACK:  So a corrective action may well have
 9    been taken.
10              MR. COE:  Yes.
11              DR. SHACK:  I see, but its color hangs in there.
12              MR. COE:  Right.  It is not real time like a
13    performance indicator, or it is relatively less real time. 
14    But the idea was there that --
15              MR. BOYCE:  One second.  You need to carry that
16    for four quarters, because if you have one and then it is
17    fixed, and then one the next day and then it is fixed, you
18    can do that every day.  And the process is built on if you
19    have got more than one, you end up degrading your
20    cornerstone and that takes you into the action matrix where
21    you get increased regulatory attention.  That is the basis
22    for it.
23              MR. COE:  And, also, a yellow inspection finding
24    does represent some underlying causal factors that make --
25    it would probably take, it was more likely than not to take
.                                                               108
 1    some time to fix, and to be assured that it wasn't going to
 2    recur.  So a year seemed, for better or for worse, seemed
 3    like about the right amount of time.
 4              Okay.  And we talked a little bit about some of
 5    the key issues earlier in the meeting.  The risk-informed,
 6    plant-specific, again, plant-specific, risk-informed
 7    notebooks, I am going to illustrate their use with these two
 8    examples that I have here for reactor safety cornerstones.
 9              Fire protection, I know we have talked about that. 
10    I know your interest in that area, and it is an area that we
11    acknowledge that, because of the nature of fire protection
12    issues and the spatial complexities that are inherent in
13    that, it is a more complex SDP, and there is essentially no
14    way to get around that.  But we do need to make the tool
15    usable, and we are working to improve its usability.
16              Safeguards, I have talked about, and the
17    Commission is reviewing the current interim SDP containment. 
18    We really haven't made as much progress as I would like to
19    have made on containment.  We have a basis document that is
20    in place, and the Risk Analysis Branch of NRR has taken on
21    the task of improving that process from a usability
22    standpoint for the inspectors' use.
23              Shutdown, we have a checksheet basically that goes
24    through some of the industry guidelines and, basically, it
25    is a Phase 1 kind of a process where it prompts the
.                                                               109
 1    inspector to send the issue to headquarters for further
 2    analysis if certain thresholds within that checksheet are
 3    met.
 4              So, with that, I think I am ready to dive into an
 5    example, unless there's any questions at this point.
 6              [No response.]
 7              MR. COE:  All right.  I have given you a package
 8    that incorporates two examples.  I have to point out that
 9    these examples we used for the rollout training prior to
10    April and so the worksheets have changed slightly since
11    April, since we have gone into initial implementation.  And
12    what I hope to achieve today is simply to illustrate to you
13    the concept.
14              First, just as an overview, let me say that the
15    SDP for reactor safety is divided into three phases.  And,
16    Dr. Apostolakis, it actually parallels very closely the work
17    that you and Budnitz did on the fire and seismic.  You
18    actually had three levels, I believe, we call them phases. 
19    But I think it paralleled -- what we have done here
20    parallels very closely the thoughts and concepts that you
21    articulated in that NUREG on how to assess.  And I know your
22    task at that time was to assess LERs for their possible
23    addition to the ASP process, the Accident Sequence Precursor
24    process.  But the concept is very similar.
25              So Phase 1 is essentially a screening where we can
.                                                               110
 1    call as green those issues which have a very high likelihood
 2    of not reaching the 1E to the minus 6 delta core damage
 3    frequency threshold.
 4              Phase 2, if something does not pass that screen,
 5    and we can't just say that it is definitely, you know, of
 6    that low of significance, then we have to do a little
 7    further analysis on a higher, on kind of a gross level,
 8    functional level.  But that is the process that I believe
 9    will give us the most gains in helping to risk-inform our
10    inspectors' thinking, and that is what we are going to go
11    through here.
12              The Phase 3 is the point at which the inspector
13    has to hand-off the issue for either verification that it is
14    a risk significant issue, to a risk analyst, or because the
15    SDP process simply can't accommodate the particular issue
16    the inspector has, and that should become apparent as the
17    inspector tries to work through the process.  So it is an
18    automatic acknowledgement that there's limitations to Phase
19    2, and if you exceed those limitations, you need help.
20              This part of the worksheet right here is just
21    basically setting up the problem.  And in this particular
22    case, we have an accumulator and a PWR, one of four that has
23    not met its required tech spec level for a period of time. 
24    And so this is very important, because, as we have
25    experienced with our initial rollout of this technique,
.                                                               111
 1    inspectors really have to write down very clearly what the
 2    deficiency is, because, as they proceed through a
 3    risk-informed process, there is a strong tendency to change
 4    the rules, or change the initial conditions as you go.  And
 5    you have to resist that, and so we have to very clear.
 6              So, basically, this is just information that helps
 7    identify the problem and in the lower half of the worksheet
 8    simply helps the inspector identify that one of the
 9    cornerstones that we are going to address in this process
10    has been affected, there has been an impact or a change.
11              DR. WALLIS:  Well, this looks like a cascade.  I
12    mean I would think you would check core decay heat removal,
13    because that is what it has to do with.  Then you would
14    check initial, and then you would check primary, and then
15    you would check one of the pressures.  Instead of just
16    checking one of those things, you would check probably four
17    of those.
18              MR. COE:  Yes, you are quite right.
19              DR. WALLIS:  It is a cascade of reasoning.
20              MR. COE:  That is exactly it.  It is a cascade of
21    reasoning, that is the way it was developed.  And, in fact,
22    that is a very good point.  And we have seen inspectors use
23    it in that fashion as well.
24              But given that the logic should be apparent here,
25    it would be clear, I hope, that if you check this, that it
.                                                               112
 1    really related to these other two higher order functional
 2    statements.
 3              DR. APOSTOLAKIS:  What does it mean that for the
 4    Maintenance Rule, it is a risk significant event?  I mean
 5    they can tell that right away?
 6              MR. COE:  The Maintenance Rule required licensees
 7    to categorize the systems and components into two
 8    categories, risk significant and non-risk significant -- or
 9    high risk significance, low risk significance.
10              DR. APOSTOLAKIS:  Oh, it is a categorization of
11    the accumulators.
12              MR. COE:  It is what the accumulators, where they
13    are in the licensee's scheme.
14              DR. SEALE:  That ties it all together.
15              MR. COE:  And that information is needed for the
16    Phase 1 screening question, which we will get to on the next
17    page, actually.
18              The next page is the Phase 1 screening process,
19    and this is the series of questions that are related to
20    trying to -- you know, if we have an issue that is --
21              DR. WALLIS:  So this value is a cross instead of a
22    checkmark, so his vote doesn't count.
23              [Laughter.]
24              MR. GILLESPIE:  Well, it depends on what happens
25    to the chad.
.                                                               113
 1              MR. COE:  This process here, Phase 1 starts by
 2    checking off which cornerstones are affected.  And, again,
 3    we have updated this a little bit, clarified it a little bit
 4    more.  But the basic idea here is that if more than one
 5    cornerstone is affected, then we go ahead and go on into
 6    Phase 2.  We are not confident, if more than one cornerstone
 7    -- typically, this might be something that would affect both
 8    initiating event frequency and the mitigating system
 9    capability.
10              DR. APOSTOLAKIS:  Can you give me an example of
11    something that affect no cornerstone?  It seems to me you
12    have covered just about everything there.
13              MR. COE:  Yes.  A licensee fails to put an SSC
14    into Category A1 of the Maintenance Rule, an SSC has reached
15    its performance criteria, and so they begin to take -- well,
16    they are taking corrective actions on a failure-by-failure
17    basis, but the licensee fails to recognize that it has
18    exceeded its performance criteria, it has been now put into
19    the Maintenance Rule.  The deficiency is that they failed to
20    take an administrative action that would then help give more
21    attention and, presumably, improve the reliability of that
22    component.
23              This is an issue currently because those kinds of
24    things that can't be related to a cornerstone, and that is a
25    good example of one, end up as what we call a no-color
.                                                               114
 1    finding.  In other words, the licensee failed to comply with
 2    the Maintenance Rule, but there was no -- for the deficiency
 3    that I described, there was no affect on plant reliability.
 4              DR. APOSTOLAKIS:  So, primarily, administrative
 5    kinds of things.
 6              MR. COE:  Yes.
 7              DR. WALLIS:  There is one thing that is missing
 8    here, and that is none of the above.  And maybe the
 9    inspector has a very good reason to know he ought to go to
10    Phase 2, although it doesn't fit in one of these boxes.
11              MR. COE:  And that is a good point, and what we
12    have stated in our implementing guidance, and what I stress
13    when I talk to inspectors, is that they should never at any
14    time feel constrained to not go, proceed into a Phase 2
15    analysis, because, as I mentioned, and as I stress over and
16    over again, it is like anything else, the more you use it,
17    the better you understand it, and that is, in fact, one of
18    the goals.  Okay.  So that is a good point.
19              If, however, only one cornerstone is affected,
20    Phase 1 screening questions try to get a little bit more
21    definition of the potential significance.  And, so, in this
22    particular case, the mitigation system cornerstone was
23    affected.  We asked a series of questions.  And, as you can
24    see here, Question Number 3 was the one that was checked
25    yes, and it was that the issue represented actual loss of a
.                                                               115
 1    safety function of a single train for greater than tech spec
 2    allowed outage time.
 3              I would point out that these screening questions
 4    are in sync with or came out of the accident sequence
 5    precursor screening criteria.  So we drew from that to try,
 6    number 1, to be consistent, and -- well, that is primarily
 7    it, is to be consistent with that.  And we might adjust
 8    these screening criteria as time goes on, as we gain more
 9    experience.  If we had found an issue that passed through
10    this and none of the questions were answered and it came out
11    green, and we subsequently found it to be of significance,
12    we would certainly want to revisit this.  But to date, we
13    have not encountered that.
14              So we say, okay, this has greater than --
15    potentially greater significance than green.  So we want to
16    continue the analysis.  At that point we ask the inspector
17    to look at what are the accident sequences that are of
18    concern here.  And for an accumulator, its function, as was
19    represented in the worksheet, the first page of that
20    worksheet, was to provide core reflood capability upon a
21    design basis LOCA.
22              And so we look at large LOCA and we look at the
23    frequency, and we look at how long the condition existed. 
24    In this case, the condition existed --
25              DR. BONACA:  How does the --
.                                                               116
 1              MR. COE:  What did I say?  Ninety hours.  I said
 2    90 hours.
 3              DR. BONACA:  How does the inspector know that you
 4    don't rely on this for a small LOCA?  I mean does it have
 5    sufficient understanding of that?  What kind of effort --
 6              MR. COE:  No, actually, the process requires the
 7    inspector to right down what the function is of the system. 
 8    And I believe, I think we might have even changed this, so
 9    it doesn't just focusing on licensing basis.
10              MR. GILLESPIE:  How does he know which sequence to
11    pick for his plant?
12              DR. BONACA:  Well, I mean here, you know, if you
13    understand the LOCA, you know, for a small break LOCA, you
14    can use the accumulators.  But mid-break LOCA, it depends on
15    the plant, and large break LOCA, all of them need it.
16              MR. GILLESPIE:  Right.
17              DR. BONACA:  So the question is -- you know, that
18    is quite a time-consuming effort to go back into this.
19              DR. APOSTOLAKIS:  That is why they take the
20    two-week course.  Is that what you teach them?
21              MR. GILLESPIE:  That's the key to it.  Plus they
22    had a week of additional training specifically on the
23    applicability of this.
24              But, Doug, do you want to?
25              MR. COE:  Yeah, we have a table in the
.                                                               117
 1    plant-specific workbooks, and what they will do, for every
 2    system, in this case, accumulators would be listed on the
 3    left column of that table.  You would go over to the right
 4    column and it would tell you which accident sequences, and
 5    each accident sequence that is represented there would have
 6    a separate worksheet.  And we are going to go through a
 7    couple of those in just a moment.
 8              Now, I am noting here that what I gave you here
 9    was that we should have had a 90 hour time period, which
10    would actually have put us over here in the -- well,
11    actually, in the middle column.  Okay.  And so this isn't
12    exactly right, and I think that has been fixed in our
13    subsequent presentations.
14              DR. BONACA:  We have different --
15              MR. COE:  Three days.  Three days is what, about
16    75 hours or so.  And so what we really have is we have a
17    time period that is greater than three days and less than
18    30.  So what we really should be in is this block right
19    here.
20              DR. BONACA:  Our slides, in fact, are correct.
21              DR. APOSTOLAKIS:  A little different.
22              DR. BONACA:  They show the F for Category 5 and
23    the G for 6, so they are correct.
24              MR. COE:  Well, the time period here is specified
25    as 90 hours.
.                                                               118
 1              DR. WALLIS:  We have 5 and you have 6.  Why is
 2    that?
 3              DR. SHACK:  Medium LOCA and large LOCA.
 4              MR. COE:  Okay.  All right.  You have -- I think
 5    you have the updated.
 6              DR. BONACA:  We have the updated version.
 7              MR. GILLESPIE:  You gave them the right answer.
 8              MR. COE:  I gave you the right answer, I have got
 9    the wrong slide.  Okay.
10              [Laughter.]
11              DR. APOSTOLAKIS:  So let me understand, it is a G,
12    is that what it is?
13              MR. COE:  For large LOCA is G.
14              DR. APOSTOLAKIS:  And what does G mean?
15              MR. COE:  G is simply the value here, multiplied
16    by this in terms of years.  It gives you an estimated
17    likelihood that that event will occur during that period of
18    time.
19              MR. GILLESPIE:  It is an index to get to the next
20    table.
21              DR. APOSTOLAKIS:  Okay.  The next table, okay.
22              MR. GILLESPIE:  Yeah, let me continue.  Now we are
23    at the simplified tool stage.
24              DR. APOSTOLAKIS:  Yeah.
25              MR. GILLESPIE:  To avoid a calculation.
.                                                               119
 1              MR. COE:  If you want to just jump ahead to this
 2    in your first example, this is where we are headed.  This
 3    initiating event likelihood of G represents that value, that
 4    likelihood that that event would occur during that period of
 5    time.  And the remaining part of the risk equation is what
 6    is the likelihood that, given that event during that time,
 7    that the plant's mitigation functions would completely fail? 
 8    And so that depends on how many mitigation functions are
 9    available to address that initiating event.
10              And so our final, what we are shooting for here is
11    which one of these cells are we in for any of the initiating
12    event sequences that were affected by that particular
13    deficiency.
14              To get to that point we need to know what the
15    plant's capability is, and what we have represented here is
16    simply a high level representation of accident sequences
17    beginning with, in this case, the large LOCA initiating
18    event.
19              So this worksheet is going to take the value of
20    the large LOCA initiating event probability during that
21    period of time, which we have represented as "G" --
22    correctly on your handouts, "G" -- as an entry point to that
23    table that I just showed you, but we document on this
24    worksheet as "G" for these large LOCA sequences.
25              We note that the exposure time was 90 hours and in
.                                                               120
 1    other words we know where that G came from because it could
 2    have come from a couple of different places in Table 1.
 3              In the next section here --
 4              DR. WALLIS:  Just look at that, because it seems
 5    to say that four out of four accumulators are needed.  Isn't
 6    that what it says there?
 7              MR. COE:  That's correct.
 8              DR. WALLIS:  But you have lost one.
 9              MR. COE:  Right.
10              DR. WALLIS:  So why is not a bad thing to lose
11    one?
12              MR. COE:  These definitions up here are there to
13    define these functions down here, and of course these are
14    going to represent the accident sequences that we are going
15    to be concerned about in this analysis.
16              Therefore, the early inventory accumulator
17    function is satisfied in terms of the full plant capability
18    for that, to satisfy that function.  The requirement, and
19    this is actually a restatement of the success criteria, is
20    that four out of four accumulators are required to function,
21    okay, to satisfy the EIAC safety function.
22              DR. WALLIS:  He's lost one.  Hasn't he lost one?
23              MR. COE:  You have indeed lost one.
24              DR. WALLIS:  So why is a zero in there?
25              MR. COE:  Because what you do down here is, first
.                                                               121
 1    of all, can you recover the failed train, and you either get
 2    a credit of zero if you can't or you get a credit of one if
 3    you do --
 4              DR. WALLIS:  And so zero is bad?
 5              MR. COE:  Well, zero is simply a reflection that
 6    you cannot recover that train --
 7              DR. WALLIS:  I was puzzled by that, because zero
 8    equals Green on the right.
 9              MR. COE:  I'll get there.  You are jumping ahead
10    of me.
11              DR. WALLIS:  Okay, I'm sorry.
12              MR. COE:  Let's walk through this as logically as
13    I can.
14              The EIAC function has been affected, okay, and
15    that is the only function here that has been affected.  In
16    other words, all of these sequences are large LOCA
17    sequences, but the only sequence likelihood that has changed
18    is this one up here, because that is the function that was
19    affected.
20              The function requires four out of four
21    accumulators.  You have less than four.  Therefore, over
22    here you get zero credit for that function, zero credit
23    here.  We ask the supplemental question in almost all cases
24    could this function be recovered by manual operator action? 
25    What the user of this SDP has said here is that in their
.                                                               122
 1    judgment you couldn't do it fast enough.
 2              In other words, a large LOCA is going to happen
 3    and there is no time -- there is no opportunity to regain
 4    that function.
 5              DR. WALLIS:  You are not going to refill an
 6    accumulator while there is a LOCA.
 7              MR. COE:  Precisely, and so that is why that is
 8    zero and so this is zero, and so we come over here for this
 9    sequence.  We essentially have lost all functional
10    capability and therefore the risk significance for that
11    sequence is solely dependent upon the initiating event
12    frequency or the likelihood that that initiating event would
13    occur during that period of time.
14              That is how we get to Table 2 -- this table
15    here -- where we have this G, initiating event likelihood
16    during that period of time.  We come out over here to zero,
17    zero capability, and so what this cell represents is a range
18    of delta CDF values that basically reflect the value of
19    that --
20              DR. APOSTOLAKIS:  So what saves you is that the
21    frequency of the large LOCA is small enough.
22              MR. COE:  That's correct.
23              DR. BONACA:  Is small enough -- and the frequency
24    is in the 90 hours.  Its accumulators are very small.
25              DR. WALLIS:  So it is small enough you could have
.                                                               123
 1    lost all the accumulators and you still wouldn't care?
 2              MR. COE:  For that particular accident initiator.
 3              Now what the table would tell the inspector to do
 4    would be that not just the large LOCA takes credit for
 5    accumulators, which is design basis and really that's all
 6    the design basis looks at, but from a PRA standpoint the
 7    medium break LOCAs take credit for accumulator reflood,
 8    okay? -- so we also have to look at --
 9              DR. BONACA:  Before we go to that though, the
10    interesting thing it seems to me that if, however, it was
11    more than 30 days, going back -- then you would be an F --
12              MR. COE:  Yes.
13              DR. BONACA:  -- and you would be White.
14              MR. COE:  Yes.
15              DR. BONACA:  So then because the frequency of the
16    LOCA and --
17              MR. COE:  Time duration --
18              DR. BONACA:  Exactly.
19              MR. COE:  So what we have done is we have allowed
20    the user to begin to see the interplay between time,
21    initiating event frequency, and remaining mitigation
22    capability, and to do so in a simple fashion that does not
23    require them to sit at a computer terminal and understand
24    the complexities of what is happening in software.
25              DR. APOSTOLAKIS:  But if we did or if they did
.                                                               124
 1    only what you said, then even if all four accumulators were
 2    unavailable the result would be the same, but the Agency
 3    would have reacted in a different way, I hope.
 4              MR. COE:  Well, from a risk standpoint, if we are
 5    using that as the yardstick for our response, what we are
 6    saying is in this case, and for the large LOCA we would have
 7    the same -- the change in core damage frequency we would
 8    estimate to be less than 1E to the minus 6, but it is a good
 9    point.
10              Actually, when you look at the next accident
11    sequence, medium LOCA -- actually, I don't know the answer
12    right now, but let's see if that makes a difference.
13              Now in a medium LOCA the success criteria is that
14    you only need two out of the four accumulators, okay, to
15    satisfy that function, same function.  Essentially you have
16    got the same series of sequences here except that the medium
17    LOCA frequency might be a little bit higher, but now you can
18    satisfy the medium LOCA, which is generally going to be less
19    than a six-inch break, with two out of the four
20    accumulators, so if you have either three or four
21    accumulators you can take credit for a multi-train system in
22    terms of the reliability of the remaining accumulators to
23    satisfy that function.
24              If you had lost two accumulators, you could not --
25    well, you would take credit for one train.  You would
.                                                               125
 1    essentially have one train of capability.
 2              DR. APOSTOLAKIS:  Let's say you lost all four.
 3              MR. COE:  If you lost all four, then this would
 4    be, instead of three here, this would be zero, and now here,
 5    as was pointed out a moment ago, you have a higher
 6    initiating event frequency --
 7              DR. APOSTOLAKIS:  So it would be White.
 8              MR. COE:  Yes, but it is because of this
 9    rationale, this logic, which is grounded in probabilistic
10    risk principles and forms the framework for our judgment
11    that that is a more significant issue now.
12              The loss of three accumulators out of four would
13    put this into a category where we would be more concerned. 
14    In fact, two accumulators would only give you a credit of
15    two for a single train, and as I am sure you are aware, that
16    value of two represents 10 to the minus 2 failure upon
17    demand.  It is simply the negative logarithm.
18              DR. APOSTOLAKIS:  Then it would be a Green, right? 
19    If you have lost two --
20              MR. COE:  I can never do this from memory.
21              DR. APOSTOLAKIS:  I already can.
22              [Laughter.]
23              MR. COE:  If you were F and you had two, you're
24    right, you would be Green.
25              DR. APOSTOLAKIS:  Something which may be obvious
.                                                               126
 1    to everyone, here you seem to be making decisions using the
 2    PRA results in some way.  You are going to severe accident
 3    stuff.
 4              MR. COE:  Yes.
 5              DR. APOSTOLAKIS:  It is not just design basis,
 6    right?
 7              MR. COE:  Right.  We reflect the dominant and the
 8    accident sequences.
 9              DR. APOSTOLAKIS:  Changing the rules?
10              DR. BONACA:  Wait a minute.  Why are you saying
11    severe accidents?
12              DR. APOSTOLAKIS:  They are looking at PRA --
13              DR. BONACA:  -- insights.
14              DR. APOSTOLAKIS:  Yes.  I mean from the design
15    basis point of view, did you really look at multiple
16    failures?  You did not.  Just one.
17              MR. COE:  We are essentially trying to establish
18    the significance.
19              DR. BONACA:  The significance, the safety
20    significance --
21              MR. COE:  Of a finding, okay?
22              DR. BONACA:  -- of a PRA, a PRA reading the safety
23    significance of the condition.
24              DR. APOSTOLAKIS:  No, but would there be a case
25    where from the design basis perspective there is no problem
.                                                               127
 1    but from the PRA perspective there is?
 2              MR. COE:  Yes, and if that condition were to
 3    arise, and we identified that the licensee's performance was
 4    deficient in some fashion, even though they were meeting
 5    their design basis, we may conclude that there was a change
 6    in core damage frequency sufficient to warrant our action.
 7              MR. GILLESPIE:  George, we had a specific example
 8    of flooding at Sequoyah.
 9              DR. APOSTOLAKIS:  Yes?
10              MR. GILLESPIE:  Where the water in the whole site
11    drained downhill and they had to put a transformer building
12    right where all the water drained, and the water during a
13    hundred year flood would bubble up out of the drain instead
14    of draining down it, and that was considered a White finding
15    and there was an NOV issued against the maintenance rule on
16    it and it was not covered in their design basis
17    documentation at all.
18              DR. APOSTOLAKIS:  So does this imply now that if
19    the licensee volunteers to accept this system that licensee
20    is saying that it is willing to be regulated by things that
21    go beyond their licensing basis?
22              MR. COE:  No.  We do not, absolutely do not, say
23    that the licensee has to do anything but meet our
24    requirements.  However, the actions that we take, the level
25    of management interaction that we engage in with the
.                                                               128
 1    licensee, is going to be informed by this yardstick.
 2              DR. SHACK:  He violated a tech spec.
 3              DR. BONACA:  Yes, he violated a tech spec.
 4              MR. COE:  Well, in this particular example.  I
 5    think George is asking a larger question.
 6              MR. GILLESPIE:  What we did, George, on that --
 7    that was a big question early on.  If we find something that
 8    is not covered in the design basis but we find it is
 9    risk-significant, then we are going to call it according to
10    the SDP and call it what it is, and we will write it up that
11    way, but the resolution of it will be different.
12              The licensee could either choose to fix it -- I
13    mean literally voluntarily -- or we have a backfit decision
14    to make and under the backfit rule --
15              DR. SHACK:  How would you get into this process if
16    he hadn't done something wrong by your licensing basis?
17              MR. COE:  Actually, the entry condition is not
18    tied only to a violation of regulatory requirements.  If a
19    licensee -- if we evaluate that a licensee has had some kind
20    of deficient performance that has caused a change in core
21    damage frequency evaluated through our SDP process to be
22    greater than 1E to the minus 6 per year, then that becomes a
23    greater than Green issue, and we can process that issue.
24              As Frank just noted, we had one issue where that
25    was pretty much the case.
.                                                               129
 1              CHAIRMAN SIEBER:  In fact, it doesn't even have to
 2    be a performance issue.  It could be a condition that was
 3    discovered, for example, by a resident inspector.  Is that
 4    not true?
 5              MR. COE:  Well, actually, we have imposed the
 6    requirement that the Staff should be capable of articulating
 7    what the performance deficiency is as an input to a
 8    significance determination process because this question
 9    arises.  A piece of equipment fails and the licensee has
10    done everything correctly.  That QA program has worked
11    exactly the way it anticipated that it would.  It was just
12    one of those things -- if you will excuse the expression --
13    a "random failure" -- okay?
14              Under those conditions if we cannot identify a
15    performance deficiency, then what the program says is that
16    this is just part of the baseline risk of a large, complex
17    industrial facility that will sometimes have components that
18    fail.
19              CHAIRMAN SIEBER:  I am thinking more of a design
20    defect that deviates from, for example, the construction
21    code that went undiscovered during the construction process
22    and the preservice testing, surveillance tests, and so
23    forth, did not reveal its existence until somebody began to
24    think about it and said oh-oh, this probably wouldn't work
25    under these kinds of conditions.
.                                                               130
 1              MR. COE:  And that is a good question and we have
 2    struggled with that one a little bit, because the question
 3    is has the opportunity arisen for the licensee to detect
 4    this and if they missed it, they had the opportunity and
 5    they missed it, you could call that a performance
 6    deficiency.
 7              On the other hand, we struggle a little bit
 8    with -- you know, we want licensees to be aggressive in
 9    finding these things too, and so we treat those very
10    carefully on a case-by-case basis so as hopefully not to
11    discourage licensee initiative.
12              CHAIRMAN SIEBER:  One example of that could be for
13    an MOV to fail under dynamic conditions, accident
14    conditions, because of high differentials or what have you.
15              DR. APOSTOLAKIS:  Is it true that we are pushing a
16    little bit the envelope of the licensing basis now?
17              MR. COE:  I want to say absolutely not, because we
18    have, as Frank mentioned, very clearly told the licensees we
19    will not engage in anything that would not conform to the
20    backfit process that we have established.
21              We have choices that we have to make about the
22    focus and the nature of our inspection, and those can be
23    done independently of whether the licensee is violating
24    anything or not.  If we find performance deficiencies that
25    rise to a level of significance that causes us to think
.                                                               131
 1    about focusing our inspection program differently, that is
 2    within our purview, but we will not impose requirements on
 3    the licensee, although -- in addition to those that are
 4    already required.
 5              If a licensee chooses to correct performance
 6    deficiencies by making the changes that then lower that
 7    delta risk back to what we would consider the nominal level,
 8    great, and that is in fact what happened in the case that
 9    Frank mentioned.  If they choose not to, then we have a
10    choice to make.  Either it is significant enough that we do
11    a backfit analysis or if it is not we may have to drop it,
12    or we may choose to modify our assessment tools, our risk
13    assessment tools of that plant to now acknowledge that there
14    is a new additive value that is related to this issue that
15    they are not going to correct and that has now become part
16    of the baseline risk, and in the future they might have more
17    susceptibility to a higher significance issue.
18              DR. APOSTOLAKIS:  But in my mind this whole
19    process is a small but a very significant step towards
20    totally risk-informed regulation.
21              MR. COE:  So far I haven't drawn a strong
22    connection to it, George --
23              DR. APOSTOLAKIS:  Why?
24              MR. COE:  Why?
25              DR. APOSTOLAKIS:  You have sequences.  You have
.                                                               132
 1    the frequency of the initiator -- fundamental in your
 2    decision.
 3              MR. GILLESPIE:  This is where at some point the
 4    rules have to catch up with the oversight.
 5              DR. APOSTOLAKIS:  Exactly.
 6              MR. GILLESPIE:  The maintenance rule, because --
 7    maybe it is easier because it is a smaller piece, is kind of
 8    there -- A(4) is is the plant safe today, and it is kind of
 9    integrated in, and we have got some links.
10              DR. APOSTOLAKIS:  Right.
11              MR. GILLESPIE:  And it's kind of got risk and
12    guidance on how you apply it.
13              The other rules are not necessarily as in synch,
14    and that is the whole risk-informing Part 50 kind of thing,
15    and it's just got to catch up.
16              DR. APOSTOLAKIS:  A different topic.  This is
17    based entirely on the sequences and this is a perfectly good
18    thing to do.
19              I was wondering whether for some SSC that are not
20    as big items as the accumulators, the importance measures
21    would have a role to play and maybe lead you to the colors
22    without -- especially if you have a component that appears
23    in, you know, 66 different sequences it would be a little
24    difficult to go through every one of them, but if you have
25    an importance measure that takes into account the
.                                                               133
 1    frequencies or the initiator and everything maybe that could
 2    play a role in the decision of whether it is White or Red.
 3              MR. COE:  You are quite right, and historically
 4    inspectors, as I said, being given two weeks of training and
 5    thrown back out into the field, saying go do your best work
 6    will typically gravitate toward the risk achievement worth
 7    and the other risk-important measures.
 8              What that doesn't do is give them a sense of why
 9    that is important and that is what we are trying to achieve
10    here.
11              Secondly, we have one other step to complete.  We
12    are in the process now of issuing these notebooks with the
13    best information that we have been able to glean from the
14    licensee.  There is one more step in our process, and that
15    is through the experience of using these and through a
16    systematic effort we hope to test the SDP worksheets against
17    the licensee models to assure ourselves that in fact the
18    dominating sequences that we're representing are in fact the
19    dominating sequences that the licenses believe that they
20    have at their plant and that there's some consistency at a
21    high level.
22              We acknowledge that there will not be necessarily
23    consistency at all levels but this is something that we
24    expect we will improve over time as we gain experience with
25    each one of these.
.                                                               134
 1              DR. BONACA:  I have another question that I would
 2    like to ask you about just to understand the whole thought
 3    process of the inspection program.
 4              For example, you said -- you postulated there was
 5    a miscalibration of a level and this is 90 hours and it
 6    could have been over 30 days and with so high a level
 7    change.
 8              Assume that you have discovered that this happened
 9    because the training was not that detailed and the operators
10    don't understand the importance of the accumulators.  They
11    use the water to wash their car in the yard or something --
12    I don't know -- so you discover that kind of issue.
13              You would still go to this tabulation and find the
14    Green.  How does it kick into the significance, to the
15    training program or whatever are the reasons which led to
16    this kind of condition?
17              MR. COE:  The agency has agreed that or has
18    formulated this whole program, the framework of the program,
19    such that Green is called the licensee response band.
20              Issues that arise and are a significance of Green
21    are our responsibility under our program is to ensure that
22    the licensee has captured that issue in their corrective
23    action program.
24              We will not engage further in terms of root cause
25    analysis or failure.  We have an opportunity to come in and
.                                                               135
 1    look at Green issues kind of in the aggregate during our
 2    annual PI&R, Problem Identification and Resolution
 3    inspection, so we have an opportunity to do that, but on a
 4    single issue basis, we would not go to the depth that you
 5    have suggested.
 6              DR. BONACA:  I mean if you really had an
 7    indication, that example I gave you, I mean the total
 8    failure of the training program or preparation of the people
 9    behind an operation, anything of the kind, wouldn't you have
10    a means by an inspector to flag it as an issue that has to
11    be -- to try to pursue them.
12              MR. GILLESPIE:  Yes.
13              DR. BONACA:  I am trying to understand how the
14    whole thing works together.  You know, you have a window on
15    the world here coming from these kinds of inspections and
16    also from the Safety Determination Process, and you should
17    not lose those insights.
18              MR. GILLESPIE:  One of the things we needed a year
19    to implement this was people were telling us you could have
20    a site that is absolutely everything working perfectly and
21    is all Green, yet has a totally failed training program,
22    corrective action program and every other program.
23              Our premise was if those programs were totally
24    failed it would show up either in an SDP evaluation as a
25    White or in one of the PIs.  That is a premise we are
.                                                               136
 1    testing this first year, and since you said a total failure
 2    of the training program, do we really believe that a total
 3    failure of the training program for the trades at a reactor
 4    would only result in one miscalibrated accumulator --
 5              DR. BONACA:  I understand what you are saying
 6    and --
 7              MR. GILLESPIE:  We are testing that and that is
 8    something we might agree with other people just to disagree
 9    with but we think it's going to show.
10              DR. BONACA:  I meant to say that wouldn't it be
11    prudent to have some process in the training that says if
12    something really transpires that is significant in the
13    evaluation and is not coming, you know, that at the minimum
14    some note is made somewhere.
15              MR. BOYCE:  There is.  Let me try to address the
16    process a little bit.  In the inspection reports Frank had
17    alluded to, we have made a change in our threshold so that
18    you can document the sort of issue you described in the
19    inspection report, and even if the issue comes out as Green,
20    that is documented.
21              That means we don't take action on any individual
22    finding but what happens is that there is an annual look at
23    the problem identification and corrective action system of
24    the licensees, and they will go back through and look at all
25    the significance determination process findings and look for
.                                                               137
 1    those sorts of commonalities, so in that case you describe
 2    there could be an individual failure.  The guy took the
 3    garden hose out and watered his lawn, but is that pervasive?
 4              Now you would hopefully see that in your annual
 5    look.  That is captured in a document called "The Plant
 6    Issues Matrix."  That plant issues matrix is put up on the
 7    website for everybody to see, so that anybody can do the
 8    sort of review that I just described at any time.  It isn't
 9    just incumbent on the NRC to take a look at it.
10              DR. BONACA:  I mean for example the licensee for
11    an event like this he would go back and try to understand in
12    fact if it's a violation of tech specs.  It would probably
13    be a Level 1.  He would perform a root cause, try to
14    understand it.
15              He may determine that there are some fundamental
16    issues there why this was lost.  I don't think that the NRC
17    process should be ignoring all those steps that we are
18    requiring of licensees.
19              MR. BOYCE:  Well, we are not.  We are hesitant
20    though to put our own label on the cause unless we know
21    exactly what it was and that sort of thing, but also in the
22    assessments that we do on a quarterly basis and for the
23    mid-cycle and end-of-cycle reviews, we go and look for those
24    sorts of issues.
25              If there are enough of them and they rise to a
.                                                               138
 1    level, that becomes a cross-cutting issue.  We are
 2    documenting those cross-cutting issues in our assessment
 3    letters that we send out at the mid-cycle and the
 4    end-of-cycle, at the end of those reviews.  We send them to
 5    licensees and we say we think we have got a human
 6    performance issue.
 7              Now the problem is that we are not quite sure what
 8    to do with that.  Once we say we think we have got a human
 9    performance issue based on these things it doesn't mean we
10    have a path to take definitive action.  We have identified
11    it or are still wrestling with "so what?"  So what if we
12    have a human performance problem here?  Does it show up in
13    the plant operation?  Does it show up in the performance
14    indicators?  We have got a whole working group trying to
15    take a look at these sorts of issues during the first year
16    of implementation.
17              We may come out with we may have a "so what" there
18    and take a hard action based on that, but right now it is
19    just a question we have been wrestling with since we started
20    implementing the program.
21              DR. BONACA:  My sense would be, for example, if
22    you go back now and you look at what the licensee did and
23    put in his Corrective Action Program and took proper
24    resolution and et cetera, it would be become a no issue.
25              MR. BOYCE:  That's right.  You would hope that if
.                                                               139
 1    all these things show up in the PIM and it's publicly
 2    available, that scrutiny would drive the utility into fixing
 3    it.
 4              DR. BONACA:  Okay.
 5              MR. BOYCE:  But that is not what we are regulating
 6    towards.  We are not using that as our tool.  That is just a
 7    means where we are trying to be transparent to the public.
 8              MR. GILLESPIE:  Let me ask Doug because he has got
 9    a second example here --
10              MR. LEITCH:  Let me ask a similar question.  What
11    about repetitive Green issues.  Do they ever become White
12    based on the repetitive nature of them or does that rather
13    point to a problem with the Corrective Action Program?
14              MR. BOYCE:  Well, I think it is more the latter,
15    because the SDP relies on the risk on each individual
16    finding and that becomes one of the problem identification
17    resolution type of issues that we would look at in the
18    annual look.
19              We would issue an inspection report that said you
20    have had three repetitive deficiencies in exactly the same
21    area, and that would be documented in our inspection report
22    which would show up in the assessment letter sent to each
23    licensee.
24              Again, it comes down to do we have a specific
25    process that acts on that information.  We don't have one at
.                                                               140
 1    this point -- it's just one of those issues we are wrestling
 2    with is how to handle those cross-cutting issues.
 3              MR. COE:  I can go through the second example, but
 4    at a high level it is essentially the same process that I
 5    have just described here.
 6              It involves a much more substantial loss of
 7    function and in a system that has implications to a larger
 8    number of sequences and so it is intended to give the
 9    audience a sense that there are some issues that are fairly
10    invasive in terms of the risk at the plant and affect a
11    number of things, and that the process of working through
12    the Phase 2 worksheets might be commensurately greater, but
13    the process ends up to be the same.
14              If you look on the very last page of that
15    example --
16              MR. GILLESPIE:  Go to the highlight worksheets.
17              MR. COE:  At least get to the plant-specific one
18    and what it is applicable to.
19              DR. POWERS:  The examples you have chosen all
20    involve fairly non-controversial questions.  Is the train
21    there or is it not?  Is the system there or is it not?
22              MR. COE:  That's right.
23              DR. POWERS:  When I look at the significance
24    determination on the fire protection I find a more
25    subjective sort of decision that has to be made.  Is this
.                                                               141
 1    protection system degraded, and if so, is there a lot of
 2    degradation, a little bit of degradation, and how do I make
 3    that judgment?  How do I decide whether it is a lot or a
 4    little bit?
 5              MR. COE:  Right.
 6              DR. POWERS:  Because those judgments then are
 7    translated into numbers that turn out to be exponents in a
 8    risk metric and I have no idea where those exponents come
 9    from, but I do know that whether I decide it is medium or
10    low degradation makes a big difference on those numbers.
11              MR. COE:  Yes.
12              DR. POWERS:  I mean decades there.
13              MR. COE:  Yes.
14              DR. POWERS:  How do I do that?
15              MR. COE:  Well, for one, the very fact that the
16    analysis points to the things that are most influential is a
17    big feature, is a significant feature and an improvement
18    because it fosters communication and focus on those
19    particular aspects.
20              There's certain aspects that you will see in these
21    analyses that won't make a difference whether you judge it
22    to be this way or that way.  I mean they won't change the
23    final result necessarily.  However, there are some that
24    will, and those are the ones that get focused on most
25    intently.
.                                                               142
 1              The cases that you are describing, fire
 2    protection, we know we have some problems with guidance in
 3    there, some lack of guidance on how to be consistent in
 4    defining those levels of degradation, and in fact we are
 5    preparing a revision to that guidance right now that I hope
 6    to issue before the holidays that will provide additional
 7    guidance for certain of those characteristics in the fire
 8    protection SDP.
 9              Ultimately speaking, it boils down -- you're
10    right -- to a judgment, and what I stress when I talk to any
11    number of different audiences about the SDP process is that
12    this process does not produce, you know, numbers
13    automatically.  They are all the result of judgments that
14    are made along the way and what the process does is it helps
15    focus on those judgments that are most influential, and then
16    what happens is all of the -- well, primarily all of the
17    discussion focuses on the validity of those influential key
18    assumptions.
19              Sometimes it takes an engineering analysis to
20    discern whether the degradation was enough to warrant
21    changing the reliability value that it is given or its
22    availability value, and sometimes it just simply boils down
23    to a matter of judgment, but in all cases the Staff's
24    responsibility is to formulate the basis for that judgment
25    and how it relates to the degradation that they have chosen
.                                                               143
 1    and it is our challenge over time to make that process
 2    consistent.
 3              That's the best answer I can give you.
 4              DR. POWERS:  I mean, what you've said, I think, is
 5    that you're going to try to improve the guidance and at
 6    least we'll have this judgment that has the potential of
 7    being reasonably consistent.
 8              The next question is, where did the numbers come
 9    from?
10              MR. COE:  Where did the numbers come from?
11              DR. POWERS:  Yes.
12              MR. COE:  It's very simply a train is valued at
13    about a ten to the minus two failure per demand.  An
14    operator action under normal stress conditions, typically is
15    also valued at about a ten to the minus two.
16              DR. POWERS:  I was thinking more of the fire
17    protection numbers.
18              MR. COE:  In the fire protection arena, I
19    couldn't, off the top of my head, give you a good basis for
20    how those values were -- why those values were put in there
21    the way they were.
22              We have one individual on our staff that's been
23    deeply involved in formulating that SDP.  We've worked
24    closely with him, but he's the real expert, and he's the guy
25    that you really should probably have in front of you to
.                                                               144
 1    explain that.
 2              DR. POWERS:  It would be helpful if the
 3    documentation on this process explained those sorts of
 4    things.  It would inspire confidence.
 5              Because my looking at the fire protection SDP said
 6    this is totally subjective.  I mean, if I know what -- well,
 7    as soon as I figure out that these are exponents in a risk
 8    metric, I know what answer I want to get.
 9              And I go in and fill the matrix out.
10              MR. COE:  Well, we have to guard against --
11              DR. POWERS:  Even if there's a typographical error
12    in the thing and it takes forever to figure it out, but once
13    you figure that out, the typographical error, then you can
14    go through and I can get the answer that I want at the end.
15              MR. COE:  I can tell you from personal experience,
16    from serving on these panels that meet with regard to -- and
17    we've had a couple of fire protection issues -- that I have
18    not detected any intent at all to try to get a particular
19    answer.
20              I think what I have stated is, in fact, true, that
21    it focuses our attention on the things that are most
22    influential, and we have great discussions and great debates
23    about, you know, how that -- what we know to be true and
24    what we know we don't know, should be reflected in the value
25    of degradation that we choose, the exponent on those powers
.                                                               145
 1    of ten that we choose.
 2              So, you know, one of the objectives of the SDP was
 3    to foster greater communication, greater insight.  And I
 4    think because of what I have seen in these kinds of
 5    discussions that we have, I think it's achieving that.
 6              And as I said, our greater challenge over the long
 7    run is to make the process more consistent.  I would say
 8    that this process, although it's going to -- it has retained
 9    subjectivity and it will continue, I think, to have some
10    element of subjectivity in it, it is far less subjectivity
11    than what we had before this process existed, and that this
12    process is constraining our judgments and our subjectivity
13    to within the logical framework of a risk analysis
14    methodology.
15              So in that sense, I think we're on an improving
16    track.  I'd be happy to answer any of the questions about
17    this example or anything else.
18              DR. APOSTOLAKIS:  Are the SPAR models going to
19    play some role eventually?
20              Are the computerized SPAR models going to play
21    some role at some point after the inspectors become more
22    familiar with them?
23              MR. COE:  They already do, to some extent, those
24    that have been improved to the point where we've started to
25    get some confidence with them.
.                                                               146
 1              We have the Phase III part of our process which
 2    acknowledges that these worksheets have limitations and we
 3    may need to go beyond these to verify the results that we're
 4    getting or modify them.
 5              We've used licensee analyses.  We've interacted
 6    with the licensee, they have -- of course, they produced
 7    their own analyses.
 8              The short-term answer is that I would expect SPAR
 9    models to be used for Phase III analysis as time goes on,
10    more and more, as they become more available.
11              In the long run -- and now I'm speculating far out
12    -- is, maybe the SDP process, as it's currently provided in
13    Phase II, is just a stepping stone, and maybe ultimately
14    we'll have inspectors out there that have access and
15    training and the ability to appropriately utilize more
16    sophisticated tools.
17              But believe me, I can only tell you how pleased
18    that I've been that people are now starting to think in
19    these terms on a day-to-day basis, whereas in the past, they
20    simply turned to me or they turned to some analyst and said,
21    what's the number?  We're beyond that.
22              MR. GILLESPIE:  George, when you look at these
23    things, this is an obvious candidate for some kind of
24    computerization.  I mean, you're filling in tables and
25    answering questions with yes's and no's and check marks.
.                                                               147
 1              The value to this in our training phase, in the
 2    initial phase, was getting people to think logically and
 3    think in terms of sequences.
 4              Whether we'll get to the point here inspectors use
 5    SPAR models or not, will be driven by the practicality of
 6    it, and is it practical to train all of our inspectors to
 7    the level of training that if they can't see it on a check
 8    sheet, will we lose the understanding of that next inspector
 9    who didn't grow up with the program?
10              DR. WALLIS:  Well, you anticipated my question. 
11    It seems that all these check sheets could be put in a nice
12    little hand calculator.
13              MR. GILLESPIE:  Oh, yes, the Palm Pilot could take
14    care of this.
15              DR. WALLIS:  And certainly the younger people
16    might even be happier with that.
17              MR. GILLESPIE:  You can electronic-ize the check
18    sheets, but that's different than not having the questions
19    there to --
20              DR. WALLIS:  But then you can upgrade at any time.
21              MR. GILLESPIE:  And the question is, would we want
22    to upgrade?  I'm not sure.  The number of findings that go
23    beyond white are very limited when you look at all the
24    inspection we do.
25              And this shouldn't be surprising if you look at
.                                                               148
 1    the LER program.  Generally it will go 1200 findings, and
 2    there are only 12 or less that actually break the ten to the
 3    minus six kind of threshold.  I know that's a CDP threshold,
 4    but the fact that you have a lot of findings and only a few
 5    that pass this kind of risk screening, should not surprise
 6    us because we have years of evidence of that.
 7              And, therefore, do we want to upgrade every
 8    inspector to a computer analyst?
 9              DR. WALLIS:  The inspector can learn, too.  I
10    mean, if you have this little hand thing, you can say, oh,
11    I'm curious about what happens with this; I'll try it.
12              MR. GILLESPIE:  Oh, yes, yes.
13              CHAIRMAN SIEBER:  On the other hand, looking at
14    the manual sheets allows one to actually see what the
15    process is, and what the relationships are amongst the
16    parameters that are in there as opposed to answering yes and
17    no, and all of a sudden, it comes up yellow.
18              MR. COE:  We've started to explore the very
19    concept that you're discussing.  We've actually been
20    experimenting with some spreadsheets that can do this.
21              And the key is, as I think you just noted, is that
22    it can't -- you can't lose the intellectual engagement.  And
23    once you lose the intellectual engagement, we're back to
24    where we were five years ago.
25              MR. BOYCE:  The other thing I would add is, you
.                                                               149
 1    could be driven to a bottom-line number as your main
 2    criteria, and that's not really the point.  We're trying to
 3    stay within bands, so that we can make good regulatory
 4    decisions.
 5              DR. WALLIS:  It's always puzzled me as to why
 6    there is this aversion to having a number.
 7              MR. GILLESPIE:  What we are really avoiding is
 8    comparing bottom-line risk numbers,
 9    plant-to-plant-to-plant-to-plant.
10              MR. COE:  It's consumer confidence.
11              DR. WALLIS:  Every time you put in these
12    judgmental things, you're really fuzzy'ing up the decision;
13    aren't you?
14              MR. COE:  But you're doing it in the daylight. 
15    You're no longer hiding the assumptions that are influential
16    in a model in some software somewhere.
17              DR. WALLIS:  That's right, but I get very worried
18    about the cop who stopped me and used a lot of fuzzy logic
19    to tell whether I was going over the speed limit or not.
20              MR. GILLESPIE:  Let me take that to the next
21    point, because I don't want to lose sight of this:  Once you
22    get through, the inspector gets through Phase II, and if he
23    comes up with a white finding, it right now gets reviewed by
24    a panel, a separate panel.
25              The licensee then gets a proposed finding of
.                                                               150
 1    white.  The licensee then gets an opportunity to see what
 2    your logic was, to see the writeup of the detail that's
 3    contained in these sheets, and, if he so wishes, to put in a
 4    counter argument which now focuses him in on the specifics
 5    of what was wrong.
 6              This includes fire protection.  It may be
 7    subjective, but it is within the system of checks and
 8    balances that the regulatory isn't unilaterally subjective.
 9              DR. WALLIS:  So it allows argument.
10              MR. GILLESPIE:  It allows for structured argument. 
11    This sets up the structure.  What do you disagree with in my
12    analysis?
13              DR. WALLIS:  This was designed by lawyers, rather
14    than engineers.
15              MR. GILLESPIE:  Well -- so there is that element
16    of checks and balances, and, in fact, once the proposed one
17    goes out and then there's some give-and-take, and normally
18    there would be a regulatory conference on it where the facts
19    would get on the table, then even when the final one goes
20    out, if there is an enforcement attached to it, there is yet
21    another opportunity to rebut it.
22              So the checks and balances on ourselves and on the
23    system is, in fact, with the licensee, but this gives us a
24    structure to argue over the points.  And, in fact, when you
25    get to a Phase III, which is a phase Doug didn't talk about,
.                                                               151
 1    when you're beyond the check sheets, and if a licensee
 2    challenges it, then you're in Phase III.  You've got the
 3    analysts involved with their analysts.
 4              In fact, then you're arguing over things like
 5    assumptions on human reliability and other assumptions.
 6              DR. WALLIS:  But if you had -- you would need the
 7    inspector at all.  All the licensee needs to do is go
 8    through the same thing.
 9              MR. BOYCE:  Licensees, of course, have their own
10    models and can do that, yes.
11              MR. COE:  And they should be.  I think that's part
12    of the communication process that we'd like to foster.
13              But it's not sufficient for just the licensee to
14    do it.  We need intelligent inspectors that are out there,
15    not only assessing the significance of their finding, but as
16    I said earlier, risk-informing their approach so that they
17    are more likely to find the bigger issues that are out
18    there.
19              DR. LEITCH:  How do you deal with an issue such as
20    an inspector finds a locked high-rad door unlocked?  Is
21    there a similar -- I mean, how do you deal with that?
22              MR. COE:  There is a significance determination
23    process.
24              DR. LEITCH:  There is a significance
25    determination?
.                                                               152
 1              MR. COE:  Yes, there is.  There's a significance
 2    determination process for each of the cornerstones, and that
 3    particular cornerstone would be radiation protection,
 4    occupational safety cornerstone.  And I believe that locked
 5    doors and such are reflected in that SDP.  I don't have it
 6    with me.
 7              MR. GILLESPIE:  Philosophically, though, all of
 8    those follow the same kind of barrier.  The Table II that
 9    Doug put up, number of recovery systems, if you find an
10    unlocked door in a high-rad area, did it lead to an
11    overexposure, yes or no?  It's got those kinds of questions.
12              Was there a training failure?  Why was it
13    unlocked?  Was it loss of control of all the keys?  Did
14    someone just leave it behind?
15              So, it's got the same Phase I, Phase II kind of
16    approach, which is looking for kind of barriers of
17    protection.  Did another barrier of protection that would
18    have prevented overexposure also break down?  Was there a
19    loss of control of the keys besides one high-rad area
20    unlocked?
21              Was there a problem in the training program so
22    that you've lost two barriers of protection?
23              So, philosophically, that was used in all the
24    areas.
25              DR. LEITCH:  Okay, thanks.
.                                                               153
 1              DR. APOSTOLAKIS:  One other question:  The various
 2    colors, yellow, white, under various -- in different
 3    contexts, especially when it comes to the action matrix, do
 4    they all represent the same kind of core damage frequency
 5    change, or sometimes they do and sometimes they don't?
 6              MR. COE:  Well, we can't relate some of the
 7    cornerstone colors to core damage frequency, so what we did
 8    is, we tried to make sure that our level of response for
 9    that particular issue would be appropriate; in other words,
10    that it would be consistent with what we would expect to
11    respond to an issue of similar significance in the reactor
12    safety area.
13              In other words, there was no quantitative attempt
14    to link those, but there was a qualitative one.
15              DR. APOSTOLAKIS:  So if I look at the action
16    matrix, and it says, you know, when you have two yellows, do
17    this, but if you have one yellow and a red, do something
18    else, that the fundamental basis for that is really the
19    judgment of the people who developed it, in looking at what
20    red might mean and so on and say, well, gee, this is the
21    appropriate level of response?
22              I shouldn't be looking for more quantitative
23    justification?
24              MR. GILLESPIE:  No.  In initiating events and
25    mitigating systems -- the mitigation cornerstone and the
.                                                               154
 1    initiating cornerstone, which is really reactor safety that
 2    Doug's been talking about, there is some sense of
 3    equivalency between PIs and inspection, because we could
 4    deal with it there.
 5              But in radiation protection, we really had to look
 6    at the data.  It's occupational protection we're really
 7    worried about there.
 8              MR. COE:  And emergency planning.
 9              MR. GILLESPIE:  And emergency planning and EP. 
10    You can't relate those to a delta CDF or a LERF number.  You
11    really kind of conceptually have a defense-in-depth, and so
12    in EP, you know, there's a training PI.  Everyone has to
13    have practiced in something, and 80 percent within every two
14    years.
15              So we're kind of -- and then there's the siren, so
16    we're thinking more in terms of number of -- equivalent
17    numbers of barriers to not -- to do the function that needs
18    to be performed.
19              So at that point, it's strictly subjective, but
20    traditionally, our reaction, a yellow reaction to EP should
21    bear some resemblance to the Agency's reaction to a yellow
22    in reactor safety.  So it was by reaction.
23              MR. COE:  These SDPs were created by a group of
24    people with industry participation, public participation,
25    and so it's got -- there's a lot of thinking that's gone
.                                                               155
 1    into these.
 2              Not that they are perfect, and as we gain more
 3    experience, we do find that we need to make adjustments and
 4    we continue to do that.  It should be noted that with all
 5    the hassle you're hearing about in the press about PIs and
 6    the comments about PIs from the industry, that everything
 7    that we've put in place for the first year of implementation
 8    was 100 percent consensus between industry and NRC.
 9              It's kind of an interesting concept.  And, in
10    fact, they're critiquing something they have already agreed
11    on, which is okay, but there's a certain perspective.
12              The regulator didn't just think all this up, and
13    we weren't necessarily smart enough, just ourselves, to put
14    it in place.  It was actually a very tortuous
15    consensus-building process to get there.
16              And sometimes that gets lost in the mix as if,
17    well, the NRC just said we had to do it this way, but NEI
18    took their 80 percent vote and all that kind of stuff that
19    they go through to say this is consensus.
20              DR. LEITCH:  I was just curious, and I think that
21    at the outset, you mentioned that during the pilot program,
22    what I think you termed the fatal flaw, was discovered at
23    Quad Cities.  Could you say a word or two more about that?
24              MR. GILLESPIE:  Yes.  Physical security was
25    unique.  We actually all agreed with industry on this SDP
.                                                               156
 1    for physical security.  And what we did was, we had -- if
 2    you ran an exercise and the exercise, the adversary was
 3    successful in getting to a certain point, then it got -- you
 4    asked the question, what equipment did the adversary get to
 5    and compromise, and you took that equipment and you went
 6    through the SDP, really, that Doug has here.
 7              In essence, you did that.  What we forgot to stay
 8    cognizant of is success in the physical security area is
 9    actually in an adversary attack, having at least one train
10    left.
11              Well, if I go into the SDP with only one train of
12    cooling left to prevent core damage, which is the success
13    criteria of the exercise, I am very far to the right to
14    start with.
15              And we kind of didn't recognize that ourselves,
16    that that's the design criteria for a physical security
17    system.  And so the design criteria that would already be
18    put in this process would be considered to the extreme.
19              So, when we tried to apply it, it didn't work. 
20    And it was inappropriate to level of reaction and corrective
21    action we'd be looking for.  And none of us saw it, us or
22    industry when we came to a consensus on how to apply this. 
23    And that was the fatal flaw.
24              So we've got kind of another, more subjective
25    scale, quite honestly, up with the Commission, and saying
.                                                               157
 1    the Commission, as a temporary basis, we think this makes
 2    sense, and then we need to step back and figure out, is
 3    there a better way to do it in the long run?
 4              CHAIRMAN SIEBER:  If there are no further
 5    questions, I would point out that this afternoon's meeting
 6    will start on time at 1:00, and I would like to thank the
 7    Staff for responding to having a last-minute, total
 8    readjustment of their -- well, usually it happens sort of
 9    randomly, as opposed to structurally.
10              On the other hand, the presentation was very good. 
11    Do you expect a letter from us?
12              MR. GILLESPIE:  No.  At this point, in fact, this
13    was kind of a status briefing.
14              CHAIRMAN SIEBER:  Right.
15              MR. GILLESPIE:  I'm going to expect that -- we're
16    holding a major public/private workshop, internal workshop
17    in the January/February timeframe, and then a major lessons
18    learned public workshop in the end of March.
19              And at that time, we're going to have this massive
20    evaluation document.  It's massive, if you look at all the
21    parameters we're looking at.
22              At that time, it may be appropriate to come back
23    and say here's our picture of the first year.  Here's the
24    major things that we need to work on.  Were there any fatal
25    flaws like the one in security that jumped out, and why
.                                                               158
 1    we're doing which ones first.
 2              So I would say that we'd probably see coming back
 3    and maybe getting back to the Committee and then the Full
 4    Committee in kind of the April timeframe.
 5              CHAIRMAN SIEBER:  Right.
 6              MR. GILLESPIE:  That's a precursor to a report we
 7    owe the Commission in June on the evaluation of the first
 8    year, so I would suggest April/May-ish, maybe May, so we can
 9    get all our ducks in a row.  And then we'd be probably
10    looking for a letter to be a precursor to the June
11    Commission meeting.
12              CHAIRMAN SIEBER:  Okay, thank you.  Again, we
13    appreciate your presentation and the time you took and for
14    your versatility.
15              MR. COE:  It's our pleasure.
16              CHAIRMAN SIEBER:  So at this time, I'd like to
17    adjourn the Subcommittee meeting.
18              [Whereupon, at 12:10 p.m., the meeting was
19    adjourned.]


Page Last Reviewed/Updated Tuesday, July 12, 2016