Reliability and Probabilistic Risk Assessment - June 22, 2001
Official Transcript of Proceedings
NUCLEAR REGULATORY COMMISSION
Title: Advisory Committee on Reactor Safeguards
Subcommittee on Reliability and Probabilistic
Risk Assessment
Docket Number: (not applicable)
Location: Rockville, Maryland
Date: Friday, June 22, 2001
Work Order No.: NRC-277 Pages 1-284
NEAL R. GROSS AND CO., INC.
Court Reporters and Transcribers
1323 Rhode Island Avenue, N.W.
Washington, D.C. 20005
(202) 234-4433 UNITED STATES OF AMERICA
+ + + + +
NUCLEAR REGULATORY COMMISSION
+ + + + +
ADVISORY COMMITTEE ON REACTOR SAFEGUARDS (ACRS)
SUBCOMMITTEE ON RELIABILITY AND PROBABILISTIC
RISK ASSESSMENT
+ + + + +
MEETING
+ + + + +
FRIDAY,
JUNE 22, 2001
+ + + + +
ROCKVILLE, MARYLAND
+ + + + +
The subcommittee meeting was held at the
Nuclear Regulatory Commission, Two White Flint North,
Room T2B3, 11545 Rockville Pike, at 8:30 a.m., Dr.
George E. Apostolakis, Chairman, presiding.
COMMITTEE MEMBERS PRESENT:
GEORGE E. APOSTOLAKIS Chairman
MARIO V. BONACA Vice Chairman
THOMAS S. KRESS Member
COMMITTEE MEMBERS PRESENT: (cont'd)
GRAHAM M. LEITCH Member
DANA A. POWERS Member
WILLIAM J. SHACK Member
ROBERT UHRIG Member
ACRS STAFF PRESENT:
MICHAEL T. MARKLEY
I N D E X
AGENDA ITEM PAGE
Introduction . . . . . . . . . . . . . . . . . . . 4
NRC Staff Presentation
-- Introduction and Overview of Draft. . . . 5
NUREG-1742, Perspectives Gained
from the IPEEE Program
-- Seismic Insights. . . . . . . . . . . . .27
-- Fire Insights . . . . . . . . . . . . . 133
-- High Winds, Floods, and Other . . . . . 213
External Events
-- IPEEE-Related Unresolved Safety . . . . 234
Issue (USI) and Generic Safety
Issue (GSI) Resolution
-- Closing Remarks . . . . . . . . . . . . 265
General Discussion and Adjournment . . . . . . . 269
P-R-O-C-E-E-D-I-N-G-S
(8:30 a.m.)
CHAIRMAN APOSTOLAKIS: The meeting will
now come to order. This is a meeting of the Advisory
Committee on Reactor Safeguards, Subcommittee on
Reliability and Probabilistic Risk Assessment.
I am George Apostolakis, Chairman of the
Subcommittee on Reliability and PRA. Subcommittee
members in attendance are Mario Bonaca, Tom Kress,
Graham Leitch, Dana Powers, William Shack, and Robert
Uhrig.
The purpose of this meeting is to discuss
the staff's draft Individual Plant Examination for
External Events insights report, draft NUREG-1742.
The subcommittee will gather information, analyze the
relevant issues and facts, and formulate proposed
positions and actions, as appropriate, for
deliberation by the full committee.
Michael T. Markley is the cognizant ACRS
staff engineer for this meeting. The rules for
participation in today's meeting have been announced
as part of the notice of this meeting previously
published in the Federal Register on May 23, 2001.
A transcript of the meeting is being kept
and will be made available as stated in the Federal
Register notice. It is requested that speakers first
identify themselves and speak with sufficient clarity
and volume so that they can be readily heard.
We have received no written comments or
requests for time to make oral statements from members
of the public regarding today's meeting.
We will now proceed with the meeting, and
I call upon Mr. Alan Rubin of the Office of Research
to begin. Alan, welcome.
MR. RUBIN: Good morning. Thank you.
Good morning, and thank you, Professor
Apostolakis, members of the subcommittee. My name is
Alan Rubin. I have been the project manager for the
IPEEE program for quite a number of years, and I am
here to present introductory comments.
There are other members of the IPEEE team
who are with us this morning, including Brad Hardin
and John Ridgely of the staff, who you will hear from
later today, John Lehner from Brookhaven National
Laboratories, and Steve Nowlen from Sandia National
Laboratories. I just want to correct a typo I think
on the agenda for that. Steve told me this morning he
is not with Brookhaven.
(Laughter.)
By the way, there are quite a large number
of other participants in the program, including
contractors, the staff in both Research and NRR,
others, some of whom are present in the audience this
morning. So I just want to acknowledge the
contributions that many people have made to this
program over the years.
The outline of today's meeting -- I will
give introductory comments that will include some of
the background on the IPEEE program, so that we're all
talking to the same base of the objectives of the
IPEEE program. I'll discuss a little bit of what took
place in the reviews of the submittals, the process
that the staff went through in reviewing licensees'
IPEEE analyses. I will discuss an overview of what's
included in the draft NUREG-1742, the insights report.
The second presentation will be on the
seismic perspectives by John Lehner, then probably
followed by the IPEEE fire perspectives given by Steve
Nowlen. After lunch Brad Hardin will discuss the high
winds, floods, and other external events aspects of
the IPEEE program. John Ridgely will then discuss the
resolution of IPEEE-related generic issues, generic
safety issues, and unresolved safety issues.
I will then conclude the program with a
discussion of some examples of how the IPEEE
information has been and may be used, and then give
some overall conclusions and observations.
We would like to -- the staff would like
to get a letter, if the Advisory Committee feels it
appropriate, on the IPEEE program. We'll leave it up
to you.
It might be helpful to us if we can get
some perspectives on the committee's views and whether
the -- if there's a feeling that the program has met
the intent of the objective of the IPEEE program,
perhaps some comments on the uses of IPEEE information
itself. But it's really up to the deliberations of
the subcommittee and the committee.
MEMBER POWERS: It seems to me that the
objectives that the agency had in asking for the IPEEE
effort were sufficiently qualitative, that there's a
good chance that the effort met that. There may be
some plants that are exceptions to that, but as a
general rule it looks like it's a pretty easy set of
requirements to meet.
There is another objective that I think we
ought to have for the insights report itself, and
that's to develop some intuition and understanding on
the risks associated with external events for the
agency's own thinking about risk-informed regulation.
And I wondered if you had set any
objectives and had any -- you said you were going to
give examples on how it might be used, but do you have
any aspirations for what would be achieved by this
effort in order to develop that agency's understanding
of risk associated with these events?
MR. RUBIN: Well, let me -- let me answer
that question when I get to the examples. But,
basically, I think I agree with you that the -- at
least from our view we think that the objectives of
the IPEEE program has been met for all plants.
In terms of the uses of the information,
it has been and is being used, from what I've seen, I
think in an appropriate fashion. Just very briefly,
to use, in my view, the quantitative estimates of core
damage frequencies as a measure of a plant's risk, I
would view that with a little bit of maybe not --
"skepticism" isn't the right word, but I'd look at
that with a -- see what kind of analysis the licensee
has done and what kind of a review and perspectives
the staff has given in our staff evaluation report and
technical evaluation reports.
So there's a lot of insights, I think,
that are available if one wants to know some plant-
specific information, both -- that's included in the
licensee submittals, but that's only a piece of the
picture. I think it's very important to also look at
what the staff has written in our staff evaluation
report and that it include in the technical evaluation
reports for each submittal -- to discuss the strengths
and the weaknesses of what we see is in the
submittals.
And although we have concluded that each
submittal has met the intent of the IPEEE program,
there clearly are, I'd say, differences in the
approaches that licensees have taken. And those
insights are included in individual technical and
staff evaluation reports.
It was not possible to bring all of those
specific -- plant-specific insights into one document
which we call the IPEEE insights report. But I just
wanted to make that point.
And I think, Dana, when I go through the
applications later this afternoon in my concluding
statements we can discuss this further, if that's okay
with you.
CHAIRMAN APOSTOLAKIS: Now, regarding the
IPEs, since you mentioned that you would like to have
a letter, we wrote two letters on the IPEEEs. one was
on the use of individual plant examinations in the
regulatory process, and the other on the potential use
of IPE results to compare the risk of the current
population or plants with the safety goals. That was
five years ago.
I guess you are asking us to write a
letter similar to the first one, the use of the IPEEE
now in the regulatory process --
MR. RUBIN: Yes.
CHAIRMAN APOSTOLAKIS: -- because we
commented also on the quality.
MR. RUBIN: Yes. I think the first one
rather than the latter.
CHAIRMAN APOSTOLAKIS: The first one.
MR. RUBIN: Yes.
CHAIRMAN APOSTOLAKIS: This.
MR. RUBIN: Okay. Some of the background,
to be sure we're all up to speed a little bit. The
Generic Letter 88-20, Supplement 4, which was the
IPEEE request for licensees to do IPEEE analysis and
submit that information to the NRC, to identify plant-
specific vulnerabilities to severe accidents for
external events. That letter was issued in June 1991.
Gosh, and here we are in June 2001 saying that the
program is basically done.
At the same time the Generic Letter went
out, the staff issued a NUREG report, NUREG-1407, that
included procedural and submittal guidance for
licensees to conduct their IPEEE analyses. And also,
in September 1995, there was a Supplement 5 to Generic
Letter 88-20 that was issued that provided additional
guidance and clarification on the seismic -- the scope
of the seismic analysis for the IPEEEs.
I think we are all familiar with the
external events that are included in the IPEEE
program. Clearly, seismic events; fires; you will
hear the term HFO, which stands for high winds,
including tornadoes and hurricanes; floods, which is
external floods; and the O in HFO stands for other,
which covers transportation, nearby facility
accidents, and other plant-specific or unique types of
external events.
CHAIRMAN APOSTOLAKIS: I'm curious. When
you issue a letter, a generic letter, do you give a
deadline to the licensees, or sometimes you do,
sometimes you don't?
MR. RUBIN: There was -- I think it was
three years. There was a number of years to respond.
CHAIRMAN APOSTOLAKIS: So why is it 10
years, then?
MR. RUBIN: Well, by the time we got the
licensees' submittals, that was I would say probably
at least a three- to five- or six-year timeframe.
There were extensions, not everybody submitted at the
same time, we couldn't -- you know, we don't have the
resources to review them all in parallel.
CHAIRMAN APOSTOLAKIS: I see.
MR. RUBIN: We had some -- at least two
dozen -- I'll get into this later -- Senior Review
Board meetings to review the licensees' submittals.
We've had at least one round and often two rounds of
requests for additional information.
Writing the technical and staff evaluation
reports is -- going through each plant review is
probably about a two-year process from the time we
start to writing the SER, roughly.
CHAIRMAN APOSTOLAKIS: Good.
MR. RUBIN: Okay. And 10 years flies by
when you're having fun.
The status of the program. In January
1988, the staff provided a preliminary IPEEE insights
report to the Commission. At that time, the report
was based on the review -- I should say the
preliminary review about one-third of the submittals.
There were 70 IPEEE submittals in total covering all
of the operating reactors in the U.S.
At that time, following that preliminary
insights report, I had given FIVE presentations to
various ACRS subcommittees and the full committee on
various aspects of the program, fire aspects, seismic,
HFO aspects. And here we are back again. Now the
program is basically completed.
We have completed reviews for all 70
submittals. One plant, Haddam Neck, has shut down.
So what we actually did, we issued 69 staff evaluation
reports. Included in those staff evaluation reports,
as I said earlier, are technical evaluation reports
which contain a lot of useful information on plant-
specific issues and strengths and weaknesses.
You have in front of you -- it was passed
out and was issued in April 2001 -- draft NUREG-1742,
which is titled "Perspectives Gained from the IPEEE
Program," and that was issued for public comment. It
has been given a very wide distribution. We have
distributed about 500 hard copies, including e-mail
distribution and announcements on the -- by e-mail, on
the website, in the Federal Register notice.
Copies have been sent to all utilities, to
various stakeholders, NRC staff, and others. The
comment period ends on July 31st, 2001. I should say
as of this date we have not received any public
comments yet, but that's not surprising. Usually when
there's a deadline you try to get them to get comments
at the last minute.
And our schedule was to issue the final
NUREG-1742 in October 2001, taking into account public
comments.
MEMBER LEITCH: Changes in procedures, and
what not, made by the utilities as a result of this
study, changes there were -- a number of utilities
made various changes to procedures, in some cases
hardware. Were those changes voluntary on the part of
the utility?
MR. RUBIN: Yes.
MEMBER LEITCH: And it seems to me that
some of the insights here could be -- other utilities
could benefit from -- if Utility A made certain
changes, Utility B may have the same situation and not
have made those changes. This is just distributed to
the utilities and hope that they will see what has
been done here and try to apply it to their particular
situation?
MR. RUBIN: The candidate -- there's
nothing that the NRC is requiring or focusing on that.
But I was going to get to it -- in Volume 2 of the
draft report NUREG-1742, our plant-specific
information, the plant-specific tables, and the
details, the types of improvements that each utility
made.
One of the things consciously we tried to
do, with staff and the Senior Review Board in
reviewing the submittals, is not just on improvements,
but where there are similar plants why there were
differences. You know, why does one plant come up
with a certain area that is a large contributor to
risk and another one doesn't? Or another plant may
have analyzed certain aspects of the IPEEEs
differently, and we focused on that significantly.
So, I mean, in terms of what a licensee
chooses to do, the improvements are voluntary. The
Generic Letter itself is not a requirement. The
Generic Letter is a request.
VICE CHAIRMAN BONACA: But going on the
same issue, for example, in the fire area there were
only three utilities, I believe, that had identifiable
vulnerabilities.
MR. RUBIN: Yes. Two utilities, three
units, yes, correct.
VICE CHAIRMAN BONACA: And one of them
identifiable vulnerabilities in the turbine building,
if I remember, that were significant. And there were
changes made to address those problems.
That plant has a number of sister plants
with identified vulnerabilities. There were also some
vulnerabilities tied to the design -- safety cables
coming through the turbine building area in locations.
Did you go back and check about sister plants to see
if they had the same configuration concern or just
simply was left to -- unaddressed? I mean --
MR. RUBIN: Well, we'll get into the
vulnerabilities later on. But just let me briefly say
of those two -- three units, okay, two reactors at one
site, and one at another site, the first one was Quad
Cities, which we have -- I have talked about to this
committee before.
That first analysis that the utility did,
they went -- the licensee went back and redid their
IPEEE, the fire analysis, in its entirety. There was
a lot of visibility. There were a lot of discussions
with the staff. There were a lot of fire inspections.
There was quite a host of activities, both at the
utility and at the staff when this fire issue came up
several years ago.
The licensee revised their analysis. We
went out and did a site audit -- the staff and our
contractors -- of the revised analysis. We walked
around the plant. We went to see what they did. And
we felt they did a very good job, in fact. Their
first analysis was very, very conservative, I would
say. That's when they came up with the fire
vulnerability. There was a core damage frequency of
five times 10-3 just from fires. And that was a
turbine building fire.
What we then -- we looked at very
carefully other plants that -- whether they even
looked at or discussed whether the cables -- safety
cables running through the turbine building. And
effectively as a result of our reviews, we questioned
a licensee that did not identify a vulnerability in
their turbine building, and as a result of the staff
questions they discovered one and made changes.
VICE CHAIRMAN BONACA: Okay. So --
MR. RUBIN: So that's sort of a short
summary of those vulnerability issues.
I'm sorry if I'm stealing your thunder,
Steve, but the question came up.
VICE CHAIRMAN BONACA: No. It's -- I
mean, understanding what the staff did with the
information regarding other licensees.
MR. RUBIN: And by the way, that is an
issue -- turbine building fires, that you brought up,
is a part of the aspects of the fire risk research
program also as well.
Let me just set the stage. The objectives
of the IPEEE program -- and Dana mentioned earlier
they seemed like kind of -- I don't know if a "low
bar" is correct, but they are not quantitative
objectives. Let me just read them.
These were straight out of NUREG -- the
Generic Letter 88-20, and these objectives were all
for licensees. There was to develop an appreciation
of severe accident behavior for their plants. We hope
they would understand the most likely severe accident
sequences that could occur at their plants under full
power operating conditions.
The licensees were expected to gain a
qualitative understanding of the overall likelihood of
core damage in fission product release. It was not
quantitative CDF estimates that we were after. In
many cases, we did get quantification of core damage
frequencies.
And, lastly, and very importantly, I
should say, licensees would voluntarily reduce, if
necessary, the overall likelihood of core damage in
fission product release when making modifications, and
plant improvements, be it either hardware or
procedural improvements, that could help prevent or
mitigate such severe accidents.
CHAIRMAN APOSTOLAKIS: I guess I have a
little of a problem with the qualitative understanding
of the likelihood. That means roughly what it is.
That's what it means?
MR. RUBIN: It means we wanted them to
understand what the dominant contributors were.
CHAIRMAN APOSTOLAKIS: It says
"likelihood."
MR. RUBIN: Right. Correct.
CHAIRMAN APOSTOLAKIS: It's a little bit
difficult to --
MR. RUBIN: Would you have liked a
different term or --
CHAIRMAN APOSTOLAKIS: Somebody at one
point asked a physicist to gain a qualitative
understanding of the speed of light.
(Laughter.)
I don't know. Go ahead.
MEMBER KRESS: It's fast.
CHAIRMAN APOSTOLAKIS: What?
MEMBER KRESS: It's fast.
(Laughter.)
MEMBER POWERS: Very fast.
MEMBER KRESS: Okay. You're right.
MR. RUBIN: Let me talk a little bit about
the IPEEE review process itself. After we received
submittals from licensees, they were reviewed to
determine whether the licensee met the intent of the
Generic Letter. That was clearly focused on the four
objectives that I discussed in the previous slide, see
whether the licensees followed the guidance that was
given in NUREG-1407, to see whether there were gaps or
weaknesses, and that they did a thorough job in
covering the different aspects of each of the areas of
the IPEEE.
The review process itself started with
initial screening reviews where we focused on the
quality and completeness of the submittals. And a
very important aspect --
MEMBER POWERS: When you use the --
focused on the quality, what does that mean?
MR. RUBIN: It means what we did not do,
we did not try to validate or verify the quantitative
results, go back and check calculations that were
included in the analysis. We wanted to see if they
were -- if they included the important aspects of the
program, but we didn't go and do a quality assurance
check.
MEMBER POWERS: You looked at the index to
see if they touched on the right topics?
MR. RUBIN: Correct.
MEMBER POWERS: Okay.
MR. RUBIN: And certainly, when there was
information that looked either inconsistent, we raised
questions. If they did not, for example, use
appropriate values, we raised questions, if we thought
those could contribute to a better understanding of
dominant contributors to risk. And you have several
examples of those later on in --
MEMBER POWERS: I have to say that in the
text itself where you have highlighted those areas
where it goes -- the reviewers questioned this, and
they went back, that was very helpful.
MR. RUBIN: Okay. Thank you.
Let me just give an example. I think
examples help. But there was some generic guidance
that industry had put out, fire PRA implementation
guide that EPRI -- that staff had not reviewed. And
we went through quite an extensive review process with
industry on a generic basis to resolve those
questions, and it resulted in some additional and
improved guidance to utilities to respond to our RAIs.
An example is in the fire area on the use
of quantitative values now for heat release rates from
cabinet fires, heat loss factors, and analysis of room
heat-up calculations as a result of a fire. So I
should -- you know, it was not that we didn't look at
the quantitative information in the IPEEEs, but we
didn't go back and doublecheck that, yes, they came up
with the CDF estimates and we agreed with it.
I mentioned earlier we did also have a few
plants, selected plants -- four, in fact -- where we
had site audits. These were additional reviews that
were beyond the screening analysis. For some plants
which either had poorly documented analyses and the
licensees asked us to come to their site, or there
were various technical issues that were in the
reviewer's mind.
One of these site visits was to Quad
Cities as a result of their fire analysis. They had
a very high core damage frequency estimate for fires.
Just another example, we had a site visit to
Susquehanna. They were on the other extreme. They
had an extremely, extremely low core damage frequency
estimate, on the order of 10-9 for fires.
MEMBER POWERS: So why can't we all just
follow Susquehanna's lead? That sounds good to me.
MR. RUBIN: They did, as a result of our
visit at Susquehanna, revise their analysis. They
came up with a couple orders of magnitude higher
estimate of core damage frequency, still on the low
side.
But we felt after our site audit that they
had identified the dominant -- where the dominant
areas were, and they actually made some procedural
improvements there as a result of that. So we
considered that a success.
I mentioned that there was a Senior Review
Board, which was a very important part of our review
process. The Senior Review Board was comprised of NRC
staff and contractors. Many of them are here in the
audience, and you will hear two presentations this
afternoon.
In the seismic area, that included Mike
Bohn of Sandia National Laboratory and T.Y. Chang of
the staff, who is in the audience. In the fire area,
it included Steve Nowlen from Sandia National Lab, who
will hear from later, Ed Connell, who is sitting over
here from NRR, and Nathan Siu from the Office of
Research who is also in the audience.
And the high winds, floods, and other
areas included Mike Bohn, also from Sandia, and Rob
Kornasiewicz who has since retired.
But for a large part we had most of these
reviewers over the entire extent of the review process
which was very, very helpful, very useful. That
provided both technical advice on the scope and
consistency of the individual reviews, and, more
importantly, helped to provide assurance that
vulnerabilities weren't overlooked.
There were a lot of discussions back and
forth in these Senior Review Board meetings, and there
were at least two dozen of them over the course of the
years focusing on RAIs and what were important issues
and important questions to pursue with licensees.
VICE CHAIRMAN BONACA: Just going back
just for a question on technical decisions. Does that
mean if you had a surrogate element --
MR. RUBIN: In a seismic.
VICE CHAIRMAN BONACA: -- in a dominant --
yes, in seismic, for example, you didn't consider that
a technical deficiency, did you?
MR. RUBIN: No, because that was a
methodology that was approved. We considered that a
weakness, that you would not be able to -- in that
group of -- if the surrogate element came up to be a
dominant contributor, you would not be able to
identify what element that was at the plant.
But sometimes if the overall risk were
low, even if the surrogate element is high, we felt it
may not be worth pursuing -- may not be necessary to
pursue. But it is pointed out so that in terms of,
I'd say, uses or applications of the IPEEEs, for
example, for risk-informed activities, if there is a
licensee that comes in with a request in the seismic
area, and that plant -- particular plant has a
surrogate element as a dominant contributor, it might
be hard, difficult, to determine, you know, should
they get some relief from some aspects in the seismic
area.
So that information is -- I felt was very
important and very useful, and it is included in all
of the technical evaluation reports, if that were the
case. And, in fact, it is even included in Volume 2
of NUREG-1742, the dominant contributors, where there
are surrogate elements.
VICE CHAIRMAN BONACA: But would that give
you some kind of indication of the quality of the PRA?
MR. RUBIN: It was an accepted approach.
I don't know if -- it was nice when the surrogate
element did not come up to the dominant contributor,
which was the case most of the time.
VICE CHAIRMAN BONACA: Okay.
MR. RUBIN: But we didn't require
licensees to go back and redo an analysis of those.
Just to touch base on the NUREG report,
the draft 1742. Volume 1 has the generic insights,
generic types of information primarily, and Volume 2
is a plant-specific database -- I call it -- from the
IPEEE program. The report itself describes the
overall process and the findings in each of the major
areas of the program.
It discusses identified vulnerabilities,
includes information on the quantitative findings,
such as the range of core damage frequency estimates
and the dominant contributors to plant risk in each of
the areas. It touches base and discusses the plant
modifications and improvements that have been
implemented or planned for each of the licensees.
It talks about the overall strengths and
weaknesses. Each plant-specific TER discusses those.
But in the insights reports also we discuss the
overall strengths and weaknesses and the very general
stance and the various methodologies that we used in
terms of models and assumptions for the analyses.
An important area that you will hear about
later is the resolution of the external event related
generic and unresolved safety issues that were, I'd
say, a challenging part of the review process which
we've included in the IPEEE program.
The plant-specific database I mentioned.
The report talks about the success in meeting the
intent and the objectives of the IPEEE program and
includes examples which I will discuss later on this
afternoon of the uses of IPEEE information by both
industry and the NRC.
If there are no further questions, that
completes my introductory comments, and we can
continue on with the program, go into -- John Lehner
will discuss the seismic reviews.
MR. LEHNER: Good morning. I'm John
Lehner from Brookhaven National Laboratory, and I
coordinated the effort at Brookhaven to review the
seismic portion of the IPEEEs and collect the
insights.
I have also listed there some of the other
contributors of Brookhaven, the reviewers of the
individual submittals. And I should also mention that
the first 20 plants were actually reviewed by ERI,
Energy Research Incorporated.
What I want to present is an introduction
and background on previous seismic programs, how the
IPEEE relates to those programs, and discuss the
vulnerabilities that were -- the way vulnerabilities
were treated in the seismic portion of the IPEEEs and
also discuss the improvements that occurred because of
the seismic reviews -- I mean, the seismic reviews of
the licensees.
Then I'll talk about some of the
perspectives of the actual analyses, first discussing
those elements which were common to the two types of
analyses, and then go into the particular perspectives
from the PRA analyses that were conducted, and then
the seismic margin analyses that were conducted.
Finally, I'll make some comments about
some of the perspectives on the methodologies used,
and wind up with some conclusions.
Alan Rubin put up a slide that indicated
the objectives of the IPEEE program, and this just
summarizes the objectives of the insights program as
it applies to the seismic portion. Basically, we
wanted to look at the processes used and the findings
that the licensees had when they conducted their
analyses, look at the plant improvements that came out
of the seismic portion of the IPEEE program, look at
plant-specific design and operational features as they
might relate to the site-specific seismic hazards, and
describe the strengths and weaknesses of particular
methodologies, and, finally, also look at the extent
to which the licensees met the intent of Supplement 4
to the Generic Letter.
Again, as was mentioned by Alan Rubin, the
insights program did not attempt to validate the
results of the licensees' submittals.
MEMBER KRESS: If one wanted to do that,
how would you go about it?
MR. LEHNER: To validate the results of
the submittals?
MEMBER KRESS: Yes.
MR. LEHNER: I think you'd need a more
indepth review than these screening reviews that we've
conducted, perhaps by duplicating selective
calculations, things like that, which were not carried
out in our screening review.
CHAIRMAN APOSTOLAKIS: How would you
validate the fragility curves?
MR. LEHNER: Well, I mean, there's
obviously a lot of uncertainty in the fragility
estimates. And, of course, for the IPEEE program, the
NUREG-1407 allowed the use of a mean fragility curve
as well as a mean hazard curve. So I think in most
PRA applications for the IPEEE the licensees basically
developed point estimates by using these mean curves.
I think some of them had previously
existing PRAs where you probably had a more -- carry
along more uncertainty, let's say. But for the
IPEEEs, they really use -- they were allowed to use
the mean fragility curve.
MEMBER KRESS: How do you feel about
technical justification for that?
MR. LEHNER: For the use of the mean
fragility curve?
MEMBER KRESS: Yes, for mean fragility and
mean hazards, and combining the two to get a --
MR. LEHNER: Well, I mean, it -- I think
for achieving the objectives of the IPEEE program, I
think it's a valid approach. I think you have to --
MEMBER POWERS: Your text seems to be
fairly critical. I mean, it says -- I quote, "And the
use of simplified fragilities may have obscured
findings related to dominant contributors to seismic."
MR. LEHNER: Well, I think that refers to
the fact that some of the licensees -- well, some of
the analyses, the assumptions that were made for the
uncertainty and getting the -- I mean, you still have
to assume a combined beta value and --
MEMBER POWERS: Combined beta value or
not, this seems to call into question that Mr. Rubin
said, that the study satisfied the objectives of the
IPEEE effort.
MR. RUBIN: Let me just add one thing.
These were instances in our reviews of individual
plants where the staff had asked for licensees to
submit examples of their calculations and analyses,
because we wanted to get some confidence if we had
some questions on a particular plant, where the
reviews might have been sort of on the margin, the
kinds of analyses and we did look at those.
We didn't validate the results. We
actually got their calculations and looked at that as
part of the review, not across the board for each
plant, but for some selected plants.
MEMBER POWERS: Well, I thought one of the
objectives was to understand what the dominant
contributors to the various hazards were. And yet
here it says that using these simplified approaches to
fragility may have obscured findings related to the
dominant contributors to seismic CDF.
I mean, it seems to say that they didn't
do it. Maybe I'm misreading the sentence, but it
seems to say these things didn't satisfy the objective
of the IPEEE.
CHAIRMAN APOSTOLAKIS: What page is that
on?
MEMBER POWERS: You can find it in a
couple of places, George. But, in particular, on
page 20, second bullet from the bottom.
MR. LEHNER: I think, you know, it depends
how you interpret that statement. The "may have
obscured" I think is not meant to say that it had not
necessarily met the objective but that --
MEMBER POWERS: It's plain language. I
mean, "may not have met," I mean, you can cast it any
way you want to. Either it did or it didn't. And
this says it didn't.
CHAIRMAN APOSTOLAKIS: Well?
MR. LEHNER: Well, I mean, the -- given
the limited objective of the Generic Letter, perhaps
that is too strong a statement. If you feel that
that's the -- that's what it says, then that's --
VICE CHAIRMAN BONACA: Well, let me just
say that that was an issue I didn't raise. But
combined with the issue of the surrogate --
MR. LEHNER: Right.
VICE CHAIRMAN BONACA: -- in some cases
being the dominant, etcetera, etcetera, there are a
lot of almost disclaimers within the text of this
NUREG as to the adequacy of any conclusions.
I mean, for example, when you compare as
a timeline CDF, due to seismic for plants, you get to
the conclusion that there hasn't -- you know, that
seems as if the programs have improved the older
plants such that -- that's rich because we know that
for the newer plants, really, they were not evaluated
for the true strength that they have. I mean, there
were some limits that they used to perform the
analyses.
So I'm only saying that to reinforce what
Dana said, just there are a lot of disclaimers to the
text that gives you a sense of, well, this is very,
very soft.
MR. LEHNER: Well, I think the disclaimers
were put in there to ensure that if the -- these
results were used for other licensing issues that
there are a lot of caveats to be observed here.
That's the reason for the disclaimers, not
to leave the impression that the reviews that were
conducted to see if they met the Generic Letter
concluded that these analyses were then validated for
licensing issues. So I think that's why you have the
disclaimers.
VICE CHAIRMAN BONACA: And the text
correctly identifies the methodological issues,
page 244, you know. But one is -- there is a good
evaluation there, there is a good description, but one
is left with questions regarding the conclusions being
drawn from figures and tables, and so on.
MEMBER POWERS: Are we going to discuss
more on fragilities? Is this the appropriate time to
discuss more on fragilities?
MR. LEHNER: It probably is, yes.
MEMBER POWERS: There's this provocative
thing that says, "UHS shapes for component fragilities
calculated appear uncharacteristic when compared to
conventional spectrum shapes derived from observed
earthquakes." Point number 1. Point number 2, "As a
result, seismic analyses using UHS spectra resulted in
significant reduction in seismic demand as compared to
corresponding design basis calculations."
Well, I can certainly understand why the
design basis calculations might have a greater demand,
but it -- I mean, when it says that the UHS shapes for
component facilities are uncharacteristic, what are
you telling me? These are some figments of somebody's
imagination?
MR. LEHNER: Well, my understanding is
that I guess a problem there is that for the eastern
U.S. -- this is only true of the eastern U.S. plants.
I mean, the western U.S. plants have UHSs that seems
appropriate. But perhaps because of the lack of
earthquake data the -- that's available for the
eastern U.S. --
MEMBER POWERS: It says it is making the
comparison with observed earthquakes. Okay? I mean,
that's what's interesting about the statement. It
says you've got a fragility curve, has a spectrum
that's uncharacteristic -- that's different from what
you observe for earthquakes. I would assume that that
would be a fatal flaw. Apparently not.
MR. LEHNER: Well, our reviews did not --
we didn't go back and -- we didn't have the ability to
go back and see how these UHS spectra were established
by the plants.
MEMBER POWERS: If somebody uses something
that doesn't match well with experimental data, I
mean, it doesn't strike me that that is maybe the best
possible analytic technique.
MR. LEHNER: Well, I would agree with you.
MEMBER POWERS: Right. It doesn't go
without passing. You said something here about that.
MR. LEHNER: Right. I think that's one of
the methodological issues that we've focused on.
MEMBER POWERS: Yes, I think there is a
problem.
CHAIRMAN APOSTOLAKIS: Well, is this
appropriate to ask, about the methodological issues?
MR. LEHNER: I have a slide.
CHAIRMAN APOSTOLAKIS: You have a slide.
MR. LEHNER: Yes. Well, just by way of
background, this slide just discusses some of the
regulatory bases for seismic designs of nuclear
powerplants. 10 CFR Part 20, Appendix A, General
Design Criteria 2, talks about protection against
natural phenomena. Obviously, earthquakes is one of
those.
The idea of a safe shutdown earthquake is
in Appendix A of 10 CFR Part 100. And, of course, the
NRC has issued a standard review plan with many
updates and numerous regulatory guides that have been
issued on seismic issues as this area has evolved.
It's worthwhile mentioning some of the
seismic programs in the past that sort of led up to
the IPEEE program. The systematic evaluation program
recognized that some of the earlier plants had been
designed before seismic design criteria had really
matured, so that went back and looked at some of those
plants.
Bulletin 80-11 looked at specifically
masonry and block wall issues that applied to -- in
nuclear plants. Then, the Charleston earthquake issue
or the eastern U.S. seismicity issue of course raised
the point that the U.S. Geological Survey informed the
NRC that there may be higher seismicity in the eastern
-- in some of the eastern U.S. sites than originally
thought.
And this led to the development of hazard
curves by Lawrence Livermore Laboratory and also by
EPRI for the various nuclear plant sites in the
eastern U.S. And these hazard curves were then used
in the IPEEE for those plants that did seismic PRAs.
MEMBER KRESS: My understanding is is they
really all use the EPRI curves.
MR. LEHNER: They actually used both. I
think two plants actually only used the Livermore
curves, the revised Livermore curves. As you know,
the Livermore curves were then later revised in I
think '94. But most plants used the EPRI curves as
their base case, and then used the Livermore curves as
a sensitivity.
And they were asking -- I think NUREG-1407
actually asked that both sets of hazard curves would
be used. And it turned out, as I'll talk about later
on, that it did not make a significant difference in
the core damage frequency or in the dominant
contributors.
MEMBER KRESS: That raises a question of
justification of using the LLNL curves as a
sensitivity then. Is that a justified use of them?
Can you technically justify that as a use for
sensitivity? I mean, why stop there, is what I'm
saying, in terms of sensitivity. How do we know they
balance the uncertainty some way?
MR. LEHNER: Well, no, I mean, as I said,
the -- you know, the guidance in NUREG-1407 allowed
the use of mean fragility and mean hazard curves and
only asked for a use of the -- of both the EPRI and
Livermore hazard analyses. I don't claim that it's a
comprehensive uncertainty analysis, certainly.
MEMBER KRESS: What's bothering me is I'm
afraid people are going to go back and misuse that as
an uncertainty distribution.
CHAIRMAN APOSTOLAKIS: Which one? This?
The Livermore curves do have uncertainty in them.
They present families of curves.
MEMBER KRESS: I know. But they use the
mean.
CHAIRMAN APOSTOLAKIS: Oh, they use the
mean.
MEMBER KRESS: Yes.
CHAIRMAN APOSTOLAKIS: Okay.
MEMBER KRESS: And I'm afraid that's going
to be misused as an uncertainty.
CHAIRMAN APOSTOLAKIS: Oh, all right. All
right.
MEMBER KRESS: When, really, you ought to
go to the full uncertainty in the Livermore curves and
propagate it through. But --
CHAIRMAN APOSTOLAKIS: But that wouldn't
be an IPEEE, then. I mean, that's a major work, piece
of work to do that. I mean, you are doing full scope --
MEMBER KRESS: What I'm worried about is
misuse of the IPEEE results later on.
CHAIRMAN APOSTOLAKIS: You may think that
you have a bound when, in fact, you don't.
MEMBER KRESS: Yes.
MR. LEHNER: I agree with you that the --
using the -- both sets of curves is simply a -- you
know, it's an interesting comparison, but it
doesn't --
MEMBER KRESS: Well, it doesn't make much
difference, it doesn't seem like --
MR. LEHNER: Right.
MEMBER KRESS: -- like you said, except
for one plant I think it was --
MR. LEHNER: Yes.
MEMBER KRESS: -- which surprised me. Do
you know why that one plant made such a big
difference?
MR. LEHNER: Actually, I don't, no. I
mean, I think -- are you talking about the Seabrook?
MEMBER KRESS: Yes, I think it was
Seabrook.
MR. LEHNER: There was like an order of
magnitude difference --
MEMBER KRESS: An order of magnitude
difference.
MR. LEHNER: -- in the CDF, yes. Yes.
Unfortunately, Seabrook was not -- well, we at
Brookhaven did not review Seabrook in detail, so we're
-- I'm not sure why that was.
The other seismic program, of course, is
the USI A-46 program, which looked at the seismic
adequacy of electrical and mechanical equipment in
plants. And that program was actually coordinated
with the IPEEE program in many plants, and the
procedures there developed by the seismic
qualification utility group, the GIP, the generic
implementation procedures for seismic verification of
equipment, was also used in the IPEEE walkdowns quite
a bit.
Then, of course, the A-46 was a licensing
program, whereas the IPEEE program is not. But the
IPEEE program then, as I said, was coordinated with
A-46. And, of course, under A-46 you also had the
A-17, which was the spatial interaction issue, and the
seismic capability of above-ground tanks, A-40.
Also subsumed in the IPEEE program were
the external event part of A-45 and the Generic
Issue 131 for the in-core flux mapping system
applicable for Westinghouse plants. You'll hear more
about the USIs and GSIs in this afternoon's
presentation.
CHAIRMAN APOSTOLAKIS: Now, let me
understand. Maybe you said it and I missed it.
Important seismic-related programs undertaken by the
NRC and industry -- what does that have to do with the
IPEEE? These were undertaken as a result of the
findings, or there were --
MR. LEHNER: No, no. These were things
that led up to the IPEEE.
CHAIRMAN APOSTOLAKIS: Oh, way back.
MR. LEHNER: Yes. Yes.
CHAIRMAN APOSTOLAKIS: Okay.
MR. LEHNER: And as I said, in other
words, the hazard curves used in the IPEEE came out of
the eastern U.S. seismicity issue. And the A-46
program -- a lot of plants -- for the A-46 program
older plants had to evaluate their electrical and
mechanical equipment, and they did it via a --
developing a HCLPF for the plant, which is similar to
what they would do in a margin analysis.
They also developed this -- I'll talk
about this a little bit more later on, but this
success paths idea from EPRI. So when it came time
for the IPEEE, a lot of plants that used margin
analysis used the A-46 analysis as their basis and
built a little bit on that to satisfy the IPEEE
requirements.
MEMBER KRESS: Are you going to talk about
the HCLPFs any later, or is somebody? The question I
have is, we had one of our fellows do a study, and he
concluded that you can correlate HCLPFs with actual
effects on CDF. But if I look at the comparison of
the plants that did both the HCLPF and a CDF, I don't
see that correlation. And I was wondering if -- it
raises a question in my mind, was our fellow wrong, or
is there something wrong with the PRA or the HCLPF
analysis in the IPEEE?
MR. LEHNER: Well, I think there's a lot
of --
MEMBER KRESS: It could be both, I guess.
MR. LEHNER: There's a lot of factors that
enter into that. I mean, you -- if you derive the
HCLPF from the PRA, then, I mean, there is -- I mean,
in the margin analysis, most of the HCLPFs were
derived by this CDFM method, the conservative
deterministic failure method, whereas if you're
deriving it from the PRAs then you are -- you are
deriving it from the fragility curves.
And, I mean, ideally, if you did
everything consistently you'd get similar results.
But I think that -- I know the -- if you're talking
about the figure that we have --
MEMBER KRESS: I forget which figure that
was.
MR. LEHNER: Yes. I think you have to be
careful about the assumptions that went into those
calculations.
So the two analysis methods -- we've
already touched on this -- that the guidance in
NUREG-1407 allowed for were a margin analysis or a
seismic PRA, and they were both, of course, ways of
comparing seismic demand versus seismic capacity of
the important SSCs in the plant.
They both involved comprehensive
walkdowns, and they were both ways of identifying
plant vulnerabilities. And the 1407 guidance also
called for at least a qualitative containment
performance analysis.
The seismic PRA, as I said, 1407 allowed
mean hazard curves or mean fragilities, but it also
called for some enhancements in the sense that you had
to look at relay chatter, soil liquefaction if it
happened to be applicable at the site, and it also
asked -- all this was optional -- that -- that plants
with a SPRA calculator HCLPF, but most plants did not
report a HCLPF that conducted the seismic PRA.
MEMBER POWERS: Let me ask you a question
about soil liquefaction. Were there any constraints
of what the licensee did there? I mean, do you have
a standard for how to treat soil liquefaction
displacements?
MR. LEHNER: No. I think that's one of
the things that we mentioned, that there really
doesn't seem to be an accepted methodology or accepted
guidelines for, you know, what's an adequate soil
analysis.
MEMBER POWERS: And so you -- whatever
they did you just kind of had to accept?
MR. LEHNER: That's right.
MEMBER KRESS: Does that raise a need for
-- if we actually wanted to put seismic PR
contributions in the PRAs, is that a need that's
unfilled?
MR. LEHNER: Well, I think some plants
actually identified some problems in that area. Of
course, you know, a -- I think the question is: what
do you do about that? I mean, it's a very difficult
problem to fix.
CHAIRMAN APOSTOLAKIS: Now, most plants I
understand did margin analyses, didn't they?
MR. LEHNER: Yes.
CHAIRMAN APOSTOLAKIS: Is there a big
difference in terms of resources required between
doing a seismic PRA and a seismic margin analysis?
MR. LEHNER: Yes, I believe so.
CHAIRMAN APOSTOLAKIS: I mean, but is
there a big difference in the benefits as well? I
mean, it seems to me the margin analysis, after you've
done it, you've done it and it shows that you don't
have any major problems, it's useless.
And you can't use any of that in
Regulatory Guide 1.174. Nothing. I mean, you don't
have an estimate of the core damage frequency, so you
save some money but you end up with nothing.
MR. LEHNER: Well, yes, that's an
interesting point.
CHAIRMAN APOSTOLAKIS: I don't know why
people prefer these things, because perhaps we don't
insist that they use a complete PRA when they request
other things so they could get away with it, because,
you know, it's the same thing with FIVE on fires.
MR. LEHNER: Yes.
CHAIRMAN APOSTOLAKIS: After you do it,
unless you go on and do a PRA on the unscreened
locations, you don't have results that can be used in
the future. You just showed that you don't have
vulnerabilities according to these rules.
MEMBER KRESS: One way to use those may be
-- Bill Shack's take on this -- is if the margins
analyses and the FIVE analyses shows you don't have to
worry about fire or seismic, then you don't have to
include them in your 1.174.
CHAIRMAN APOSTOLAKIS: Well, then, if
that's the case, I think you need a much more detailed
review than these guys were allowed to give those --
MEMBER POWERS: It seems to me, Tom, I
mean, this is like analyzing one sequence. You come
out and you find out, well, that sequence is a 10 to
the minus sequence, so I threw it away. And I, in
fact, define my sequences so that they're all less
than 10-6, so I can throw them away, so I have zero
risk from the plant. I mean --
MEMBER KRESS: You're exactly right.
Especially if you're going to use importance measures,
you've got to worry about that, too.
MEMBER POWERS: Yes. And that's what
worries me here is that we're doing all of this
categorization of equipment, and we're not getting any
benefit out of this for the risk achievement or risk
reduction worth with respect to seismic and fire and
that categorization. And we'll never get it.
MEMBER KRESS: Yes. I was wondering if
anybody would bring up the concept that just because
it's relatively low contribution to the CDF, it may
not be a relatively low contribution to the
derivative, and that's what you're really finding in
1.174 is the derivative. And so, but anyway --
CHAIRMAN APOSTOLAKIS: Well, I think we
should clarify this. Either we go back to 1.174 and
say external events are not to be included, or we do
a serious job here. I mean, you can't have it both
ways.
MEMBER KRESS: If the intent is to use
this in 1.174, that might not be a --
CHAIRMAN APOSTOLAKIS: Well, 1.174 says
the total CDF.
MEMBER KRESS: Oh, I know. But maybe
1.174 says don't use the IPEEEs. Go back and do a
real seismic analysis.
MEMBER POWERS: Yes, but we never mean
that.
CHAIRMAN APOSTOLAKIS: But we never mean
that.
MEMBER POWERS: We say total CDF, but we
never mean that, because we say that there's no risk
whatsoever due to shutdown events. And now we're
saying there's no risk due to seismic events. And
pretty soon we'll get around to saying there's no risk
due to fire events.
MEMBER KRESS: Might as well forget the
internal events, too, then.
(Laughter.)
MEMBER POWERS: Might as well leave them
out as well.
MR. LEHNER: I think some people actually
have proposed a way of getting a pseudo-CDF, something
like an analysis.
CHAIRMAN APOSTOLAKIS: But why? I mean,
I don't understand it. How much would it cost?
Because remember now, these guys are building on what
EPRI has done and Lawrence Livermore. They are not
starting from scratch. They are just implementing
something.
MR. LEHNER: And they also have the
internal events PRA, too.
CHAIRMAN APOSTOLAKIS: And they have the
internal events PRA. They have to do walkdowns
anyway, no matter which approach they take. So it's
a mystery to me. I mean, what -- is it because it
will take time to try to understand what Livermore
did? I don't understand this.
VICE CHAIRMAN BONACA: Well, I think in
part it's the timeframe when the IPEEE came.
CHAIRMAN APOSTOLAKIS: It was 10 years.
VICE CHAIRMAN BONACA: Well, the utilities
at that time were not allowed to use PRAs to justify
changes as we see today, as 1.174 allows.
CHAIRMAN APOSTOLAKIS: That may very well
be part of it, yes.
VICE CHAIRMAN BONACA: So that shift I
think would justify on our part now to raise our
expectations, because since, you know, we have right
now an STP that is coming, for example, with a
significant initiative that is based on PRA insights,
then that should be a counterpart in higher
expectation. I don't think we are seeing it, you
know, here -- because, again, it's the outcome of the
program that started 10 years ago. Things have
changed.
MEMBER POWERS: I think it's imperative to
understand that there's been a change in mindset
between when this Generic Letter was sent out --
CHAIRMAN APOSTOLAKIS: That's right.
MEMBER POWERS: -- and today that's a
fairly significant change in mindset. And so those
people that undertook things promptly after reading
the letter really had no opportunity to respond to
that change in mindset.
VICE CHAIRMAN BONACA: But wouldn't it be
appropriate at this point for us to say they --
MEMBER POWERS: Well, it depends on
whether they want to go to the risk-informed
regulations or not. I mean, those are optional, so
it's --
CHAIRMAN APOSTOLAKIS: I think we're going
to end up with a standard thing that is going to say,
"These analyses will be upgraded as necessary in the
future." I don't think anyone will go out and say,
"Redo."
MEMBER KRESS: I think we did exactly the
same thing in the IPE.
CHAIRMAN APOSTOLAKIS: Yes. And it's
happening, by the way. It is happening. I mean, they
are upgrading their IPE.
MEMBER POWERS: Yes. But the opposite is
happening, too, George. People are coming in and
saying, "Well, from the IPEEEs we get or" --
CHAIRMAN APOSTOLAKIS: And those guys do
not find the staff very sympathetic, they don't think.
MEMBER POWERS: It's the staff that's
doing it.
CHAIRMAN APOSTOLAKIS: Then we should not.
VICE CHAIRMAN BONACA: The main concern I
have is what already Tom voiced on a specific issue.
This document will be used in the future to draw a lot
of conclusions, a lot of --
MEMBER POWERS: I think this document
could be used to draw a number of conclusions,
probably none of which are intended by you, the staff,
or the industry.
VICE CHAIRMAN BONACA: Absolutely. And
those conclusions might be, you know, solidly
incorrect, because it's just so limited.
CHAIRMAN APOSTOLAKIS: But it's really --
I mean, coming back to the original question, it's --
I'm a little bit puzzled by this tendency to do
margins analysis. I mean, you could call this a
screening analysis, which is a legitimate part of any
PRA and then say, "Now, the remaining stuff I'll
quantify."
MEMBER KRESS: That would be the right way
to do it.
CHAIRMAN APOSTOLAKIS: That's the right
way to do it.
MR. LEHNER: You know, I think my -- just
my own opinion, but I think the fact that, as I
mentioned earlier, that the A-46 program already
involved doing a -- basically a margin analysis, it
was very convenient for licensees to then do a
similar, somewhat enhanced thing for the IPEEE.
VICE CHAIRMAN BONACA: You know, margins
analysis was valuable for licensees in the early '80s
when they were building plants, and they were asked to
perform PRAs to demonstrate that the plant, as
designed, had significant margin involved, what was in
the design, and, therefore, no change had to be made.
That was the purpose of, really, margin analysis.
For this purpose, I totally agree with you
that it doesn't give you the insights that you would
want to have.
CHAIRMAN APOSTOLAKIS: Are you saying that
anywhere?
MR. LEHNER: Well, we mention that --
CHAIRMAN APOSTOLAKIS: I mean, you have a
Section 264, Seismic Evaluation Methods and Strengths
and Weaknesses. Are you saying anywhere that the
margins analyses are limited and that perhaps in the
new regulatory environment they will not be too
useful?
MR. LEHNER: No. We don't quite say that,
no. I mean, we talk about what a -- you know, what an
SPRA gives you and what a margin analysis gives you.
CHAIRMAN APOSTOLAKIS: Yes. But, again,
you are placing them on the same level.
MEMBER SHACK: When you read what he says
about the seismic PRAs, it does not inspire a whole
lot of confidence.
(Laughter.)
CHAIRMAN APOSTOLAKIS: Like give me a
characteristic sentence.
MEMBER SHACK: Well, page 254, "In some
cases, the use of simplified fragilities may have
obscured findings related to dominant contributors to
seismic CDF."
CHAIRMAN APOSTOLAKIS: Right.
MEMBER SHACK: You go back to 247.
"Because of the correlation between the analyst's
expertise and quality of the fragility calculations,
guidelines or criteria may be made so that only
analysts with sufficient qualifications will perform
the fragility calculations in future seismic PRAs."
You know, some of the fragility analyses
are good, and some of them aren't so good. It really
is not --
MR. LEHNER: Actually, I think that's an
interesting point, because I think we also mention in
the report that overall the margin analyses were more
consistent among each other. I think it's because --
and they're more comfortable with calculating --
making those kinds of calculations.
MEMBER POWERS: Well, you also have a
guidance on how to do them, whereas there is no
guidance --
MR. LEHNER: Right.
MEMBER POWERS: -- for how to do a seismic
PRA.
CHAIRMAN APOSTOLAKIS: No. But, I mean,
coming back to Bill's point --
MEMBER SHACK: Well, I mean, one of the
conclusions I came to was roughly that -- that maybe
I'm one of these guys doing these conservative
assessments, because I didn't trust their ability to
do something as --
(Laughter.)
MEMBER POWERS: Well, let me dissuade you
of that, because it turns out that sometimes they
follow the directions and sometimes they don't.
(Laughter.)
CHAIRMAN APOSTOLAKIS: Well, I don't think
the degree of use of expert judgment in the actual PRA
is that different from the margins. I mean, I'm sure
you can repeat the same sentences by changing one or
two words and make them applicable to do margins
analysis.
MEMBER SHACK: No. And perhaps it comes
back to -- at least it's consistent because there's a
guidance document that sort of --
CHAIRMAN APOSTOLAKIS: Yes. But we are --
MEMBER SHACK: That doesn't make it right.
CHAIRMAN APOSTOLAKIS: What you're saying
is we are producing consistently results we cannot
use.
MEMBER POWERS: Well, I question about the
consistency, because I come back to this -- in some
seismic margin analysis submittals licensees did not
entirely follow the criteria for success path
development or their submittal did not contain
sufficient information to permit verification of the
appropriate application of the criteria. I mean --
MR. RUBIN: May I make a comment, please?
MEMBER POWERS: -- this seems to be a very
flexible world we live in here.
MR. RUBIN: Maybe a couple of comments.
First of all, the point that was made that the Generic
Letter came out 10 years ago, way before Reg.
Guide 1.174, there was -- I don't even know if it was
an inkling in somebody's eye, but risk-informed
activities and the use of PRAs.
CHAIRMAN APOSTOLAKIS: In fact, we
wouldn't even be using the words IPEs and IPEEEs.
MR. RUBIN: Right. So, I mean, that was
not the intent of the IPEEE to use it for risk-
informed activities. But I certainly agree, if
someone has done a seismic margins analysis, it is
going to be difficult to come up with, you know, a
quantification to use in Reg. Guide 1.174.
Some of the comments that you are -- the
subcommittee is making in terms of sentences seems to
cast great doubts on the IPEEEs and their success. I
think the intent we were trying to put forward in the
report is that not everybody did an A job on their
IPEEEs.
So we had to put some perspectives in this
insight report to generalize or sort of characterize
the flavor of the reviews. And what I said earlier is
that you really need to go and look at the plant-
specific staff evaluation reports and technical
evaluation reports to see where these sentences apply.
I wouldn't broad-brush sentences that --
that these kinds of statements apply across the board
to all of the IPEEEs. But we didn't want to also say
that everything was so rosy and glory that it was, you
know, the best thing we could ever imagine for all of
the plants.
So that's -- I think you need to keep that
in mind in looking at this report. It may be a hard
thing to -- to write or to characterize. But if
you've got some suggestions, I'd appreciate it.
That's I think the help -- if it helps you in looking
at the report, how we tried to put it together, that's
just a comment.
MEMBER POWERS: My quotations of the
language, not meant for criticism of the author's
language. I think you guys were refreshingly honest
in your presentation here.
MR. RUBIN: But I think it is taken a
little bit out of context also, because you --
CHAIRMAN APOSTOLAKIS: Alan, let me ask
you another question.
MR. RUBIN: Yes. Okay.
CHAIRMAN APOSTOLAKIS: Because I realize
it's difficult to provide perspectives and comment on,
you know --
MR. RUBIN: Yes. We're doing -- there are
69 perspectives in here, which we're not --
CHAIRMAN APOSTOLAKIS: Okay. But do you
think that after this program -- your technical
opinion and that of your group -- after this program,
is there a unit out there that, in fact, might have a
vulnerability in the sense that the seismic-induced
failure would have a frequency of close to 10-4 or
even greater? Is there a chance for that after you've
done all of this?
MEMBER SHACK: Like Haddam Neck.
MEMBER POWERS: There is one.
MR. RUBIN: Haddam Neck is shut down, not
because of the IPEEEs by the way.
CHAIRMAN APOSTOLAKIS: But something that
is hidden, that we don't know about. I mean, the
level of review, the level of analysis is --
MR. RUBIN: I've been sitting in on all of
these reviews. When I see the kinds of discussions,
series of discussions that have taken place at our
Senior Review Board meetings to go into these kinds of
issues -- and, yes, there's a chance that something
can slip through the cracks. We're doing a screening
review.
But I'd say we're doing a very -- with the
resources and the time, and there's nothing -- if
there's a substantial amount of resources for each
review -- I think we're doing a pretty good job to try
and -- there's no zero probability, but I feel fairly
confident that we have asked questions where there
were lots of problems in initial reviews.
You know, if somebody just takes a
submittal and uses that as the basis for
characterizing a plant, I think they could be way off
base without looking at the discussions on the RAIs
and the responses that are in the staff's technical
evaluation report.
So short response, I'd say the chance is
low but it's not zero. But don't ask me to quantify
it.
CHAIRMAN APOSTOLAKIS: Can you give me a
qualitative description of the margin?
(Laughter.)
MEMBER POWERS: A margin.
(Laughter.)
MR. RUBIN: Isn't low good enough?
(Laughter.)
Well, you know, we didn't see the 10-4.
Haddam Neck was on the high end. But we saw close to
that. In fires we saw estimates of greater than 10-4.
For CDF estimates, in the low 10-4 range. We didn't,
you know, consider or call that a vulnerability.
We felt that the licensee had made lots of
improvements, even in the seismic analysis. Where
they did seismic margins, the walkdowns led to lots of
improvements. I mean, John hasn't gotten to that yet.
But even though they can't quantify their PRA, they
did make a lot of fixes based on the IPEEE.
MEMBER SHACK: Well, I sort of see it the
other way. You know, I looked at the wide range of
results you got and this sort of -- you know, does
this sort of tell you that it's -- you know, you can't
go any further with generic regulations?
Everything is now so plant-specific that
you almost -- you know, you really do need a
performance basis. If you don't like what they have,
you somehow have to have a way to look at an
individual plant and tell them, you know, to get their
CDF number down.
MEMBER KRESS: Did I hear that right?
MR. RUBIN: I won't touch that one.
MEMBER KRESS: From Bill Shack?
(Laughter.)
MEMBER POWERS: These metallurgists are
steeped in rigor. Just wait until we get to 50.46;
you'll see rigor.
MEMBER KRESS: Okay.
(Laughter.)
MEMBER SHACK: Well, I didn't say these
analyses were rigorous. I just said they show a lot
of variability.
MEMBER POWERS: I didn't say the analyses
were rigorous either. I just said metallurgists are
steeped in rigor.
MR. RUBIN: Well, I think we do know that
there is vulnerability among the design, and we expect
variability among the PRA results. So that's not a
surprise. Doesn't mean you can't, you know, come up
with generic regulations. But if you're doing
something on risk insights, you really better look at
the individual plant.
MEMBER LEITCH: Well, I'm left with the
question that although you did not try to validate
these results, when I look at the figure like that on
page 232, I see two and a half orders of magnitude
difference in the CDF results.
And I guess it seems to me that there
could be at least three possible reasons for that.
One is differences in methodology that was used,
differences perhaps in identification of issues as a
result of the walkdown, or perhaps just plain errors.
And I guess although you didn't really try
to validate their results, as I understand, would you
have looked at some of these outliers to see which of
those might be contributing to these? In other words,
are these really plant differences, or is it
methodology and --
MR. LEHNER: Well, I think it's both. I
mean, certainly, you know, plants have been designed
to different criteria as seismic standards evolved.
But methodology also plays a role, and I think one of
the -- you know, one of the implicit outcomes of this
whole individual plant examination and risk-informed
regulation is this idea of adopting standards to try
and perhaps eliminate some of the variation in the --
in what's an acceptable methodology.
I believe the NS standard on seismic
analysis is -- either has been released or is about to
be released.
So in answer to your question, I think
there is both elements, but I think the recognition
that methodology played a role has also led to the
idea of trying to put out some standards that would
narrow those differences in methodology.
VICE CHAIRMAN BONACA: We just talked
about Haddam Neck with 2.3 10-4 CDF from seismic.
It's not surprising. But there are now plants of the
same vintage still in operations, and they chose not
to perform a PRA. So you have only a seismic margin
analysis.
You know, there are issues left like that
that come to mind all the time as I read that. What
about that? Seismic margin seems to say that that's
okay, and yet some of these plants they are part of
the same vintage. Why would they be different from
Haddam Neck? They wouldn't.
MR. LEHNER: They wouldn't. I mean --
well, I mean, you know, I don't want to categorically
say that they would have the same core damage
frequency. But, yes, I mean, there were plants out
there even when the margin analysis basically -- I
mean, there are plants where the margin analysis did
not give them a large margin over their design basis
earthquake, as we'll get to later on.
So, certainly, plants seem to be up to the
-- there was no plant that had a HCLPF that was below
their design basis, but there were certainly plants
whose HCLPFs were below the review level earthquake.
All right. So just to conclude with this
slide here, basically two margin analyses, one
developed by the NRC, which is an event tree/fault
tree approach, and the other one by EPRI, which is the
success path approach. And almost all licensees that
did a margin analysis used the EPRI method. I think
there were only two licensees that did an NRC seismic
margin.
Now, the guidance in NUREG-1407 basically
binned the plants into various analyses categories,
and this was based on the seismic hazard associated
with a plant site as well as, to some degree, the
design of the plant.
Maybe it's easier to start out with a full
scope seismic margin analysis where the SSCs will be
evaluated against a review level earthquake, which was
basically 0.3 g for the eastern U.S. These plants had
to do a detailed relay chatter evaluation, soil
failure evaluation, and, of course, perform a walkdown
-- a detailed seismic walkdown.
Most of the plants that did -- that were
binned into the focused scope seismic margin category,
here again, they had to evaluate their equipment
against a review level earthquake. The relay
evaluation was less rigorous in the sense that only
relays that had been identified previously under the
A-46 program as low ruggedness relays that were now in
the IPEEE scope but not in the A-46 scope had to be
examined.
And as far as the soil failures, these
plants originally were asked to do a soil failure
evaluation under Supplement 4. And so the ones that
did their margin analysis early on did so, but most of
the plants actually did not have to do a soil failure
evaluation because Supplement 5, which was issued in
the mid '90s, recognized the lower seismic hazard of
the revised Livermore studies and eliminated soil
failure evaluation from the scope of the focused scope
seismic margin analysis.
And then there was also reduced scope
seismic margin for those plants which were in very low
hazard areas. And here the plant basically did not
have to evaluate against the review level earthquake,
the 0.3 g earthquake, but basically had to evaluate
against their design basis, their safe shutdown
earthquake. So the safe shutdown earthquake became
the review level earthquake in that sense.
And, of course, the plants in the western
U.S. either had to do a seismic PRA, or the 1407 also
let them do a 0.5 g review level earthquake margin
analysis.
CHAIRMAN APOSTOLAKIS: You said that some
were EPRI proposed and some NRC. From these, your
scope of what -- which one is EPRI?
MR. LEHNER: Either one. You could use
either methodology --
CHAIRMAN APOSTOLAKIS: To do any of these.
MR. LEHNER: -- to do any of these.
CHAIRMAN APOSTOLAKIS: Okay.
MR. LEHNER: Yes. As I said, only two
plants use the NRC margin analysis. But the scope
here could be accomplished using either one.
This next slide shows how NUREG-1407
binned the plants and what they actually did. in
other words, on the left-hand side here, there were 10
plants that were binned in the reduced scope category,
49 in the focused scope, eight in the full scope, and
four that had to do seismic PRAs.
As it turned out, many more plants did
seismic PRAs. A lot of the focused scope plants did
seismic PRAs, so we wound up with a total of 27
seismic PRAs out of the 71 submittals. One plant did
actually both analyses, did both a margin analysis as
well as a seismic PRA analysis.
A number of plants -- as you can see here,
the shaded area sort of indicates the minimum. If
they're in the shaded area they did something less
than what was specified in 1407, and there were a few
plants that in the reduced scope category sort of did
a plant-specific analysis which was a variation on
reduced scope.
And in the focused scope category there
were a number of plants that felt that the Supplement
5 allowed them to actually do a reduced scope. And in
those cases while the submittal was, let's say, less
than adequate to --
CHAIRMAN APOSTOLAKIS: John, let me ask
you something --
MR. LEHNER: Yes.
CHAIRMAN APOSTOLAKIS: -- because I don't
quite follow. I look at the last column.
MR. LEHNER: Right.
CHAIRMAN APOSTOLAKIS: SPRA. And it says
-- it has four numbers -- 1, 18, 4, and 4. The total
is 27.
MR. LEHNER: Right.
CHAIRMAN APOSTOLAKIS: What does that
mean?
MR. LEHNER: Okay. If you look at --
let's look at the second row, focused scope.
CHAIRMAN APOSTOLAKIS: Okay.
MR. LEHNER: Forty-nine plants were binned
into the focused scope bin in 1407. So those 49
plants could have done a focused scope margin analysis
and satisfied the requirements. It turns out that, of
those 49, 29 actually did a focused scope, 18 did a
PRA, and three did a reduced scope.
CHAIRMAN APOSTOLAKIS: But why, then, did
they end up in the focused scope bin if they did the
reduced scope?
MR. LEHNER: Well, that's what I was just
explaining, that they -- I mean, the bins were set up
ahead of the IPEEE process. The bins were the minimum
requirements the plants had to fulfill in order to
meet the intent of the IPEEE.
Most plants either chose to fulfill those
minimum requirements or did more, like those 18 plants
that did the PRA actually did more than they were
required. In a few cases, plants did less than they
were required, and those are the ones in the shaded
area.
CHAIRMAN APOSTOLAKIS: And they still
claim they did a focused scope?
MR. LEHNER: Well, they claimed that
Supplement 5 gave them relief from focused scope and
they could do a reduced scope, which was a
questionable interpretation.
CHAIRMAN APOSTOLAKIS: Well, then, how did
you decide to put a unit in the reduced scope bin or
the focused scope bin? That --
MR. LEHNER: Oh. Because when they
presented their submittals, their submittals --
CHAIRMAN APOSTOLAKIS: So they declared
it.
MR. LEHNER: They declared themselves.
CHAIRMAN APOSTOLAKIS: Oh, I see.
MR. LEHNER: Yes, they declared
themselves. They stated how they met the IPEEE.
CHAIRMAN APOSTOLAKIS: So 49 licensees
declared they were doing the focused scope.
MR. LEHNER: No. Forty-nine licensees --
the guidance by the NRC said you 49 licensees have to
do at least a focused scope.
CHAIRMAN APOSTOLAKIS: Hmmm?
MR. LEHNER: The left-hand column is the
guidance by the NRC in NUREG-1407. It said you 49
licensees have to do at least --
CHAIRMAN APOSTOLAKIS: So you told them
what to do.
MR. LEHNER: Yes.
MEMBER SHACK: Set a minimum.
MR. LEHNER: A minimum standard.
CHAIRMAN APOSTOLAKIS: For those 49.
MR. LEHNER: Yes. That was the minimum
standard for those 49 plants.
CHAIRMAN APOSTOLAKIS: So you --
MEMBER SHACK: And then you guys went
further.
MR. LEHNER: Right.
CHAIRMAN APOSTOLAKIS: So you told four
licensees to do a seismic PRA.
MR. LEHNER: Yes.
CHAIRMAN APOSTOLAKIS: But, in fact, 27 of
them did it.
MR. LEHNER: Right. Exactly. So, you
see, it actually is -- it's actually a little bit --
I mean, if everybody did the minimum you'd only have
four seismic PRAs out there.
CHAIRMAN APOSTOLAKIS: Anyway, I -- okay.
But did you see a clear difference between the
conclusions and insights that a seismic PRA offered
versus one that is a reduced scope? I mean, is it
clear that the licensee who did the seismic PRA
benefitted more?
MR. LEHNER: Oh, yes, I think so. I mean,
the seismic PRA would give you, you know, dominant
contributors. A reduced scope basically -- you know,
a reduced scope, the licensee did not even have to
calculate a HCLPF for the plant. They basically just
had to see that they met the review level earthquake.
And the justification was that these were plants in a
very low seismic hazard area.
CHAIRMAN APOSTOLAKIS: I'm sorry. Go
ahead.
MR. LEHNER: Sure. I was saying that
there is definitely, you know, greater benefit to the
seismic PRA because the PRA gave the licensees better
insights as to not just the core damage frequency but
also the dominant contributors during a seismic event
to core damage, whereas a reduced scope basically only
told them that their equipment was adequate for the
design basis earthquake.
CHAIRMAN APOSTOLAKIS: Okay. You have a
total of 21 viewgraphs and you are just completing
number 7, which is one-third. And you have been
talking for an hour.
(Laughter.)
MR. LEHNER: I'll try to speed it up here.
(Laughter.)
All right. In the seismic area, nobody
really -- well, I shouldn't say nobody. The
vulnerabilities -- it was left to the plant to define
what constituted a vulnerability, and definitions
varied quite a bit. Many plants -- most of them that
did margin analysis did not define vulnerability but
said they had none anyway. And a lot of plants
avoided the term altogether.
In some cases, in the seismic area where
they did identify vulnerabilities, the kinds of things
that they identified were similar to what other plants
called outliers or open issues or anomalies. So, you
know, the bottom line is that the -- where
vulnerabilities were identified they were -- it would
be unfair to characterize those plants any differently
than the ones that did not identify vulnerabilities.
Now, by the way, I think one reason that
no serious vulnerabilities were identified was because
of the fact of some of these other previous seismic
programs, like A-46, where a lot of inadequacies have
been addressed already and fixed. Be that as it may,
even though very few licensees identified
vulnerabilities, almost all licensees made some kind
of fixes that related to outliers or open issues that
they identified during their assessment.
And so a lot of improvements were made in
the seismic area in response to their analysis. And
this list -- some of those examples, they are
basically improvements in the hardware area, in
maintenance, housekeeping issues, or in procedures and
training. Overall, 70 percent of the plants made some
sort of improvements in response to their seismic
analysis.
And you can see here the number of plants
that reported this type of improvement. For those
plants that had no IPEEE-related improvements, about
half of them had already made improvements under the
A-46 program and felt there were no further fixes
needed under IPEEE. And then, you know, about 10
plants said that -- mainly the newer plants said that
there were no additional fixes that they had to make.
MEMBER UHRIG: On the hardware, there were
sort of three generations of seismic hardware over the
years. Was this additional hardware coming in, or was
it replacement with the more sophisticated hardware?
MR. LEHNER: I think in some cases it was
replacement. For instance, in the relay area it made
some replacements. But additional -- but mainly it
was -- as indicated there, you know, strengthening
anchorages, bolting things down, bolting things
together, eliminating spatial interaction problems
where one component -- a non-safety-related component
could fail and fall onto a safety-related component,
that sort of thing.
So it was not a large exchange of
equipment. As a matter of fact, most of these
improvements were low-cost improvements, you know, in
spirit with the Generic Letter, really. They were
low-cost improvements, but significant improvements,
effective improvements.
MEMBER KRESS: How did they reinforce
masonry walls?
MR. LEHNER: How did they reinforce
masonry walls?
MEMBER POWERS: Steel and wire. That's
the most common way to reinforce it.
MEMBER KRESS: Just build a frame in front
-- on each side of it?
MEMBER POWERS: All the way around it.
MR. LEHNER: At least to -- yes, to
prevent it from falling onto -- I mean, the masonry
walls issue, again, was only an issue if the masonry
wall would --
MEMBER KRESS: If it falls onto something.
MR. LEHNER: -- fall onto some vital piece
of equipment. So if you could protect it --
MEMBER KRESS: I would almost think you'd
have to have a framework to do it, rather than just --
MEMBER POWERS: Well, usually just some
bars across it. Or weaken it on the other side, so it
would fall in the other direction.
(Laughter.)
MR. LEHNER: All right. Let me quickly go
through these elements that were common to all of the
seismic IPEEEs. Screening was done both in the PRA
area and in the seismic margin area.
The screening level -- for those people
that did margin analysis, they basically used the
review level earthquake, g level, as the screening
level, and used the EPRI NP-6041 guidance. There are
tables in there that allow you to screen out
components based on past experience.
In the PRAs, they also screened out in
some cases based on the review level earthquake; in
other cases, higher screening levels. And, in
general, in many PRAs they screened out the majority
of components. Obviously, that would reduce the
amount of analysis that had to be done.
The walkdowns were really I think one of
the most important benefits of the IPEEE program,
especially for those plants that did a reduced scope
analysis. It was really a walkdown that was the
essential outcome of the IPEEE, where they looked at
their SSCs, looked at capacity versus demand, and
looked for outliers, and quite a few outliers were
identified.
They checked anchorages, looked at spatial
interaction concerns, identified those, and there were
many -- I think most of the insights that the
licensees gained came out of the walkdown process.
I'll talk about the dominant contributors
and weak links a little later on. For relay
evaluation, because the relays had been evaluated so
thoroughly in the A-46 program, there were a few
significant low ruggedness relays that were identified
solely as a result of the IPEEE program.
The IPEEE program scope was a little bit
bigger than the A-46 program, so there were more
relays included under its scope. But those relays
that were identified as low ruggedness usually proved
to be not important for the safe shutdown of the
plant.
MEMBER POWERS: I will say that in the
documentation on this, where you discussed this is
extremely confusing. What you've written up here is
very clear.
MR. LEHNER: Okay.
MEMBER POWERS: You might want to change
that language, because it took me forever to sort out
what you actually meant by the words in here. That
sentence is much better than the -- what you say --
things like chatter or vulnerable relays in selected
success path circuitry that related only to the IPEEE
did not have adverse consequences. And that made no
sense to me. If it was a success path, it had to have
adverse consequences. Now I think I understand better
what you were saying.
MR. LEHNER: Yes. I understand what
you're saying, but the key phrase there is "related
only to the IPEEE."
MEMBER POWERS: Yes. That clause you say
has already been fixed --
MR. LEHNER: Okay.
MEMBER POWERS: -- is what you need in
there.
MR. LEHNER: Right, right. Exactly.
Soil evaluation -- as I indicated before,
those sites that were located on -- those plants that
were located on soil sites did soil analyses for
liquefaction and slope instability. They looked at
stresses in buried piping. And as we discussed
earlier, there is no general consensus on the best
approach to look at liquefaction-induced soil
displacement.
But some sites had identified this as a --
as -- actually, they identified it in their screening
analyses -- or I should say in their first analyses,
those sites that identified soil problems usually went
back and took a closer look and managed to allay some
of the concerns with their soil failure.
As far as non-seismic failures in human
actions, in the PRAs these were, of course, included
in the event trees and fault trees, because most
licensees that used seismic PRAs adopted their
internal events -- event trees and fault trees, and so
they had human actions and non-seismic failures
included.
And for the human actions they used a wide
variety of approaches to account for seismic stress.
Usually they had a multiplier on the human failure
rates that they used in their internal events, and
then had some g-level beyond which the action was no
longer considered credible.
MEMBER POWERS: I mean, it seems plausible
what they did, but how do you -- how do you have any
confidence that the multiplier or the scaling factor
that you've used has any bearing on reality?
MR. LEHNER: Well, that's a difficult
question. I mean, you know, it's hard to run a
simulation of a seismic event.
MEMBER POWERS: Well, actually, it's
probably pretty easy. We just don't do it.
MR. LEHNER: I think if you get the right
stress levels, it's --
CHAIRMAN APOSTOLAKIS: That's a very
important point. In fact, on page 225, the report
says that no strong technical basis was provided for
the values chosen, which is an accurate statement.
But what is disturbing a little bit is that it was not
identified -- this issue of human error probabilities
was not identified anywhere else in the report as a
weakness of the methodology and as something that
something needs to be done about.
I think the guys who wrote 264, Seismic
Evaluation Methods and Strengths and Weaknesses, were
seismic people. And they have no appreciation of the
human error stuff; that's for somebody else. Yet we
are talking about seismic PRAs here, so the whole
thing is one thing. So to -- and the same thing
applies to fires, by the way.
But to say this -- that somebody says --
and I multiplied by five because, you know, there were
bad conditions, and everybody says okay, that doesn't
make sense to me at all. And then --
MEMBER POWERS: Well, we accepted an STP
for doing sensitivity studies.
CHAIRMAN APOSTOLAKIS: That's not the same
thing.
(Laughter.)
But then what's even more perplexing is if
you go to page 529, which deals with -- now you're
going to tell me somebody else is going to do that,
but this is for that somebody else -- IPEEE-related
aspects of common cause failures related to human
errors.
Okay. All of the 69 IPEEE submittals,
which excludes Haddam Neck, provided some treatment or
discussion of non-seismic failures and human actions.
Of the 69 submittals, 61 provided adequate information
to resolve this issue -- this issue being part of
Generic Safety Issue 172.
Two provided adequate information to
partially resolve this issue, and six did not provide
adequate information. And so what I would like to see
is the details from one of the 61 submittals that
provided adequate information using these non-sensical
multipliers and to resolve a generic safety issue.
How can that be?
On the one hand, we say that there is no
strong basis for these numbers. And then we say 61 of
69 provided adequate information to resolve this
issue. So maybe someone who will address the issue of
the generic safety issue later will explain this? I'd
like to see the details. I'm not really objecting to
this. It's just that it sounds like it's inconsistent
with the technical evaluation that went on before.
And, you know, if you look at -- I guess
common cause failure and human error, if you look at
page 525 where there's a figure, it's clear that
common cause failure is an important element. So how
did these 61 guys manage to resolve the generic safety
issue when the technical basis is not strong?
John, you can go on. Obviously, you're
not going to -- you are not the one to answer the
question.
But I -- you know, this is another case,
like the one we were discussing earlier regarding
total CDF. We say that human error is important; the
agency should do something about it. And then people
do these funny things, and we don't raise hell. And
we just accept it, and, you know, well, what can you
do? I mean --
MR. RUBIN: Can I --
CHAIRMAN APOSTOLAKIS: Yes.
MR. RUBIN: May I add a couple of points?
In many of the seismic submittals in particular, in
terms of human failure, human actions, the seismic
event was over quickly, and the procedures that the
licensees had in place were for operators in the
control room, for the large part.
There were instances -- I can think of an
example where a licensee was -- and we questioned this
-- the licensee was going to take credit in a seismic
fire interaction for going down into the plant and
shutting a valve for hydrogen in the line for a
seismic event. And we said, "Wait a minute. How can
they take credit for that?" And we pursued that
further.
But for the large part, many of the
actions were in the control room. They're not remote.
The seismic event is over relatively quickly.
CHAIRMAN APOSTOLAKIS: But I --
MR. RUBIN: We need to clarify the report,
I think.
CHAIRMAN APOSTOLAKIS: But I still would
like to see one or two representative cases from the
61 licensees.
MR. RUBIN: We'll try to get you some this
afternoon.
CHAIRMAN APOSTOLAKIS: That would be more
convincing, I think. That would be an uncertainty
analysis, sensitivity analysis. But perhaps the
people who write the conclusions on seismic and fire
should not be seismic and fire experts, because they
have no appreciation for everything else.
Okay. You can't say in one place the
numbers are arbitrary, and then when it comes to the
conclusions you don't even mention it. I mean, I --
it seems to me based on what I read here, not on what
Alan said, there is very strong evidence in this
report that we really don't know how to quantify human
error -- period -- under these conditions. And we
should say that.
Now, that doesn't necessarily mean that
the IPEEEs are useless, because, you know, there may
be situations like Alan just described one or two
where, you know, that may not be the driving force.
But it should be emphasized, because it -- this -- you
know, anyway, I said enough.
MR. LEHNER: I think maybe what you're
saying, it should be one of the items that's mentioned
under some of the methodological issues.
CHAIRMAN APOSTOLAKIS: Yes. If some of
the dominant sequences involve human error, yes, it
should be. Even though it is not something that a
fragility expert will do --
MR. LEHNER: Makes sense, yes.
CHAIRMAN APOSTOLAKIS: -- it's part of the
methodology.
MR. LEHNER: Well, in the --
CHAIRMAN APOSTOLAKIS: When do you think
it's a good place to stop? I don't want you to be
there for two hours -- if we're going to take a break.
I mean, in terms of your presentation. Don't ask
other people.
MR. LEHNER: Well, let's see. Well,
actually, maybe after these -- maybe after these
common elements would probably be --
CHAIRMAN APOSTOLAKIS: Okay. So the next
one is SPRA results.
MR. LEHNER: Right.
CHAIRMAN APOSTOLAKIS: Okay. Fine.
MR. LEHNER: Now, just to mention
regarding non-seismic failures and human actions, in
the margin assessments, these were usually only
qualitatively -- well, not usually, they were only
qualitatively discussed. And sometimes we had to
specifically ask in our RAIs about the human actions.
And the licensee basically then explained
that -- about the location and timing of the human
actions that were involved in the success paths, and
those explanations were usually convincing that they
had chosen success paths where human actions were well
understood and were in the control room. And so I
think this reinforces what Alan said earlier.
So in that sense, you know, the
explanations in many cases that they furnished for the
human actions involved in the success paths were
reasonable.
Regarding seismic fire and seismic floods,
seismic-induced fires were -- the submittals indicated
that the licensees had looked at seismically-initiated
fires. They also looked at seismic actuation of the
fire suppression system or a degradation of the fire
suppression system from seismic events.
And a number of licensees had found some
outliers in this area, and they felt that some of
their significant plant improvements were revealed by
looking at these issues. These were things like
looking at hydrogen lines.
You know, they first looked at fire
sources and then looked at the vulnerability of those
sources, like oil tanks or hydrogen lines and how
vulnerable these were and some of the improvements
they made was to put added restraints on these things
and furnish protection from having these items
initiate fires due to the seismic event.
And, again, these came out of the
walkdowns where, you know, they looked at these plant
areas where there were fire sources and how vulnerable
they were, and that was one of the big benefits from
the walkdowns.
There were a few PRAs that actually looked
at the seismic-induced fires and seismic-induced
floods in their actual accident sequences, but most of
them were addressed as minor walkdowns.
Regarding containment performance, most of
the assessments only looked qualitatively at
containment, looking at containment integrity,
isolation, bypass. I mean, the guidance in NUREG-1407
was that they should look for containment failure
modes, you know, unique to a seismic event that they
would -- that would be different from things that they
identified in the internal events PRA.
And there were a few seismic PRAs that
actually did a Level 2, and, as indicated there, there
were some -- the LERF frequencies identified in those
PRAs varied from 10-7 to 1.6 10-5 per year.
And, finally, all of the IPEs, as required
by NUREG-1407, conducted an independent peer review to
ensure the overall quality of the submittal, and they
listed the review members. And some of them even
listed the questions that the review members had asked
and their replies to those questions.
If there are no questions, I --
CHAIRMAN APOSTOLAKIS: Any questions from
the members?
VICE CHAIRMAN BONACA: I just had a
question about seismic fire and seismic flood. The
text specifically states that a few of the evaluations
included those kinds of consequences -- fire and
flood. Most of them did not.
MR. LEHNER: The PRAs.
VICE CHAIRMAN BONACA: Yes, the PRAs.
Yes. In the PRAs that considered those, did they find
those issues to be significant in risk?
MR. LEHNER: I don't think they showed up
as dominant contributors.
VICE CHAIRMAN BONACA: Okay.
MR. LEHNER: I do not believe so. No, I
don't believe so.
VICE CHAIRMAN BONACA: Okay. Thank you.
MEMBER SHACK: Typically, who was on these
independent review -- peer review panels? I mean,
other utilities, consultants, internal or --
MR. LEHNER: Usually, there were some
outside consultants, plus some internal staff members
who were not involved in the actual IPEEE.
MEMBER SHACK: But in all cases there
would be somebody from outside, then.
MR. LEHNER: Yes. Yes.
CHAIRMAN APOSTOLAKIS: Any other comments?
Okay. According to the schedule, we'll
reconvene at 10:45.
(Whereupon, the proceedings in the
foregoing matter went off the record at
10:24 a.m. and went back on the record at
10:45 a.m.)
CHAIRMAN APOSTOLAKIS: Ready to start
again, John?
MR. LEHNER: Yes. Turning now to the
quantitative results from some of the seismic PRAs
that were carried out, this viewgraph shows a
histogram of the various CDFs.
Now, as indicated there in the
parentheses, what's plotted here is the CDF values
that were obtained with both the EPRI and the
Livermore hazard data. In other words, many plants
appear twice on this histogram. One was their EPRI
CDF and one was their CDF based on the Livermore
hazard data.
And, I mean, in general you can see that
most of the CDFs fall between 10-6 and 10-4, kind of
the range that previous seismic PRAs have shown.
Those three data points in the 10-4 to 10-3 range, two
of those points are the Haddam Neck plant that, as we
talked about earlier, has been shut down. And one of
them is the Seabrook CDF with the Livermore hazard
curve. But with the EPRI hazard curve it's -- the
Seabrook plant is in the 10-5 range.
This next viewgraph just indicates the
comparison of the CDF based on EPRI versus Livermore
for those plants that used both hazard analyses. And
you can see that the difference, except for that one
point which happens to be Seabrook where there is an
order of magnitude difference in their CDF, the --
CHAIRMAN APOSTOLAKIS: I don't understand
the figure. Can you make it horizontal? So what are
we looking at their? Seismic CDF-based --
MR. LEHNER: We're plotting here --
CHAIRMAN APOSTOLAKIS: Maybe you can use
the mobile microphone.
MEMBER POWERS: I mean, you do have it in
your viewgraph.
CHAIRMAN APOSTOLAKIS: Yes. But he wants
to stand up and discuss it. I mean, if he wants to.
MEMBER POWERS: Well, I mean, it's one CDF
quantity as to another CDF. You compute the CDF with
the one hazard curve, and then you compute it with the
other, and you plot them one to one.
CHAIRMAN APOSTOLAKIS: I knew there was
something simple about it.
(Laughter.)
And then the point tells us what? I mean,
the 45-degree line, it means that --
MR. LEHNER: Well, if they were exactly
equal they would all fall on the 45-degree line,
right? So this shows you the difference that the
different hazard curves made. I mean, if we take any
one point here, this is the value of the CDF that was
based on the Livermore curve. And this is the value
of the CDF based on the EPRI hazard results.
CHAIRMAN APOSTOLAKIS: Right.
MR. LEHNER: So as I said, if they were
all -- if the results were all perfectly equal there,
they would be along this line. As you can see, this
is sort of the linear regression line through the
results that there -- in most cases there was not a
significant difference.
The one outlier at this point, which is
the Seabrook -- the one plant here, I mean, here
Seabrook has a 10-3 -- well, greater than 10-4 CDF
based on the Livermore curves, but a 10-5 CDF based on
the EPRI curves.
CHAIRMAN APOSTOLAKIS: So these are based
on mean curves, right?
MR. LEHNER: These are based on mean
hazards.
CHAIRMAN APOSTOLAKIS: All of them are on
the mean curves.
MR. LEHNER: Yes. Yes.
CHAIRMAN APOSTOLAKIS: So, then, if we use
uncertainty we might see a greater dispersion.
MR. LEHNER: Certainly, yes.
MEMBER POWERS: What do you mean a greater
dispersion?
MR. LEHNER: I mean, I don't --
MEMBER POWERS: There's no difference.
CHAIRMAN APOSTOLAKIS: What?
MEMBER POWERS: What you would find is
there's no difference if you put the uncertainties --
CHAIRMAN APOSTOLAKIS: I don't think so.
No difference?
MEMBER POWERS: Yes, you would -- because
there's uncertainty in the seismic CDF on both the
horizontal and the vertical axes, the dots would be
huge and --
CHAIRMAN APOSTOLAKIS: 95th percentile for
Livermore is higher than for EPRI. So I should see
some difference.
MEMBER POWERS: It would be
indistinguishable relative to --
CHAIRMAN APOSTOLAKIS: It depends on what
I choose to plot. It depends on what I choose to
plot.
MR. LEHNER: Yes. I was going to say it
would depend on what you choose to plot.
CHAIRMAN APOSTOLAKIS: Of course it would.
MEMBER SHACK: But is this arising because
as you go to the lower frequency level the EPRI curve
is going a little bit -- I mean, you know, you get a
factor of three at the low --
MEMBER POWERS: I think it's totally a
statistical sampling.
MR. LEHNER: I mean, there's a comment --
MEMBER POWERS: If you calculated the
uncertainty in that slope, recognizing the uncertainty
in the values of the points, I guarantee you you would
find no way to distinguish that from a 45-degree line.
CHAIRMAN APOSTOLAKIS: So it will be a
scatter plot.
MEMBER SHACK: So there's a shift in the
mean curve if you --
MEMBER POWERS: You might --
MEMBER SHACK: -- use a lower frequency.
That's where --
MEMBER POWERS: Well, I think that's what
they derive out of it, but I don't think it's a
meaningful shift.
MR. LEHNER: There's been some speculation
that the -- even though the curves are different that
the slopes of the hazard curves in those areas that --
that control the -- you know, the seismic response are
not that different. That's one assumption.
MEMBER POWERS: The other thing I will
hasten to point out is the regression line is also
incorrectly calculated, because it assumes that the
horizontal axis is totally certain.
MR. LEHNER: It's only there as sort of a
guide to --
(Laughter.)
CHAIRMAN APOSTOLAKIS: Now, why did, then,
two of the dots there are below the 45-degree line?
MR. LEHNER: Oh. That just means that it
turned out that their EPRI CDF was bigger than their
Livermore CDF.
CHAIRMAN APOSTOLAKIS: Yes. The question
is: why?
MR. LEHNER: Oh. Why?
MEMBER POWERS: It can happen in any
western state in the calculation.
CHAIRMAN APOSTOLAKIS: The widespread
belief is that if you use the EPRI curves you get
lower numbers.
MEMBER POWERS: It's eastern seismicity.
CHAIRMAN APOSTOLAKIS: And for the west
it's the reverse?
MEMBER POWERS: It's not the reverse.
They are almost identical.
CHAIRMAN APOSTOLAKIS: So why are both the
dots below the line, then? One should be above.
MEMBER POWERS: George, they're below the
line by the width of a dot.
CHAIRMAN APOSTOLAKIS: So what does that
tell us, then? That for the eastern United States
Livermore is more conservative, right?
MR. LEHNER: Well, I think the -- the
conclusion that we'd like to draw is that it doesn't
make much difference which hazard curve you use.
CHAIRMAN APOSTOLAKIS: It doesn't make
much difference.
MR. LEHNER: As far as your CDF is
concerned. And it turned out that it didn't make much
difference as far as the dominant contributors either.
In other words, the ranking of the dominant
contributors didn't change --
CHAIRMAN APOSTOLAKIS: But wait a minute.
Why doesn't it make much difference? Look at the
points on the left there.
MEMBER SHACK: Yes. But if you're at
10-6, do you really care whether you're up or down a
little bit?
MR. LEHNER: Yes. I mean, let me -- maybe
another way to illustrate this --
MEMBER SHACK: Where the action is they
come together on the 45-degree line.
MR. LEHNER: There's a different way of
looking at it. There's a figure out of the text. I
mean, this basically compares, you know, Livermore's
CDF versus EPRI's CDF.
CHAIRMAN APOSTOLAKIS: So this is the
revised Livermore now, right?
MR. LEHNER: Revised Livermore, yes. Yes,
revised Livermore.
MEMBER KRESS: And 14 and 15 are the two
that are below the --
MR. LEHNER: Right.
CHAIRMAN APOSTOLAKIS: And you're sure
these are western plants? 14 and 15?
MR. LEHNER: No. These are -- no, because
we want some plants who use site-specific spectra.
CHAIRMAN APOSTOLAKIS: Okay. So it
happened, then, for the eastern United States, which
is an eastern -- maybe you have very strong values
for --
MR. LEHNER: Well, I guess it depends on
where their seismic response is. If you'd like I can
look up what plants those are.
MEMBER KRESS: I was wondering whether it
had anything to do with the uniform spectrum that --
which gets kind of -- it gets convoluted with this.
MR. LEHNER: Well, yes. Pilgrim and
Oyster Creek.
CHAIRMAN APOSTOLAKIS: Oh, okay. So they
are both eastern United States.
MR. LEHNER: Yes.
CHAIRMAN APOSTOLAKIS: Maybe the reason
was that there were -- the analysts. Using EPRI and
Livermore doesn't mean that you are using a concrete
methodology. I mean, the analyst must play some --
MR. LEHNER: Oh, certainly.
MEMBER KRESS: You have to have success
criteria, and you have to have the fragility of these
things, and look at the response to different spectra.
And I don't know. You know --
MR. LEHNER: Yes. But, I mean, again --
MEMBER KRESS: -- a lot of reasons you
could end up --
CHAIRMAN APOSTOLAKIS: What's number nine?
MR. LEHNER: Number nine?
MEMBER SHACK: Seabrook.
MR. LEHNER: That's Seabrook. Yes, that's
Seabrook.
CHAIRMAN APOSTOLAKIS: Okay.
MEMBER KRESS: You know, that almost has
to be in response --
MR. LEHNER: Presumably, the analyst was
the same for both the EPRI and the Livermore analyses.
MR. RUBIN: John, the high one was Haddam
Neck.
CHAIRMAN APOSTOLAKIS: Nine was Haddam
Neck?
MR. LEHNER: No, nine was --
MEMBER SHACK: No, Seabrook.
MR. LEHNER: -- Seabrook.
MR. RUBIN: I think 15 is Haddam Neck.
Yes, that's Haddam Neck. It's the one with the EPRI
curve. The EPRI is higher than the Lawrence
Livermore.
MR. LEHNER: Yes, that's right. The
highest one is Haddam Neck, but there is two --
MEMBER SHACK: The second one I think is
Pilgrim.
MR. LEHNER: Yes, 11 and 14 -- 11 and 14
have the EPRI higher than the Livermore. Those are
Pilgrim and Oyster Creek.
CHAIRMAN APOSTOLAKIS: Bob, you have a
question?
MEMBER UHRIG: Well, just point out that
this is a logarithmic curve. And take number one
there, the difference looks very large, but it's
insignificant compared to something like, say, 13.
CHAIRMAN APOSTOLAKIS: The blue and the
red?
MEMBER UHRIG: Yes. You have to take that
logarithmic scale into account when you're looking at
those.
CHAIRMAN APOSTOLAKIS: But also now, since
you mentioned one, I look at one and I look at 14, 15,
or maybe nine, or the others, and there is a
difference in CDF that is two and a half to three
orders of magnitude. What are the two driving forces
behind this? Why such a wide variability? Is it the
design of the plants?
MEMBER POWERS: Where is this two and a
half orders of magnitude difference?
CHAIRMAN APOSTOLAKIS: Well, it's 10-7 in
one, two or three 10-7, and then the other one -- 15
is two or three --
MEMBER POWERS: Oh, you mean across the
spectrum.
CHAIRMAN APOSTOLAKIS: Yes. Yes. So what
is the driver? Is it the design, or is it the
analysis?
MR. LEHNER: Well, again, I think --
CHAIRMAN APOSTOLAKIS: Or where they are?
MR. LEHNER: I think it's a combination of
those things. I mean, certainly the design and the
location are going to play some role. I think these
are site-specific hazard curves. But the analysis as
well is going to -- you know, as we said before, the
variation in the analysis obviously I think plays a
role here, too.
VICE CHAIRMAN BONACA: Some of the older
plants like Haddam Neck had -- inside an auxiliary
building separated by walls, so there was very little
hiding certain components from system interactions.
And if you do an analysis, very vulnerable to that,
there isn't much you can do. And some of the very low
ones, of course, they were built and designed with
poor separation and different concrete walls and
structures that -- big difference comes from that, in
part.
MEMBER KRESS: When they use a seismic
hazards curve, do they have to estimate a distance
away from the fault line, to adjust the curve for
that?
MR. LEHNER: Well, I mean, they -- I think
they make a variety of assumptions to generate this
family of hazard curves, including, you know,
distance, attenuation, and then put certain weightings
and probabilities on that. And that's why if you want
to -- if you want to take the uncertainty into
account, you should really propagate that whole family
of hazard curves. But in this case it was a mean
curve developed from a family of curves.
Listed here are the dominant contributors
that were identified from the seismic PRAs. The first
column is the seismic failures, and the second column
are the random failures, and the third are the
operator action errors that were identified as
dominant contributors.
So, as you can see, a majority of the most
frequently observed dominant contributors under the
seismic failures had to do with electrical systems.
You can see also listed here is the surrogate element
which showed up in a few PRAs as one of the dominant
contributors. We're going to talk more about that a
little later on.
Some buildings also -- I mean, some
structures like block walls and turbine building,
auxiliary building, also showed up in the dominant
contributor column under the seismic failures.
In the random failure and operator action
area, the diesel generator random failure was, again,
prominent for both BWRs and PWRs. And the operator
action errors for PWRs aligning aux feed was an
operator action error that was high on the list.
For the BWRs it was mainly things related
to power recovery as far as operator errors go that
were identified as dominant contributors.
CHAIRMAN APOSTOLAKIS: "Random failures"
means they failed -- it was out of --
MR. LEHNER: Not due to seismic, not due
to seismic event itself.
So summary conclusions from the PRAs -- as
I noted earlier, the electrical system components were
the most frequent contributors. In about half the
occurrences those were listed as dominant
contributors. Building and structural failures were
significant, and then the rest was made up by
frontline and support systems and tanks.
And in about six to eight percent of the
major contributors listed, the surrogate element
played a role. And the licensees modeled -- usually
you screened out --
MEMBER SHACK: Well, that's a funny
number. Just, you know, it's seven out of 27 PRAs,
but then you look at the fraction of the whole
submittals. Why don't you just look at the fraction
of the PRAs in which it was the significant element?
MR. LEHNER: Yes. Yes. That's true.
MEMBER SHACK: It's a lot more than six
percent.
MR. LEHNER: Yes. Well, wait a minute.
No, I'm -- this is where -- no, I think it -- I think
the six percent is only for the PRAs. I mean, seven
out of the --
MEMBER SHACK: Twenty-seven PRAs had it as
a significant element.
MR. LEHNER: Okay. I'm sorry. Yes, I
guess that's right. Okay.
MEMBER SHACK: Well, at least that's what
the report says.
MR. LEHNER: Yes, that's right. No,
you're right. You're right, yes.
CHAIRMAN APOSTOLAKIS: So you did not
validate the results of the report. You just --
MR. LEHNER: Actually, you're right. I
was confusing it with something else.
Regarding a surrogate element -- and we
can talk about that more later, but I should mention
here that most plants that use a surrogate element
used a single surrogate element for all of the
screened out components.
But there were some that were -- did a
little bit more discriminating, where they used
several surrogate elements, like one for the -- all of
the components in the aux building, another one for
all of the components in the safe shutdown facility.
So that gave you a little bit better insight into
where the contributors lie.
We've already talked about the fact that
the EPRI and Livermore hazard curves did not
significantly alter CDF or the dominant contributors.
And in general, we make the statement in the report
that the CDF values did not necessarily trend upward
with plant age.
And, you know, we mentioned that I think
with some caveats that one could perhaps interpret
this as saying that the seismic programs that have
been implemented have helped to bring down the CDF of
older plants to a reasonable level.
MEMBER POWERS: One would say that if they
were at an unreasonable level prior to the imposition
of the programs.
MR. LEHNER: Yes.
MEMBER POWERS: Do you know that?
MR. LEHNER: We don't know that, no.
MEMBER POWERS: So the alternate
conclusion is that the programs have been useless.
MR. LEHNER: Well, you could take a
positive view.
(Laughter.)
MEMBER POWERS: You may want to look at
that language in the report, because you do this
several times --
MR. LEHNER: Yes.
MEMBER POWERS: -- when you're talking
about the SEP plants versus the more modern plants,
and you come to the conclusion that -- that activities
have made things better. There is -- the alternate
conclusion is still left open.
MR. LEHNER: Well, I mean, quite frankly,
we were struggling how to characterize that. And I'm
willing to listen to suggestions.
(Laughter.)
MEMBER POWERS: Okay.
MR. LEHNER: How to best state that.
All right. Turning to the margin
analysis, this is a histogram of the different HCLPF
ranges that were found in the margin analysis. And by
the way, the only reason there are three figures here
is just to distinguish the ranges a little bit better.
I mean, people only reported HCLPFs to one or two
places.
MEMBER SHACK: What was the cutoff at .3?
Why didn't you just let them report what they found?
MR. LEHNER: Well, the screening was done
at that level. In other words, the review level
earthquake was at .3 g, so they screen out anything
above that. So it would have taken a lot more effort
for them to not screen them.
But that's an important point in looking
at this HCLPF data because, as you said, if they could
-- if each plant would actually calculate a plant
HCLPF as high as possible, then you would probably see
a different trend than you do if you cut it off at the
.3 level.
VICE CHAIRMAN BONACA: You will probably
see a lower CDF -- lower CDF for more recent plants,
maybe more --
MR. LEHNER: A higher HCLPF for more
recent plants.
VICE CHAIRMAN BONACA: Yes.
MR. LEHNER: Yes.
MEMBER POWERS: Is there a database that
I can go to that says, "Okay. Here is the calculated
HCLPF, and here is the actual performance of the
device under various seismic loads or system or
structure"?
MR. LEHNER: Well, I mean, the tables in
EPRI 60-41 were based on that kind of a --
MEMBER POWERS: Yes. Okay. You're right.
You're right.
MR. LEHNER: I should also mention that
the HCLPF values shown here presume that the
improvements have been made. I didn't mention this
when we talked about improvements. But some of the
submittals were somewhat ambiguous as to when those
improvements would be in place. So the HCLPF values
reported here are --
CHAIRMAN APOSTOLAKIS: Let me understand
again what this means.
MR. LEHNER: Okay.
CHAIRMAN APOSTOLAKIS: If I take the
second column from the right, .25, .299 --
MR. LEHNER: Right.
CHAIRMAN APOSTOLAKIS: -- I guess it's
your left -- I see that 10 plants do what? That I
have high confidence? What? What's my confidence,
99 percent?
MR. LEHNER: No, no. Well, the HCLPF is
a 95 percent confidence at a five percent failure
probability.
CHAIRMAN APOSTOLAKIS: So I am 95 percent
confident that the probability of failure of those
plants --
MR. LEHNER: It's no greater than --
CHAIRMAN APOSTOLAKIS: -- is five percent.
MR. LEHNER: It's no greater than five
percent.
CHAIRMAN APOSTOLAKIS: It's no greater
than five percent.
MEMBER KRESS: If the earthquake g is no
bigger than that range.
CHAIRMAN APOSTOLAKIS: If the earthquake
is no bigger, or if they are designed against such an
acceleration?
MEMBER KRESS: Well, acceleration --
MR. LEHNER: It's that seismic demand
that's being put on the plant. In other words, if I
have a g level between -- these plants reported a
HCLPF that says that an earthquake -- well, let's take
the easiest case. The review level earthquake had a
g level of .3.
So those plants that have a HCLPF of .3 or
greater, they have a 95 percent confidence that their
success paths will be available to shut the plant down
safely at --
CHAIRMAN APOSTOLAKIS: Five percent of the
time.
MR. LEHNER: No, 95 percent of the time.
(Laughter.)
MEMBER KRESS: It's bad to have a low
HCLPF.
CHAIRMAN APOSTOLAKIS: So if my -- now,
review level, you said -- but what does that have to
do with the actual plant? The safe shutdown
earthquake?
MR. LEHNER: Well, the review level
earthquake is higher than the safe shutdown
earthquake. That's the whole idea of the IPEEE. In
other words, the safe shutdown earthquake is a design
basis earthquake. That's what the plants were
designed to.
So the review level earthquake was chosen
to see how much margin these plants have above their
design basis.
CHAIRMAN APOSTOLAKIS: It doesn't tell me
that. If my SSE is .2, how does that affect these
figures? My SSE is .2.
MR. LEHNER: Well --
CHAIRMAN APOSTOLAKIS: And I do a HCLPF
analysis with -- do I need the review level earthquake
for a HCLPF analysis?
MR. LEHNER: Yes.
CHAIRMAN APOSTOLAKIS: Okay. So I do it
for .3.
MR. LEHNER: Yes.
CHAIRMAN APOSTOLAKIS: So what does that
tell me?
MR. LEHNER: Well, it tells you what -- if
your HCLPF is .3, then you have a high confidence that
your plant will survive an earthquake that's, you
know, 50 percent higher than your safe shutdown
earthquake, if you have a safe shutdown.
CHAIRMAN APOSTOLAKIS: I don't know how
much margin I have. I just --
MEMBER SHACK: It's your next plot.
MR. LEHNER: Yes. I was going to say,
let's go to the next plot. I mean, this basically
shows you -- this plots the ratio of the plant HCLPF
to the SSE value versus the SSE g level.
And the dashed line is -- you know, is at
one. In other words, those plants have a HCLPF that's
just equal to their safe shutdown earthquake. And
both of those plants are -- I mean, in some cases,
these are plants that did reduced scope analyses. And
in some cases they did not report a HCLPF, so by
default we just gave them a HCLPF that was equal to
their safe shutdown earthquake.
The solid line is the highest HCLPF that
the plant could report because of what we talked about
a little while ago about the fact that the screening
level was at .3 g. So a plant can't report a HCLPF
above .3 g, because they've screened out the
components at the 3 g level, so they never evaluated
those components.
So you have to assume a .3 g limit. But
this shows you the margins, basically, that the plants
have above the safe shutdown earthquake based on this
HCLPF calculation.
CHAIRMAN APOSTOLAKIS: So give us an
example. Pick one.
MR. LEHNER: Well, I mean, if we -- if we
pick this plant here, it basically says that its HCLPF
value is twice the value of the safe shutdown of --
the design basis of the safe shutdown earthquake.
CHAIRMAN APOSTOLAKIS: That still doesn't
tell me what the probability of failure is, though.
It just tells me that the HCLPF value is --
MR. LEHNER: It doesn't -- well, I mean,
it says you have a high --
CHAIRMAN APOSTOLAKIS: In terms of g, in
other words.
MR. LEHNER: Yes. I mean, you have the
high confidence --
CHAIRMAN APOSTOLAKIS: I do, because I
already have high confidence for the review level. So
if you were down --
MR. LEHNER: Well, but this shows you
that, yes, you have --
CHAIRMAN APOSTOLAKIS: I don't multiply --
I don't divide the probability by two. Okay? I mean,
I just -- I can only say that I have high confidence.
MR. LEHNER: Yes. I mean, you can't get
a quantitative -- yes.
CHAIRMAN APOSTOLAKIS: How much I have I
don't know.
MR. LEHNER: Right. That's right. I
mean, it does not tell you a -- it doesn't give you a
probability.
CHAIRMAN APOSTOLAKIS: Right.
MR. LEHNER: The other issue on this plot
is that we distinguish between plants who, in their
analysis, use a new structural analysis or plants that
simply scaled up their analysis from their SSE,
because when plants use a new structural analysis they
-- by eliminating many of the conservatisms that they
used when they did the original design basis
calculations, the actually reduced their seismic
demand.
And, therefore, the HCLPFs that they
calculated would have been -- were different or higher
than if they had used a more conservative method. So
one has to distinguish between how to calculate it --
that HCLPF, and that's why you've got the triangles --
the solid triangles and the open squares.
Now, this is a list of the weak links that
were the outliers that were found in the SMA. So this
is not necessarily -- I mean, one can assume, as one
does with a PRA, that these are the dominant
contributors.
But, nevertheless, these are the -- in the
success path, when they calculated the capacities of
their SSCs and the success paths, these were the --
those SSCs and the success paths that had the lowest
capacity -- in other words, were the weak links in the
analyses.
CHAIRMAN APOSTOLAKIS: And the licensees
did something about it?
MR. LEHNER: Well, I mean, they -- in some
cases they did, and in some cases they didn't. I
mean, the -- getting a plant HCLPF that was lower than
the review level earthquake was not a problem as far
as the IPEEE guidance was. In other words, it was an
assessment of the plant's capacity. It does not mean
that every plant had to have a plant HCLPF above the
-- equal to or above the review level earthquake.
Certainly, if the HCLPF was below the
design basis, then the plants would fix things so that
their HCLPF at least came up to the design basis. But
there were plants that have HCLPF values that were
below the review level earthquake value.
CHAIRMAN APOSTOLAKIS: So that did
something about it. I mean, the numbers that you have
shown us so far reflect those changes.
MR. LEHNER: Yes. Yes. These numbers
reflect those changes, and, as a matter of fact, as I
said, the -- in some cases, the analysis was done by
the plants before they had actually implemented those
changes. So, you know, one of the follow-ups here
would be to make sure that those changes were actually
implemented.
MEMBER LEITCH: This does not list
directly loss of offsite power.
MR. LEHNER: Well, in the margin analysis,
loss of offsite power was assumed as being
unrecoverable. So they -- that was part of the
guideline of the margin analysis. They basically --
in a seismic margin analysis, you assume that you lost
offsite power and you are not going to recover it.
CHAIRMAN APOSTOLAKIS: I wonder about --
are they concerned at all about the human performance
to the margins calculations?
MR. LEHNER: Yes. They -- the success
paths that the licensees chose -- the guidance was
that they should choose success paths that did not
require, you know, extraordinary human performance,
and that the -- the actions that would be required
would be reasonable to carry out under seismic
conditions.
And as I mentioned before, the margin
analysis talked about this to some degree. In many
cases, they elaborated on it when we -- we asked them
RAIs in this area, because this was an area that often
was not discussed thoroughly in the submittals.
But in responses to RAIs, they talked
about the timing and location of these actions, and
provided some justification why these actions were
feasible under the conditions that they were taking
place. But that was the way they addressed the
actions.
I mean, generally, you can see that the
weak links that are listed here are similar to the
dominant contributors that were identified in the
seismic PRAs.
Now, I should also mention here -- we
talked earlier about a statement in the report that
talked about the success path, the way they were
developed in the margin analysis, and that some
licensees did not completely follow the guidance
provided in EPRI 60-41. And that refers mainly to the
fact that the success paths were supposed to be as
independent as possible, and some licensees described
success paths that used the same equipment for some of
the functions.
Basically, the success paths had to
identify ways of controlling reactor reactivity,
reactor pressure, reactor inventory, and decay heat
removal. And in some cases plants identified, as
redundant success paths, let's say, two different
trains of the same system.
So the diversity that you wanted was not
necessarily there. And the reasons for this in some
plants was simply because they didn't have seismically
qualified equipment to give you the diverse paths. In
other cases, it seemed to be a -- well, there was
perhaps a reluctance to go and do further analysis to
establish a completely different success path, if
you've had some seismically qualified equipment that
could accomplish the safe shutdown.
MEMBER LEITCH: In considering the time
for operator actions, do you know if they considered
time for diagnosis? It's not always apparent that
you've had a seismic event. I was telling some of the
guys at the break that I was in charge of a plant that
was in a fairly industrial area -- a fossil plant --
and we had an earthquake. And it must have -- I was
at home asleep at the time, and it woke me up and I
called the plant.
It must have taken us half an hour before
we figured out that we had an earthquake. I mean, we
were, first of all, looking around for what might have
exploded in the plant -- you know, things like aux
boilers, generators, thinking a hydrogen explosion.
Then we thought about, you know, some of the adjacent
refineries, did they have some kind of a problem or --
MR. LEHNER: Yes.
MEMBER LEITCH: You know, it took a little
while to say, "I don't know what else it was. It must
have been an earthquake." You know, but it took a
while to reach that conclusion.
MR. LEHNER: Well, I mean, the -- you
know, the need here is not necessarily to realize
you've got an earthquake, but to -- to respond to
whatever the problem in the plant is as far as getting
your safety systems in place.
But to answer your question, I think the
people that did PRAs usually adopted the human error
methodology that they used in the internal events.
And then, depending on the methodology they used, you
know, there was a diagnostic component. And then, for
their external events, they -- as we discussed
earlier, simply put multipliers on some of those
failure rates.
The margin analyses talked about time
available to do the action. They did not necessarily
talk about the different phases of the action, but
they certainly talked about the fact that they would
not credit actions that had to be done very quickly
under -- where you had to realize very quickly what
was wrong and take actions very quickly. So they did,
in general, use actions that you would have a lot of
time to implement.
MEMBER POWERS: I'm wondering with
symptoms-based procedures why the multiplier is
different from one.
CHAIRMAN APOSTOLAKIS: In what? Systems-
based procedures?
MEMBER POWERS: Symptom-based.
CHAIRMAN APOSTOLAKIS: Oh, symptom.
Symptom.
MEMBER POWERS: In symptom-based
procedures, why is the multiplier different than one?
MR. LEHNER: The control room ceiling is
falling down here.
MEMBER POWERS: Those are one-time events
and it's over with. I went through the San Fernando
Valley earthquake, and we had to respond to chemical
problems. And I don't think our response was any
different than if we would have done anything else.
MEMBER KRESS: Could it be, Dana, that
when you have an earthquake that you actually invoke
multiple sequences at the same time?
MEMBER POWERS: Well, if that's the
case --
MEMBER KRESS: And the symptoms are
confusing, then.
MEMBER POWERS: Well, I mean, if you have
a multiple -- if you have multiple events going on in
a control room at a time, when you do the human
reliability analysis you take that sort of thing into
account -- or should. And maybe -- or maybe it's just
more ordinary -- that's more ordinary in an earthquake
event. I don't know.
MEMBER KRESS: Yes, that would have been
my guess.
MEMBER POWERS: The fraction level was
high.
CHAIRMAN APOSTOLAKIS: The story Graham
tells is that they may not even realize it's an
earthquake.
MEMBER KRESS: Well, I sort of liked your
thing, too. You don't care. You just look at what is
going on in the plant, and that's what the symptoms-
based do. But I suspect if the earthquake is big
enough to give you substantial contribution to the
CDF, you probably have a lot of things going on, and
that's where the operator confusion might go in, and
induced LOCA and induced loss of offsite power at the
same time, that sort of thing -- going on
simultaneously it seems to me like.
MR. LEHNER: I think the multiplier
perhaps is a crude way of compensating for that sort
of --
MEMBER KRESS: Yes.
CHAIRMAN APOSTOLAKIS: It multiplies a
number that's --
MEMBER KRESS: It's crude. If you
multiply a crude number by a crude number, you get a
really crude number.
MEMBER POWERS: Well, I'm still perplexed
how they picked the multiplier.
CHAIRMAN APOSTOLAKIS: It's an engineering
judgment.
MEMBER KRESS: Yes, that's perplexing.
MEMBER POWERS: I don't even know how they
have any judgment in this matter. Probably it's one
of those things that I can undoubtedly derive from the
superior work being done at the Haldrin program.
MEMBER KRESS: I'll tell you how it's
derived. You know it's bigger than one. Ten is too
big. So what do you do? You choose five.
CHAIRMAN APOSTOLAKIS: Actually, in Japan
I believe they did experiments where they put the --
MEMBER POWERS: I mean, that's not --
CHAIRMAN APOSTOLAKIS: But I don't know
what that means. I mean, this is almost like what is
indicated -- proposed about the gas reactor.
MEMBER POWERS: I mean, if you're going to
-- you have to remind yourself that an earthquake
occurs, and it's usually a substantial amount of time
-- hours -- before the next aftershock comes. Okay?
During that period, my experience with the earthquake,
actually things are kind of quiet and calm, because,
you know, traffic and what-not.
MEMBER KRESS: Best time of the day, isn't
it?
MEMBER POWERS: All the fans --
(Laughter.)
-- and things like that. All you hear is
the blowing of the wind through the broken-out
windows.
MR. LEHNER: So turning to some insights
on the margin analyses, again, the electrical system
components were often the governing outliers.
Building and structural failures, especially block
walls, were significant as far as weak links go. And
then balance of the weak links went along the
frontline support systems.
As that figure previously showed, the
seismic margins in terms of the HCLPF being above the
design basis earthquake do vary significantly among
the plants. And similar to the PRAs there was no
observable correlation between the HCLPF values that
were calculated for the plant and the plant age.
But, again, as we talked earlier, that
statement has to be qualified with the fact that you
couldn't calculate HCLPFs higher than .3 g based on
the screening methodologies used.
And, finally, it's important to note that
with the improvements taken into account there were no
plants that had HCLPF values below their safe shutdown
earthquake value.
MEMBER KRESS: Okay. Is that true for the
plant on your slide four slides back that had a HCLPF
value in the range of .1 to .15?
MR. LEHNER: Yes. Matter of fact --
MEMBER KRESS: That was this safe
shutdown?
MR. LEHNER: That plant -- as a matter of
fact, I believe that's Quad Cities. That plant
originally had a HCLPF of .09, but they committed to
making some improvements that got it into their view
range.
MEMBER UHRIG: One question on the
electrical system components here. Was this mostly
failure of the components? Was this the wires being
disconnected?
MR. LEHNER: Well, some of it was relay
chatter.
MEMBER UHRIG: Relay chatter.
MR. LEHNER: Yes. But some of it was, you
know, diesel generator.
MEMBER POWERS: I thought you told us that
was all fixed.
MR. LEHNER: Well, but some of the weak
links were still those relays.
MEMBER POWERS: This will all be solved
when we go to digital systems, by the way.
(Laughter.)
MR. LEHNER: All right. The
methodological issues -- I think we talked about most
of these, actually all of these I guess. We've talked
about the fact -- you know, from hazardous spectrum,
some of the comments in the reports state that there
-- it's uncharacteristic as compared to conventional
spectrum shapes, and use led to a reduction in seismic
demand.
Use of surrogate elements -- in general,
this would not be a problem if it was used properly;
that is, if the screening level was set high enough so
that the element would not show up as a dominant
contributor.
And by the way I should mention here that
there were some plants that simply threw away their
screened out components. I mean, they did not even
include them in a surrogate element. So at least the
ones that used surrogate elements have knowledge that
there could be a contribution from those components.
We talked about the new SSI calculations
versus scaling, and how the HCLPFs that were obtained
should not be compared directly but should be compared
with each other but not -- not necessarily across.
And we also talked about the fact that the component
fragility calculations varied in quality due to the --
some of the estimates on the uncertainty and other
things that went into those calculations.
MEMBER KRESS: Would you elaborate a
little more on your second bullet? Why is that a
problem? It's a dominant risk contributor. Because
it may be overestimating the risk?
MR. LEHNER: No, because you don't -- I
mean, the surrogate element lumps all of the things
you screen out together.
MEMBER KRESS: Yes.
MR. LEHNER: So if the surrogate element
shows up as a contributor, you don't know --
MEMBER KRESS: You don't know whether it
was or not.
MR. LEHNER: -- well, which of those
things that you screened out.
CHAIRMAN APOSTOLAKIS: But it warns you to
go back and look, right?
MR. LEHNER: Well, that's true, yes.
CHAIRMAN APOSTOLAKIS: I mean, that's the
purpose of it.
MR. LEHNER: Absolutely. But what that
would mean is you would have to look at -- you would
have to set your -- yes, it was not --
VICE CHAIRMAN BONACA: So you have a
surrogate element that is dominant, and you're saying,
wait a minute, what's here? And then you -- so what
do you do? You seismically qualify it. I mean, it
leaves you hanging there.
MR. LEHNER: I mean, I suppose what you do
is raise your screening level and --
CHAIRMAN APOSTOLAKIS: Absolutely.
MR. LEHNER: -- screen in more components
and --
MEMBER SHACK: Right. Well, again, if
your risk is 10-6 --
MR. LEHNER: Right.
MEMBER SHACK: -- you know, there's the
dominant element.
MR. LEHNER: Yes, you're absolutely right.
Exactly.
MEMBER POWERS: Unless it's a
metallurgical issue, in which case you can --
MEMBER KRESS: But if you have a large
number of components that might fail simultaneously
due to something like the seismic, or might have a
decreased reliability all because of some common
reason, would that be a good way to determine an
importance measure like Fussell-Vesely or Rowell, if
you just used surrogate elements instead of trying to
do it for each individual one? Is that a legitimate
way to get an importance measure for those things?
MR. LEHNER: No.
MEMBER KRESS: This is another issue is
the reason I'm bringing it up.
MR. LEHNER: No, I don't think so. I
mean, I'm not sure I follow you completely, but I --
MEMBER KRESS: I mean, it seems to me like
it gets the -- it adds up the importance of all of the
things you lumped into that surrogate and --
MEMBER POWERS: Does it add them up, or
does it take the geometric mean?
MEMBER KRESS: Well, that's what I'm
trying to get at. I think it maybe takes the mean, so
it doesn't really add them up.
MEMBER POWERS: I mean, it's equivalent to
adding it up -- one of them is very important, and the
others are kind of in the -- I mean, that's the
equivalent.
MEMBER KRESS: I think you're probably
right.
CHAIRMAN APOSTOLAKIS: I think it's an
overestimate.
MEMBER KRESS: Yes.
CHAIRMAN APOSTOLAKIS: It's an
overestimate. So human error should be --
MR. LEHNER: Yes, should be one of those
things mentioned.
MEMBER POWERS: Let me ask a question. In
the final analyses of these we saw quite a range of
assessments on the probability of bypass events being
created by seismic events. Within the PWR subset of
those things, when they analyze things like steam
generator tube behavior under accidents, did they
analyze the as-constructed tube behavior, or did they
look at the degraded tube behavior?
MR. LEHNER: I don't believe that they
looked at degraded tube behavior. As a matter of
fact, let me ask Jimmy if he recollects. Did anybody
mention --
MR. XU: No. No.
MR. LEHNER: I don't think anybody looked
at degraded.
MEMBER POWERS: So this pain that shows up
in this document to the -- how useful the walkdown was
to find the as-built/as-operated plant may apply in a
lot of areas, but it certainly doesn't apply to steam
generator tubes.
MR. LEHNER: I would agree.
MEMBER KRESS: It's kind of interesting
because you would expect they know pretty much how
degraded their steam generator is.
MEMBER POWERS: Yes. I mean, one of the
advantages of the current condition monitoring program
is you have a pretty good idea what your degradation
is. What they don't have I think is they don't have
a clue how shaking around of the support plates and
what not would affect things. I mean, all they know
is piston behavior.
That would be a difficult calculation to
do, but it probably casts real doubt on the bypass
fractions, which are spread. But I don't believe any
of them.
And bypass, by the way, is not a trivial
consideration here. Bypass accidents are consequence-
producing things.
MR. LEHNER: All right. Coming up to the
last slide, here are the conclusions that are stated
in the report. Well, no vulnerabilities were
identified by most plants. There were significant
improvements made based on outliers and anomalies that
the analyses identified. The analyses basically took
account of these improvements. Seventy percent of the
plants proposed improvements of one sort or another,
and based on their seismic analysis.
The walkdowns, as we talked about, were
probably a very important part of the IPEEE, with the
most important part for those plants that only did
reduced scope evaluations, and many of the
improvements were carried out based on those
walkdowns.
The margin analyses and the PRAs seem to
point to similar components as dominant contributors
in the PRAs as well as weak links in the margin
analysis. Based on these analyses, the age of the
plant was not, in general, found to be a major factor
as far as the seismic risk. And the submittals
indicated -- the submittals in the RAI responses, I
should say, indicated that the IPE program was
successful in meeting the general intent of Generic
Letter 88-20, Supplement 4.
And the licensees did carry out a lot of
modifications that reduced their seismic risk, but it
should also be stated that the -- the way it's stated
here -- the success of the licensees varied, depending
on the methods and assumptions used. I think it's
fair to say that while everyone met the intent of the
Generic Letter, some licensees made a larger effort
than others and probably got greater benefits than
others from this.
MEMBER UHRIG: I find that one statement
a little puzzling. The seismic risk in the older
plants was comparable to the newer. And yet, when you
look at the seismic strengths, they went from very
simple things with an order of $100 per unit to the
next generation it was $1,000 per unit, and the
following generation it was $10,000. Very
sophisticated seismic constraints. This implies that
was a waste of money.
MR. LEHNER: Yes. I think one -- I mean,
one point, again, to make is that probably if you
evaluated the HCLPFs, the plant HCLPF without having
this .3 g cutoff, we would find that the newer plants
would have substantially higher HCLPFs than some of
the older plants. That's my guess.
Any other questions?
CHAIRMAN APOSTOLAKIS: Any other comments
from the members? No?
Thank you very much, John.
MR. LEHNER: Thank you.
CHAIRMAN APOSTOLAKIS: I suppose we can
start with the fires now. We have to go until 12:30.
MEMBER POWERS: I will acknowledge to
members that I sometimes hang out with the speaker.
At least I know what he is.
But I will also point out that during the
course of him doing this study he absolutely would not
let me even see a hint of the thing. He jealously
guarded it as though it were actually a precious
commodity. I shall not forgive him for his
secretiveness.
CHAIRMAN APOSTOLAKIS: If you cannot
forgive, you cannot review.
(Laughter.)
MEMBER POWERS: What?
CHAIRMAN APOSTOLAKIS: If you cannot
forgive, you cannot review.
MR. NOWLEN: You'll have to recuse
yourself for having a grudge against me.
(Laughter.)
MEMBER POWERS: No. I just intend to get
even.
MR. NOWLEN: If you would prefer, we can
defer this. But --
MEMBER POWERS: Were you talking about
deferring it until next week or --
MR. NOWLEN: Until after lunch.
MEMBER POWERS: Oh. George, you know, if
you want to get started, we'll get started. If you
want to defer this until after lunch, we can. But
that's entirely your choice here.
CHAIRMAN APOSTOLAKIS: Why don't we start
and go for about half an hour.
MR. NOWLEN: Okay.
CHAIRMAN APOSTOLAKIS: You've got some
introductory stuff to show us?
MR. NOWLEN: Sure.
CHAIRMAN APOSTOLAKIS: Okay.
MR. NOWLEN: Of course. Okay. Well, my
name is Steve Nowlen. I'm with Sandia National
Laboratories. My role in the IPEEE process was
primarily as a member of the Senior Review Board. So
at that level, I participated in virtually all of the
reviews.
There were a couple of the very early ones
that I wasn't involved with, but after the first
couple I did get involved, so I was involved at some
level in virtually all of these. And I also led the
Sandia team that developed the insights report that
we're talking about today. It was a team effort, and
I'll acknowledge my team members as key contributors
as well.
The outline that I'm going to follow is
quite similar to the other portions of the
presentation. I'll give you some introductory
material. I'm talk about the vulnerabilities that
came out of the IPEEE process. I'll talk about plant
improvements, CDF perspectives.
We'll do some discussion of where the
dominant contributors came from based on the IPEEEs.
Some discussion of methods and modeling perspectives.
There is a lot of material in the report on methods
and modeling. We can't go into all of it, so we'll
cover some of that, and then I'll cover some
conclusions.
Okay. In the way of an introduction, one
thing to recognize is that all of the IPEEE submittals
did include an assessment of the internal plant fire
scenarios.
And all of the licensees chose some form
of a probabilistic method to assess fire, but also
recognize that their submittals vary almost as much as
the plants themselves vary. I mean, there was a wide
range of choices made in both general and specific
methodologies, so it -- comparing one to another can
be problematic in that regard.
In general, you can categorize the methods
used in three ways. There were those licensees who
relied almost entirely on FIVE. And FIVE is --
essentially stops at the level of a quantitative
screening analysis. So you get qualitative and
quantitative screening. And if you stop FIVE that's
basically where you stop.
Most licensees chose to go beyond that.
Almost all of the licensees used FIVE to some extent,
but most of them chose to go on, and they typically
quantified the contributions from the unscreened
scenarios. So they would not stop simply at
screening; they would continue on.
And so you got into various forms of PRA,
and some of these were new PRA studies, some of them
were updates of old PRA studies, and then there were
a couple of plants that actually used a fire event
tree approach, which was an update of very early risk
studies that were done. And so they were a little bit
unique. But, again, it was a probabilistic method,
albeit a very early probabilistic method.
MEMBER POWERS: Where within this spectrum
lies what is referred to in the report as F PRA IG?
MR. NOWLEN: The fire PRA implementation
guide would be two types. There were some utilities
who began with the FIVE methodology and then did their
PRA quantifications using the fire PRA implementation
guide. There were also a small number of licensees
who jumped straight into PRA based on the fire PRA
implementation guide.
So they would fall under the second group,
the various forms of PRA. That's one of those various
forms, or actually two of those various forms.
CHAIRMAN APOSTOLAKIS: When you say
updates of early analyses, what are these earlier
analyses?
MR. NOWLEN: Well, a lot of plants already
had preexisting PRAs. For example, the NUREG-1150
plants had preexisting PRAs that were out there. And
so rather than starting from scratch, they began with
that and updated it and submitted that as their IPEEE.
CHAIRMAN APOSTOLAKIS: So these were fire
PRAs, then.
MR. NOWLEN: Yes. Yes, in most cases.
CHAIRMAN APOSTOLAKIS: Because you make a
distinction there. You say fire event tree approach.
MR. NOWLEN: Yes, the fire -- well, the
fire event tree approach goes back to a very early
report published by an unnamed laboratory -- Sandia,
of course -- 1978. It was a methodology that was
published before the work at UCLA really hit the
streets -- very, very early event tree type approach,
more subjective.
CHAIRMAN APOSTOLAKIS: So some licensees
use that?
MR. NOWLEN: Yes. Two plants.
MEMBER POWERS: Those with good taste.
(Laughter.)
MR. NOWLEN: Well, I'll not comment yet.
There were two plants in particular that
had done preexisting risk studies using that method,
and so for their IPEEEs they chose to update those
preexisting analyses rather than start from scratch
with a new analysis. And so they followed the same
approach, updated the results, and submitted that as
their IPEEE. But it's not the quantitative PRA that
you're familiar with.
CHAIRMAN APOSTOLAKIS: Okay.
MR. NOWLEN: It's a different one.
When it comes to vulnerabilities, the
situation is, again, similar to seismic. There wasn't
a specific definition of what constitutes a
vulnerability provided by the NRC, so the licensees
came up with their own definitions. In some cases
there was no explicit definition provided.
For those who did provide explicit
definitions there was a range of criteria applied.
These are more or less in the commonality, listed in
the frequency with which people used a particular
definition. The NEI severe accident closure
guidelines, for example, were the most commonly
applied.
And then there are a variety of other
criteria that people used in order to define what
constituted a vulnerability. Some -- the most recent
was singles. As long as I didn't have any areas that
led directly to core damage, I didn't have a
vulnerability, and that was -- a couple of plants use
that kind of a definition.
So when you look at what we got out of the
studies in terms of identifying vulnerabilities, we
did, in fact, have two cases. And both of these were
mentioned earlier this morning. The first one was
Quad Cities, and based on their initial analysis --
and, again, these are plants who at some point in the
process defined the vulnerability and said, "Yes, we
have a vulnerability," and I'll clarify that.
In their initial analysis, Quad Cities did
conclude that there were potential fire
vulnerabilities. It was associated with turbine hall
fires, and, in particular, large oil fires in the
turbine hall that led to loss of safe shutdown
equipment and, in particular, cables that were routed
through the turbine building to the reactor buildings.
There was a proximity issue associated
with their remote shutdown panels that were also
located in the turbine building. As a result of those
proximities to the fire, they took relatively low
reliability for their operator recovery actions to
take remote shutdown actions. And there was also a
fairly significant contribution from the reliance on
the sister unit equipment for shutdown, and the outage
time associated with the sister unit also turned out
to be a fairly significant factor.
What Quad Cities did is under considerable
attention from the NRC, both from Research and NRR,
there was a requantification analysis performed. And
the ultimate conclusion of that reanalysis was that
there were, in fact, no vulnerabilities remaining at
the plant.
The reanalysis relaxed some of the
conservatism that was in the original analysis. For
example, there was some additional cable tracing.
They had assumed certain cables would be lost. They
went back, traced, found out that they were in
different areas and took credit for that.
There was also some relaxation of system
impacts. They had assumed if any cable associated
with a particular system were lost that system would
be lost. They relaxed that to say, well, certain
cables aren't as important as others. We may not lose
the system function. We may lose an indication or
something else, but the system function would be
there. They took some credit for that.
And they also refined various aspects.
They dug a bit deeper. They sharpened their pencil.
They looked into aspects of the analysis that have
been handled in very simplistic ways and refined that.
And, in addition, there were some plant changes made
in response to the initial analysis that were also
credited in the reanalysis. So, again, based on the
reanalysis, they concluded that the vulnerability
didn't exist.
MEMBER LEITCH: Steve, my question would
be: is Quad Cities unique in this situation? It
would seem to me that many plants would have this kind
of vulnerability. And is it true that they do not?
Or was Quad Cities just -- just came upon this and
others perhaps overlooked this vulnerability?
Because I guess what I'm saying is if Quad
Cities made some changes to improve it, what about the
other plants that might have similar vulnerabilities?
MR. NOWLEN: Sure. There were some unique
things about Quad Cities, clearly. There were aspects
of the situation there -- in particular, the location
of the remote shutdown panels in relative close
proximity to these fires they were postulating --
relatively unique.
In the IPEEE process, we did focus
considerable attention on turbine buildings. And so
we asked a lot of licensees very specifically about
their turbine buildings, and they typically responded
with answers that satisfied us that there was not a
similar situation there.
There are, of course, exceptions and one
of them is our second vulnerability case, which was
Millstone -- Millstone Unit 2. In the case of
Millstone the initial analysis concluded there were no
vulnerabilities. There was an outlier identified.
They didn't call it a vulnerability --
they called it an outlier -- associated with storage
of some transient combustibles in proximities to some
important cables and they identified some resolution
paths for that.
But in part because of knowledge of
members of the Senior Review Board about this plant
and things we had seen from Quad Cities, they were
specifically asked about their turbine hall analysis.
And in response they did come back and say, "Yes,
you're right. We found a vulnerability in the turbine
hall."
In this case, they focused on two
particular scenarios that each came in with an as-
found estimate of risk that was very conservative CDF
of on the order of 4E-4, conservative analysis,
conservative assumptions. The reason that they had,
then, missed in the original analysis was that they
had underestimated the CCDPs associated with these
particular scenarios.
And in this case it was the original
analysis that assumed these CCDPs would be two times
10-3. And when they went back and looked again at
what equivalent was going to be lost, they concluded
it was one times 10-1. So .1 -- very substantial jump
there.
And so as a result, they implemented some
improvements. In particular, the turbine driven
auxiliary feedwater vulnerability was fixed. This
basically derived from a vulnerability of that
particular system, and they implemented changes to
remove that vulnerability.
They weren't real explicit about exactly
what those changes were. But their requantification
ultimately showed that the CDFs were on the order of
2E-7 and 2E-8 for these two scenarios in particular.
So the fix really dropped the CDF quite considerably.
MEMBER LEITCH: But it seemed to me in the
Millstone case, from what I read hear, that initially
it was like 10-7 or 10-8.
MR. NOWLEN: Yes.
MEMBER LEITCH: And then they --
MR. NOWLEN: They screened, initially, in
fact.
MEMBER LEITCH: Yes. And then there was
some attention brought to bear on this by the NRC and
they --
MR. NOWLEN: Yes.
MEMBER LEITCH: -- looked at it and they
said, "Ah, it's 10-4." And then they did some fixes
and brought it back up to 10-8 again.
MR. NOWLEN: Correct. Yes.
MEMBER LEITCH: And I guess -- were these
-- was there special attention given to Millstone as
a result of the rest of the scrutiny that Millstone
was under at this time? I mean, I guess --
MR. NOWLEN: No.
MEMBER LEITCH: -- what I'm wondering is,
would this have surfaced at another plant?
MR. NOWLEN: Yes, we believe so. Yes. We
asked a lot of licensees about their turbine halls.
Unless we got a really good analysis of the turbine
hall that said, "We've looked at it in detail, and
it's not important to us," or we got someone who did
a good analysis and said, "Yes, it's an important
area" -- and you'll see later that a lot of people did
identify the turbine hall as an important fire area.
We asked a lot of licensees about that
area and said, you know, "Look, we're not satisfied
with the analysis you've done here. Please give us
more." And we got a lot of good answers on that, and
so a lot of people did go back.
And in this one particular case the
vulnerabilities surfaced, but that was the only other
case where the vulnerabilities surfaced.
VICE CHAIRMAN BONACA: The reason why I
asked the question at the beginning of the morning,
the question that Graham is asking, because there are
some sister plants which are pretty much identical in
configuration, locations, etcetera. So the question
would be -- normally, when you have a finding like
this, you go back and ask the other guys exactly the
same issue.
Now, you were pretty unspecific about what
the fix was, except in the text it speaks of the
turbine-driven aux feed pump.
MR. NOWLEN: Yes. That was the -- for
Millstone that was the extent of the information we
got.
VICE CHAIRMAN BONACA: So, you know, I'm
left with the question -- did the other guys look the
same way? Didn't find it because of that? Or is it
something else?
MR. NOWLEN: Well, again, all I can say is
we did specifically focus licensees' attentions on
this issue. We directed them to consider what
happened at Quad Cities, and later what happened at
Millstone and Quad Cities. And we asked them to
consider similar issues for their plants. And the
answers we got back were, "No, we don't have the same
kind of issue."
So we took that at face value and stopped,
unless we had reason to, you know, say, "Well, wait a
minute. Your analysis missed this one point." In
some cases, we went back a second time and asked
again, but ultimately in all of the other cases we
were satisfied they had addressed it and didn't have
a similar vulnerability. Okay?
So jumping to plant improvements, we did
see quite a wide range of plant improvements
identified by licensees. And it's worth pointing out
that the status of these improvements, as in the case
of seismic, isn't always entirely clear. It includes
things that were considered and rejected. We've
actually counted those.
There's a few cases of that where people
said, you know, we identified some things but decided
they weren't cost effective or weren't of sufficient
impact to pursue, things that were considered and
implemented, things that were being considered, things
that we're going to think about in the future, and
things that were simply identified as a potential
benefit without any real discussion of how that was
going to be addressed.
But overall a majority of the licensees
did identify at least one plant improvement. And this
was -- 44 of the submittals, 44 of the 70 submittals
included at least one fire-related plant improvement,
and that represented 62 units -- those 44 submittals.
And that's 64 percent of the submittals, so I think
that's a good thing.
And the plant improvements, again, similar
to seismic, they fell into three common categories and
that's operating procedures and training practices.
That was almost half of the improvements that were
associated with that.
Maintenance procedures and practices, a
smaller number -- about 12 percent -- were associated
with that. And then physical design changes were
fairly highly represented as well, and these ranged
from minor things to fairly substantial things.
So, again, there's a range in each of
these, but a fair spread. And, in particular, the
physical design changes -- quite a good representation
of changes beyond simple procedures.
MEMBER LEITCH: We're under the impression
that the February San Onofre event was made
considerably worse by the fact that there were
barriers missing between certain breaker compartments,
and the fire propagated from one to the other.
MR. NOWLEN: Yes. And really --
MEMBER LEITCH: Has that kind of thing
surfaced as something which should be in a maintenance
procedure?
MR. NOWLEN: I can't recall anything like
that, and I'm not familiar with the San Onofre event,
so I don't have a lot of detail there.
MEMBER LEITCH: Okay.
MR. NOWLEN: But I don't recall things
along those lines, no.
MEMBER LEITCH: Okay.
MR. NOWLEN: Okay. Again, getting more
specific, there were a range of issues identified in
these improvements or addressed in these improvements
-- emergency procedures, enhancements to identify --
or to address identified fire risk scenarios.
For example, they would take scenarios
that were identified in the IPEEE and look at their
procedures and adjust them to reduce the likelihood
that things would go bad in these events. Operator
training -- some of the licensees, for example, cited
that they were using scenarios from the IPEEE process
to develop new training scenarios for the operators,
specifically simulating some of the things they were
postulating in the IPEEEs in terms of scenario
development.
Fire brigade training, an additional
detail -- or additional attention to the firefighting
and dominant fire areas -- in particular, pre-
planning, additional fire drills, that was fairly
commonly cited.
General maintenance procedures tended to
focus on things like housekeeping, transient
combustibles, additional requirements for fire
watches, reduction of fire hazards, that sort of
thing.
In terms of the physical changes, we saw
cases of relocating equipment and cables to remove
them from the critical fire area or to reduce the fire
hazard associated -- or the fire hazard presented to
those pieces of equipment. Some fire protection
system modifications and upgrades, fire barrier
changes and upgrades that people were citing, and in
a few cases we saw electrical design changes, system
design changes -- in particular, plants who looked at
spurious operation potential.
In a few cases we had plants that came
back and said, "Well, we've made a design change to
the system to reduce the likelihood of spurious
actuation in order to reduce particular scenarios."
MEMBER POWERS: The general category of
spurious actuations, do you find any difference --
consistent difference between those plants that have
self-induced station blackout and those that do not?
MR. NOWLEN: It's a tough question. We
did have --
MEMBER POWERS: I wouldn't ask it if it
wasn't hard.
MR. NOWLEN: Yes.
(Laughter.)
We didn't, and we did, in fact, question
a number of licensees regarding the issue of self-
induced station blackout. We did have access to the
Brookhaven report on that subject, and during each
review we would look at that report, and if it was a
plant that fell into one of the categories we would
specifically look at the submittal for that kind of
information.
We typically didn't see it in the original
submittals. It would not be discussed. We would then
go back to the licensee and ask them a question about
how they had addressed that.
This gets wrapped up a bit into the
general issue of main control room abandonment and how
they did human factors for main control room
abandonment. The typical response we got back was
that they considered that even looking at SSPO issues,
the number they've used for reliability of remote
shutdown reflects the probability that those
procedures would fail and that they consider it
conservative.
Others provided us with some additional
detail as to what the SSPO procedures actually were
and the rationale for concluding that their numbers
were bounding. But in general, I think it was
discussed earlier today that human factors remains one
of those areas that is something of a state-of-the-art
issue.
CHAIRMAN APOSTOLAKIS: Human performance,
not --
MR. NOWLEN: Human performance, yes. I'm
sorry. And I think we fall there here. And, in
particular, with regard to control room abandonment,
our ability to really analyze those in detail is still
an area of challenge for PRA. And I think that's
reflected here, and so the answer is a bit mixed.
MEMBER POWERS: I guess -- I mean, what
you've said is that it's a mixed bag for those that
have self-induced station blackout. What I was
interested in was in those that -- the differences
between those that do and those that don't in self-
induced station blackout.
MR. NOWLEN: You can't really tell,
because it's all wrapped up in the control room
abandonment. And everyone tended to take fairly --
well, not everyone, but the majority of licensees took
fairly simplistic approaches to conservative analysis
of control room abandonment.
And so the distinction between SSPO and
non-SSPO plants -- it gets washed out by the almost --
the relatively simplistic approach that people took to
conservatively estimating control room abandonment
contribution.
MEMBER POWERS: A lot of the text of the
document speaks of these conservative analyses, and I
was wondering, how do you know that they're
conservative? Is it plausibility arguments?
MR. NOWLEN: Plausibility, the combined
judgment of the Senior Review Board, the judgment of
the reviewers. You know, for example, if someone took
a one in 10 probability that a remote shutdown failed,
we generally said that's probably conservative and we
accepted it.
MEMBER POWERS: I'm wondering how you knew
that.
MR. NOWLEN: Judgment. We're supposed to
be experts.
MEMBER POWERS: Well, I'm just trying to
understand how you got that judgment. I mean, how --
since I'm not an expert, how would I become an expert
in judging the probability of control -- alternate
shutdown panel failure? Or do I run 600 attempts with
the panel, and if 60 of them fail then I know it's .1
or --
MR. NOWLEN: Yes. It's a real -- it's a
tough issue. You know, again, you wouldn't ask if it
weren't. But we just had to use our own judgment.
You know, did we consider -- and, in particular, we
took it in the context of the objectives of the IPEEE
process. Virtually all of the licensees acknowledge,
yes, the control room is important to us, and it's a
dominant contributor to fire risk.
Well, in the context of the IPEEE, that
was -- the primary objective is, you know, have they
acknowledged that they know where their risk
contributors come from? Whether they got exactly the
right number we were less concerned with.
And, again, recognizing that this brings
in a number of state-of-the-art issues, we typically
didn't pursue it to that level. We said, you know,
the licensee has acknowledged that this is an
important area. It shows up as one of their dominant
contributors. We can all argue about the number, but
that's the answer.
Now, the ones we tended to focus on were
the ones where we thought they had taken an overly
optimistic view of control room fire risk and used,
for example, very, very low probabilities of
conditional -- or conditional probabilities of
abandonment given a fire, or who had taken very, very
high reliability values for remote shutdown. Those
were the ones that we tended to focus on and say,
"Gee, guys, have you really thought hard about how
important the control room might be to you?"
Is that satisfactory?
MEMBER POWERS: Well, it's the answer.
CHAIRMAN APOSTOLAKIS: If I look at
Figure 3-5 on page 331, you have --
MR. NOWLEN: I'm sorry. Which page?
CHAIRMAN APOSTOLAKIS: Page 331. There is
a simple -- there is a reporting of fire CDF versus
the method of analysis employed. Does it tell us
anything? It seems as if those which --
MR. NOWLEN: Yes, we're jumping a little
ahead. I actually have --
CHAIRMAN APOSTOLAKIS: Oh, okay.
MR. NOWLEN: -- if you want to --
CHAIRMAN APOSTOLAKIS: We can talk about
it. But this is speaking of the same -- it seems to
me that the same approach is used, which is -- it
seems to yield more conservative numbers. I don't
know if that was --
MR. NOWLEN: Yes. We're --
MEMBER POWERS: Well, I mean, I really
question --
MR. NOWLEN: This is the figure you're
referring to?
MEMBER POWERS: -- whether you can draw
that conclusion? Because if they --
CHAIRMAN APOSTOLAKIS: Well, that's why
I'm asking the question here.
MR. NOWLEN: Exactly. Yes. Our own
perspective is that these are largely a wash. You can
see, for example, the FIVE studies, which we've called
FIVE plus. There is actually a very, very small
number of studies you can call true FIVEs, that just
did FIVE and stopped. Everybody -- almost everybody
did a little bit more.
But the FIVE studies tend to be a little
bit higher. They are screening, so you would kind of
expect that, that if they stop at screening -- people
who sharpen their pencil tend to get lower numbers.
But there is a lot of wash here.
It's difficult to say there is a true
trend here. There is a lot of spread in the data, and
they all overlap. And so, you know, it's difficult to
conclude that there is any real trend here, and our
conclusion was that there is no real trend here.
There are some reasons that you can say,
yes, that some of these we expected higher numbers,
but also one thing to recognize is that in general
screening was at 10-6 for fire compartments. And once
they had satisfied themselves that they were below
that threshold it stops.
CHAIRMAN APOSTOLAKIS: So how did these
guys handle the issue of control room abandonment?
MR. NOWLEN: A range of ways. Which one?
The FIVE studies, in particular?
CHAIRMAN APOSTOLAKIS: The FIVE studies.
MR. NOWLEN: There was some analysis done
that would typically begin with a fire frequency, and
they would assign a conditional probability that given
a fire they would abandon.
CHAIRMAN APOSTOLAKIS: That's a key here
because that's doing a screening analysis.
MR. NOWLEN: That's a screening, yes.
CHAIRMAN APOSTOLAKIS: They're very
conservative there. What kind of numbers do they use
to be very conservative?
MR. NOWLEN: To be very conservative, it
was about .1 was about the most conservative that --
so one in 10 fires would lead to control room
abandonment with no screening of any of the events.
So you start with about a 10-2 fire frequency in the
control room, a .1 on abandonment, and a .1 on remote
shutdown failure, and you're at 10-4 control room.
We had a number of people who stopped
there and said, "Yes, our control room is important.
We know that, and, you know, thank you." And so, as
you'll see, I've got some other slides that show some
of these areas that contribute. And there are,
indeed, some 10-4 IPEEE estimated control rooms, and
those tend to be that -- that's how you get 10-4 for
a control room -- those three numbers multiplied
together.
But, again, it varies. You know, some of
the FIVE studies went much deeper into the main
control room and dug a lot deeper. So it's really all
over the board.
CHAIRMAN APOSTOLAKIS: But there really is
no basis for the .1. I mean, it's --
MR. NOWLEN: No. No, you're right. It's
-- it doesn't have a good, strong, scientific basis.
Again, you have to use your judgment. And, again, in
the context of the IPEEE, the licensee says, "Yes, we
know it's an important area. You know, what more do
you want us to say?" And we said, "Okay. Thank you."
And we kind of let them go at that point.
CHAIRMAN APOSTOLAKIS: Okay.
MR. NOWLEN: Okay?
CHAIRMAN APOSTOLAKIS: I don't think we
should start with the perspectives now.
MR. NOWLEN: Okay. This is actually not
a bad place to stop, so we can stop right there.
CHAIRMAN APOSTOLAKIS: Take an hour, Mike?
Okay. 1:15.
(Whereupon, at 12:14 p.m., the
proceedings in the foregoing matter went
off the record for a lunch break.)
A-F-T-E-R-N-O-O-N S-E-S-S-I-O-N
(1:15 p.m.)
CHAIRMAN APOSTOLAKIS: Okay. Steve, keep
going.
MR. NOWLEN: Okay. Returning to the
presentation, we're on slide 9, beginning the
discussion of CDF perspectives at this point. The
plot that we've shown here in this particular slide
separates the plants in the BWRs and PWRs and shows
the range of fire CDF results we got for those plants
that did report CDF values. Not all did that, by the
way.
Compared to the IPE values for the
corresponding group, I'll note that you can't compare
the squares to the squares. They don't plot that way.
This is just a distribution of the range for the
entire population.
And the conclusion here is that, by and
large, the IPEEE fire CDF values are in the same range
as the IPE internal events values. They are
relatively comparable here.
MEMBER POWERS: Let me ask you a question
about CDFs, not that I argue with your conclusion for
this plot, but there are some -- how do we get these
CDFs? You have some features that are, in fairness,
highlighted in the report but raise some questions in
my mind.
It says, "Most licensees screened all
scenarios involving propagation of a fire from one
zone to another. The rest reported CDF contributions
for fires ranging from one percent," which I'll admit
sounds pretty insignificant, "to 30 percent," which is
not.
MR. NOWLEN: Well, 30 percent of what,
though? If it's already --
MEMBER POWERS: Of the overall fire-
induced CDF.
MR. NOWLEN: Yes. But if the fire CDF is
1E-7, and 30 percent of that comes from the --
MEMBER POWERS: Yes. But what about 1E-4?
MR. NOWLEN: They didn't report 30 percent
due to room to room, so --
MEMBER POWERS: What did they report room
to room?
MR. NOWLEN: No one found room-to-room
scenarios to be a dominant contributor to CDF.
MEMBER POWERS: Well, dominant -- three
percent is not dominant, but it's not negligible
either.
MR. NOWLEN: Yes. Okay. That was perhaps
misphrased. No one found room-to-room scenarios to be
a high contributor to CDF. They were all finding
relatively low numbers for room-to-room scenarios.
Now, in one particular case we did have a
plant who found some room-to-room scenarios that
turned out to be relatively important in comparison to
other rooms.
But, again, that -- if I recall correctly,
that particular case is a plant that has a low CDF to
begin with. And so the room-to-room scenarios are
also low. This is a relative contribution for that
particular --
MEMBER POWERS: If I understand what's
said here, you're making all of these conditional
statements based on 20 percent of the submittals.
MR. NOWLEN: Yes. In the room to room
that is true. There was a limited sampling of the
submittals.
MEMBER POWERS: Okay. If I looked at the
others, would it raise all of these numbers?
MR. NOWLEN: No. No, it wouldn't.
MEMBER POWERS: Well, it would at least by
perhaps as much -- as little as one percent. In some
cases 30 percent.
MR. NOWLEN: Well, I think I've lost you.
You know, the worst -- the most significant in a
relative sense for any given plant that room-to-room
scenarios was cited as was 30 percent of the total CDF
came from room-to-room fire scenarios.
MEMBER POWERS: Right.
MR. NOWLEN: Again, that was a plant that
had a very low fire CDF. So we have to take that
number with a grain of salt.
MEMBER POWERS: Maybe you need to make
these things clear, because otherwise --
MR. NOWLEN: Perhaps.
MEMBER POWERS: -- I think this is a very
provocative statement, and it really raises questions
about whether they found their dominant fire scenarios
in the course of doing this work, because if they go
through and assume there's no propagation in between
things, except for a few who find it's a 30 percent
contributor, then I would really question whether you
have found the dominant contributors.
MR. NOWLEN: Yes. And then, again, you
have to take these in the context of the absolute
numbers. And you're right. In this case, we should
clarify that in the report. You know, we didn't get
30 percent of a 10 to the minus -- you know, we didn't
get -- Quad Cities wasn't 30 percent room to room.
These were plants that were in the -- probably as I --
I don't recall the details of this particular case.
But typically in the, you know, high 10-7, low 10-6
range, with numbers in the low 10-7 range coming from
room-to-room scenarios --
MEMBER POWERS: It's a non-trivial
consideration, because we spend an enormous amount of
time and resources chasing around on these fire
penetration barriers. And what we'd really like to do
is look at the risk significant ones, and what you're
really saying is that there aren't any risk
significant ones.
MR. NOWLEN: The IPEEEs didn't identify
any risk significant ones. That is correct.
MEMBER SHACK: Does that includes the ones
where they just sort of gave up and combined things?
That isn't counted as a room-to-room thing? They just
gave up and assumed it was all one room?
MR. NOWLEN: No. If they, in the end,
treated it as all one room, then that's one room. It
would not be a room-to-room scenario anymore. And
there were cases of that as well.
We saw cases going both ways, in fact,
where they began with a large room, and at some point
in the analysis they decided to cut it into smaller
pieces. We also saw cases where they initially cut
things into smaller pieces and said, "It's
unnecessary. We can recombine it, and it's still
small, so why don't we do that." And so there were
cases both ways.
Ultimately, the bottom line is if they
cited it as a single room number, we cited it -- we
treated it as a single room number. If they cited it
as this is a room-to-room scenario, then we treated it
that way.
But you're right, yes. And the answer is
that room-to-room scenarios did not present high-risk
scenarios for the IPEEEs. That's not where the higher
CDF values were coming from. They were coming from
other areas, individual areas.
MEMBER LEITCH: Steve, I know it's not
really the point of that viewgraph, but I was
wondering if those two very low CDFs for BWR fire and
BWR internal events, are they the same plant?
MR. NOWLEN: Yes. Yes, they are. That's
Susquehanna.
MEMBER POWERS: Yes. We've got to find
out what Susquehanna's fire protection program is, and
just put that in the NFPA 805 and let it go at that.
MR. NOWLEN: Well, again, there was
considerable attention paid to that particular number.
They looked at it in the review process in pretty
close detail. Ultimately, you know, the number is
still very, very low in comparison to the other
plants. Of course, we take it with a grain of salt,
but in --
MEMBER SHACK: Is their performance during
fire as good as it is for internal events?
MR. NOWLEN: I can't answer that question.
I don't know. I would -- well, no, I don't want to
speculate.
MR. RUBIN: Yes. I think that was one of
the issues, yes, definitely.
MR. NOWLEN: It jumps out, yes.
MEMBER LEITCH: You're questioning the
validity of the results without -- just on the face of
it, I guess is what I'm saying.
MR. NOWLEN: But, again, this was a case
where there was a Level II review, and so they went
down to the plant and they had extensive discussions
with them, and the review team satisfied themselves
that this was a -- you know, that there weren't
outstanding vulnerabilities to be identified here,
that, you know, despite whether you agree with that
number or not, it's not a 10-3 plant, for example.
And so, again, within the context of the
IPEEE, that satisfied our objectives, and we moved on.
In this case, we kind of agreed to disagree with the
utility on that one.
MEMBER LEITCH: Yes, okay.
MR. NOWLEN: Another interesting thing is
that if you start looking at them individually, and we
did avoid this to a large extent in the report -- we
didn't want to compare one plant's fire to one plant's
IPE directly and present all of those results.
But if you do make such comparisons, you
find that the vast majority of the submittals do
report a CDF value that's within one order of
magnitude, in fact, of the IPE internal events CDF for
the same plant.
There is a small number of licensees who
didn't report CDFs, and those, in particular, are the
FIVE-only studies. They were small, they did FIVE,
stopped, so you get a screening answer, and it's not
a CDF. We didn't include those.
Another thing that we saw, or didn't see
I should say, is any definitive trend of CDF with
plant vintage. We did specifically look at this, and
there is a plot in the report that shows it. You see
this is -- the operating license is the value that we
chose to plot against, the date of the operating
license. And, again, that's a shotgun blast. There
is no tremendous trend there. It's very, very flat,
in fact.
MEMBER POWERS: Did you do any kind of
formal regression analysis to try to separate out
factors in these -- this shotgun blast?
MR. NOWLEN: No, we didn't.
The other point that we looked for and
didn't especially see -- and we actually talked about
this already -- is that there was no real definitive
trend based on the method applied. There are some
weak trends that you can sort of anticipate, and you
do see those.
But again, statistically, it's difficult
to say that there's a real trend. The FIVE studies,
again, tend to solve marginally higher CDFs. They
tended to stop at a lower level of detail.
Presumably, sharpening the pencil would further reduce
those values. And other than that, they tended to
yield nominally similar results.
What I want to go into now is where were
the dominant fire CDF contributors? And I'm going to
cover it -- talking about it by fire area or fire
zone, and by the types of initiating events that were
analyzed and in terms of the fire sources that they
postulated.
So in terms of the fire areas and zones,
the main control room is the one that was most
commonly identified as the dominant contributor, and
it was -- the main control room analysis itself was
typically dominated by the abandonment scenarios.
MEMBER KRESS: What was the criteria used
for abandonment? If the --
MR. NOWLEN: There tended to be different
criteria. The most commonly applied criteria is the
criteria you find in the fire PRA implementation
guide. It basically did an interpretation of testing
done by Sandia under USNRC sponsorship in the 1980s.
They interpreted the time it took for the
smoke layer to descend to eye level, which is one of
the things we reported in those studies. And then,
based on the conditional probability that you put the
fire out within that same time period, failure to
suppress would lead to abandonment.
So the typical number -- when you do that
analysis according to the PRA guide, it comes out .07,
I believe -- 007? 007, yes, 7E-3. So that was the
most commonly applied number.
There was considerable discussion of that
approach. It became one of the areas that was
discussed with EPRI with regard to the fire PRA
implementation guide. Our ultimate resolution there
was that so long as they did not screen those
scenarios on that basis, the probability of
abandonment.
And that they continued and provided an
analysis of remote shutdown, we accepted the number
for the purposes of the IPEEE. But, yes, that was the
most common. There were some others. Some people
took conservative numbers; some took more optimistic
numbers.
CHAIRMAN APOSTOLAKIS: Again, I'll repeat
the comment I made earlier for the seismic analysis.
You state in the report -- and I think you just said
it again -- that the human error probabilities varied
widely. There is no really strong technical basis,
and so on.
And yet when it comes to discussing fire
methodology perspectives, there's no mention of human
error. Again, when we say fire methodology, we mean
fire growth and suppression, or you also mean the
scenario. So it seems to me that there should be some
discussion of that, because this is one of the most
important elements.
MR. NOWLEN: Yes. I'm surprised. There
is a discussion of human reliability or human
factors --
CHAIRMAN APOSTOLAKIS: There is a
discussion separately?
MR. NOWLEN: Yes.
CHAIRMAN APOSTOLAKIS: In the section that
says Fire Methodology Perspectives, there is no
mention of it.
MR. NOWLEN: I see.
CHAIRMAN APOSTOLAKIS: You know, if I were
to decide --
MR. NOWLEN: Yes, we culled it out as a
separate section of the report --
CHAIRMAN APOSTOLAKIS: Right.
MR. NOWLEN: -- but it's -- it is a part
of the methodology. But, yes, it was culled out as a
separate section. But there is a fairly considerable
discussion.
We did see something a bit different in
the fire area than we saw in some of the other areas.
Fire tended to be more binary. Typically, they began
by crediting what's in the IPE, and then it was more
commonly a binary. Either we're going to credit that
action or we're not going to credit that action.
Relatively few people use performance
shaping factors, for example.
CHAIRMAN APOSTOLAKIS: Yes, and there were
between five and 10, as you state in your --
MR. NOWLEN: Right. Yes.
CHAIRMAN APOSTOLAKIS: And those -- you
know, sometimes, especially in a field where we don't
know much, people are dying to find somebody's report.
I found out after 10 phone calls that a number that I
was trying to track down a few years ago originated
from me.
(Laughter.)
I'm serious.
MR. NOWLEN: It's disconcerting, isn't it?
CHAIRMAN APOSTOLAKIS: Not 10 calls, but
four or five. I said, "No, this guy told me, this guy
told me," and then finally the guy says, "Well, you
told me."
(Laughter.)
So here we have an EPRI document which was
used by people who found that the suppression of fire
within 15 minutes or non-suppression is 3.4 10-3. I
mean, that's a very low number.
MR. NOWLEN: Oh, that's the correct
number, yes.
CHAIRMAN APOSTOLAKIS: But if it comes
from a document from a major organization, I guess it
has some weight. But I'm sure it's just judgment,
somebody's judgment.
MR. NOWLEN: No. It was actually based on
an analysis.
CHAIRMAN APOSTOLAKIS: Based on actual
fires?
MR. NOWLEN: Yes. They did an analysis of
the events in the fire event database, developed a --
CHAIRMAN APOSTOLAKIS: 10-3 as a time? As
a function of time?
MR. NOWLEN: I'm sorry? Nathan?
MR. SIU: This is Nathan Siu, Office of
Research. The -3 number, basically what it comes from
is a very small number of control room fires. I think
it was four. And they had the times to extinguishment
for those, which were pretty much clustered -- very
short times.
They assumed that the time to suppress was
log normally distributed, so they basically fit the
curve to that, and then read off the tail to say,
"Okay. Look at 15 minutes or whatever the appropriate
number was." So there is some development there, but,
again, you can obviously question the basis. And
that's why we had a lot of discussions on that
subject.
CHAIRMAN APOSTOLAKIS: It's a lot of
judgment. I'm not blaming you for -- I mean, I'm just
stating that the -- you know, there are some numbers
that are pretty low, and the performance shaping
factors of five and 10 -- that is all judgmental.
It's the same in the seismic area, and I think this
report should make a big deal out of it.
MEMBER KRESS: It seems like an insight,
doesn't it?
CHAIRMAN APOSTOLAKIS: It is a major
insight, yes, a major insight. And, again, if we come
to GSI 172, I don't know if there is a fire example
that you guys can show us of these 61 units that
supplied sufficient information to resolve the issue,
because 172 is not limited to seismic. Is it? It
includes fires. It's multiple system responses
program.
MR. NOWLEN: Yes. There are fire --
CHAIRMAN APOSTOLAKIS: I'd like to see
fire, too, to -- just to learn what was considered
adequate.
MR. NOWLEN: Okay.
CHAIRMAN APOSTOLAKIS: Another unique
issue with the fires, it seems to me, Steve -- and we
have not discussed it very much, if at all -- is not
just the human error but the severity factors.
MR. NOWLEN: Oh, absolutely. Yes.
CHAIRMAN APOSTOLAKIS: It seems to me that
the severity factors is destined -- are destined to be
there forever, because I don't see how we can get data
to -- to tell us what percentage of fires is large
fires, and so on. Does everyone know what severity
factors are?
MR. NOWLEN: I do have a discussion on
this in a couple of slides. But --
CHAIRMAN APOSTOLAKIS: Okay.
MR. NOWLEN: -- and Nathan may choose to
jump in at that point as well.
CHAIRMAN APOSTOLAKIS: Fine. We'll
revisit them then.
MR. NOWLEN: Yes.
CHAIRMAN APOSTOLAKIS: But it's a major
issue with fires.
MR. NOWLEN: It is.
CHAIRMAN APOSTOLAKIS: It's not an issue.
It is an issue, I guess.
MR. NOWLEN: Yes.
CHAIRMAN APOSTOLAKIS: But it's a very
essential part of the analysis, and it has to be
judgmental, because, you know --
MR. NOWLEN: Yes. And it did become a
considerable point of focus, but --
CHAIRMAN APOSTOLAKIS: But that brings
down the frequencies by two or three orders of
magnitude, does it not?
MR. NOWLEN: Depending on how they're
applied. We typically saw one, but we did see cases
of three or four, yes.
CHAIRMAN APOSTOLAKIS: All right.
MR. NOWLEN: Okay? Let's see. Okay.
Dominant fire areas -- again, another area -- switch
gear rooms, the emergency switch gear rooms in
particular, and the scenarios here tended to be panel
fires leading to damaged overhead cables. These
showed up a lot. Again, that's pretty consistent with
what we've seen in past PRAs.
The third area here is turbine buildings.
We've already discussed turbine buildings a couple of
times. Often times these were large oil fires that
led to the large contributions in the turbine hall,
and there were a fair number of licensees who reported
their turbine halls as high contributors in their
IPEEEs.
A little bit of a surprise compared to
past PRAs. The past PRAs have tended to be at plants
that just didn't turn out to be much of an issue. In
this case, we had a fair number of licensees who did
identify that.
Other areas that we often wonder about in
fire PRA - cable spreading rooms. In this particular
case, the answer tended to be driven by how many cable
spreading rooms there are. Again, not incredibly
surprising. If there were more than one cable
spreading room separated with train segregation, then
they tended not to be important.
The other factor was the type and nature
of the fire sources that were in the room. If it was
strictly a room full of cables, they tended not to be
important -- fire frequency very, very low for self-
ignited cable fires. Whereas if they had panels in
the room, then the fire frequency pumped up. You had
a higher contribution in general. Again, not too
surprising, fairly consistent with what we've seen in
the past.
We also saw various types of electrical
equipment rooms in certain plants that have a lot of
the control room equipment that gets relocated to a --
what you would normally expect to find in the control
room gets relocated to an electrical -- auxiliary
electrical equipment room. Those areas tended to show
up as very important as well. So those were real
common, fairly typical of what we see, perhaps with
the exception of turbine buildings, so far.
Others -- diesel generator rooms. These
were often associated with loss of offsite power
scenarios, not too surprisingly. Although, again, we
don't typically see those diesel generator rooms
showing up as dominant in past fire PRAs, so that's --
for some plants that turned out to be important.
Cable vault and tunnel areas -- again,
something we see in past PRAs has been found
important. Kind of a mixed bag in the IPEEEs. It
depended a bit on how they treated their transient
combustibles. Many of the submittals took substantial
credit for administrative controls on transient
combustibles in such areas, argued that they weren't
to access during normal operation, and argued very low
frequencies, so they tended to go away.
But, again, if there were other ignition
sources, that brought them back. In a number of cases
we did ask licensees about their treatment of
transient combustibles, and they would come back and
say, "Well, okay. If we do that, here's a new
number." So this is another area where we've tended
to question the results and often got a somewhat
higher number with the response.
And then another one that tended to be
very plant-specific -- a few cases -- battery/charger
rooms popped up as important contributors. And,
again, these were typically due to plant-specific
factors. There happened to be some cables routed
through that area that turned out to be very
important.
Moving on to the accident sequences, this
was a really tough area for us to try and glean
insights. The information that we got in the
submittals was typically fairly sparse in this area.
We would generally get a description of what accident
sequences were considered in the analysis.
But then when it came down to
quantification and saying this particular scenario is
associated with this sequence, we typically didn't get
that level of detail. Licensees weren't asked to
provide that level of detail, and we didn't get it.
We didn't generally pursue that as an RAI
issue unless we felt it was important, that we really
wanted to know what was going on here. Then we would
ask licensees to tell us about what the scenarios
were. If they had provided us with no information at
all about what sequences had been modeled, we would
ask that question.
But where we do have information, the
general plant transients tended to dominate. It may
not be especially a robust conclusion -- again,
because of the sparsity information. It's based on
relatively few submittals that gave us that level of
detail.
There were also cases that we saw of
transient-induced LOCAs, stuck open PORV valves, some
limited cases involving spurious operations, valve
operations typically, and then the RCP seal LOCAs for
the Westinghouse PWRs -- we saw a few of those crop up
as important for those plants.
And that's about all we have to say about
those. Again, a relatively sparse area in terms of
the documentation we got.
When you look at the contributors in terms
of the fire sources, in general there was a lot of
attention paid to the electrical panel fires in the
IPEEEs themselves. The licensees spent a lot of time
looking at panel fires. They did dominate the
analysis for a variety of areas -- the main control
room, cable spreading rooms that had panels in them,
switch gear rooms obviously, and these electrical
equipment rooms. Those all tended to involve panel
fires.
The potential for damage to overhead
cables and how that was treated was often a critical
factor in what their contribution ultimately was, and
that was dependent in part on the fire size that they
assumed. These tended to be point estimates. There
was a most likely fire size assumed. That was
propagated through the analysis, and a zone of
influence was assessed, and they would look at what --
within that zone of influence.
So, again, the electrical panel fires were
the most typical contributing source. The other most
commonly cited one was large oil fires. Again, this
was often -- turbine halls would also, in certain
other pump areas where you have large oil sources,
they would typically crop up as important.
Transient fires rarely were found to be
the important fire sources. In some cases, this is
due to treatment, in fact, because typically if a
licensee went in and said, "Well, I've got all of
these fixed fire sources, and they're doing all the
damage anyway. So I'm going to lump my transient fire
frequency in with the fixed sources and I've bounded
the problem." That was not at all uncommon. Quite a
few licensees did that.
So you tend not to get a separate split
out of, what did the transient fires actually
contribute? Unless you want to do the ratio of how
much of the fire frequencies --
CHAIRMAN APOSTOLAKIS: In how many cases,
though, did they argue that there is not enough --
there are not enough combustibles in the room? So
we'll screen it out. That's when the transient
combustibles become --
MR. NOWLEN: Yes. We did get a lot of --
MEMBER KRESS: And transients I think are
more likely during shutdown conditions. And I don't
know if this included shutdown conditions at all.
MR. NOWLEN: It did not include the
shutdown conditions. And that observation has been
made by -- before.
In this case, back to George's question,
the areas that we tended to focus on for transient
combustibles in the review process were exactly those
ones you cite -- the areas where there weren't other
fix sources present, and those areas where they were
screened out based, for example, on administrative
controls.
We generally did not accept that as an
argument in and of itself to screen an area -- say,
well, I've got administrative controls, therefore, I
consider them so unlikely that I don't even have to do
any more evaluation.
We questioned those whenever we ran into
them and asked them to provide an explicit treatment
of transient combustibles for those areas. And in
response the licensees would come back with a
reanalysis that would give us a revised estimate.
And, again, even then the answers tended
to be relatively low contributions by the time you
take a fire frequency and a partitioning factor for
location and then you propagate it through the fire
modeling and credit suppression and things of that
nature. In some cases, severity factors would be
applied.
Let's see. Self-ignited cable fires was
an area where most of the licensees screen these as
fire sources. In particular, all of the newer plants
that had the newer style cable followed the FIVE
methodology guidance that said these fires apply only
to the older, unqualified cables. So if you have all
qualified cables, you can screen them.
So the newer plants did that. And even
for the older plants, the pre-1975 plants in
particular, most of them cited that they had back-
qualified their cables in the Appendix R days to the
flammability criteria of IPEEE 383. So they screened
them as well.
There were relatively few plants that did
include them explicitly and treated them. And, again,
for those cases they tended not to be very dominant.
They tended to be low contributions.
Okay. Jumping ahead -- getting into
methods and modeling issues. Again, I've mentioned
that we grouped these submittals in different ways or
into different groups. The FIVE -- in this case, the
FIVE plus the fire PRA guide studies, the ones that
began with FIVE and then moved into the PRA guide, the
ones who began with FIVE and then moved into other
types of PRA analysis not specifically referencing the
PRA guide, and those who jumped straight in to doing
a PRA from the get-go.
The selected -- again, I've covered this.
It didn't seem to have a big impact on the CDF. There
are some trends, but it's really hard to pull anything
specific out of it. And one point to make here is
that as with the other aspects of the IPEEE there is
one or more minor weaknesses that exists in virtually
all of the submittals.
For example, most of the submittals did
not include a detailed human factors analysis. And we
considered that to be a weakness of those submittals.
The most common exception was the MCR abandonment
scenarios. We did get a number of licensees who did
human factors analyses for those.
And we typically saw that they were
crediting the recovery actions that were modeled in
the IPE. In those cases, we typically looked to
ensure that they had considered whether those modeled
actions were reasonable given the context of the fire.
And in some cases, plants would go back and reexamine
their credited actions and would eliminate those that
were associated with, for example, actions within the
fire area that you're analyzing and would take those
out.
Our biggest concern here was some guidance
in the fire PRA implementation guide that had
suggested that you could do screening using the IPE
event trees directly. And since those included those
human actions, you're potentially screening by
crediting human actions that may not be possible. We
focused in particular on those and asked licensees to
go back and reexamine their screening if they didn't
credit those types of human actions.
MEMBER POWERS: Is there a database, so
that I can -- if I hypothesize a fire of a particular
time at a particular location, I can estimate the rate
of smoke generation?
MR. NOWLEN: A database? There are models
that do that kind of thing. They tend not to be the
models that are applied in this context. But there
are simulation models that do that kind of thing.
MEMBER POWERS: I guess what I'm asking
is, when you ask the licensees to consider, I hope you
ask them to consider the effect of fire and not the
affect of fire.
MR. NOWLEN: Yes.
MEMBER POWERS: Heat, smoke, and stress.
Do they have a good estimate of what the smoking rate
is?
MR. NOWLEN: No. No. They don't go to
that level. Typically, it's a judgmental assessment
of whether or not smoke is likely to build up in a
particular area. And, again, the typical response was
if it's the area that has the fire in it, you just
don't credit the actions. And that -- in fact, based
on other work, you know, that may be somewhat
conservative.
The other specific example that we ran
into was the control room. Typically, in the control
room they said things happening in the control room
are not impacted by fires occurring outside the
control room. That may be a little optimistic.
But, again, it was very typical. We
didn't argue that point especially. You know, again,
this is an area where there is still challenges for
PRA.
MEMBER LEITCH: There's a discussion in
Appendix B concerning heat loss factors.
MR. NOWLEN: Yes.
MEMBER LEITCH: -- gas layer modeling.
And it left me a little confused. Apparently, a
classical number has been .7, and there was some other
information that perhaps .95 could be used, and that
turned out to be not -- that turned out to be non-
conservative. And I guess was that number -- my
question is: was that number actually used any place,
or did everybody go with the .7 number? Or how did
that work out?
MR. NOWLEN: Okay. Ultimately, all of the
licensees used one of two numbers -- either .7 or .85.
Okay? And there were -- there was guidance that was
developed by EPRI, in cooperation with NRC. We worked
with them to develop the guidance.
A little background -- let me back up one
step. The heat loss factor is a simplified way of
treating heat losses to the walls and the ceiling
during a fire event. Most fire models treat that
directly. They do heat transfer and the walls absorb
heat and it goes away.
But under the FIVE methodology, there's a
simplified correlation for estimating how hot the hot
gas layer will get based on how much heat comes into
the room. But since a fraction of that heat goes into
the walls and is no longer available to heat the air,
we take away part of the heat.
Well, the heat loss factor is that
fraction of the heat that we take away. So .7 says
you're taking away 70 percent of the heat. You've got
30 percent left to heat the air. It's a simplified,
back-of-the-envelope kind of approach.
When the original methodology FIVE was
developed by EPRI, the recommendation was use .7, it
seems to work well, and it seemed relatively
consistent with the data that was out there. The fire
PRA implementation guide came out with new guidance
that said, well, in some cases it might be as high as
.97, .95, .85, and so they recommended new guidance to
use a new number.
And there was considerable discussion of
that. We did some comparison with -- of the
correlation to test data using the different numbers.
And as you say, the numbers tended to come out -- the
new numbers were non-conservative for the vast
majority of cases.
Again, now back to your question, we
ultimately settled on the two numbers -- .7 and .85.
And the difference here was another aspect of the EPRI
methodology. And this aspect was the virtual height
of the fire. Where am I putting the fire? Do I put
it on the floor? Do I put it on the top of an
electrical panel, for example?
Do I put it at the location of --
typically, under the FIVE methodology, if you put the
fire on top of a panel, then you assume the hot layer
would only descend to that level, the level of the
fire, and wouldn't go any further. So you would use
only the volume of the room above that point.
If you put it on the floor, you use the
entire volume of the room. Okay? What we came down
to is that if you had the fire source elevated well
above the floor, there was a criteria developed. If
you put it up high above the floor, then you could use
the higher heat loss factor. If you modeled the fire
on the floor, you used the .7.
And there are cancelling effects. Because
you've reduced the volume you end up with the same
temperature, which is really what we expect given the
same fire, whether it's up there or down here.
MEMBER LEITCH: Okay.
MR. NOWLEN: So that's how that got ironed
out.
MEMBER LEITCH: So no one actually used
the .97.
MR. NOWLEN: Not in the end, no. They all
went back and reexamined and applied the new numbers.
MEMBER LEITCH: Thanks.
MR. NOWLEN: Okay. Let's see, have I
covered this one? Yes, I think so.
MEMBER POWERS: I don't know whether this
is the point to discuss fire growth modeling, or are
you going to come to that?
MR. NOWLEN: I didn't really present
anything here on fire growth modeling. There is a lot
of detail in the methods, and I was selective on how
much of that I have covered. If you want to go there,
I'm prepared.
MEMBER POWERS: Well, one of the things
that continues to bother me about how you model these
fires is taking probabilities, applying them together,
on things that are not transparently independent. For
instance --
MR. NOWLEN: Sure.
MEMBER POWERS: -- you have an area with
a geometric factor, and you take some probability of
the fire -- where the fire is located, and then you
take some probability of the severity factor, and you
multiply them together to get the amount.
Do you see a lot of that kind of stacking
of probabilities on things that are not transparently
independent quantities?
MR. NOWLEN: We saw some of that and
attacked it where we saw it. The most common area was
severity factors overlapping other aspects of the
analysis. For example, if you're going to do a
severity factor that credits most fires are small, and
don't cause any damage, which was not at all uncommon,
then when you go to the detection suppression analysis
you need to base that on the fact that I'm now, by
definition, treating a large fire, because I've
eliminated all of the small ones.
We did see a bit of that, and we did
attack it fairly vigorously when we saw it. And the
typical response was a revised estimate that would
eliminate the double counting factors.
For example, a lot of people use severity
factors in lieu of a detection suppression analysis.
They said, you know, "Look, only one in 10 fires is
going to cause any damage, so I'll take a .1 and move
on. And I'm going to skip detection suppression
analysis."
We weren't entirely happy about those. It
tends to drive you towards a generic answer rather
than a plant-specific, case-specific answer. But so
long as we felt it was within the bounds of what we
would get from a detection suppression analysis, we
accepted it and said, "Well, again, within the context
of the IPEEE identifying vulnerabilities, okay."
But, you know, we did see various cases of
that. And, again, we did attack it when we saw it.
MEMBER POWERS: The COMPBRN code gets used
a lot in these analyses.
MR. NOWLEN: If I can correct -- the
COMPBRN code wasn't used a lot in the IPEEEs. A lot
of people used the FIVE modeling worksheets. That was
by far the most common. Relatively few actually went
to COMPBRN and IPEEE. But, yes, when they used codes,
COMPBRN was the code of choice.
MEMBER POWERS: The question comes up --
COMPBRN was written with a set of assumptions and
hypotheses. At least I tend to have seen people use
COMPBRN fairly indiscriminately. Did people tell you
about when they applied COMPBRN and when they did not?
MR. NOWLEN: I would say yes, because the
people who used COMPBRN tended to be the PRA studies,
the folks who jumped straight into PRA. And those
were typically done by people who were well versed in
fire PRA, and they used them in the way that they have
traditionally been used in fire PRA.
So with the people who did COMPBRN
studies, we had occasional issues about it, but it was
typically choice of parameters. For example, what did
you use for your ignition temperature? What did you
use for the damage temperature? Things of that
nature. Rather than fundamental abuse of the model.
Again, far more common in the IPEEEs was use of the
FIVE spreadsheet approach.
MEMBER POWERS: And certainly you
highlight the indiscriminate use of the glamorous fire
for every cable-to-cable transition known to man.
MR. NOWLEN: Yes. That was another one of
the fire PRA implementation guide issues, the fact
that a single fire test -- it was a USNRC test at
Sandia, 1975. That was used to develop guidance for
how fires would propagate from tray to tray.
And, yes, we had considerable difficulty
with the concept that you could extrapolate that to
all conditions. And, ultimately, those were typically
purged from the final answers. When questioned, most
licensees went back and just simply got rid of it and
said, "Okay. We'll do it a different way."
So you -- I think you will have a very
hard time finding any of the final analyses where that
really played any role at all. Yes. And we did --
again, that was one of the generic RAIs that was
addressed with EPRI.
MEMBER POWERS: Do you have a set of
documents for each of the submissions that you are
doing?
MR. NOWLEN: Yes. For each of the
submittals there is typically a technical evaluation
report written by the reviewers, and there is a staff
evaluation report. There is also a collection of RAIs
-- one, two, perhaps three rounds of RAIs, and, in a
more limited number of cases, site audits.
MEMBER POWERS: If I wanted to get those
documents, could I?
MR. NOWLEN: Alan Rubin?
MR. RUBIN: Yes, you can, in ADAMS.
(Laughter.)
Pardon me. That --
MEMBER POWERS: The question was quite
different and quite explicit. I asked if I could get
those documents.
(Laughter.)
MR. RUBIN: Yes. They are publicly
available.
MEMBER POWERS: It would be interesting to
see the one for Waterford.
CHAIRMAN APOSTOLAKIS: Steve, would you
say that detection and suppression are areas that were
not modeled very well?
MR. NOWLEN: There was a range of
treatment there. Again, you know, some people did
very well. Some people took a shortcut. For example,
a lot of the submittals used severity factors in lieu
of detection suppression analysis.
CHAIRMAN APOSTOLAKIS: Or just the
probability that comes from questionable sources.
Somehow this area never received serious -- as serious
an analysis as the growth factor. Is it because there
are things -- the detectors are so reliable that we
don't even worry about them?
MR. NOWLEN: Oh, no. No. I don't think
that was the case. It was simply that this was a
common area where a simplified approach was used --
again, severity factors.
For those who did do a more traditional
detection suppression analysis, it was typically based
on the fire PRA implementation guide -- again, had
developed a series of probability of suppression
versus time for different classes of fire. The
alternative approach was basing the analysis on fire
brigade response times.
They say, "We can get to -- we've done
drills. We can get to this area within 10 minutes."
We're going to assume that the probability that a fire
lasts longer than that is very low. In some cases,
they said, "No fires will last more than 10 minutes,"
and we would typically say, "Please go back and
reconsider the possibility of a long duration fire."
But, again, there is a very wide range.
There are some very excellent analyses done based on
fairly traditional PRA approaches, and there are some
very shortcut approaches based on severity factors,
and sort of everything in between.
Again, we -- in the context of these
reviews, we wanted to achieve a comfort level that
they had identified the vulnerabilities, and at least
were in -- we're identifying the correct areas that
were dominant contributors. And in this particular
case, what you find is you usually don't get to the
detection suppression analysis until you're already
dealing with your dominant contributors.
So for us as a review team it perhaps was
a lower priority than some of the other things. For
example, screening -- we paid a lot of attention to,
did they get the right screening results in the first
place? And when we got down to actual quantification
of what survived in the dominant contributors, we
tended to not focus quite as much on the details of
exactly what number they were using.
How they got there was certainly a
criteria. You know, gee, did you guys use a
reasonable approach? Does it at least seem reasonable
to us? Again, you're typically dealing with the
dominant areas by that point.
MEMBER POWERS: You use the word
"reasonable" a lot in this area. And it's troublesome
because you don't give me any idea of how your
reasoning satisfied them.
MR. NOWLEN: It's very difficult to
quantify the judgment of a panel of individuals
that --
MEMBER POWERS: Is it consistent with
experience? Consistent with databases? Consistent
with models? Those things I understand. "Reasonable"
is not a word I understand very well.
MR. NOWLEN: I shall reexamine every use
of the word.
MEMBER POWERS: And as Dr. Kress has
pointed out, I'm inherently unreasonable.
MR. NOWLEN: No comment.
(Laughter.)
CHAIRMAN APOSTOLAKIS: Coming back to the
screening --
MR. NOWLEN: Yes.
CHAIRMAN APOSTOLAKIS: -- there was no
need to assume probabilities for the detection and
suppression screening scenarios?
MR. NOWLEN: They typically did not in
screening. Typically, screening was limited to
likelihood of the fire, likelihood of -- or, I'm
sorry, likelihood of the fire, conditional core damage
probability given the postulated damage state of the
plants.
In a few cases we had people bring in
additional factors. For example, we would see
severity factors apply in a screening analysis that
did, in effect, bring in a detection suppression
credit. But, again, you know, that's that simplified
approach that I -- I wouldn't really call it detection
suppression analysis.
And, again, we often questioned the
factors that went into screening. If we saw too many
things going into screening, then they weren't willing
to declare that they were doing detailed analysis. We
would often say, "Hey, look guys, you're going into
the realm of detailed analysis, and we'd like to hear
more about that" -- was typically our approach to
that.
Anything else? Let's see, how am I doing
on this slide?
I think we've talked about the PRA
implementation guide. It was used quite widely by
licensees by the way. There were these 17 generic
RAIs, and ultimately revised guidance was provided to
resolve those RAIs within the context of the IPEEE.
Some of these still remain open in the broader context
of PRA, but within the context of IPEEE we resolved
them.
I think we covered the severity factor
approach. Again, widespread use by licensees of
severities, severity factors. About half of the
submittals used them in some form or another. And
various factors -- again, the fire PRA implementation
guide was a common source.
We were especially concerned when we saw
multiple severity factors being applied to the same
scenario, and those really raised a red flag in our
mind and we would chase those down, typically got
responses that would back off on the second and third
number that were applied and give us a new answer.
And, again, in my own view and what we've
cited in the report is that this severity factor, the
widespread use, tended to drive the answers towards
generic CDF estimates as opposed to plant-specific
estimates. And so long as you're satisfied that the
situation is not too far off from the norm, okay. If
we get situations where it appeared like you've got
something unusual here that might warrant further
review, we would question those.
Okay. Getting close.
MEMBER POWERS: In the end, coming up with
an answer -- how do we know when they do the severity
factors that they're getting a good answer?
MR. NOWLEN: In the broad context, that is
an extremely difficult question. In the context of
the IPEEE, again, we went back to the -- to the team
having a comfort level that the licensee didn't miss
a vulnerability, they've got the right dominant areas,
they've got the right scenarios. Maybe we don't like
the number, but, you know, the bigger picture --
MEMBER POWERS: They were developing
plausibility there.
MR. NOWLEN: I think so, yes, in a sense.
We tried not to get overly focused on the final
numbers, until you got something like 5E-3. Then, you
know -- that's an interesting number.
MEMBER POWERS: How about 5E-9?
MR. NOWLEN: Yes, that one was an
interesting number as well.
(Laughter.)
Okay. Again, I mentioned that, you know,
of these issues there are a number that do remain open
to debate I think in the broader context of PRA, the
panel fire issues, severity factors. Barrier
reliability was another one that I think still -- and
gets to the issue of the room to room.
Firefighting, how we credit firefighting
is still an open issue. Effectiveness of fixed
detection and suppression. And these are all things
that are -- insights that are being transferred to the
research program, so, you know, you've seen other
presentations on the research program, I'm sure, and
so you should see a lot of parallelity between this
list and what's going on in the research program.
MEMBER POWERS: When you say "non-code
compliant," you're speaking NFPA code for --
MR. NOWLEN: Yes. Yes. There was a
particular question raised in our reviews regarding
code compliance. A lot of the nuclear powerplants had
retrofitted fire protection systems, and in a retrofit
situation it's sometimes difficult or impossible to
meet code. So there are various code non-compliance
issues that you'll run into.
In this particular context, what we
typically did is we asked the licensee, are your
systems code compliant? Yes or no. We did not, then,
ask them to go back and, if the answer is no, use some
other number. We simply tried to use it as a flag to
say here are cases where the generic reliability
values may not be directly applicable because of these
non-compliance issues.
But this is another area where, you know,
is there a basis for adjusting the numbers?
Absolutely not.
So we didn't ask the licensees to advance
the state of the art and give us some alternative
number. We simply tried to use it as a flag that
would flag that for future attention that, gee, there
are non-compliance issues for a particular plant
and --
MEMBER POWERS: What other compliances are
-- non-compliances are --
MR. NOWLEN: Yes. A lot of them can be
nits. Some are not nits. And we didn't go to that
level. For the purposes of the review, again, we --
we flagged it that the TER typically will say the
licensee was asked, and they have said no, this might
be an area for attention in the future if these values
are used elsewhere, for example.
MEMBER POWERS: Elevations.
MR. NOWLEN: Elevations, yes. Whether,
you know, the detectors are 10 feet apart or nine and
a half feet apart or, you know -- you can get some --
you have a very minor -- or minor non-compliance
issues. In some cases, they are not minor, though.
And, again, we didn't try and --
MEMBER POWERS: It's very important.
MR. NOWLEN: It can be, yes.
MEMBER POWERS: But sometimes the non-
compliance is not very important.
MR. NOWLEN: Exactly. And we did not --
without going onsite and inspecting the system, you
can't make that kind of a judgment. And so we didn't
attempt to. We simply tried to flag them.
And, again, how we deal with that in the
future -- good question. You know, PRA still has
challenges here, and that's one.
So, conclusions. In a lot of ways a lot
of things we thought we know seemed to have been
confirmed. You know, again, we're seeing the fire
CDFs that are coming in on the same order as the
internal events values. You can argue how
conservative some of those numbers are.
That's been the wide perception, that --
MEMBER POWERS: We have Appendix R. We
end up with a system that, as Nathan will point out to
me pretty quickly, has not a great deal of redundancy
in it. Why wouldn't you think that it would even have
a higher CDF than --
MR. NOWLEN: This perception is based on
past PRAs, and past PRAs have gotten that answer.
That's where our perception derives -- 1150. Even the
early studies that came out of UCLA, Indian Point,
they have consistently come up with an answer that's
on the same order as the internal events, and that's
what we saw here as well.
So, you know, is the answer conservative?
Is it not? Well, all those debates remain. But, you
know, again, the IPEEEs are pretty consistent with
what we've seen in past PRAs in that regard.
Again, main control rooms -- they were
found to be important. IPEEEs, we've seen that
before. Emergency switchgear, the insight regarding
multiple cable spreading rooms, those are all
consistent. And also, plant-specific configuration
issues having so much to do with the fire risk. We
saw that here as well.
There were various things that would make
an individual plant -- a room in an individual very
important, whereas other plants you wouldn't expect to
see that -- the battery/charger rooms. You wouldn't
normally expect those to show up generically, but for
particular plants they turned out to be important.
We've seen that in the past as well.
MEMBER POWERS: Your significance
determination process -- why is it based on generic?
MR. NOWLEN: Well, PRA is based on a lot
of generic stuff, too. I mean, we use generic flyer
frequencies. We use generic reliability of
suppression systems. You know, there's a lot of
generic things that go into any fire PRA. So, you
know, you don't have enough data to get plant-specific
on every single item.
You know, fires happen, but they don't
happen every day. So at some level we have to be
satisfied with that, and, you know, judge the results
accordingly.
MEMBER KRESS: Let me ask you a question
about your first bullet again.
MR. NOWLEN: Sure.
MEMBER KRESS: I let it get by me before
I caught it. The fire CDFs are normally the same as
the IPE. That's an average number. Did you have any
correlation between if it had a high CDF and IPE
value, did it also have a high fire? Or was there any
correlation between those things?
MR. NOWLEN: This is a slide that I
skipped because it -- it's hard to figure out what it
means to us. But I'll go back and show it, if I can
find it.
MEMBER POWERS: I'll just comment while
he's looking. Tom, I did plot them, and I had a hard
time coming to that conclusion, that there was a tight
correlation.
MR. NOWLEN: What you have here is this is
the ratio of fire to internal events versus fire CDF.
So, you know, we have cases where fire was, you know,
10 times or more. So you do tend to see that the ones
with the higher fire CDFs tend to have the higher
ratios as well. Exactly what that means -- difficult
to say.
You know, you can come up with a lot of
explanations for why that might be so. Maybe there's
more uniformity in IPE, more variability in fire. But
you look across the board, that doesn't seem to be
borne out.
MEMBER KRESS: That's sure an interesting
plot, I'll have to admit.
MEMBER POWERS: Take out the top two
points and the bottom three. You'll see what the
problem is.
MR. NOWLEN: Yes, it's largely a shotgun
blast. You've got a -- well, there's our 10-8 plant
again.
MEMBER KRESS: Except the BWRs do seem to
have a correlation.
MR. NOWLEN: Well, they both seem to trend
a bit. You know, you can -- you know, the desire to
draw a straight line through there is almost
irresistible. But, again, how do you interpret it?
We originally did this as trying to show
the ratio of internal to fire, and we said, "Well, we
need to spread it somehow." Well, let's spread it by
fire, and this is what we found. And it -- we've
scratched our heads ever since, and we've come up with
at least six explanations for why that might be true.
So in the end, we -- this particular plot
is not in the report, because there are so many
potential explanations that you can come up with for
why that might be so, and it -- you know, you could
make a career of exploring those I think.
MEMBER KRESS: Well, it's probably because
if you have a high CDF plant, it's vulnerable to
failures and the fires create the same sort of
failures.
The point I wanted to make, though, is if
I were thinking defense in depth, and I had CDFs due
to fire that were -- you know, if I were trying to
control my CDF and I had one of these high CDF plants
that I wanted to control, I'd put a lot more attention
on the fire, even though it's comparable, because
there is such a big uncertainty in it, and that's what
the defense in depth is. It's supposed to deal with
uncertainty. It seems to me like that's --
MEMBER POWERS: Only when you're a
rationalist. When you're a structuralist --
MEMBER KRESS: When you're a
structuralist, you don't care. Right.
MEMBER POWERS: -- it deals with the fact
that you're probably wrong about all of these
analyses.
(Laughter.)
MEMBER KRESS: Yes. I just wanted to get
my defense in depth --
(Laughter.)
MEMBER POWERS: I mean, but you raise
another point. That you have this number that often
times is comparable, and yet you are putting far more
attention on each little nit in the operational
incidences. And we have -- I mean, this is like
having one scenario in a CDF that's big. And the
question is: is fire getting its fair --
MEMBER KRESS: Due attention. That's
exactly my point.
MEMBER POWERS: And before I'm willing to
trudge off and do a lot of things on fire, I think I
want to look a lot harder at these CDF calculational
techniques, because there's lots of judgmental
components to it.
I mean, it's a lot of metaphysical things
that we're never going to be able to compare them
against them. I think you want to look at them fairly
closely before you jump too much on this, but it looks
like it's worth jumping on.
MEMBER KRESS: Yes.
MR. NOWLEN: Okay. We -- I'm sorry?
MEMBER POWERS: Fire is the only place in
the regulations where defense in depth is defined.
CHAIRMAN APOSTOLAKIS: Not anymore. Well,
the white paper I guess is not a regulation.
MEMBER POWERS: The white paper is not a
regulation. 1.174, contrary to what you may think, is
not a regulation.
CHAIRMAN APOSTOLAKIS: It carries a lot of
weight, though.
(Laughter.)
MEMBER POWERS: Only with you.
(Laughter.)
CHAIRMAN APOSTOLAKIS: In fires you have
a lot of --
MR. NOWLEN: It's true. Fire is -- you
know, as a discipline, fire has treated defense in
depth for --
MEMBER POWERS: Let's not congratulate
ourselves too much here. Fire may well cull out
defense in depth, and it may have a prescription for
defense in depth. It has not been -- fire protection
has not done as vigorous a job in the area of
diversity and redundancy.
CHAIRMAN APOSTOLAKIS: That's right.
MR. NOWLEN: Defense in depth is more on
the phenomenological side.
MEMBER POWERS: It is the classic
structural approach to defense in depth, which, of
course, is the appropriate approach to take.
(Laughter.)
MR. NOWLEN: Okay. Returning to the
conclusions, again, I've mentioned we had a few
surprises. The turbine hall showing up in as many
plants as they did show up I think was a bit of a
surprise. You know, in the diesel generator battery
room kinds of areas showing up -- again, those are
plant-specific features.
MEMBER POWERS: Do you wonder if turbine
fires show up because people spend a lot of time
looking at them after things like Narora, and what
not?
MR. NOWLEN: I think there is an element
of that, sure. But from a more traditional
perspective of fire protection, the turbine hall is
where all of our worst fire hazards are. So if we're
going to have bad fires, it's the most likely place to
have bad fires.
The risk comes in when you combine that
potential for a bad fire with collocation of important
equipment and cables. And that's where these cropped
up, and I guess we were a bit surprised to see as many
plants that had that much safety equipment in turbine
halls. You normally consider that secondary site
power generation. You might have offsite power.
But when you start finding emergency
switchgear and cables routing through the turbine hall
to get to the reactor building, things like that,
that's what cropped up here. And we had -- again, in
comparison to what had been done in earlier PRAs, you
don't see those kinds of areas showing up.
MEMBER POWERS: I think that's -- the
words that you just appended on, why it was a surprise
to -- they need to appear a little more strongly maybe
in your executive summary.
MR. NOWLEN: Okay.
MEMBER POWERS: I mean, it's just
something -- go back and look and make sure that it's
really reflecting what you've learned out of this.
MR. NOWLEN: Okay.
MEMBER LEITCH: Do you know if any of the
licensee corrective actions included the use of
synthetic fire retardant lubricants in the turbine
blue boil system?
MR. NOWLEN: Well, I don't remember seeing
that in any of the plant improvements. That's
something that has happened for other reasons. You
know, in a lot of pumps, in fact, we use high fire
point oils and things like that. I don't remember
seeing any cases where that was cited as an
improvement.
MEMBER LEITCH: I think it's fairly
commonly used in the electro-hydraulic control system
but not in --
MR. NOWLEN: Okay.
MEMBER LEITCH: -- the lubricant system,
that I'm aware of. I was just --
MR. NOWLEN: I'm not qualified to answer
that. I'm afraid I don't know the answer.
Let's see. Again, I've mentioned the
point that, you know, we did have a lot of debates on
methodology as a part of the review process. We've
resolved those to our satisfaction in the IPEEE
context, but a number of those still do remain open.
And, again, they're being addressed through the other
research programs.
I think overall we have concluded that all
of the licensees did meet the intent of the IPEEE
process with regard to fire. We did have two
licensees that at some stage of the analysis cited
that vulnerabilities existed and took actions to
address those. And we have most of the licensees
identifying at least one improvement, and often
several improvements.
Sixty-four percent of all the submittals
cited at least one improvement, and I think, again,
that's a good news story.
And with that, unless there are other
questions, I'm done. Thank you very much.
CHAIRMAN APOSTOLAKIS: Okay. Our next one
is by Brad Hardin.
MEMBER POWERS: Brad has an easy topic.
Everything else, right?
(Laughter.)
MR. HARDIN: Good afternoon. I'm Brad
Hardin, and I'm going to talk to you about high winds,
floods, and other external events. Sometimes we refer
to them as HFO events.
And I'd like to acknowledge the other
members of our team here, because I didn't do the HFO
reviews for all of the plants. Alan assigned each of
the team members a certain number of plants, and for
each of those plants that we were assigned the staff
member did the individual review.
And some of those people are here today.
There's Ed Chow and John Ridgely; Art Buslik; and Uril
Chelia, who is no longer in our area but he did some
of those I think earlier; John Chen, who is retired;
and Bob Kornasiewicz, who is retired also, acted as an
advisor to us in this area.
MEMBER POWERS: Is there cause and effect
here?
(Laughter.)
MR. HARDIN: Maybe. And Mike Bohn from
Sandia also was very helpful in the SRB meetings.
MEMBER POWERS: And he has left the area.
(Laughter.)
MR. HARDIN: All of the staff people that
did the HFO reviews were involved in all of the SRB
meetings as well and prepared RAIs. We had a number
of RAIs in this area, maybe not as many as for seismic
and for fire, but we did have a fair number of them.
The areas that I'm going to cover -- and
I'll try to do this quickly so we have time to do the
other things as well -- types of events that are
included in HFO, the type of screening methodologies
that were used by the licensees, and a summary of
results, methodologies. We can break up the results
into qualitative and quantitative results, talk about
each of those. And then plant improvements, which
there were quite a few of, and so that's an important
area to talk about, and then conclusions.
As Dana said, this area covers just about
everything that's left I guess. And that would be
high winds, including tornadoes, tornado missiles and
hurricanes, external floods, including intense
rainfall, flooding from nearby bodies of water, such
as lakes, the ocean, rivers, including wave run-up and
postulated dam failures, both upstream and downstream,
transportation accidents --
MEMBER POWERS: What is a downstream dam
failure? Loss of water? Is that --
MR. HARDIN: Yes.
MEMBER POWERS: Yes.
MR. HARDIN: Yes, that would be more like
a loss of water in that case.
Transportation accidents from highway,
aircraft, train, and barge. And then accidents at
nearby industrial and military facilities. And then
one that's kind of close and related to that would be
there are other types of external events -- some of
the type of industrial equipment that they might have
on the plant itself, like nearby pipeline accidents,
release of hazardous materials from onsite storage,
like chlorine and various chemicals, hydrogen, fuels,
effects of temperature extremes, blockage of drains,
and intakes by debris.
MEMBER POWERS: You say effects of
temperature extremes. Does that include the frazzle
ice kind of phenomena?
MR. HARDIN: I'm sorry, Dana.
MEMBER POWERS: Frazzle ice?
MR. HARDIN: Yes. Perhaps breakdowns of
equipment due to low temperatures, but I guess
typically.
And then any plant-unique hazards,
anything particular to a plant because of its unique
design. I don't think we found many things like that,
but those were included as well.
The licensees were given a number of --
I'm sorry, I forgot to put one of the viewgraphs up.
They had a number of options they could use in
reviewing HFO. All of the licensees -- first of all,
they had to review their plant-specific hazard data
and the licensing basis for the plant compared to the
FSAR. They had to identify any significant changes
that might have taken place since the operating
license review.
At that point, if they wanted to make a
comparison of the plant with the 1975 standard review
plan criteria, if they decided that they could satisfy
all of those criteria they were pretty much home-free,
and they could just document that.
They had a choice. In addition to doing
that, they could also do a PRA, or they could look at
the hazard frequency for various things like wind
events or flooding. And if they determined that that
was significantly low frequency they would be all
right also.
And so I think we'll see that there's a
combination of all of these different approaches that
were used. Sometimes plants combined SRP criteria
review along with some of the quantitative approaches,
such as the hazard frequency or the PRA.
And the PRAs were done with this different
level. Some of them were fairly complete PRAs. Maybe
they used one that they had in existence already. In
other cases, they did a partial PRA just for the
subject that they were interested in.
And this slide indicates the choices that
were made by most of the licensees. Many of them,
most of them, like 80 percent, decided to do the
qualitative screening approach using a comparison with
a standard review plan. About 15 percent performed a
PRA, which was either a full PRA, partial, might have
used more conservative bounding parameters or could
have been best estimate.
Less than five percent of the licensees
chose to use a hazard frequency approach, so that
wasn't as popular with them.
And a summary of the results -- there were
no vulnerabilities identified. However, there were
quite a few improvements made. So even though they
didn't identify anything as a vulnerability, they did
choose to make quite a few changes and improvements to
their plans.
Most of the submittals did not define what
constituted a vulnerability. I think you heard a
little bit of discussion earlier about
vulnerabilities, and that in many cases they did not
define what they were. They indicated to us that they
did not find a vulnerability.
About half of the plants reviewed -- 34
submittals -- reported plant improvements. And in the
same cases as were reported for seismic and fire, many
of these were not reported as having been completed
yet, but they had been identified. Some of them were
still being evaluated, and we did not know if they had
actually completed all of those.
MEMBER UHRIG: These were not required
improvements.
MR. HARDIN: No. We did not require any
improvements.
MEMBER UHRIG: It was their own self-
improvement.
MR. HARDIN: That's right.
Of the 34 submittals, there were a total
of about 64 improvements. So, obviously, some of the
plants made more than one improvement. And of these
improvements, they were about half procedural and half
hardware-related.
MEMBER LEITCH: I can't find the reference
here, but I seem to recall reading that Turkey Point
had more improvements than anyone else.
MR. HARDIN: That's right.
MEMBER LEITCH: Like five.
MR. HARDIN: Yes, that's --
MEMBER LEITCH: Okay. Yes, okay, there it
is right there. And I guess -- does that say that
they had -- based on their experience with Hurricane
Andrew they perhaps recognized some things that the
rest of the industry did not?
MEMBER UHRIG: They also have determined
that it leaves a lot of things --
MEMBER LEITCH: Yes. Yes.
MR. HARDIN: I guess that's possible. I
don't know.
MEMBER LEITCH: I mean, it would seem to
me that -- you know, that they were there, and they
perhaps have a better understanding of these kinds of
issues than some of the other ones. Maybe they got
religion and the others didn't. I mean, I just -- I
just wonder if the kind of things they did are
applicable to the rest of the industry.
MR. HARDIN: That could be true. I don't
remember if there were other plants that made
reference to Andrew. I think there might have been.
There may have been other plants that referred to
lessons they learned from that. I'm not sure.
MEMBER POWERS: So there's been a --
following Andrew, there was a lot of attempts to
publicize -- I mean, people were forever making talks
about what was learned at Turkey Point in connection
with Hurricane Andrew. So it's not like it's hidden
information. But whether they got religion or not, I
don't know.
(Laughter.)
Andrew was a big earthquake. I mean, a
big hurricane, but it wasn't the biggest that you
could hypothesize. And, in fact, what I understand is
we're headed into periods of time when we'll have
bigger ones.
MEMBER UHRIG: Andrew was a very unusual
hurricane because it did not have a storm surge. It
had -- most of the damage was wind. Very, very high
velocity winds -- 170, 180 miles per hour.
MR. HARDIN: I'm thinking a little bit
more about your question. I think my opinion is that
probably there were not too many plants that might
have missed opportunities to make similar
improvements, because a little bit later -- and I'll
show you what some of those improvements were -- and
quite a few of the plants did similar things in this
area for flooding.
MEMBER LEITCH: Okay.
MEMBER POWERS: Do we still require plants
to shut down if a hurricane is imminent?
MR. HARDIN: I can't answer that. I don't
know.
MR. RUBIN: Dana, yes, that's correct.
That's still part of the procedures for station
blackout.
MEMBER POWERS: But we have this
incredible low probability of damage.
MR. RUBIN: This is defense in depth.
MEMBER POWERS: Good man.
(Laughter.)
CHAIRMAN APOSTOLAKIS: When in doubt --
MEMBER POWERS: But we're not in doubt.
We've done the analysis.
CHAIRMAN APOSTOLAKIS: Often wrong but
never in doubt.
(Laughter.)
MR. HARDIN: I know that some plants have
criteria that shut down if a flood level reaches a
certain -- a certain level to where they don't feel
they have enough margin anymore.
MEMBER POWERS: Well, I mean, of course
the difference is that if -- I mean, the situation is
that if a flood level is very high, or the hurricane
is imminent, now it's a conditional probability.
Whereas these numbers are annual probabilities.
MR. HARDIN: Okay. Just go through
quickly on the remainder of this one. Flooding
accounted for the largest percentage of improvements
-- about 50 percent of those. High winds was next
with 27 percent. Transportation or nearby facility
accidents was about eight percent. And then other
external events was about 15 percent.
There were some improvements that were
cited that were of interest to us because they were
related to HFO areas, but these were done independent
of the HFO review, the IPEEE review. And there were
36 plants that reported that based on their review
they concluded that there were no improvements
necessary.
MEMBER POWERS: Let me ask a question
about questions of timing on these. We have -- the
IPEEE was asked for like in '91, some early time. And
now -- and in between the two we had a flooding event
at WMP II. Was that recognized in this -- in these
responses?
MR. HARDIN: I don't recall that it was.
MR. RUBIN: What are you referring to?
MEMBER POWERS: Where at WMP they had --
the fire system --
MR. RUBIN: The internal flooding.
MEMBER POWERS: Yes.
MR. RUBIN: That would come under the IPE,
the internal flooding, rather than -- this is,
remember, an external flooding assessment.
MEMBER POWERS: Okay.
MR. RUBIN: That's what I thought you were
referring to.
MEMBER POWERS: Yes.
MR. HARDIN: Some more results. All of
the licensees screened out accidents involving
transportation and nearby facilities, meaning they
tried to quantify that area. They concluded that the
core damage frequency contribution was less than 10-6,
or else through their standard review plan review they
screened it out in that way.
And the same thing with plant-unique
hazards. Those also turned out to be pretty low on
the importance. I don't recall actually that any of
those were identified. Most licensees indicated that
some form of walkdown had been performed during the
HFO review.
Sometimes it wasn't specifically stated,
but I think when they indicated that they had followed
the standard review plan review approach that would
require that they do a walkdown in conjunction with
it, so I assume that they did use walkdowns. And I
think it's clear from the improvements they made that
walkdowns are very important to them in this area,
too.
None of the 70 submittals determined that
there were any particular containment performance
issues that were unique to external events. Similar
issues, as with an IPEEE, were the ones that showed up
in IPEEE.
Some examples of plant improvements --
protection against high winds, there were procedures,
sheltering plans, protection of diesel generator
exhaust system from tornadoes. There were missile
shields in some cases, strengthening of exhaust stacks
of a nearby fossil plant to protect against collateral
damage. That's an interesting one.
Protection against external floods, and,
again, procedurals, increased inspection of roof
drains, improved emergency procedures in the event of
dam failure.
MEMBER LEITCH: That exhaust stack in
nearby fossil plants, is that Turkey Point, do you
know?
MEMBER UHRIG: Yes.
MEMBER LEITCH: Because I know that --
MEMBER UHRIG: One of the stacks actually
went down, and the other one was damaged. I don't
know whether they took it down to rebuild it or not.
MEMBER LEITCH: I think Waterford has some
adjacent fossil units, too. It's an interesting thing
to see. I don't know how adjacent is adjacent, but --
MEMBER UHRIG: Well, Turkey Point was
close enough that it could create problems, not on the
reactor but on the turbine deck.
MEMBER LEITCH: Yes.
MR. HARDIN: Some more improvement
examples for external floods. The addition of
scuppers in the roof parapet walls to aid drainage and
reduce roof loading during heavy rainfall. That was
probably the most common improvement that was made by
a number of plants.
It kind of goes along in line with the
other one of improved -- increased monitoring to make
sure that debris doesn't clog the drains in the roofs.
Upgrading flood-resistant doors. Improved penetration
seals between the service and auxiliary buildings was
done at Salem, and that was very significant for them.
They had calculated a contribution to core
damage about the order of 10-4, and by improving the
penetration seals they were able to show a reduction
down to about 10-7. And the reason for that was, on
that particular plant, in that area all three
emergency trains had cables that were not separated,
and they could all have been flooded and could have
shut down all of their emergency service.
Protection against accidents involving
transportation or nearby facilities, plant guidelines,
excluding all flights over plants. This would be not
just overflights by commercial companies, but in one
case I guess company pilots had not been restricted
before, and so they were given guidelines to prevent
them from flying over the plant itself. Prevention of
barge shipping of explosives in nearby shipping
channel.
Protection against accidents involving
transportation or nearby facilities continued.
Addition of backup cooling water intake structure to
protect against barge accidents. Addition of concrete
barriers surrounding propane tank near the diesel
generators to protect against possible vehicle impact.
Protection against external events
included guidance regarding onsite storage and
transportation of hazardous materials, review of
control room habitability as affected by onsite
storage of hazardous materials such as chlorine. And
modifications to prevent ice formation on diesel
generator service water pumps.
Some more -- addition of screens on drains
to prevent foreign material intrusion into safety-
related equipment spaces. Modifications to
ventilation exhaust systems to protect against
potential combustible gas explosions. And
modifications to plant intake structure to prevent
blockage from debris.
Now we go into a summary of quantitative
results. We did have some quantitative results for
the HFO areas. On the range of the estimates of
contributions to core damage frequency for high winds
and tornadoes, they range from about two times 10-7 to
six times 10-5 per year. For floods, they range from
two times 10-8 to about seven times 10-6. And I
mentioned before the improvement that Salem had.
Transportation and nearby facility
accidents -- we didn't have any values reported other
than that they were all screened out. They were less
than the criterion of one times 10-6 per year. The
same thing with the plant-unique events.
MEMBER POWERS: That transportation and
nearby facility accidents -- that just reflects the
fact that that's something that's covered by a
standard review plan, gets examined in fair detail?
MR. HARDIN: I would think so. I can't
remember. Volume 2 lists a summary of each of the
areas of review for HFO and whether there was a PRA
done. And I don't recall if any of the plants
actually calculated something. I think you're
probably right.
MEMBER POWERS: I mean, we've just
basically put out a revised standard review plan in
regard to this stuff. People look at it fairly
closely.
MR. HARDIN: I think you're probably right
on that.
Some more external event quantitative
results. Haddam Neck reported for lightning about
eight times 10-6 per year.
MEMBER POWERS: It says that in the
document, and it doesn't come back and say, "And other
people reported much lower values for lightning." Is
it the case that only Haddam Neck looked at lightning
or --
MR. HARDIN: I think there were other
people that used PRAs to look at this, and they got
values that were much lower than that. Haddam Neck
had the highest values, and that's why we're reporting
those.
MEMBER UHRIG: That area is not the
highest incidence of lightning in the country. It's
much more severe in southwestern Florida.
MR. HARDIN: Yes.
VICE CHAIRMAN BONACA: Some people have
evaluated it.
MEMBER POWERS: Well, they do evaluate it
through these peculiarities of how you do the
probabilistics. They draw an area, and say, okay,
well, the frequency of the lightning strikes is so
much here, so the chance of hitting this little tiny
vulnerable component that happens to be a spike on the
top of the loop is --
MEMBER KRESS: Is the ratio of the areas.
MEMBER POWERS: -- is the ratio of the
areas instead of --
MEMBER KRESS: Strange thing.
MEMBER POWERS: The probabilistics are
often very strange.
VICE CHAIRMAN BONACA: I know something
about the snow, for example. You know, that was just
simply discovered in that -- the roof of the building,
the auxiliary building that contains a lot of
safeguards, too, is designed to sustain as much as six
inches of snow. I mean, it's a tin roof.
Yes. So that procedures to clear the roof
-- fortunately, of course, we have a high temperature
inside that building. That will keep the area melted
to some degree. But if you get to low enough
temperatures you have accumulation of ice.
So, I mean, there was, you know, insight
there that leads you then to have some procedures to
clear the roof to make sure you are aware of that.
So, but --
MR. HARDIN: I think, unfortunately, we
really don't have much reported information on
lightning from the plants. Haddam Neck reported it.
There were other plants that reported that they used
a PRA to do the HFO review, but they didn't tell us
specifically for the different areas. So we just
don't have information on it.
And South Texas reported about eight times
10-6 per year for chemical release. And, again, I
think there were other plants that reported chemical
releases, but that was the largest one.
MEMBER KRESS: Is that close to the oil
refinery or what?
MR. HARDIN: I'm sorry?
MEMBER KRESS: Is that an oil refinery or
close to --
MR. HARDIN: I kind of think so down
there, but I don't recall what the specific facility
was.
MEMBER KRESS: It's being expanded in
South Texas.
MR. HARDIN: I'm not going to --
CHAIRMAN APOSTOLAKIS: We have a whole
presentation on unresolved safety issues.
MR. HARDIN: Yes. So I'm just flashing
this up here. This is just to indicate that in the
HFO area there are some generic issues that had to do
with these topics. And John Ridgely will go into
those in more depth.
Conclusions -- there were no HFO-related
vulnerabilities. About 50 percent of the plants made
HFO-related improvements. And relative to the other
external event challenges, HFO contributed
significantly less to overall plant core damage
frequency.
Based on the extent of the documentation
by the licensees, and the discussions that they gave
us on this area, it would seem that they actually had
done quite a bit of work, and they probably learned
quite a bit about their individual plants, so that
hopefully if they were to have an event like this they
would be better prepared to take care of it.
MEMBER POWERS: It really is the
overwhelming sense that you get in that section, that
they did a lot more than I would have thought they
would have done.
MR. HARDIN: There was quite a bit of
material submitted to us. I think it did leave you
feeling that they had done a fair amount of work
there, and they responded to a number of RAIs in that
area, and there were quite a few improvements,
obviously, that they made.
MEMBER POWERS: Good.
MR. HARDIN: These next slides I don't
think you need to see them unless you want. Just as
an example of what they were, this was just to show
you what some of the quantitative results were, so --
CHAIRMAN APOSTOLAKIS: We should reserve
some time for the next speaker, I think. Any other
questions for this particular -- on this particular
subject?
Thank you, Brad.
MR. HARDIN: Thank you.
CHAIRMAN APOSTOLAKIS: What time do the
members disappear?
MEMBER POWERS: 4:00.
CHAIRMAN APOSTOLAKIS: Okay. Tom?
MEMBER KRESS: 4:00.
CHAIRMAN APOSTOLAKIS: So it looks like at
4:00 we should -- well, we still -- we will take a 10-
minute break. So we'll start at 3:00.
(Whereupon, the proceedings in the
foregoing matter went off the record at
2:50 p.m. and went back on the record at
3:00 p.m.)
CHAIRMAN APOSTOLAKIS: Back in session.
Now, you are threatening us with 47
viewgraphs here.
MR. RIDGELY: Not actually. I've added
two.
(Laughter.)
VICE CHAIRMAN BONACA: Originally, he had
seven.
(Laughter.)
CHAIRMAN APOSTOLAKIS: Before we adjourn,
I would like to go around the table and get the
members' views regarding, first, whether we want to
write a letter, and, second, general comments. So we
don't even have an hour for this subject.
MR. RIDGELY: Right. Which is why I'm not
going to focus on what the issues are, because these
issues have been discussed with the ACRS previously.
CHAIRMAN APOSTOLAKIS: Okay.
MR. RIDGELY: And so there is no
discussion of that. It's only on the materials
presented. And I guess I should apologize. My name
is John Ridgely, for the recorder.
CHAIRMAN APOSTOLAKIS: Okay.
MR. RIDGELY: And I do hope to go rapidly
through this. But I do hope to get to your questions
also on there.
CHAIRMAN APOSTOLAKIS: Okay. You have
half an hour.
MR. RIDGELY: All right. This is what I
propose to do -- list the issues, talk at them --
about them one at a time, talk a little bit about the
review process, provide a summary of each of the
issues with a description -- short description,
findings, related improvements -- and then come up
with conclusions.
The licensees were explicitly requested to
address these particular issues -- USI A-45, Generic
Issue 103, 131, and 57, and the Sandia fire risk
scoping study issues. They were not explicitly
requested to look at these issues -- GSI-147, 148,
156, and 172.
However, during the IPEEE process it was
concluded that if the licensees had made an adequate
submittal that we could also most likely resolve some
of these issues.
The importance of this slide is to show
that what we have here is an interrelationship between
not only the issues -- multiple issues -- but they
appear across also multiple generic issues. So these
are very highly interrelated.
On the review process, the licensees'
IPEEE hopefully is complete with regard to these
issues. The licensees' assessment was to demonstrate
an indepth knowledge of the external events as they
related to these generic issues. And the licensees'
assessments results are reasonable, given the design,
location, features, and operating history of the
plant.
An issue is, thus, considered resolved if
no potential vulnerabilities associated with its
related concerns were identified in the submittal or
plant-specific improvements to eliminate or reduce the
significance of the potentially identified
vulnerabilities were implemented at the plant.
Most submittals contained information that
addressed most of the generic issues. If information
on an issue was incomplete, then that was taken up
with the Senior Review Board and the reviewers to
determine whether the missing information would lead
to an important finding or would lead to a potentially
significant vulnerability that might have been
overlooked.
In these cases, requests for additional
information were sent out to the licensees and we
proceeded from there. If not, then the potential
vulnerability -- if a potential vulnerability was not
missed, then the SER listed the missing information as
a weakness. In such a case, the submittal would still
meet the intent of the Generic Letter. And for those
where the generic issue or sub-issue is not closed,
the staff will determine separately from the IPEEE
program if there is any need to do any further work to
close those particular issues.
USI A-45, Shutdown Decay Heat Removal
Requirements, the objective was to determine if the
decay heat removal function is adequate, and whether
cost-effective improvements could be identified. In
reviewing the submittals, we found that adequate
information was provided in the submittals to resolve
this issue.
The decay heat removal equipment was
included in seismic and fire PRAs. The equipment was
included, and seismic margin analysis in the form of
a safe shutdown equipment list. For the seismic
margin analysis, each component's high confidence of
low probability of failure value was determined.
We've concluded that all plants have
adequately addressed USI A-45. All plants have
identified at least one method of removing decay heat
and no vulnerabilities were identified.
Generic Issue 57 --
MEMBER LEITCH: Can I ask I guess just a
process question? If you have concluded that all of
the plants meet USI A-45, then will ACRS be getting a
look at that for closure? Is that the way that's
going to work?
MR. RIDGELY: I believe this is it. This
issue has been brought to the ACRS previously, and the
ACRS has written letters I think on some of these, and
they've identified that they're going into the IPEEE
program for resolution. Some of them they've dealt
separately with.
MEMBER LEITCH: Okay. Okay. Thanks.
MR. RIDGELY: You're welcome.
GSI-57 is the effects of fire protection
system actuation on safety-related equipment. They
were to evaluate the risks that possibly a seismic
event could induce a fire and induce suppression
diversion so that you don't have a fire suppression
system where you need it. And the other issue is that
it could actuate the fire protection system and cause
damage.
In reviewing the submittals, we found that
the plant's fire protection system was frequently
designed to the seismic Category II/I criteria. Most
plants had the pre-action types which requires two
independent conditions -- for example, smoke to valve
and then heat to fail the fuse in the sprinkler head.
There were a few that had deluge type,
which relies then in this case on spatial
relationships between the fire protection system and
the safety-related equipment seals and drainage
systems to keep from flooding.
Carbon dioxide Halon systems were reviewed
for the potential to have adverse effects on personnel
in the control room and on equipment, predominantly
there the diesel generator.
Our conclusions on this generic issue is
that the licensees have concluded that the impact of
this activation is negligibly small, no plant
vulnerabilities were identified, and all but four
plants have adequately addressed this issue.
CHAIRMAN APOSTOLAKIS: So that's in a
generic safety issue as a result -- for specific
plants. Is that what --
MR. RIDGELY: For all the plants except
for four.
CHAIRMAN APOSTOLAKIS: In this case.
MR. RIDGELY: In this case.
CHAIRMAN APOSTOLAKIS: In other cases,
it's --
MR. RIDGELY: We'll go through each one,
and I'll tell you what's missing here.
Generic Issue 103, the Design for the
Probable Maximum Precipitation -- in this case the
objective is to evaluate the potential effects of
revised PMP criteria on site flooding and roof
ponding. Physically, roofs can withstand the
additional loads because of the excess rainfall
overflows, the roof parapets. In some cases, scuppers
were installed in the parapets.
To credit roof drains, licensees referred
to procedures to periodically inspect for roof
drainage system blockage. And typically the site
flooding from the PMP effects on nearby rivers and
streams -- this is dam failures, for example -- did
not adversely affect the plant.
If flooding could adversely affect a
plant, plant changes were usually made -- timely
shutdown, sand bags, that kind of thing. Site
drainage adequately removed very local intensive
precipitation or there was insignificant water
accumulation. Or if there was significant water
accumulation, no adverse effects on components or the
components were designed to operate submerged.
Confirmatory walkdowns were used to
identify doors and penetrations vulnerable to moisture
intrusion, and the ability of drainage systems and the
site drainage.
The conclusion for this generic issue is
that the original design and construction of the
plants included sufficient margin to allow for the
variations of up to two to three times the original
design basis PMP without adversely impacting safe
operation of the plant. No plant vulnerabilities were
identified.
One plant -- Salem -- installed new
penetration seals between the service and auxiliary
water buildings, and reduced the core damage frequency
from 10-4 to 10-7 per year. All but three plants
resolved all aspects of this generic issue.
Generic Issue 131 is applicable only to
Westinghouse plants.
VICE CHAIRMAN BONACA: I have a question
regarding the statement that you have.
MR. RIDGELY: Yes.
VICE CHAIRMAN BONACA: Those three plants,
are they committed to resolving those? Is that --
MR. RIDGELY: There are no commitments
from anybody to resolve these open issues that I'm
aware of. These open issues would now go to some
other organization -- I believe Generic Issue Branch
-- and they will determine whether it is worthwhile to
pursue getting closure on these issues.
VICE CHAIRMAN BONACA: Because, I mean,
they are not generic anymore. By the time you go from
100 plants to three, they're very specific to those
licensees. And so I guess it's hard to understand how
the process works.
MEMBER KRESS: You have to go to a backfit
analysis, then.
VICE CHAIRMAN BONACA: All right. I
understand. Thank you.
MR. RIDGELY: You're welcome.
MEMBER LEITCH: In a few cases, this table
in the report that addresses each particular plant and
whether they have resolved the issue or partially
resolved the issue, there is a couple of places where
there are blanks.
MR. RIDGELY: That's because when we were
in the process of printing this all of the SERs had
not been written at that time.
MEMBER LEITCH: Okay.
MR. RIDGELY: The next version will have
them all filled in.
MEMBER LEITCH: Okay. Thanks.
MR. RIDGELY: This particular issue is
dealing with a failure of the in-core flux monitoring
system and in a seismic event with a possibility that
its movement could cause a small break LOCA.
This was applicable to all but three
Westinghouse plants with those that have an immobile
flux monitoring cart. This issue had already been
resolved by 19 plants, and for six plants the as-found
condition was adequate. Adequate restraints were
added by four plants, and this was mainly installation
of angle iron welded to the seal table to bolt to the
transfer table in place.
Administrative controls were implemented
at one plant to restrain a chain from falling onto it,
and walkdowns were performed to verify the
installation of previously-installed improvements.
Our conclusions on this generic issue is
that no plant vulnerabilities were identified, and all
plants have satisfactorily resolved this generic
issue.
Generic Issue 147, Fire-Induced Alternate
Shutdown and Control Room Panel Interactions -- this
issue -- the objective of this is a fire in the main
control room might lead to a loss of control or power
to alternate systems before the transfer could take
place, or the total loss of system function or
spurious operation leading to a LOCA, and alternate
shutdown systems needed to be electrically
independent.
Our finding on this is that many relied,
in part, on the compliance with Appendix R
requirements and meeting those regulations. Alternate
shutdown locations varied from one place in a plant to
some -- up to 14 different locations. And these were
found to be electrically independent of the control
room. No unrecoverable LOCAs would be identified.
Spurious hot shorts were considered, anywhere from one
to six at a time. And no total loss of system
function was identified.
Our conclusion on this one is that no
plant vulnerabilities were identified, and 94 percent
of all of the plants resolved this issue
satisfactorily.
Generic Issue 148 is Smoke Control and
Manual Fire-Fighting Effectiveness. The issue here is
that the buildup of smoke could hamper efforts of the
fire brigade and operators, potentially damage
equipment, and lead to misdirected fire suppression,
or inadvertently initiate fire suppression systems.
We found that 65 percent of the manual
fire -- 65 percent of the submittals credited manual
fire-fighting actions, 15 percent did not explicitly
discuss this issue, but it could still be evaluated
because this issue is related to one of the fire risk
scoping study issues covering the same topic. And so
we could look at that portion of the submittal to
resolve this issue. Twenty percent of them took no
credit for manual fire-fighting activities.
While this is a conservative assumption
from a PRA standpoint, it has its problems. First of
all, it does not consider the potential effects of
misdirected spray. And if they did not consider this,
then this is one of the reasons why this issue would
remain open and not fully closed.
Even though they take no credit -- took no
credit for manual fire-fighting activities, many of
them did discuss fire brigade training, simulation
exercises, equipment, and timing aspects. Because of
insufficient data to evaluate equipment damage from
smoke, this aspect of Generic Issue 148 was not
addressed. This would be basically beyond current
state of the art, and that's not what the IPEEEs were
for.
Our conclusions were that no plant
vulnerabilities were identified. It was completely
resolved for 71 percent of the plants, partially
resolved for 25 percent of the plants, and not
resolved for four percent of the plants.
Generic Issue 156 is --
CHAIRMAN APOSTOLAKIS: But you said that
insufficient data to evaluate equipment damage from
smoke -- this aspect has not been addressed. So how
can you say that it has been resolved for 71 percent
of the plants?
MR. RIDGELY: For the IPEEEs, their
challenge was not to advance the state of the art, but
to use the information and techniques that are
currently available. There is very limited experience
with smoke damage to equipment, and so there really
isn't any particular basis to derive any kind of a
conclusion about what smoke would do.
Those that did address it said that smoke-
induced damage to equipment would be a, relatively
speaking, long-term event, and that that would be
taken care of by regular maintenance and be something
that would occur after the fire was put out.
CHAIRMAN APOSTOLAKIS: Yes. Okay. I
won't consider that as resolved, but consider it still
open until sufficient information is available. I
just --
MR. RUBIN: Let me just add to this. In
the report itself, in discussing the issues, some of
the issues are fully resolved by the IPEEE. The
plant-specific reviews, some are partially resolved.
This issue 148 is partially addressed in the IPEEE
program. So that aspect -- this is a discussion I had
one day with the -- in a subcommittee meeting, just on
Generic Issue 148 to clarify that point.
CHAIRMAN APOSTOLAKIS: Okay.
MEMBER UHRIG: Since the time these were
written there has been a good deal of work done
jointly with Sandia and Oak Ridge National Laboratory
on the damage of fire to particularly the electrical
systems.
MR. RUBIN: There are research activities
going on, particularly with the effect of smoke on
digital I&C systems, as you're aware of. And that's
going on under a separate program. That's why it was
not considered to be part of the IPEEE review for that
issue.
MR. RIDGELY: The SEP program was to
review 31 plants that were licensed prior to issuance
of the 1975 edition of the standard review plan, which
those plants did not explicitly address the
information in that SRP. These are the nine issues
that are -- were to be addressed, and we will take
those issues as we go through.
Findings on this is that we are -- no
improvements specifically identified for this generic
issue were made. Other improvements were made for
other reasons that would affect this generic issue.
External flooding resolved the hydrological issues.
These are issues on the other page of 1, 4, and 6.
Seismic evaluation resolved the seismic design issues,
which would be 5, 7, and 8.
The HFO evaluation would resolve the wind
and other issues, which is 2, 3, and 4. And
resolution of USI A-45 also resolved the shutdown
issue, which is number 9.
Our conclusion is that no plant
vulnerabilities were identified, and all 31 plants
have resolved this generic issue.
Generic Issue 172 is a Multiple System
Response Program. This was to address 11 IPEEE-
related MSRP concerns raised by the ACRS regarding
safety issues that might exist and which might not be
addressed by the NRC's existing generic safety issues.
The first one of these is the effects of fire
suppression system actuation on safety- and non-
safety-related issues.
This issue overlaps Generic Issue 57, and
it was resolved in part by seismic -- part of the
seismic walkdowns. It was also addressed as an impact
on safe shutdown equipment or safety-related
equipment.
Most of the licensees considered non-
safety-related equipment unnecessary for safe shutdown
or drains adequate to prevent unacceptable flooding.
This aspect of this issue was resolved for all but two
plants.
Seismically-induced fire suppression
system actuation is also addressed by Generic
Issue 57. It was addressed in part by the seismic
walkdown. Sixty-six submittals evaluated the
potential effects of inadvertent actuation. Many did
not include seismically-induced loss of fire
protection system.
Some included evaluation of the potential
effects of fire protection system component failures.
Plant improvements in this area included replacing
relays and switches, strengthening component
anchorages, and implementing procedures to properly
secure transient fire protection equipment. This
aspect of this generic issue was resolved for all but
three of the plants.
Seismically-induced fires is related to
the Sandia fire risk scoping study, and a few plants
-- licensees performed PRAs for initiating events.
Most addressed the issue as part of the seismic
walkdown, and most evaluations limited the impact on
-- to safe shutdown equipment.
Some included pipes and tanks containing
flammable materials. Plant improvements in this area
mainly were restraining gas cylinders. This aspect of
this generic issue was resolved for all but three
plants.
The fourth issue is the effects on
hydrogen line ruptures. Hydrogen line ruptures did
not contribute significantly to the core damage
frequency. Typically, addressed with walkdowns
following EPRI's FIVE methodology. This was resolved
for all but five plants, but two licensees addressed
hydrogen lines but not tanks. The other three did not
address either of the issues.
The fifth aspect of this generic issue is
non-safety-related control system and safety-related
protection system dependencies. This is related to
the Generic Issue 147 and a fire risk scoping study
issue. Safe shutdown can be performed at the main
control room or the auxiliary shutdown panels with
only safety-related equipment. Non-safety-related
equipment failures would not inhibit shutdown. This
was the position that was taken by most licensees.
All but four licensees provided adequate
information to close this issue. One did not address
hot shorts, and three did not discuss the issue at
all.
The next aspect of this issue is the
aspect of flooding or moisture intrusion on non-safety
and safety-related equipment. The HFO portion of the
IPEEE resolves the flooding aspect for these
components. Moisture intrusion is evaluating the
potential effects of seismically-induced
failure/activation of fire protection system and
misdirected spray from manual firefighting activities.
This was resolved for all but three plants.
The next issue is seismically-induced
spatial and functional interactions. This was
addressed by -- in part by seismic walkdown. Most
submittals limited this to direct impact on safe
shutdown equipment. Plant improvements related to
this were strengthening of component anchorages,
anchoring cabinets together, procedures to secure
transient fire protection equipment. This aspect was
resolved for all but two of the plants.
The eighth issue is seismically-induced
flooding. A few licensees evaluated this using a PRA.
Most used a seismic walkdown. Most evaluations
limited their scope to safe shutdown equipment. Plant
improvements in this area include adding seals to
waterproof electrical cabinets, enhanced drain
inspection procedures. This was resolved for all but
six of the plants.
The ninth issue is related to seismically-
induced relay chatter. A few plants had low
ruggedness relays in the IPEEE success paths that were
not redundant to those in the USI A-46 evaluation.
Twenty-seven licensees performed seismic PRAs.
Fourteen included relays in their PRA. Recovery
actions were not modeled. Forty-two licensees
performed separate evaluations.
Low ruggedness relays found in alarm
circuitry, negligible consequences, or operators could
provide effective reset for those relays. In a few
cases there was a plant improvement, and the
improvement was replacement of the low ruggedness
relays. All licensees resolved this issue.
Now, item 10.
CHAIRMAN APOSTOLAKIS: Yes.
MR. RIDGELY: I was wondering if you were
going to get back in time for this.
CHAIRMAN APOSTOLAKIS: I made sure I did.
(Laughter.)
MR. RIDGELY: The IPEEE issue focused on
human errors involving operator recovery following the
occurrence of an external event, namely fire and
earthquake. Errors modeled in PRAs were done by using
the IPE model, modifying the IPE model using
judgmental scaling factors, or simplified operator
error fragilities.
In seismic margin analysis, reliance is
placed on most familiar success paths and most
reliable equipment and qualitative discussion on
operator reliability.
In fire evaluations, the licensees used
the IPE model or the IPE model with a performance
shaping factor, expert judgment to determine a factor
for each action, a conservative screening factor of,
for example, .1, or some reevaluated or requantified
all error rates. And this we consider resolved for
all but eight plants.
Now, for two slides you do not have. The
question was asked as to what is the -- give us some
examples of what was done for plants that -- where we
found these acceptable. Well, one -- and I just
grabbed some off the shelf. Okay? These --
CHAIRMAN APOSTOLAKIS: So it's a random
example.
MR. RIDGELY: More or less random example,
yes.
One plant went back and relied on NUREG-
4826, the screening approach for a single train and
multi-train system. This approach was found
acceptable and identified so in NUREG-1407.
Another plant for the fire -- the human
error probabilities were increased by roughly a factor
of 10 over the IPE values, but no credit was taken in
any sequence for recovery actions, and this included
the restoration of the loss of offsite power. In the
-- excuse me, that was the seismic area.
In the fire area for this particular
plant, only one recovery action was credited, and that
was aligning alternate power to the reactor protection
system motor generator sets. Another plant -- they
used the IPE human error probabilities until they got
to a ground acceleration of .5 g. And then they set
the error rate to one.
(Laughter.)
They did a sensitivity and --
CHAIRMAN APOSTOLAKIS: At .5 g, it becomes
one? Really?
MR. RIDGELY: Yes.
MEMBER POWERS: You wouldn't agree with
that number?
(Laughter.)
CHAIRMAN APOSTOLAKIS: Sensitivity
performance to --
MR. RIDGELY: Right, to .35 g, and this
changed the core damage frequency by about 50 percent.
CHAIRMAN APOSTOLAKIS: Mean perform
sensitivity -- that means it was an error of
probability of one down to .35 g? Is that what that
means?
MR. RIDGELY: When they changed that to
.35 g, that's when it crossed over and made it one.
They are failure rates.
CHAIRMAN APOSTOLAKIS: Right. But then
sensitivity performed to .35 g, what does that mean?
That you put the error equal to one at .35 g?
MR. RIDGELY: What they did was they had
a -- they used -- the IPE value, whatever the error
rate was --
CHAIRMAN APOSTOLAKIS: Right.
MR. RIDGELY: -- okay, up until they had
an earthquake magnitude of .5 g.
CHAIRMAN APOSTOLAKIS: Correct.
MR. RIDGELY: Okay. Then they set it to
one. Okay? Now, then they did a core damage
frequency probability for this. All right?
Then there's a sensitivity. Instead of
changing the error rate to one at .5 --
CHAIRMAN APOSTOLAKIS: Right.
MR. RIDGELY: -- they change it to .35.
And then they -- that changed the core damage
frequency by about 50 percent.
CHAIRMAN APOSTOLAKIS: Fifty percent from
what?
MR. RIDGELY: From what it was when they
did this evaluation. So it's not even a factor of two
increase in core damage frequency, so it's not
necessarily -- percentage-wise, it's not a big change.
Now, that's what they did.
And as far as fire --
CHAIRMAN APOSTOLAKIS: Well, the real
issue, though, is that the HEPs, it's not just the
factors that were multiplied here, but it's also that
they themselves -- it's basic human error
probabilities. The ideas are of questionable
validity.
MR. RIDGELY: I won't argue with that. It
was intended that for the external events that
hopefully the licensees would look at whatever values
they start with, usually from the IPE, and say, "Well,
under those circumstances I could expect the error
rate maybe to be something higher based upon the
ground moving or smoke coming in," or whatever.
MEMBER POWERS: I think you're wrong,
Mario. We shouldn't put the operators and run a
scenario with them on the shaker table. We should put
the PRA analysts on the shaker table.
(Laughter.)
See if they think that a .35 g would --
VICE CHAIRMAN BONACA: But they would --
even .35 g seems to be a little bit incredible.
MR. RUBIN: But then, as you pointed out,
they have time after the .5 g has settled down to get
up and recover, maybe an hour or two --
(Laughter.)
-- take some operator actions.
CHAIRMAN APOSTOLAKIS: The problem is we
are dealing with a basic set of numbers that are not
based on -- don't have a strong technical basis, and
we will --
MEMBER POWERS: Well, unless they come
from THERP, and then they are totally reliable.
CHAIRMAN APOSTOLAKIS: Yes.
MR. RIDGELY: You were looking for
examples where you found that they were not resolved.
Well, here we have some here. The first one --
modifications to operator actions from an IPE were
made from a fire, but they did not discuss what the
effect would be of a seismic event. And that was left
as an open issue.
Another case -- in fact, two other cases
they did apparently a very good discussion of operator
recovery actions for a seismic event, but very minimal
for fire aspects. And then, for a partially resolved
one, they did -- a detailed human error analysis was
performed to evaluate operator actions that might be
necessary for each fire area.
However, the seismic human actions
discussed were -- the general discussion wasn't
specific to success paths, so that was a partial
resolution.
The eleventh item on this list is
evaluation of earthquakes magnitudes greater than safe
shutdown earthquake. Well, that's the point of the
IPEEE. And having done an acceptable seismic portion
of it, they solved this problem and all of the people
have resolved this issue.
Therefore, in our conclusions for Generic
Issue 172 -- is that no plant vulnerabilities were
identified, and 56 plants have resolved all 11 of the
MSRP issues.
Now, to try to put this a little bit in
perspective, this is what it looks like. This is the
number of plants versus the number of issues that are
open. You see there's one plant that has seven issues
open, one five, but the majority have thrown those two
out as outliers. We've had a pretty good success with
those on a per plant basis.
If you want to look at it by an issue
basis, these are the issues. Obviously, common cause
is the biggest issue here, and this is the -- this is
how it comes about issue by issue.
All right. Sandia Fire Risk Scoping
Study. This is to evaluate risks of five previously
unaddressed fire risk issues that were identified in
NUREG-0588. The first issue is seismic/fire
interactions. We've heard a little bit about this
before.
Fires might cause threats to the plant for
different reasons, for complicating -- causing
spurious actuation which could complicate operator
response to the seismic event, cause actuation of fire
suppression systems inadvertently, or could lead to
flooding problems, habitability concerns, diversion of
suppressions, suppressions to non-fire areas rendering
them not available for the -- where the fire is,
potential for overdumping of gas suppression, some
pressurizations of the compartments, spraying
important plant equipment.
I'll talk about the answers on this one.
This was resolved partly with a seismic and fire
walkdown. The evaluated induced failure and actuation
of fire protection systems, plants improvements in
this area, was to ensure existing procedures for
securing cylinders were followed, and 66 plants
provided adequate information to resolve this aspect
of the generic -- this generic issue.
The second issue is the adequacy of fire
barriers. The fire barrier issue is important because
it -- we're talking about protecting redundant
equipment, potential for fire from one room to go to
another room, also for retention of smoke. And what
we found when we reviewed this is that this discussion
-- the licensees discussed inspection, surveillance,
and maintenance procedures for seals and doors, fire
watches for welding activities.
Where they did multi-zone fires they found
it was not a significant contributor to the core
damage frequency, and smoke through the penetrations
they found would be diluted and not inhibit
firefighting activities.
MEMBER POWERS: Now, you say this is not
a significant contributor, but we still have this 30
percent number. Thirty percent of CDF is not a non-
trivial number.
MR. RIDGELY: Okay.
MR. NOWLEN: This is Steve Nowlen again.
We discussed that -- you know, the idea that 30
percent of a small number is not significant in this
context. For that plant to -- it's a visible
contributor given their number, but --
MEMBER POWERS: I mean, you're the one
that's telling me that it's 30 percent of a small
number. I know it to be 30 percent of a number that
can range from one times 10-4 down to 10-8.
MR. NOWLEN: We will be sure to clarify 30
percent of which number as we do the revision of the
report.
MR. RIDGELY: And 66 of the plants
resolved this aspect of the fire risk scoping study
issues.
The third one is smoke control and manual
firefighting. This issue became Generic Issue 148.
Most submittals discussed consideration of smoke in
their fire brigade training, and 55 licensees provided
adequate information to resolve this issue. This
issue, again, is for the possibility of hampering
firefighting activities.
The fourth issue is dealing with equipment
survivability. Again, this is potential for
misdirected sprays, for sprays coming on spuriously
and failing equipment. This issue is addressed by
Generic Issue 57. And 65 licensees provided adequate
information to resolve this aspect.
The fifth issue is fire-induced alternate
shutdown/control room panel interactions -- a
combination of fire-induced failures and spurious
actuation, with a high probability of random equipment
failures, were identified as potential contributors to
fire risk. This issue became Generic Issue 147.
The transfer control from the control room
to alternate locations is in all the plants. The
plants identified they were electrically independent,
either from the power source or a fuse or breakers in
the line. Spurious actuations were considered, and 67
licensees provided adequate information to resolve
this issue.
Let's see. So our conclusion is 25
licensees used EPRI's FIVE methodology. No plant
vulnerabilities were identified, and 53 licensees
resolved all aspects of this generic issue.
Graphically, this is the issue. This is how it looks.
Obviously, the one that spans out is the
-- the LOCA effects, and this is primarily because,
again, if we're talking about misdirected spray the
common thing that wasn't considered in manual
firefighting was not specifically -- not credited in
20 percent of the plants. So this is why that
particular item is so large.
Looking at it a different way by number of
plants, we see that the number of issues -- number of
plants that have open issues -- again, it's either,
you know, one or a very low number -- again, defining
it as a success for closure to this issue.
Summary and conclusions. There were 31
IPEEE-related issues. There were unresolved safety
issues and generic safety issues and sub-issues. Nine
were explicitly discussed in the Generic Letter; 22
were not.
We considered a major achievement to
resolve a large majority of these issues -- 44
licensees provided sufficient information to resolve
all 31 of these issues; 25 submittals had one or more
generic issues or sub-issues open or partially
resolved.
Saying that a little differently, we have
100 percent closure on the first three -- A-45,
Generic Issues 131 and 156; 95 percent on Generic
Issues 57, 103, and 147; 80 percent on 172 and the
fire risk scoping study; and 70 percent for 148.
For those issues that are not fully
resolved, potential -- we don't believe the potential
vulnerability was missed. They were identified as
weaknesses in the plant SER. And any need for
additional work on those would be addressed separately
from this program.
Saying it a little bit differently, this
is how it looks, so we consider this to be a success
of the IPEEE program.
And I'm through all of my slides, and I
didn't take an hour.
CHAIRMAN APOSTOLAKIS: Thank you. Thank
you.
Alan, you have here some closing
conclusions and remarks. I don't know that -- do you
have anything that's new?
MR. RUBIN: The only thing that's new is
the examples of the uses of IPEEE information.
CHAIRMAN APOSTOLAKIS: Maybe we could
address that one.
MR. RUBIN: I think it's useful, because
I think that --
CHAIRMAN APOSTOLAKIS: Sure.
MR. RUBIN: I can certainly get through
this in two minutes.
CHAIRMAN APOSTOLAKIS: Okay. Good.
MR. RUBIN: Because I think you've heard
the basic conclusions. Let me say that we think the
IPEEE program has met the intent of the Generic
Letters, and the licensees have met the four
objectives that I discussed earlier today.
But let me put up the slide in this
package on uses of IPEEE information. These are
examples without going into much detail. First of
all, licensees have obviously, you've heard about,
used the IPEEEs to make plant-specific improvements.
The second bullet -- the NRC has used
these issues, as you just heard from John Ridgely, to
resolve the external event related generic safety
issues, a large number of them, a very large
percentage of them.
The NRC, and particularly NRR, has used
the results in the fire protection area to prioritize
areas for plant inspection. That's both for the fire
protection and the seismic areas. And you've also
heard in some of the improvements areas licensees have
used the results to prioritize areas for fire
protection training in several cases.
Another use is that the results have
provided insights to the risk importance of inspection
findings. That has been used in a useful -- in the
significance determination process for the reactor
oversight program. Some of the results from the
reviews and risk insights have been incorporated into
NRC's Regulatory Guide, the comprehensive reg. guide
and fire protection, Reg. Guide 1.189, and the
industry's fire protection standard, NFPA 805.
MEMBER POWERS: I take it what you're
saying in connection with NFPA 805 is because NRC
staff participated in the development of that and had
some preliminary information on these that that
somehow got folded in.
MR. RUBIN: That's correct.
MEMBER POWERS: There's no indication that
having produced this report we're now going back and
revise NFPA 805?
MR. RUBIN: No. It's just the insights as
we went along, and particularly some of the -- you've
heard the generic questions that we had on the fire
protection and fire PRA implementation guide were
carried out and factored into those -- that guidance
document.
MR. NOWLEN: Yes. If I could elaborate a
little further. This is Steve Nowlen again. The
three of us who are on the Senior Review Board also
participated in NFPA 805, so there was, you know,
direct knowledge of what was going on from the IPEEEs,
and we communicated that to the panel. And it did get
incorporated, so, yes, there is a very -- very direct
connection.
MR. RUBIN: And the last bullet on this
page was that the results of the insights have been
used to identify topics and to provide a basis to
prioritize several areas of the fire risk research
program. An example is the importance of turbine
building fires and some other areas that Steve Nowlen
mentioned in his presentation.
One other area we had been asked by the
Commission -- to look at what is the cumulative effect
of exemptions to Appendix R on fire risk. The IPEEE
was a basis to do that analysis, and a SECY paper was
provided to the Commission in July 1999. That was
SECY-99-182.
The results were also used to prioritize
research needs for age-degraded structures and passive
components using both insights from the IPEEE program
as well as aging data from operating plants. And,
finally, in the evaluation of severe accident
mitigation alternatives, known as SAMAs, the IPEEE
results are being used in part for that for the
license renewal process.
So it's a pretty -- I think there are some
uses that go beyond what we originally anticipated.
But as we come to the risk-informed area we're in now
for many activities these results are more useful than
I probably would originally have thought when the
IPEEE program was first undertaken.
CHAIRMAN APOSTOLAKIS: I'd like to go
around the table, unless there is a specific question
for Alan. Thank you very much, Alan.
MR. RUBIN: Okay.
CHAIRMAN APOSTOLAKIS: There are I guess
at least two questions. One is, shall we write a
letter now or wait until the staff has received the
public comments and responded to them? Or should we
write a letter at all?
And the second is, what kind of things do
we want the staff to present at the full committee
meeting in July? Okay?
So shall we start with the big question.
How about the letter? And then, I would also like to
know, you know, if we are writing a letter what you
guys think.
MEMBER POWERS: It seems to me, George,
we've got to think in terms of two letters. I think
in the end we're going to have to write a letter
explicitly addressing the question of the Generic
Safety Issues, because we have an obligation in that
area. In some cases there are Generic Safety Issues.
And I don't think we can write that letter
closing out the generic safety issues until the staff
has got public comments back.
CHAIRMAN APOSTOLAKIS: Right.
MEMBER POWERS: Right now, I would say
that it appears to me that USI A-45, GSI-103, GSI-131,
GSI-57, all can probably be declared closed, at least
in a generic sense. There may be individual plants
that need something.
I don't believe we can conclude that GSI-
148 and 172 -- that's smoke control and multi-systems
response -- can be declared closed. I think we need
-- I at least need to examine more closely 147 --
that's shutdown control panel interactions, and GSI-
146, that is the SEP, a little more to have an answer.
But I think they will probably be declared closed with
exceptions.
CHAIRMAN APOSTOLAKIS: Okay.
MEMBER POWERS: But, again, closing out
those issues looks to me like that's a letter to come
after the public comments have come back and been
closed. And in that regard, I think that any
presentation of the committee has to at least touch on
a synopsis of what Mr. Ridgely presented to us very
nicely. I mean, he's quick, but maybe he's a little
too quick for the full committee.
But the synoptic nature of his
presentation is quite fine. Just do more a status
report on where they stand on those GSIs, but not --
MEMBER KRESS: Save the full presentation
for later after the public comments.
MEMBER POWERS: Yes.
MEMBER KRESS: So we'll have the --
MEMBER POWERS: Yes. But I think he -- I
mean, I think you want to get --
MEMBER KRESS: We need a status report.
MEMBER POWERS: Yes. I think you need to
keep the committee abreast on these GSIs, because,
like I say, in some cases there are GSIs. So, you
know, we raised them. We have an obligation to stay
abreast of whether they're coming and what not.
I think it might be useful for us to write
an interim letter at this point to the -- in
connection with this study, if nothing else to help
the staff highlight it as something that ought to be
looked at carefully and made public comments on it,
because there's no question this group of people have
done a tough, tough, hard job.
I mean, I am quite impressed with what
they've been able to pull together out of what could
look like just a cacophony of unrelated results. And
I think they've done a really nice job, produced a
report -- as I call -- refreshingly frank in some of
its language. They may want to refine some of that
language to make sure that it really reflects what
they intended to say.
It may well be that the -- as they say
that the licensees have fulfilled the objectives of
the Generic Letter. I'm not sure that this is
entirely demonstrable. And I call attention
particularly to the simplified fragilities and the
human reliability analyses that show up in the
document.
Another thing I think that it's useful for
us to point out in a letter is that the -- the IPEEE
process really has not yielded what I would call
usable risk information concerning fires and external
events, usable in the sense of 1.179 determinations,
and the like.
I think it highlights the diversity of the
technologies available, the lack of standardization,
the deficiencies of databases that afflict this
general area simply because it has not received the
kind of attention that it probably deserves in light
of the results we're getting. And I guess that's the
most overwhelming conclusion we come out of the IPEs.
Is the risk so far on the risk of external
events comparable to normal operating events? They
haven't received that kind of technological
development that normal operating events -- and they
do highlight areas for priority research.
I think that's going to be one of the
biggest values, as Mr. Rubin pointed out so nicely,
that there's a lot to be mined here as far as defining
what research should be done. And I think we can
point -- we could help them highlight the needs that
have emerged from having done this IPEEE study.
Similarly, I think, as you noted, it can
highlight the challenges we face in the area of human
reliability analysis and the remarkable absence of
these topics in the human performance program plan, or
whatever it's currently called, and what not.
But, again, I think we should offer our
hardiest congratulations to the people involved in
this work. I think they put in some substantial
effort to pull things together as nicely as they have.
CHAIRMAN APOSTOLAKIS: Good. That's it
for you.
MEMBER POWERS: That's all I can --
CHAIRMAN APOSTOLAKIS: Any other members
have anything? Yes? Bill or Mario. Mario, go ahead.
VICE CHAIRMAN BONACA: I just -- I second
very much the points that Dana has made regarding the
GSIs and ISIs. I'm not sure about writing a letter on
these documents right now before we have -- I would
rather wait for having the -- you know, the feedback
from open comments.
In general, I also think that this is an
amazing effort to pull together some insights from all
of these massive IPEEEs which are a little bit
obscure. I would like to make a couple of comments.
One is that I think the lessons learned
from such a large program are somewhat limited, I
mean, because the expectations of the programs were
low to start with. I mean, and so there are two
lessons there to me. One is that if you set somewhat
lower expectations, you get, you know, a hodgepodge of
information. It's hard to really get lessons out of
it. And it's important -- I find some of the
conclusions are speculative in my judgment.
For example, the one that -- risk for
older plants and newer plants are similar I think is
a reach. I mean, if you walk down most recent plants
and old plants just it's hard to believe that that's
true. And so some of the conclusions are speculative
somewhat. I believe, however, that the text puts it
in that perspective. It's clear you understand that
it's a true statement.
I also believe that the value to the
licensees may be somewhat overstated. I mean, when I
hear that 36 percent of submittals showed no plant
improvements, and most of the others had maybe one or
two, I really wonder -- and, again, it comes from the
fact that the expectations set by the programs were
somewhat low, and maybe we didn't get the benefit that
we could have got if the expectations set were higher,
like, for example, process and what you would want to
see out of the program itself.
I do believe, again, that given what was
submitted and developed, I think that this is a good
summary, this report. But, again, I would just wait
for the feedback from the industry before -- or
comment before I write a letter.
CHAIRMAN APOSTOLAKIS: Bill?
MR. RUBIN: May I take 30 seconds just to
clarify one point?
CHAIRMAN APOSTOLAKIS: Sure.
MR. RUBIN: I didn't get -- this is a
slide that I had skipped. Overall, if you take into
account the number of plants that made improvements,
it was 95 percent of the plants made one improvement,
either fire, seismic, or HFO area. So the number you
were quoting was correct for the HFO portion, but --
CHAIRMAN APOSTOLAKIS: Well, I thought it
was correct also for the fire.
MR. RUBIN: No. Fire was about 50
percent, also -- and seismic was 70 percent made
improvement.
MR. NOWLEN: Individually, each area, but
when you collect them all together as an IPEEE group,
you know, you get like 95 percent cited at least one
improvement across the board.
CHAIRMAN APOSTOLAKIS: Yes, right.
VICE CHAIRMAN BONACA: I understand. You
might have an improvement that is a change, and I'm
saying this is a significant program, and I just -- I
don't know. I've been there, and I think that you
would see much more than that. That's my judgment.
Okay? And, again, I've been there, and I've seen it,
and things -- so I am not impressed by the numbers.
CHAIRMAN APOSTOLAKIS: Bill?
MEMBER SHACK: Well, I'm always impressed
-- you know, I like these integrated programs. You
know, we have regulations one piece at a time. This
is the one chance to sort of look at the whole impact
of all the regulations on all the plants at least in
this area.
And so I think, you know, it's kind of an
integrated picture that you don't get any other way.
So I think it's very important -- you know, I think
it's -- unlike Mario, I think, you know, it sort of
made a fairly substantial contribution to managing
risk. I mean, I got the impression that the plants
learned a lot doing this. You know, they made some
improvements.
I think even the quantification, with all
of the problems that it has, it certainly gives you at
least the picture that, you know, this is an area
where we begin to prioritize, and we begin to put some
emphasis on it. So I think that's an important result
from it.
I think the notion of the letter -- I
don't see why it can't wait until we get the public
comment. But I take a much more positive spin on what
was accomplished in the program.
CHAIRMAN APOSTOLAKIS: Other members?
Comments? Grant? Yes.
MEMBER LEITCH: I guess my question about
the improvements is I was left with the impression
that not all of these improvements have been
implemented. And if that is the case, I think some
kind of a summary on the status of implementation
would be helpful.
MEMBER POWERS: For the whole committee?
Wouldn't that be kind of an arcane thing, for the
whole committee?
CHAIRMAN APOSTOLAKIS: Well, he'd like to
see that sometime. That's I think what you're saying.
MR. NOWLEN: I could comment on that
because it probably derived from my presentation.
That is true. The status of the improvements is not
always specified. In some cases we know that there
were things that were under consideration, and by now
may or may not have been implemented.
I think beyond what you have in the report
it's going to be difficult to provide that. That
would require a separate followup with the licensees
to say, you know, "Gee, what did you do about these
things?" And right now that's not a part of our
insights work here. So it might be something for NRC
to consider in the future but probably not here.
MEMBER LEITCH: And I think it also -- I
think also a number of these improvements were made
independent of the studies.
MR. NOWLEN: Yes. In some cases, it was
difficult to be certain whether improvements they were
citing were being made for other reasons and were
simply being credited here by -- or whether they truly
derived from the program. In some cases, people were
explicit that, gee, these things we've done before
really made an impact here, but it was often difficult
to tell. So, again, beyond what's in the report
already, it's -- you can't say much more.
VICE CHAIRMAN BONACA: I would like to say
one thing. I think I gave a message that has been
interpreted as overly negative, and I really didn't
intend to do that.
What I was trying to do is to say that in
my judgment if some of the expectations had been a
little bit stronger in the definition of the program
-- for example, the way to conduct it in some respects
and the expectations for what you would get out of it,
I think there would have been a much higher payback
than actually was possible given the definition of the
program itself.
I believe that what has been produced
meets the requirements and the objectives of the
program. I believe that more could have been derived
by a better-defined program. I'm criticizing probably
what was written in the requirement for 10 years ago.
MEMBER KRESS: I think we ought to write
a letter, and I see no good reason to wait until
public comments. I think we can go ahead and write
the letter now while the subject is hot. It's going
to be tough to figure out how to squeeze all of this
into a couple-hour presentation, but I think now is
the time to write a letter.
And I think it should be a relatively
positive letter from the standpoint of the -- of the
nice job they did. And I think I agree that it did
meet most of the -- it did meet the requirements for
the IPEEE.
I think there are lessons that could be
learned that are in addition to the ones they already
learned. Number one, I really like the slide that
highlighted the research needs with respect to PRAs.
And I think that's a good one.
But I -- one of the things that struck me
that we didn't dwell on very much was the fact that
the plant age in terms of when it was constructing the
license didn't seem to make a damn bit of difference
on the bottom line CDF. That was a surprise to me.
I worried for years that here we've got
plants that are licensed under different requirements,
and you have to tolerate that. They require each
plant to be updated to all of their new requirements
all the time, and I worried about the older plants
being under different requirements, might not be the
right -- not be up to par.
Well, this kind of puts -- this puts this
in terms of external events -- it went against my
intuition. I would like to understand it more, and I
wonder also if it's true for internal events. That it
doesn't matter.
MEMBER POWERS: I think I would be more
excited about the conclusion if some legitimate
regression analysis had been done that -- you know,
the similarity in the plots may be reflecting
compensating errors or compensating differences. And
it would be nice to see if you could do something --
MEMBER KRESS: I would like to see more
done on that.
And the other thing that I was looking for
and really didn't see was that when you have seismic
for -- in particular, it bothers me that we think a
CDF, for example, of equal magnitude to the internal
events might be acceptable, because I suspect you're
compromising emergency response at the same time.
And this is one set of sequences that it
has high uncertainty to it, in my mind. And it
worries me that we don't feel a little -- I worry more
about those kind of things, especially when I see it
of equal magnitude. So that didn't give me a lot of
comfort that it was just of equal magnitude. I would
like to have seen it much lower.
And I don't know -- you know, I don't know
if -- these are just thoughts. I don't know if
they're worth bringing up. You know, I would have
expected to see a lot more defense in depth associated
with things like that.
CHAIRMAN APOSTOLAKIS: No. But, I mean,
if you wanted to talk about these sequences, these are
usually very strong earthquakes. And the fact that
perhaps the surrounding communities will not exist
anymore is also a fact.
MEMBER POWERS: Well --
CHAIRMAN APOSTOLAKIS: I mean, even though
we regulate on -- I mean, it's a fact that if you go
to .5 g, there will be nobody to evacuate.
MEMBER POWERS: Well, I'd caution you that
there is not a surrounding community. The nearest
town can't exceed a population of 25,000. So it's not
like these plants are out in an empty field.
MEMBER KRESS: Except for one and two
plants, you're right.
And last but not least, I think it's worth
pointing out that I don't really think these results
are highly useful for risk-informing the regulations,
although there are some things you could -- some
insights you can draw, but I don't think they're
highly useful.
MEMBER POWERS: I think the only thing
they tell you is that to risk inform them we're going
to have to look farther than just the normal
operating.
MEMBER KRESS: I think that's what you
learned mostly for it.
CHAIRMAN APOSTOLAKIS: Okay. Graham, you
didn't have a chance to tell us whether you want a
letter or not.
MEMBER KRESS: Oh, I'm sorry, Graham.
MEMBER LEITCH: Oh, the letter? I don't
see any problem with writing the letter now. I mean,
I have no problem with writing the letter now.
CHAIRMAN APOSTOLAKIS: I'd rather have it
at the end, but -- when is the end of the public
comment period?
MR. RUBIN: July 31st is the end of the
public comment period.
CHAIRMAN APOSTOLAKIS: So we will have to
write it in September, then, if --
MEMBER POWERS: Well, they'll get the
public comments, and they'll have to resolve it.
CHAIRMAN APOSTOLAKIS: Oh, they have to
resolve them.
MR. RUBIN: We have to resolve them.
MEMBER POWERS: I mean, if we -- it seems
to me that if we've got things that we want them to
take into account when they do the resolution we ought
to write something.
CHAIRMAN APOSTOLAKIS: Are we then
commenting just as a public stakeholder planning to
influence the final report? Or are we commenting on
the overall project/program?
MEMBER POWERS: No. I think we want to
comment on the -- we want to give them the sort of
stuff that they might want to address as they go
looking at it and revising it.
CHAIRMAN APOSTOLAKIS: Well, that's
certainly one point of view. And I think that would
be arguing for writing a letter now.
Okay. So anything else?
Okay. Thank you very much, gentlemen. It
was a very good effort -- seven presentations.
Thank you, members, for being here, and we
will see you again in a couple of weeks.
(Whereupon, at 4:04 p.m., the proceedings
in the foregoing matter were adjourned.)
Page Last Reviewed/Updated Tuesday, August 16, 2016
Page Last Reviewed/Updated Tuesday, August 16, 2016