1 UNITED STATES OF AMERICA NUCLEAR REGULATORY COMMISSION *** BRIEFING ON IPE INSIGHT REPORT *** PUBLIC MEETING *** Nuclear Regulatory Commission Room 1F-16 One White Flint North 11555 Rockville Pike Rockville, Maryland Wednesday, May 7, 1997 The Commission met in open session, pursuant to notice, at 2:01 p.m., the Honorable SHIRLEY A. JACKSON, Chairman of the Commission, presiding. COMMISSIONERS PRESENT: SHIRLEY A. JACKSON, Chairman of the Commission KENNETH C. ROGERS, Member of the Commission GRETA J. DICUS, Member of the Commission NILS J. DIAZ, Member of the Commission EDWARD McGAFFIGAN, JR., Member of the Commission . 2 STAFF AND PRESENTERS SEATED AT THE COMMISSION TABLE: JOHN C. HOYLE, Secretary KAREN D. CYR, General Counsel JOSEPH CALLAN, EDO GARY HOLAHAN, Director, Division of Systems Safety and Analysis, NRR WAYNE HODGES, Director of Systems Technology, RES ASHOK THADANI, Deputy Director, RES MARY DROUIN, IPE/IPEEE Section Leader, RES . 3 P R O C E E D I N G S [2:01 p.m.] CHAIRMAN JACKSON: Good afternoon. It is always good to see the handsome faces. I am pleased to welcome members of the Staff to brief the Commission on the IPE insight report. In November of 1988 the Commission issued the Generic Letter 8820, requiring each utility licensed to operate nuclear power plants to perform an Individual Plant Examination, or IPE, of each of its plants to search for previously unidentified vulnerabilities to severe accidents. As a result of performing an IPE a licensee was expected to develop an appreciation of severe accident behavior, to gain an understanding of the most likely accident sequences that could occur at its plants and to gain a more quantitative understanding of overall probabilities of core damage and fission product releases. The Staff examined the IPE submittals to determine what the collective IPE results imply about the safety of U.S. nuclear power plants and how the IPE program has affected reactor safety. During today's briefing the Staff will summarize the results of the IPE insights program examination. I and my fellow Commissioners are looking forward to your briefing today and I understand that copies of the viewgraphs are . 4 available at the entrances to this room. Good afternoon. Please, Mr. Callan, proceed. MR. CALLAN: Good afternoon. With me at the table are Ashok Thadani, the Deputy Office Director of the Office of Research -- you are into your second week? MR. THADANI: Second week, yes. MR. CALLAN: I still want to say NRR. Mr. Gary Holahan, the Director of the Division of System Safety and Analysis from NRR; Wayne Hodges, the Director of the Division of Systems Technology and Research; and Mary Drouin, the Acting Branch Chief of the Probabilistic Risk Analysis Branch in Research -- she works for Wayne Hodges. She is also the technical lead for the IPE program. Mr. Thadani will give an overview of the IPE program. He will then be followed by Mary Druin, who will cover the status of the IPE program, the insights documented in NUREG-1560, and the recent NRC IPE public workshop that was held in Austin, Texas a few weeks ago. Finally, Mr. Holahan will brief the Commission about the NRC follow-up activities. Ashok? MR. THADANI: Could we go to viewgraph number 3, please? As you well know, following the accident at Three . 5 Mile Island was tremendous activity, both within the industry as well as at the Agency. Focus was starting to be given to the potential for severe accidents that now became more credible than they had been considered in the past. During the early period after the accident, a significant number of backfits were imposed on the industry and a number of research activities were initiated, both in this country as well as other countries. In mid-1980s the Commission issued a policy statement on severe accidents. In that policy statement the Commission concluded that the existing plants do not pose an undue level of risk to the public and that no immediate changes were necessary. This statement recognized a number of changes that had been imposed during the previous few years as a result of the accident at TMI. The Commission, however, recognized that there may be some aspects of designs and that some plants may be outliers in terms of potential impact on public health and safety, and so the Commission indicated that the Agency was going to move towards developing a systematic approach to trying to understand what the impact might be on a plant- specific basis. As part of the severe accident closure plan, the Staff had three key elements to address to ensure that the issues of severe accidents were being adequately addressed. . 6 The three elements were -- the first one was the concept of making sure that there was much better understanding of capability of containments, various types of containments to deal with severe accidents. There was a considerable margin in terms of design of these containments and it was judged that the containments could handle significant types of challenges from severe accidents. This was called the Containment Performance Initiative. By and large it was the Agency's effort with some limited work also done by the industry. The second element of the closure plan was accident management. It was indeed critical to fully understand severe accident behavior and a lot of research went into getting that understanding. With that understanding and the sense of containment capability, it was then deemed that one can use that information in conjunction with individual plant examinations -- that is, a plant by plant look at the design aspects that integrate this information and then make decisions on whether any further actions were required, backfits or whatever those actions might be. The important element of this was the recognition that IPEs provide very valuable information to the . 7 licensees, that they can develop their command and control activities in dealing with accidents, taking information from Individual Plant Examination, the severe accident behavior studies, and integrating them and making sure that the emergency response organization then could deal, if there were an accident deal with that accident. These were the three key elements. Of course, today we are going to be discussing what was in Generic Letter 8820, and as the Chairman noted, the objective there was to look for potential vulnerabilities on a plant- specific basis. CHAIRMAN JACKSON: Let me ask you a question before you go on. How many generic issues are there that are on the books? How successful have we been in resolving them, using IPE insights or results? MR. THADANI: I don't know the number of generic issues we have on the books, but a fair number of generic issues have been resolved on the basis of getting some insights from these Individual Plant Examinations. One that clearly comes to mind is one of the more important ones, which was reactor coolant pump seal LOCA issue, and the Commission indicated that the Staff should follow up on the basis of looking at the Individual Plant Examinations -- but we can get the numbers. CHAIRMAN JACKSON: I think it would be useful . 8 because I think it seems that we have some softness in terms of how many generic issues are still out there, and the question would be is there a systematic approach to resolving or dispositioning them? MR. THADANI: There are two elements that I may just touch. Clearly, the first -- whenever there is a generic issue identified there is clearly prioritization that is done and the prioritization utilizes information from the Individual Plant Examinations and then in some cases even resolution is based -- but we will get the numbers. CHAIRMAN JACKSON: Well, it relates really to two things. It's systematic disposition of the generic issues, and the second is the use of the IPE. MR. HOLAHAN: There is an additional set of generic issues associated with the IPEEE program. CHAIRMAN JACKSON: Right. MR. HOLAHAN: That have to do with external events, and of course the Agency has a tracking system for -- CHAIRMAN JACKSON: I know, but the issue has to do with resolving them as opposed to tracking them. MR. HOLAHAN: Yes, but there are many of them I think which -- for which IPE is not the ideal mechanism for resolving those issues. . 9 CHAIRMAN JACKSON: I think Commissioner Diaz -- COMMISSIONER DIAZ: I was just going to say that if we are going to get the numbers, they might be in some categories so that we can determine this and work on it. CHAIRMAN JACKSON: That is the whole point of using the IPE results, because they give you a way of assessing risk significance to the extent that they are useful. MR. HOLAHAN: Yes. MS. DROUIN: What I would also add is that as part of the generic letter the licensee could elect to try and resolve on a plant-specific basis a generic issue, and there were some that some of the licensees for the most part most licensees did not elect to resolve generic issues. There were some. We do discuss that in the NUREG. CHAIRMAN JACKSON: They elected not to do it on a plant-specific basis? MS. DROUIN: On a plant-specific basis. CHAIRMAN JACKSON: But what about invoking IPE results to -- as part of those plant-specific -- MS. DROUIN: That is what I am saying. Very few of them did. We are going to be issuing a report over the next couple of months in terms of what generic issues were resolved through the IPE process. . 10 CHAIRMAN JACKSON: That would be helpful. Yes, okay. MR. THADANI: Yes, I think that would address the question you have raised. May I have the next viewgraph, please -- no, Viewgraph Number 4, please. Again, you have covered, in your introduction you covered the focus in attention of the generic letter. I do want to make a point that the probabilistic risk assessments are probably the only tool we know where you integrate design and operational aspects and you take a total look at the plant rather than a part of the plant at a time, so to speak. In that sense, it provides very useful, very important understanding of the behavior and interaction of man-machine, so to speak. And we in the generic letter emphasized the importance in terms of participation on the part of the utilities in the conduct of these studies, and a number of licensees did play a fairly active role in the conduct of these studies, and in fact when we go through some of the results and so on, the maximum I would say the biggest benefit of these studies was (a) the understanding on the part of the industry, and as I said, it's being utilized as part of accident management plan. But also during the . 11 conduct of these studies, some licensees identified some significant safety issues, and in some cases actually made changes, design changes, before they in fact submitted the individual plant evaluations. And I think that was -- in my mind that was a great benefit, because these were potentially very significant outliers they identified during the conduct of the evaluations, took corrective actions, and in many cases, the results they submitted took credit for those modifications. So I want -- the point I want to make is the purpose of the IPE in that sense was served initially through these evaluations. CHAIRMAN JACKSON: Well, in a sense, doesn't that address the fourth objective? MR. THADANI: Yes, but there are two parts to that. The first one is what I would call very significant safety problems that they identified and fixed essentially by and large. The next step is are there still some concerns, some potentially significant contributors? I would put these in generally two categories. Some would be very plant-unique. Maybe there is a significant accident sequence. It's a very plant-unique issue. If we want to take action of course we would use our backfoot requirements rule to make sure we're consistent with our procedures. Another element of this is when you see similar insights from let's say 20, 30, 40 plants, and the one you've heard . 12 more than once I know, for example, station blackout is still an important contributor when you look at these studies, so there's that generic implication there still, and as you will hear, our plans are to look at both elements. Should we be taking plant-specific followup actions? And we are reassessing some generic issues such as station blackout. I mentioned that in an earlier -- CHAIRMAN JACKSON: You've identified a time line on which you plan to do this? MR. THADANI: Well, I received the message of the schedule I had for station blackout which initially was 1298. We're relooking at that as I indicated during the grid reliability discussion. We will be reassessing schedule. CHAIRMAN JACKSON: So would you say that there are licensees or any licensees that did not meet the fourth objective of reducing the probabilities, because -- where there were significant contributors to risk? MR. THADANI: There -- if I may hold back on that one, if you focus only on IPE's, then I think by and large licensees have taken what I would call at least minimum steps. There may be other things that could be done. You will hear a little bit about some plants. There are some questions about how close they come to quantitative health objectives. There may be other things that can be done, and . 13 perhaps ought to be done. That's now our responsibility to see. I will qualify my comments by saying that is only on IPE's. IP triple E's there are already some indications, at least I know of one plant where there's a significant issue on fire. That licensee has made initial modifications to reduce risk from fire, but there are still some questions how far have they reduced risk from fire, and we're going to be looking at that issue further. COMMISSIONER ROGERS: Just before we leave this, I may be wrong on this, but my recollection is that when we got into the IPE process, when we first started to think about requiring IPE's, it was really on the basis of closing the severe-accident program, and that that looked like the final cap of that program, to ask each licensee to do an individual plant examination. Now, there was no requirement that that be done using a PRA. As a matter of fact, back in 1988, as I recall, we were very antsy about using risk analysis, PRA analysis, that when we're talking about probabilities and risk and so on and so forth, it was with some ambivalence about how to do this, and we certainly didn't require that every plant do a PRA. They had to do a plant examination, and they had flexibility in how they could do it. In the long run it turned out I guess that everybody did a PRA, when all things shook down. MR. THADANI: Yes. . 14 COMMISSIONER ROGERS: But I think that it is important to keep that in mind, because the general approach was, in my recollection, that this was really to be a value to the licensees in understanding their plants better in light of the severe accident possibilities, not for all purposes in the plant, but really originally directed towards closing the severe-accident program. And what I think is happening here, and I'm not sure it's a bad thing, but I think we ought to recognize that it's happening, that we are drifting over now into using the results of the IPE's, which now have turned out to be PRA-based, for broader purposes. Now that may be very good, but I think that one should recognize that we are taking steps beyond what the original purpose of the IPE was, and I'm a bit concerned because I feel that at the time that -- and I may be not quite right on this, and the record will have to be looked at to find out -- that I think the Commission's general posture of the Commissioners was that we weren't -- we didn't expect to use those IPE's for regulatory purposes. MR. THADANI: If I may comment on that, you're quite correct. In the '88 time frame the focus clearly was to identify those potentially handful of plants which may pose significant risk, and so to identify what we called outliers -- COMMISSIONER ROGERS: Right. . 15 MR. THADANI: That was the language. And it's not to say that the staff was -- I think the staff was of the view that risk assessments -- doing risk assessments was a good idea. The concern was the cost of risk assessments, and staff had a dialogue with the industry, and there were simpler methodologies developed by organizations outside which we said -- which was short of risk assessments -- with reduced scope as a matter of fact which we said would be acceptable to meet the intent of these evaluations, but the industry chose to go beyond, and they did spend more resources, and that was the basic concern we had. COMMISSIONER ROGERS: Well, I think our own resources, I think we made a statement that we couldn't possibly review every one of these -- MR. THADANI: That's absolutely correct. We could not review these. The staff review of the IPE's has always been mindful of what was the intent of these studies, and the scope of the reviews therefore has also been fairly limited in that sense, but as we go into the kind of regime that we're talking about now of risk-informed use in essentially all of our regulatory activities, then the issue of scope, quality reviews and so on clearly has to be -- COMMISSIONER ROGERS: Oh, absolutely. MR. THADANI: Consistent with that application. . 16 COMMISSIONER ROGERS: I just think that it's important that the Commission keep in mind that historical background, because we didn't start out with this program as a uniform PRA for every plant, that then we would look to see what more could be done on the basis of it. It was really to really find the outliers. MR. THADANI: Yes, indeed. That was the objective. And now -- CHAIRMAN JACKSON: Well, were the IPE's consistently reviewed or was there guidance to ensure that -- MR. THADANI: We had guidance for consistent review of the IPE's. The issue is the scope and the depth of our reviews was fairly -- in most cases I guess we call step 1, and then step 2 reviews. The scope and depth of step 2 review was higher than that of step 1. We had to have a reason to go on to step 2 review because of resource considerations, and Mary can probably tell you if you're interested that what level of effort we expended on these reviews, it was not very significant, if you look at a plant-by-plant basis. CHAIRMAN JACKSON: You say it was not very -- MR. THADANI: Not very significant. CHAIRMAN JACKSON: Okay. MR. HOLOHAN: Could I add something before we . 17 leave the subject? That is, in trying to come to grips with the issue of where did we start on the IPE program, and where are we going in the future, I think it's helpful to distinguish between what is IPE and what are PRA's. The IPE was really intended to be a one-time examination of plants. The PRA's are really the tools to do that. I think in the long run the PRA's have a role, but the IPE's I think will come to an end. I think there are some additional things that we are talking about doing, and sometimes we get a little confused about the IPE's as though they are the tools, and I think it's helpful to maintain that distinction between the tool and the program, and the IPE reviews were for the purpose of the IPE program. Were the analyses good enough to find vulnerabilities? Now when we're talking, as we did yesterday, talk about future uses of PRA, I think it raises, you know, additional issues and additional reviews. CHAIRMAN JACKSON: So the PRA's were a tool to do the IPE's. MR. HOLOHAN: Yes, exactly. CHAIRMAN JACKSON: It was of finite duration. MR. HOLOHAN: Yes, exactly. CHAIRMAN JACKSON: Always meant to be with a specific focus, but the PRA's live on with these other regulatory potential uses? MR. HOLOHAN: Exactly. . 18 CHAIRMAN JACKSON: A la the discussion yesterday. MR. HOLOHAN: Yes. CHAIRMAN JACKSON: Okay. MR. HOLOHAN: Or maybe even newer and better versions of PRA for future uses. CHAIRMAN JACKSON: Okay. MR. THADANI: Okay. Mary. MS. DROUIN: Okay. Slide number 5, please. Before we get into NUREG 1560 I think we can benefit by talking just briefly about the whole IPE program, because the IPE program is much broader than the actual NUREG that was issued. Two points here that I want to make on the slide is one, in looking at all these IPE submittals, the staff received a tremendous amount of information on severe accidents, plant design and operating characteristics, core damage frequency, system dependencies, so when you look across these 76 submittals, the wealth of information there was just tremendous. In trying to understand all the information that was contained in these submittals, we divided up the program into four primary activities. The first one, of course, was to look at each of the submittals and review them against the intent of the generic letter. Was the analysis, as Mr. Holahan said, adequate enough such that had a vulnerability existed at the . 19 plant and indeed been discovered. In parallel with that, we created an IPE database where we took information out of the submittals, entered it into a database that allows the user to query across plants so if you are interested in something on a group of plants, you could get that without having to dig through 76 different volumes of information. Also, as we were reviewing -- all these activities have been going on in parallel. We have been going out to each of the regions, meeting with the resident inspectors and various regional personnel, providing them insights on a plant-specific basis of what we have been learning from these IPE submittals. And then, lastly, the main topic for today is NUREG 1560, what we have documented as the different insights that we have gleaned from looking at all these different submittals. COMMISSIONER ROGERS: Just before you leave that, how do you define within class in the IPE? MS. DROUIN: Within a class, we define class, for example, when you are looking at the reactor design by interpolis design so we are looking at the BWR 1/2/3s, the isolation condenser plants, the BWR 3/4s, Westinghouse four loops, Combustion Engineering BMW and then on the containment side, dividing it by containment type and that . 20 is what we meant by class of plants. Just quickly, also giving you a status of where we are on the four various activities, in terms of the IPE reviews, out of all of these the staff evaluation reports have been issued to NRR and to the licensees on all the submittals except five and we are in the midst of wrapping up these remaining five as we speak. In terms of the IPE database, it's complete. It has been made available to the public. It is on the web page and we have also issued a NUREG. I believe it is 1603, which is a user manual of how to use the database. COMMISSIONER ROGERS: Do we have any information on users of that database, yet? I mean, do we have any indication of how useful it is or has been so far? MS. DROUIN: Well, we have been using it internally for several years now. COMMISSIONER ROGERS: I was thinking, since it's on the Internet. MS. DROUIN: In terms of the public, we just put it there. I mean, it's been there like less than two weeks. So in terms of how many people have downloaded it -- COMMISSIONER ROGERS: I had a little trouble getting on it myself this morning. MS. DROUIN: Well, we will be delighted to come up and personally, you know, load it for you. . 21 CHAIRMAN JACKSON: What use have the regions made of the IPE results? MS. DROUIN: I think a lot in their inspection activities because we have also been given briefing for the inspections, the IPAP inspections, day to day decisions. MR. CALLAN: Chairman, Mary is right. The regions are getting into it but they have been lagging NRR substantially and it has only been in the last several months that the graduates from this two-year training program, the -- what's the title? MR. THADANI: Senior reactor analyst. MR. CALLAN: Senior reactor analyst, which is a fairly intense qualification process, are now starting to become productive and that was a major, major step in the process of exporting PRA expertise to the regions. Now speaking as an ex-regional person is one of the frustrations the regions have is their perceived inability to interact with the licensees in their region on PRA issues and licensees, as you know, are making increasing use of PRA risk insights and all facets of their interactions with the staff, whether it be on enforcement issues, requests for enforcement discretion and the whole range of issues that we interact and the regions are very frustrated because they don't have the expertise to deal with those things without extensive support from NRR. . 22 CHAIRMAN JACKSON: So it is an expertise issue, not having put the framework into place? MR. CALLAN: Yes. The inspection procedures are out there, the training programs are in place but the regions don't have the expertise, the sophistication. CHAIRMAN JACKSON: In the regions? MR. CALLAN: In the regions at this point. As I said, that may change in the coming year or so as the SRAs, the senior reactor analysts, start stepping out and exerting some leadership. CHAIRMAN JACKSON: Do we have -- I mean, are we going to have going out this year senior reactor analysts to each of the regions at least? MR. CALLAN: Each region has two billets. One of the problems is that the individuals who were selected for these positions were, as you would expect, are among the best and brightest of the inspectors. They are also the top candidates for promotion and several of them have been promoted. Several of them are now in headquarters. Some have been on your staff and my staff and because -- so there has been a substantial turnover in the role. That was intended, actually. The intention was to train these people and have them move on but, unfortunately, the demands of the organizations have often plucked them out of the training . 23 program prematurely so that has been frustrating. This will take time to get the regions up to speed. The regions are definitely lagging in this area. CHAIRMAN JACKSON: That's interesting. Okay, thank you. MS. DROUIN: Okay. Regarding NUREG 1560, we did publish volumes one and two last October for public comment. Over the last several months, we have received comments from a dozen utilities. We have received comments from EPRI, from NEI and other members of the public. We held a three-day workshop back in April and we had an attendance of about 100 people and I am going to speak more to the workshop later on in the presentation. We do plan on issuing a final version of the NUREG this summer. Okay, NUREG 1560. As I spoke earlier, when you look at all these submittals, there is just a tremendous amount of information and deciding what perspectives, what insights, how you are going to slice information was a job in and of itself. What we finally settled on was to look at it from four different perspectives. One was first going back to the original intent of the generic letter which was the impact on reactor safety. So that was one of the first objectives in terms of the perspectives we wanted to get . 24 from these submittals and document. The second one was now looking more towards the actual results in the submittals, you know, looking at the core damage frequencies at the accident sequences, at the containment failure modes. What were the results telling us in terms of reactor design and containment performance versus the assumptions that are in these analyses? So we were trying to get perspectives on that item. Third, moving away from the actual results, looking at the models and the methods that were used, what insights and perspectives could we learn about the models and methods that were used in these submittals and to provide perspectives on that one. Then, last, there were two things that we were explicitly asked to look at. Was one, what could we say from the IPE results regarding the Commission's safety goals and also what has been the impact of the station blackout rule and core damage frequency. So we were looking at the results for that too. Next slide, please. Before I get into some of the results, I think it behooves to put into perspective, into context, what NUREG 1560 addresses and what it doesn't address. First of all, it was 75 submittals we looked at that covered 108 units so we did make the decision early on that the perspectives were . 25 going to be treated on a unit basis, not a submittal basis. That seems trivial but that actually can really skew your results and your insights but we did decide -- CHAIRMAN JACKSON: I was actually going to ask you a question about that when you said there were 75 and I knew there were more units than it actually represented. MS. DROUIN: Yes. It represents 108, so we did treat the results on a unit basis. Also, the IPEs only cover a level one two PRA at full power internal events only with internal flooding. So perspectives regarding low-power shutdown, other modes of operation, external events, those are not covered in this insights report. Now, some of the external events stuff will be covered later on as part of the IPEEE program but it is not in this document. Next is that we do recognize that these PRAs were originally done back in the era of about 1990. Utilities have been, in some cases, updating them. That updated information is not reflected in here. It is based on the original IPE submittals. And, lastly, the accuracy of the information is not reflected so if a utility told us they had a two-train system, we believed them so we did not go and verify -- CHAIRMAN JACKSON: So you didn't verify any of the . 26 IPE results for any of the plants by, say, getting the fault trees and event trees and looking at it in terms of the systems for any of the plants? MS. DROUIN: No, that's correct. CHAIRMAN JACKSON: You just took it as it was? MS. DROUIN: We took it as it was. COMMISSIONER ROGERS: What would be -- how difficult would it be to update, you know, the third bullet? The fact that, you know, you took things -- this report -- MS. DROUIN: Can I address that later on? Because that is something we will talk about when I get to the workshops, what we plan to do. COMMISSIONER ROGERS: Oh, sure. MS. DROUIN: Next slide, please. Okay, if we look at the first objective, which was the impact of the IPE program on reactor safety, there were several questions that we asked ourselves in pursuing these perspectives and, you know, what was the type of vulnerabilities that were identified, you know, what were the improvements and what was the impact of these improvements on the overall safety. And what we saw was, first, that very few vulnerabilities were identified. That was more, I believe, due to the different definition that was used for vulnerability. Vulnerability was not defined in the generic . 27 letter or NUREG 1335, which was the supporting guidance document. Definition of vulnerability was left to the licensees and we saw many different definitions. Most of them came down to either using, for example, like one E minus four per reactor year and if you were above that, it was the vulnerability. If your accident sequence or contributor, for example, was greater than 50 percent of your core damage or your containment failure, that would be a vulnerability. Some of them use sensitivity analyses but they were different definitions. CHAIRMAN JACKSON: So the industry did not develop itself some overall -- MS. DROUIN: There was and it was the NUMARC but not every licensee, only about 25 percent of the licensees elected to use the NUMARC guide document for their definition of vulnerability. I think it was around 25 percent. CHAIRMAN JACKSON: Okay, Commissioner Dicus, I think, had a question. COMMISSIONER DICUS: Pretty well along those lines, but I guess I want to be sure I understand this. So few "vulnerabilities" were identified not necessarily because there are few but because of the definition issue? Is that another way to look at this? . 28 MS. DROUIN: I think that is one way to look at it, but I would think the next thing is to look at the next bullet. Regardless of whether a licensee explicitly used the word "vulnerability," they all identified weaknesses or safety issues, if you want to call it that, and identified improvements. CHAIRMAN JACKSON: Do they credit the IPE program for those improvements? MS. DROUIN: Yes. Well, I don't want to say -- they discussed them in their submittal. So if you go to each submittal, there are improvements that are discussed in great length in each submittal that have been made. I would suspect that probably some of them, if they weren't an exact result of the IPE analysis, they certainly are using these improvements. CHAIRMAN JACKSON: Okay. MR. THADANI: If I may, NUMARC issued guidance document and in terms of their thought process on what should one do with the results and they indicated they had two key areas. One was frequency of core damage and the other was frequency of potential for large early release. In terms of frequency of core damage, they indicated that if that frequency is greater than 10 to the minus four, design options should be considered by the licensee, design improvements hardware changes, whatever . 29 have you. If the frequency of core damage is in the range of 10 to the minus four to 10 to the minus five, one could look into procedural improvements and enhancements. And if the frequency was below 10 to the minus five, then that could be considered down the road as part of accident management considerations. As far as frequency of large release is concerned, everything I said applies except reduced by an order of magnitude in frequency. Frequency of 10 to the minus five for large releases, if it's higher than that it is either design or hardware changes. Ten to the minus five to 10 to the minus six, look at procedural changes. Below that, then, look at it down the road as part of accident management. We -- we thought that was a fairly reasonable approach and it turns out, I would say, reasonably consistent with some of the things we have been talking about. COMMISSIONER ROGERS: When did we settle on our definition of a large release? When -- what point -- MR. THADANI: We never did settle on the definition of large early release. What we settled on was we will convert that to early containment failure and we defined early in terms of number of hours after onset of core damage. But we didn't really end up defining large . 30 early release because we started out with release that has a potential for prompt fatality. One or more. And then there were a lot of discussions back and forth. So what we have now is, I might say, some kind of surrogate means of saying if these conditions exist we believe that would lead to a large early release, without defining what that is. COMMISSIONER ROGERS: I understand. But when did we come to the conclusion of what that definition of what that surrogate is? MR. THADANI: In 1993, in a Commission paper, we indicated the difficulties with the definition and the SRM, I don't remember the dates, but soon after the SRM came indicating, discontinue those studies of trying to define large early release. COMMISSIONER ROGERS: The only problem I was trying to get at is when the licensees had something to work with that was more or less common -- MR. THADANI: I think this -- their definition was, I think, reasonably consistent. We used early containment failure and they also were talking about early containment failure. And the differences, I think, could be in timing of early containment failure. But the thought process still was, does it lead to early containment failure and as you know, over the years we have had a number of . 31 issues, what kind of challenges one should worry about with the potential for early containment failure. We have taken some actions in those areas, I think, over the last several years and, by in large, it has been a timing approach. MR. HOLAHAN: The other thing I would add is regulatory analysis guidelines contain effectively a definition of -- a working definition of large early release in the context that Mr. Thadani mentioned but also in the guidance documents we spoke about yesterday. The regulatory guides of standard review plans provide effectively a working definition for large early release. That's a little different, but basically what Mr. Thadani said. It's a timing issue with respect to core damage and containment failure. MR. THADANI: The definition is in fact given in the regulatory analysis guideline, and it talks about x hours after onset of core damage as a definition. CHAIRMAN JACKSON: Please? MS. DROUIN: Okay. Just to give you a couple of examples of some of the improvements, we certainly saw a lot of improvements were associated with loss-of-power concerns, and we are seeing improvements, you know, like adding, replacing diesel generators, increasing redundant offsite power capabilities, improving the ability to cross-tie from . 32 buses or units. We saw things, replacing the emergency core cooling system pump, air -- motors with air-cooled motors, using the fire water system for core cooling. Also using the fire water system for sealed cooling to your pumps, increased training for feed-and-bleed operation. So this is just a small sample of the improvements, but I think we cataloged like over 500 improvements when you went through across all the 70-some-odd submittals received by the staff. Of all those improvements we did try and get a feel for what was the status of them, and at the time of the IPE submittals that we're now going back you know to the 1992 time frame, about 50 percent of those improvements had been implemented at that time. CHAIRMAN JACKSON: Let me ask you this question at taking great risk, but if you look back at some of the requirements that came post-TMI, are they any of them that upon review or that the IPE insights would suggest were less significant or less important than others? Or have you really done that examination? MR. THADANI: We haven't done that examination. It may not be very easy to do that, but the converse I think one can say that a number of the changes clearly were significant improvements. CHAIRMAN JACKSON: Okay. MS. DROUIN: I would agree with that. I'm sorry, . 33 I lost my train of thought. One of the things is that we also did look at as part of the review to see what level of participation, you know, the licensees had in their analyses, and we did see that there was a good-faith effort. I mean, we did not -- I don't recall of an instance -- I mean, I could be wrong, but I don't recall one -- where a licensee just went out and turned over their IPE to a contractor. You saw a lot of the work being performed in-house so that you were seeing, you know, this in-house capability certainly increasing. I don't want to mislead you, because one of the things that did come out of the workshop, you know we're now in the time frame of 1997 versus back in 1990 when they were being done, but one of the things that did come out of the workshop was even though this in-house capability had, you know, increased, we're now starting to see a decrease, because of a sense of frustration on the public, you know, how quickly we're moving forward in this area. Next slide, please. If we move to the second objective, which was looking at the results themselves and what they were telling us, some of the things that we were trying to get a feel for is that when you take a class of plants, for example, if you look at all your BWR 6's or you look at all your CE plants or you look at your large, dry containments, within that . 34 group you see tremendous variabilities in the results, and begs the question, you know, what's driving this variability? Is it due to plant-specific design differences, or is it due to assumptions or methods, you know, how does the human play a role in this. And these were the type of things that we were trying to derive as we went through all of these submittals. The biggest thing that comes out is that the plant-specific features certainly play a tremendous role in that variability, and I can't emphasize that enough. No two plants look alike when you start getting into the depths of these plants, and you start looking at the support systems, you start looking at electric power, at service water, at component cooling water, these plants start looking very different, and these are the things that tend to drive the results. But at the same time the differences in the scope and the boundary conditions and the assumptions also played an equal part in causing the variability. So it's not strictly plant design, you have a mixture of these two in there. When you look at the results across the plants, you do see that station blackout and transients are the primary contributors to risk across all the plants, whether you're looking at boilers or whether you're looking at your pressurizers, and even when you look at your individual . 35 classes. However, when you start looking at on a plant- specific basis and trying to understand the reason, the reason from plant to plant to plant varies. Why station blackout is important at one plant and why it's important at another plant are for very different reasons, and that usually gets down into the design differences of the support systems, and in many cases also of the analysis assumptions that are behind it. When we started looking at the human actions, this was a little bit more difficult, because this is the one area where you have very much inconsistency in how some of the methods are applied, and I'm going to talk a little bit more than that, but I think the biggest thing that we noted is that what human actions are important is probably more driven by analysis here than plant-specific design differences. When you start looking at what were the top human actions, it wasn't surprising what we saw. I mean, for the boilers you saw depressurization, containment venting, aligning containment or suppression pool cooling, initiating your standby liquid control system, on the PWR side of course the switchover to recirc where you don't have the automatic switchover, feed and bleed, depressurization, and cooldown, these were the ones that tended to be the top, but they weren't important in every single plant. CHAIRMAN JACKSON: Let me ask you this question. . 36 This is more similar to Commissioner Rogers' question about large early release. Is there a common definition of core damage used in all of the -- MS. DROUIN: You preempted my next slide. CHAIRMAN JACKSON: Oh, so sorry. MS. DROUIN: So why don't we go to the next slide, because I think that's where the heart of a lot of this is. When we got past the results in trying to, you know, look at, you know, the design differences and the assumption differences in terms of, you know, what was causing the variability in the results, you know, the other thing of course that we were looking at, you know, was what -- and where were the strengths in these models and methods, and where were the weaknesses, and were the weaknesses more due to a lack of knowledge versus misapplication of the method, and I think that's a very, you know, difference between the two, because in some cases it's not a lack of knowledge, it's a lack of -- misapplication, and that's really what we found. When you looked at the different methods that are used in these PRA's, when you look at your systems analysis, your accident sequence analysis, your plant damage that your containment of entry, the methods and the models behind them, you know, are very well established. The problem comes into how they implement these methods when you look at . 37 the scopes and the boundary conditions, you start seeing very differences, and I'll address, you know, for example, the core-damage definition. There's not a standard core- damage definition, so you could see anywhere from someone defining core damage as once the reactor water level gets below the top of active fuel to two feet above the bottom of active fuel, to the peak cladding temperature. You saw a varied differences, and there's no right or wrong in this case, but it bounds and it scopes the problem, and they will -- you will now get very different results. CHAIRMAN JACKSON: Well, let me -- you know what my next question inevitably is going to be, and that is, you know, this is along the line of some of what we were discussing in the briefing yesterday where we were talking about, you know, five 10 to the minus 4 versus five point one 10 to the minus 4. Since core damage frequency is what, you know, many of these PRA's reference, what can you tell me? MS. DROUIN: I think it's like any analysis. You have to look at what the analysis handles and what it doesn't handle, and it doesn't mean the number is right or wrong. I think when you look at any engine in the analysis and you look at, you know, what was the input and what was the scope that dictates then, you know, what that result means. . 38 CHAIRMAN JACKSON: No, I appreciate completely what you're saying, but, you know, we have some triggers or thresholds or whatever that are built into -- MR. HOLOHAN: Guidelines. CHAIRMAN JACKSON: Guidelines. Okay. MS. DROUIN: And if you get into the -- because I was here yesterday, and if you start looking at the uncertainties in the distribution on these things, if you go back, for example, to NUREG 1150 and you start looking at other PRA's and you look at what their distributions are, and I'm just going to focus in on the level 1 part, because that's all I have in my head at the moment, but if you look at what their main values are, and you look at what the 95th percentile, what you see is a factor of 3. CHAIRMAN JACKSON: Okay. MS. DROUIN: You do not see, you know, a factor of 10 or a factor of 100. CHAIRMAN JACKSON: You don't see orders of magnitude. MS. DROUIN: No, you do not. CHAIRMAN JACKSON: Okay. Then that's the most -- okay. MR. THADANI: But I would also -- I think I would also hasten to add that that's a rather stylized look at hardware data. . 39 CHAIRMAN JACKSON: Yes. MS. DROUIN: Yes. MR. THADANI: I think what we're talking about could be more important, and if you step back and look, what Mary said was dominant contributors are transients, which means if you're starting to uncover the core, it is -- it could take some time before one can get to a peak clad temperature of 2,200 degrees Fahrenheit, which means there is that much time available for intervention, corrective action, and so on. That means that is a conservative analysis if we accept peak clad temperature of 2,200 degrees Fahrenheit as reflective of core damage. What that says is that the licensees in some cases have made more conservative assumptions on failure definition and that the results are probably biased in that direction. Sometimes that is done just to reduce the cost, because it is much simpler to go forward with those assumptions, and this is just one example. There are differences sometimes in success/failure criteria. Some licensees will go to greater lengths to try and better define what is that minimum required to deal with a challenge. Others will not do that. They will use what is a final safety analysis report, transient and accident analysis values, which we know are conservative. So there will be those differences. CHAIRMAN JACKSON: Mr. Holahan, you had a comment? . 40 MR. HOLAHAN: I just wanted to mention that what Mary was talking about is the amount of variability that you see in the analysis. That doesn't reflect those things that you didn't analyze, which I think are also an important contributor to the uncertainties, and it doesn't really reflect also the fact that something in the analysis might be an error or some sort of a bias. So I think although I would think that a factor of three is maybe the minimum value, I don't think we're talking about orders of magnitude. When I see the number 4.1 times ten to the minus five, it means to me that the answer is somewhere between ten to the minus four and ten to the minus five. It's in that range. CHAIRMAN JACKSON: Okay. Let me ask you this question. How many of the inconsistencies that you speak of, that you've delineated on this viewgraph, would be eliminated with the issuance of the regulatory guidance and documents and the standard review plan sections that we talked about? MS. DROUIN: I think the bulk of them would be. When we went through, I believe it was Mr. King who spoke to this yesterday, and we talked about NUREG-1602 which goes through and systematically, you know, gives the attributes of, for lack of a better word, of a quality PRA. . 41 We started that in NUREG-1560 and we actually broke down the PRA, you know, starting with your level 1, your level 2, your level 3, and then, looking at each of the different levels, what are the different tasks associated with doing that part of the analysis. And if you're looking at, for example, one task would be your initiating event analysis, regardless of what -- the application or the reason you're doing, if you just wanted to do a very high quality PRA and given the current models and methods, what do we mean by that? CHAIRMAN JACKSON: I understand. MR. HOLAHAN: In addition to that, even if there were areas for which changes or improvement were made, using the regulatory guides I think would highlight those areas where there were differences and give insights, both to the licensee and the staff of the limitations of the tool that they've got. MR. HODGES: And also, NUREG-1602 is not a requirement. It says here's what we think would be a good way of using the state-of-the-art technology to do an analysis; and if you were reviewing one and they had already used their bounding assumptions and analysis, you're not going to make them go back and change. So you won't necessarily eliminate this, but you might constrain. CHAIRMAN JACKSON: What it does is it says -- it . 42 constrains what the use is. MR. HOLAHAN: Yes. Exactly. CHAIRMAN JACKSON: How much you can rely on that. MR. HODGES: Yes. MR. HOLAHAN: Yes. CHAIRMAN JACKSON: And that's really what it says. MR. HOLAHAN: Probably the first and the most important step is understanding the tool that you propose to use. CHAIRMAN JACKSON: Right. MR. HODGES: Yes. CHAIRMAN JACKSON: Right. Exactly. Okay. MS. DROUIN: When we start looking more at these models and methods, as I said, where we really saw tremendous inconsistency, not incorrectness but inconsistency, was in, you know, primarily the scope and the boundary conditions and the assumptions that were implied or -- not implied, I'm sorry -- used by the various analysts. The one area that I probably would highlight would be the human reliability. There were a couple of things that we did see here. Certainly again was inconsistency in the identification and selection of what human actions to model, and then inconsistency in the implementation of the various methods. . 43 The last one was certainly there are types of errors that the current methods do not cover when you start looking at errors of commission, those things that the operator elects to do on his own, not that he has failed to implement but that he thinks he's doing the right thing but he does the wrong thing. Those types of errors are not currently modeled which could have some impact on the final results in terms of identifying what are going to be the dominant sequence and contributors. CHAIRMAN JACKSON: Did you identify any methods or models that should not be used? MS. DROUIN: No. No. MR. HODGES: I think, you know, we found at least as wide, maybe wider variability in application of a specific model as we did between models on the human analysis. MR. THADANI: I guess one -- I know of one plant IPE, when they first came in, they assumed that the likelihood of human error is zero in recovery acts. MR. HOLAHAN: Yes, I remember that. MR. THADANI: Zero. And of course that required a lot of interaction. CHAIRMAN JACKSON: Say that again. MR. THADANI: There was one IPE that was submitted which was based on -- analysis was based on the fact -- . 44 their judgment that their operators will not make errors at all, probability is zero. That was a submittal. CHAIRMAN JACKSON: I see. MR. HODGES: That's one of the five that the evaluation is not written yet. [Laughter.] MS. DROUIN: Again, that was sent -- you know, I mean, the way I was focusing on was the actual method. That was not a method; that was -- CHAIRMAN JACKSON: I understand. MS. DROUIN: They had an assumption. Okay. Slide 12, please. We were asked to look at the IPE results as they compared to the Commission safety goals. In doing this, you know, there are several concerns or issues. Primarily the IPEs are internal events at full power looking at core damage and containment performance only. So we do not have a level 3 analysis which carries all the way out to risk looking at off-site health consequences. They also don't include lower power and shutdown. They don't include external events. So this is looking at a very narrow part of the risk when we provide the insights here. The first thing we did was to look at the two numerical objectives, the core damage frequency of 1e minus . 45 four per reactor year and the conditional containment failure probability of .1. When we looked at the core damage frequency, we saw that the core damage frequencies for the boilers all fell below the 1e minus four. Most of the PWRs fell below the 1e minus four, but there were several plants that were above the 1e minus four. COMMISSIONER DIAZ: Could you say what most means? Ninety percent? Ninety-five percent? MS. DROUIN: I think it was like 10, 15 percent if you look at it on a unit basis. CHAIRMAN JACKSON: When you talk about based on point estimates, this kind of relates to the question I asked yesterday. Is it based on propagating mean probabilities through the, you know, the fault tree, or is it based on carrying forward actual probabilistic distribution? MS. DROUIN: Yes. As far as we can tell from the IPEs, what they reported to us were point estimates. CHAIRMAN JACKSON: So you multiply this .5 by this .4 by this .2 by this .1 as opposed to really carrying forward the full distributions? MR. THADANI: And one would not call these mean values. CHAIRMAN JACKSON: Okay. . 46 MR. THADANI: They're not really -- CHAIRMAN JACKSON: They're really -- when you say point estimates, you must mean that, that you multiply point -- MS. DROUIN: I think most of them are point estimates. I don't want to say absolutely. CHAIRMAN JACKSON: No, but I'm saying, most of them -- MS. DROUIN: But I think most of them are. They didn't tell us differently. CHAIRMAN JACKSON: And so when you calculate a net core damage condition -- core damage frequency, you're multiplying everything along the sequence? MS. DROUIN: That's correct. CHAIRMAN JACKSON: Okay. MS. DROUIN: That's correct. CHAIRMAN JACKSON: Yes, Commissioner McGaffigan. COMMISSIONER McGAFFIGAN: If you were to do a 95 percent confidence interval, your guesstimate, knowing that they haven't done it, how many plants would have part of their 95 percent confidence interval below 1e ten to the minus four? MS. DROUIN: I think that you will certainly see some of these above -- I'm going to answer a little bit differently -- above the 1e minus four because you saw quite . 47 a few of them that are right at the line. COMMISSIONER McGAFFIGAN: So an awful lot right at the line, so therefore if you have any sort of normalized distribution, part of it's going to be below the line. MR. HOLAHAN: It's a little dangerous to guess. My guess is that most of the PWRs, the 90 percentile, the 95th percentile, would be able ten to the minus four. The boilers might be below, but most -- it's hard for me to think that most of the PWRs are in the middle or upper range of ten to the minus fives and that the tail of that curve is not above ten to the minus four. MR. THADANI: It -- I'm sorry. CHAIRMAN JACKSON: Commissioner? COMMISSIONER DIAZ: I was going to say since, you know, we have, say, ten to 15 percent that do not meet the - - do not go, you know, one times ten to the minus four, did we look at whether there was a generic cause for that? MR. THADANI: Yes. MR. HOLAHAN: Well, I think the presentation in the report puts plants into categories and deals with issues in categories, and I think that's probably the best way of addressing what is it that makes some of the numbers higher than others. MR. THADANI: If you -- well, basically, on -- let's talk about PWRs, for example, and I have a class of . 48 plants in here. It shows that if you -- by and large, the key contributors are station blackout and transients. And I would expect that means that the auxiliary feedwater system is playing a very important part in those designs. So you could then glean, if you took the next step, glean that kind of information from these. You have -- MS. DROUIN: I mean, if you want to compare here, you can see the distribution. If you look -- well, unfortunately I don't have a back-up slide on this, but there's a figure in here that has plotted the 1150 results, the main versus the distribution from the 95th to the 5th, and plotted against it are the IPE results. The IPE results, if I look at the PWRs and if I look at the biggest spread, which is Sequoyah 1150, which goes from about 2e minus seven all the way up to about 2e minus five, you see the spread of the IPE results going outside that spread just on the core damage frequency, and you see the same thing on the boilers. In fact, on the boilers, you see that there's quite a few that are even -- quite a few -- I don't know -- at least a dozen that are above the 95 percentile of the highest plant, the boilers in 1150. CHAIRMAN JACKSON: Okay. Why don't you go on. MS. DROUIN: Okay. . 49 MR. THADANI: I did want to make a comment, and that was yesterday when you asked us a question about how many plants may be approaching safety goals and we gave a response that there may be some, this is what I would call a fairly crude analysis, and what this says is -- leaving aside the issue of at what confidence level should we discuss this issue of safety goals and so on, what this says is the judgment was made if you had mean values and the frequency of early containment failure is less than ten to the minus five per reactor year, assuming all the analyses are credible and so on, then I think generically enough work has gone on, one could say that in that case, one would not be challenging the safety goals, the early fatality criterion which would be controlling basically. The difficulty here is that what we have got is very, very approximate calculations, and in order to really give a solid answer to a question like that, I think one has to dig a little deeper to be able to say how close are some of these plants or do they exceed these quantitative goals, and that statement then has to be tied with what kind of confidence we have in that particular statement, whatever that confidence level might be, and we don't have that information as yet. And it's very difficult to do at this stage from these studies. MS. DROUIN: And that serves as a great . 50 introduction to the next slide. CHAIRMAN JACKSON: Before you go, if I look at the containment failure probability -- MS. DROUIN: Yes. CHAIRMAN JACKSON: -- do you have any sense of how the numbers would go if you had a more full scope results where you would explicitly consider seismic events, et cetera? MS. DROUIN: I mean, it's going to be on a plant- specific basis, but, you know, you -- CHAIRMAN JACKSON: It's going to drive it that way. MS. DROUIN: Primarily, yes. CHAIRMAN JACKSON: All right. Okay. MR. HOLAHAN: I think you also get into one of the inherent difficulties in using conditional containment failure probability. It's very hard to define what that really means. CHAIRMAN JACKSON: Exactly. MR. HOLAHAN: Which earthquake are we talking about? MR. THADANI: I think by and large if -- based on at least the studies that have been done to date, the early containment failure -- there's some I'd say unique characteristics of severe accidents that tend to challenge . 51 containments. If you look at Mark I and Mark II plants, they are inert. They're very -- the containments are very small, and if you had a severe accident and if these containments were not inert, hydrogen would be the real cause for failure of the containment, probably fairly early in the accident. However, for Mark I containments, the most significant challenge early on is a potential for the liner melt through. It's like a light bulb. If you have a corium coming down into the lower cavity, it will spread out, very hot, attack the metal, and it will be the failure of the metal liner. The way to deal with that problem is very simple, actually. A lot of work has been done. One needs to make sure there's a way to get water, a layer of water on top of the corium. Commissioner Rogers remembers this very well. And in the IPEs, I believe, all licensees have now got procedures to find a way to get water in, and that takes care of that early challenge. Similarly, the -- another challenge of great concern for large, dry containments was the direct containment heating issue. Which research seems to show is not a real significant -- I think hydrogen for mark three containments is still a real issue. Mark three containments have . 52 igniters but these igniters are powered by off-site power source so there may be a question about some similar accidents, whether the igniters will function or not and could lead to potential for early containment failure. So I guess what I am getting to is that because the challenges are sort of unique of that nature, I am not sure that seismic would be a big issue. Fires could be because fires can cause station blackout or other kinds of scenarios. CHAIRMAN JACKSON: I just used that to capture the generic fires, you know, et cetera. Whatever. MR. THADANI: Fires could be. MR. HODGES: Another bias in some of these IPEs is many of them did not take credit for some of the research that has been done on things like direct containment heating so they are getting actually worse results than you would expect. CHAIRMAN JACKSON: Yes. MS. DROUIN: Looking at the quantitative health objectives, you know, we looked at both of them, what was your risk from your latent cancer which is not to exceed .1 percent of the total risk within 10 miles and what is the risk from your prompt fatality which is not to exceed .1 percent within one mile. When you look at these, both can be translated . 53 into numerical objectives looking at the latent cancer, which implies the risk should be less than five e minus seven per reactor year and for the early, which is implying the risk should be limited to below two e minus six per reactor year. So looking at these numerical objectives, was there some way to extrapolate from the IPE results against those numbers? And, again, I want to say we have the same issues and concerns because these were limited analyses again in the sense of just addressing full power internal events and they were not level three analyses, they did not include, you know, the other aspects of risk and we are also dealing with the point estimates. But was there some type of crude screening thing that we could do to try and get, you know, a feel for where we are against these objectives? Well, the first thing we did is that we went back to NUREG 1150 and recognized that the most limiting margin in getting there was going to be associated with early fatality risk. So since we are dealing with early fatality risk, we then went and looked to see what are the dominant contributors and your dominant contributors are associated, you know, with your early containment failure and bypass. Given that, we went back to the IPE results and looked at what they were reporting as the frequencies associated with early containment failure and bypass and see . 54 if we could screen at that, what was a threshold level that we could screen at if they were below that level. We could sort of get a feel that they were not going to approach these objectives and looking at that we were able to assume or guess as the threshold of about one e minus five per reactor year. So if those frequencies fell below that, we felt comfortable in screening those plants. At that point, we were able to screen out about 79, 80 of the units fell below that one e minus five and that left us about 29, 30 units that were above it. So then we said, well, given that, was there another gross back-of-the-envelope type calculation that we could do real quickly to try and get a feel where these remaining plants fell and there were several things that we did. We first went and looked at the release classes that were reported in the submittals associated with early containment failure and bypass and we looked at the source terms that were associated with the early containment failure bypass release classes in looking at the release fractions that would give rise to an early fatality, looking at what the release fractions were for iodine, cesium and tellurium and then seeing if they were above -- if they were above a certain threshold it could give rise to this early fatality. . 55 So then we went and took that information and then we tried to then account for the population. In looking at about one-third of the sector's population out to about one mile, that translated into a certain thing and through our back-of-the-envelope calculation real quickly, what we came out of is that there are another 15 plants we could screen. But it looked like we had about 14 plants using, you know, their source terms and release classes and then doing this crude approximation, we had about 14 that may approach this numerical objective of the two e minus six per reactor year for your early fatality which, as Mr. Thadani was also saying, I'm not trying to say this is very, very crude. It just sort of is a flag to point of where we might need to go look some more in depth. MR. THADANI: I might just note that what Mary is talking about is discussed in volume two, section 16 and it starts at pages 16-3 and goes on to 16-11, sort of the process that we went through. COMMISSIONER DICUS: Before you go on? CHAIRMAN JACKSON: Sure. COMMISSIONER DICUS: I guess obviously, given even all the qualifiers you put on confidence in these numbers, it is still a little disturbing to have a document that says possibly based upon the staff's extrapolations of uncertain data. I think I have that all right, 14 plants may approach . 56 this individual early fatality objective. That is somewhat disturbing to have this and, I guess, go forward and perhaps it is in some of the documents that I haven't reviewed but what are you going to do about this? What's the next step? It might be important to talk a little bit about that at this point. MS. DROUIN: Mr. Holahan is going to talk to all of that. MR. HOLAHAN: Thank you. COMMISSIONER DICUS: Had you planned on that? [Laughter.] MR. THADANI: No, frankly, we do want to make sure. I think there are ways to screen out. I think one of the areas we have discussed, we must follow up on, is all of those plants which are showing frequency of early containment failure of greater than 10 to the minus five, as a way to screen, make sure we are looking at those plants. I would make another note. And if we want to impose the backfit, reduce, we will go through our process, substantial improvement in safety through regulatory analysis guideline and cost/benefit analysis to see how far we can actually go. MR. HOLAHAN: The point that we really -- CHAIRMAN JACKSON: Let's wait. If you are going to speak to it, let's, for coherence, let her finish, if you . 57 don't mind. COMMISSIONER DICUS: No, that's fine, we may come back to it. CHAIRMAN JACKSON: Then we can come back and have a complete discussion. MS. DROUIN: The next one kind of goes on that same theme in the sense -- well, let me back up. Let's go to slide 14. We were also asked to look at, you know, what we say in terms of the station blackout rule, what kind of impact that it has had on core damage frequency. As we were asked to look at the safety goals, we had problems here too because, again, we were trying to us an analysis. This was not the purpose of it and to glean what we could from it. When you do look across all these plants, you saw a tremendous variety in the coping methods that were adopted as a result of the rule. But now when we are trying to assess, you know, what has been the impact and we are trying to glean this from these submittals, the problem came is that a lot of this information that we needed is simply not in the submittal and we only had about 15 percent of the licensees that told us the before and after picture. You know, here was their core damage frequency before the station blackout rule and here was their core damage . 58 frequency after the station blackout rule. In looking at that, you know, you saw an average reduction of two e minus five. And so if you are looking just for the impact, using a very small sample, you do see reduction that has been a result of the station blackout rule. The other thing was to look at, you know, what was the actual credit and what I mean by that is that, although we might not have had the before and after, we had a larger sample in that licensee's totals that they took credit. They might not have told us the before CDF but we knew that the core damage frequency that they reported they told us that they had implemented the station blackout rule and it was credited in there. So when we go back and look at that sample of plants, that was about I think 60 percent of the plants, but don't quote me on that. I am doing that one off the top of my head. You saw that the vast majority fell below the goal of the one e minus five per reactor year but you did see some plants that had implemented the station blackout rule that were still above the one e minus five. I think it begs the same question. Here, and I don't want to preempt Mr. Holahan, because we are working very closely with NRR and trying to . 59 identify the selection criteria of what activities we are going to pursue. I think NUREG 1560 serves as the first step in pointing to some things but, you know, how we proceed forward, I think you have to come up and decide, you know, what criteria you are going to use in pursuing based on these insights and perspectives on some of these plants that are coming out of the document. CHAIRMAN JACKSON: How many licensees have, in fact, implemented the station blackout rule? MR. THADANI: I can confirm but I believe it is 100 percent. CHAIRMAN JACKSON: All right. MR. THADANI: The rule is -- CHAIRMAN JACKSON: I am just looking at what the next-to-the-last bullet said. For those licensees that had implemented -- MS. DROUIN: Right because, again, we are basing this on the submittal which is 1990. CHAIRMAN JACKSON: All right. COMMISSIONER ROGERS: Do we have any numbers of the average cost in dollars per person rem averted in achieving that average reduction of two e to the minus five? Can we see what that cost to do that? CHAIRMAN JACKSON: Can you capture? I mean, is that data available? . 60 MR. THADANI: We could -- we can approximate it. We have -- COMMISSIONER ROGERS: It is just a ballpark number as it is. How does this compare with it? MR. THADANI: We could probably estimate it could be on the order of what I am probably giving I would suspect is a conservative maybe 200 person rem per year per plant because if I -- what I am doing is I am making an assumption here that station blackout is going to lead to a substantial release and I am using some old siting source term studies data to try and estimate. But we can give you a much better estimate. COMMISSIONER ROGERS: I think it would be interesting to see how that works out, you know. MR. THADANI: We can do that. We will do that. MR. HOLAHAN: I think the risk part -- CHAIRMAN JACKSON: I just want to know, given the station blackout rule, is station blackout still the dominant contributor to core damage? MR. THADANI: It appears to be from most of the studies, still a dominant contributor to core damage. MS. DROUIN: But I would also add, you are always going to have something that contributes to risk and the question is, is it coming down, is it coming down. CHAIRMAN JACKSON: You were about to make a . 61 comment? MR. HOLAHAN: I was going to say, I think we have a substantial amount of information about a station blackout analysis but the costs associated with station blackout or reducing risks, I think there is very limited information available. MR. THADANI: We provided the Commission some information on costs a few years ago on station blackout and I thought your question was more on the averted risk in terms of person rem. COMMISSIONER ROGERS: Yes, right. We can convert it to that measure. MR. THADANI: We can try and get that. MS. DROUIN: Slide 15, please. As we said, we did have a workshop back in April in Austin, Texas. We had three objectives that we had stated very clearly at the beginning of the workshop that we had given to all the attendees. What we were trying to achieve was, one, get feedback on the accuracy of the actual information and data that was in the NUREG. Also, get feedback on the perspectives and insights that are discussed and also get feedback on the potential uses of the results and the perspectives that are discussed and that's what we went forward with during the three days and had a lot of discussion on. . 62 When you look at the workshop it was attended by various utilities, all the owner groups, EPRI and NEI was there. Tremendous comments we received, primarily focusing on the first objective was what we really got, so the accuracy and information of the data and that led to the third bullet down here where we had a general concern that the information in the NUREG is out of date and what do we plan to do with that. When I look at the second objective, in terms of, you know, what feedback could we get on the perspectives that were in the NUREG, we really didn't get any kind of what I would say negative feedback in the sense that what we had presented was incorrect. It was more, really, associated with information is out of date and then because it is out of date, how does the NRC plan to use this? And those two concerns kind of fed each other. Our plans right now for NUREG 1560 is that we are not going to go back and rewrite this NUREG with the updated information for several reasons. One is that we don't have the information. We have very -- we have a scarcity and it is not as simple as just getting the core damage frequency numbers. You need the core damage frequency numbers, you need the accident sequences, you need the contributors, you need the -- I mean, it goes on and on and on. The only -- we did not just look at that bottom line number in coming to . 63 the perspectives and insights that are reported. You then go to the next question, is that, you know, these PRAs are going to keep evolving, keep updating and the conclusions that we really have here on a global basis, I think, are still pretty valid. They are not going to be, of course, on a plant-specific basis and that's the regime, the realm we're moving into. It might come back, maybe, years down the road or sooner down the road that we revisit that. But at this point in time, it is not our plan to go and update this with the information. We do plan on citing to a NUREG where we have some updated information in it but we aren't going to disregard that. There is some updated information that has been provided to us and what has been will be cited in there. We will also provide an appendix of the summary of the public comments and our staff responses to it. At this point, I will turn the presentation over to Mr. Holahan. CHAIRMAN JACKSON: Do you have all the questions to ask -- I mean the answers to what the Commissioners just said? We hope you've been keeping the list. MR. HOLAHAN: I did write down some. COMMISSIONER DICUS: Yesterday, it was, you know, "That question will be answered tomorrow." CHAIRMAN JACKSON: That's right. Remember I said . 64 we'd come back to you on this. COMMISSIONER ROGERS: I hope you remember those questions. MR. HOLAHAN: Slide 16, please. CHAIRMAN JACKSON: That's the answer, second bullet. MR. HOLAHAN: I thought I would cover some of these through the presentation, then I have a list of things that I don't think are quite covered in the presentation I will try to address, okay? One of the issues is the use and the relationship between 1560 and other ongoing activities, and the insights derived from the IPE program and the review of those IPEs has been used in developing the regulatory guides. Although much of what's in the regulatory guides is really regulatory philosophy, you see a lot of the technology issues are dealt with in the reference document NUREG-1602, and there are a number of sections in 1602 that derive the technical insights directly from the IPE program. So, in fact, there's a lot of overlap between a few of the chapters in NUREG-1560 and sections of NUREG-1602. Not only did it give us ideas of what constitutes state of the art, but it gives us an idea of the various methodologies used by licensees. So that's reflected in 1602. . 65 Neither 1560 nor 1602 are really the regulatory guide. I think in the long-term, we'll consider 1560 to be the counterpart to the IPE program. It's sort of the one- time snapshot of the licensee's evaluation of those plants and the summary of that activity is what's in 1560. What was learned from that program I think will be preserved in the regulatory guides and its reference document, which is NUREG-1602; and I think as we learn more about the technology and the state-of-the-art expanse, I would expect that not to result in another version of 1560, but perhaps a revision to NUREG-1602. So that -- and I think in the long-term, as was mentioned yesterday by Tom King, the staff is looking at the possibility of developing industry standards on doing PRA type analysis, and that would either take the place or reference a document, a state-of-the-art document like 1602. The 1560 insight document has provided information for the staff for a number of uses, and I think I'll just go ahead and cover that on slide number 17. Because there are a number of follow-up activities. As Mary mentioned, there were a number of plant enhancements identified and modifications made as part of the IPE program. Not all of them are called vulnerabilities, but there were plant upgrades. But not all improvements were made by all plants, and what we see from . 66 looking at the document is there was a wide variety of results and a variety of decisions that were made by licensees as to what enhancements to put in place and which ones not. I think this raises the possibility that the staff will look at those areas where some licensees decided that an enhancement was, you know, a valuable contribution to safety, but where the decision wasn't made on a comparable plant, I think we want to back and understand why those decisions were made. So that's one area where the IPE program will be useful in identifying or screening for potential safety issues. I will go on and cover the other regulatory activities as I go on. One of the things we need to do is to take the IPE results and look at them and identify what sort of areas do we want to follow up on. I think you've heard a number of discussions today that there's sort of the natural tendency to say, well, if a plant is above ten to the minus four, maybe we should look at it. But we've identified a slightly different approach, which is -- and this is still on the development, and I think we owe the Commission a paper on how we're going to do this later in the summer. I think it's August, July or August. MS. DROUIN: September. . 67 MR. HOLAHAN: Or even September. And one of the things we've begun to think about is since the reason we're looking at this is for potential improvements to the plants, those improvements are really made in specific areas and on specific issues. So the fact that the core damage frequency, the total is high really doesn't tell you what you want to know about whether an improvement would be cost beneficial. So what we decided to do is to pick a screening criteria which is much closer to the regulatory analysis guidelines for what you really want to know and what the regulatory analysis guidelines say is if you can identify a given issue or a given change to the plant which would produce a ten to the minus five improvement, that would be a substantial improvement. So that's the first screening test. So what we thought we would do is go back and identify individual sequences above ten to the minus five rather than a plant above ten to the minus four, because those sequences might identify given pieces of equipment or given procedures or activities where you might be able to make improvement to drive the risk down. Now, obviously the further above ten to the minus five, the more potential for improvement there is. So that's one of the places we'll start looking. . 68 The others are in addition to using the numbers that are in your report, I think we have to ask ourselves, do I believe all of the numbers and should I be just using those answers? So one of the things we'll be looking at is the distribution of results. And when you page through the insights report, you'll see on a class of plant sort of basis, there's quite a lot of variability, one plant to another, on both the risk and the large early release frequencies. So we will be looking at those outlier plants more than those that tend to be sort of in the center of the distribution and what we want to know is why the ones that are high are high, are there really physical differences in the plant or plant activities that are making it different from other plants, because if there are things that many plants can do and a few plants are not, then at least we know that there are feasible changes or potentially practical changes that could be made to those plants to make them look like the others. So at least it's a screening criteria to get a collection of plants and issues that can be looked at. Really what we're interested in is using this information to make potential safety improvements if they meet the backfit rule requirements for being substantial improvements and justified by cost. . 69 In addition to looking at the plants that appear to be sort of higher than their counterparts, we're also going to look at those that are quite a bit lower, and I think what we hope to learn from that is either they have some brilliant solutions to safety issues which I think we would like to understand, or else there's something unusual in their analysis that says maybe I ought not to believe that they really are that different. So I think we're going to look at the outlier plants and the issues that are above ten to the minus five. CHAIRMAN JACKSON: But it also implies, does it not, that in looking at the outlier plants, you really have to have an updated -- I mean, what you -- you know, if you're relying on analysis that you told me is seven years old, that presumably there could have already been changes and updates to the analysis that would not have them be such outliers. MR. HOLAHAN: Yes. CHAIRMAN JACKSON: Look at them as a crude screen to start. MR. HOLAHAN: Yes. Well, unfortunately, it's the only database we have at the moment. CHAIRMAN JACKSON: No, no, no. I agree with that. When I say crude, I mean coarse screen. MR. HOLAHAN: Yes. So I think we do understand . 70 that. CHAIRMAN JACKSON: Okay. MR. HOLAHAN: What that means is that really it is only the first step in the screening process. CHAIRMAN JACKSON: Sure. MR. HOLAHAN: And then I think, rather -- one of the things we talked about was the difficulty of going back to all licensees and asking for all of this information over again, but, in fact, if there are a handful of plants and a handful of issues, then we can go to the licensees and say, "Does this really reflect your current understanding of the plant?" And we can deal with a much smaller set of information. There is an additional item that we're interested in following up on, and frankly we haven't cited exactly how to deal with it, but we realize that the IPE program has produced something I think somewhat unusual, which is the plants that started this process meet their regulatory requirements. The enhancements that they are making are really beyond the minimum regulatory requirements, and almost by definition, those are not controlled by any regulatory process. In fact, there's nothing in the process that says a licensee couldn't remove the enhancement they put in a few years ago if they get tired of doing it next year. . 71 So what we see is we have a situation in which there may be enhancements put in the plant which both we and the licensees think were very worthwhile doing, and yet they are possibly or maybe likely not to have been captured in any way in the current licensing basis of the plant. So the first step we want to do is go back and understand the status of improvements put into the plant, and then I think we have a regulatory decision to make or maybe even a policy decision for the Commission to say once we understand what these are, and if they are important safety issues, should they be controlled by some sort of regulatory process? Should they be listed in the FSAR, for example, and so they're controlled by the 5059 process? Should the Commission in fact require licensees to continue to provide those enhancements? So it's -- I think that's an issue that we're going to need to come back to. It isn't clear at this stage what we should do with it, but I think it's an important issue that we need to follow up on. Can I go to slide 8? In addition to finding plants for which some safety enhancements may be worthwhile, we may find some potential safety issues of a generic nature that need attention. Now, I think this is less likely than the plant specific issues by the very nature of the IPE program. It . 72 was by its nature the search for plant specific information and we are more likely to find that it is plant specific variations or plant specific features that are important or should be required than we are likely to find, you know, broad generic issues that need to be addressed. Now, the reactor coolant pump seal issue I think is a possible exception to that, although it's possible that it may be more important on some plants than others and, in fact, could be dealt with on a plant-specific basis. But it is an example of an issue that does come up in a number of the analyses, that it shows up to be important, and not just in one place in IPE, but it shows up as being important in the station blackout analysis and in a number of transients. So it's one of the subject matters that we'll probably be following up on. COMMISSIONER DIAZ: Can I ask a question? CHAIRMAN JACKSON: Please. COMMISSIONER DIAZ: I'm just trying to understand the depths of this. For example, you talk about BWR reactor coolant pump seals. Are issues like, you know, stress corrosion, cracking in recirculation lines in BWRs, which used to be, you know, an issue we always talked about, will that show up in this analysis? MR. HOLAHAN: I don't think so. But it won't show up because the analysis doesn't show it to be important. If . 73 the analysis showed that this was a dominant issue on boiling water reactors, then it will say -- well, I think it's sort of the same as the station blackout issue. We dealt with this years ago, but why is it still dominant? But to the extent that things are not dominant, I think they will pass by. COMMISSIONER DIAZ: Okay. MR. THADANI: I think that is a very important question, I think, because it raises some other types of issues because of the way the risk studies are actually done, experiential database, and we've talked a little bit about in-service inspection yesterday. And since we're on the station blackout issue, as you know, in the BWRs, the steam generator tube capability at certain temperature and pressure conditions is also a concern, an issue that is being studied currently as part of the steam generator activity, and to the best of my knowledge, and maybe Mary can correct me, I don't believe any IPE or PRA has addressed that sequence potential for a steam generator tube failure given high pressure, high temperature conditions in the primary system. CHAIRMAN JACKSON: Are you looking at ATWS? MR. THADANI: ATWS is also one of the issues that we're reassessing besides station blackout, yes. COMMISSIONER DIAZ: But I think it is clear that . 74 there are certain issues that are laying out there that have not been addressed. MR. THADANI: That's right. Yes. COMMISSIONER DIAZ: Thank you. MR. HOLAHAN: In addition to the potential regulatory uses that I've discussed of the IPEs, I think it's an important area where we can learn about issues that need some research activities, and when something is important in the IPEs, I think that -- in the PRAs that go along with those, then I think those are areas where we may want to make improvements and push the state of the art. I think all these PRAs say that human analysis is important and it's an important contributor to the uncertainties as well. I think the research program already recognizes that and I think this just reinforces, you know, that additional work in that area is important. Core damage prevention strategies -- for example, the use of this information in severe accident management guidelines or improving PRAs, I think as you mentioned earlier, the -- for example, how core damage is modelled, I think these are potential areas for research both sort of in the basic research, understanding the phenomenon better, and also in the modelling sense of including these in sort of the state of the art of probabilistic risk assessment. COMMISSIONER DIAZ: Excuse me. Does this mean . 75 that the early containment failure you feel like has been resolved and doesn't need to be considered as one of these issues? MR. HOLAHAN: Well, I think it depends on which mechanism for early containment failure we're talking about. I think some have -- some have been resolved fairly convincingly, but I also go back to what Wayne Hodges mentioned earlier in that in the level 2 analysis, I think these analyses are not quite state of the art, and so I'm a little bit reluctant to -- I think you want to draw what information you can from them, but I would be a little bit reluctant to have these analyses, which I think are behind the state of the art, directing the research program. In a sense, I think the research program has led our understanding of core melt progression and containment performance, and there probably isn't a lot from the IPEs that the research community doesn't already know. COMMISSIONER DIAZ: Okay. MR. THADANI: I think the only point I would make would be the idea -- the two key elements: first, prevention of core damage is fundamental; and second, do we understand accident management enough to try and see if molten material can be retained in vessel. I think those are -- if we can come to some conclusion on that, that would indicate the actual risk of public health and safety is much . 76 lower than what we are calculating today with these models. COMMISSIONER DIAZ: It certainly will relieve the containment damage, yes. MR. HOLAHAN: The last prepared section is the fact that IPE results can be used to prioritize inspection activities, not just in a broad sense, but also on a plant- specific basis where there are sequences, equipment and activities on a given plant that the licensee has identified as important. I think these are clearly candidates for increased inspection activity or focusing the existing inspection activities. CHAIRMAN JACKSON: Well, with respect to these two bullets, I mean, to what extent have inspection activities already been prioritized by risk? MR. HOLAHAN: Well, I think as Mr. Callan mentioned earlier, I think it's an ongoing process. I think we've begun doing that. CHAIRMAN JACKSON: Is there a guidance out there to that effect? Is that part of some core -- I mean, how - - what do you mean when you say you -- MR. HOLAHAN: Well, there is -- in the PRA implementation plan, there is -- a folding of risk insights into the inspection program is one of those activities, and I think some of it has been done, but I think there is more being planned, also. . 77 CHAIRMAN JACKSON: Let's hear from Mr. Callan. MR. CALLAN: Several of the major inspection procedures, what I would call kind of the bread and butter procedures that, for example, that the residents use, direct residents, inspectors, to use risk insights to select smart samples when selecting maintenance activities. Given the range of maintenance that may be going on in a day, they only have resources to look at maybe one or two items. Operational activities. Every day, they have to triage what they look at, what they get involved in, and risk insights are used. Of course, the issue is what I mentioned earlier, Chairman, and that is that that presupposes that they have the expertise, the sophistication to make wise choices. CHAIRMAN JACKSON: In what they are making use of in making those selections. MR. CALLAN: Right. CHAIRMAN JACKSON: What tools they're -- MR. CALLAN: Right. CHAIRMAN JACKSON: Aside from their own sophistication. Are they using PRAs or insights from IPEs or what? MR. CALLAN: I'm going to have to give you somewhat of a parochial perspective, a Region IV perspective, but I think this is representative. I would . 78 say essentially all the inspectors, all the residents and region-based inspectors have undergone at a minimum the three-day PRA course, most of them the one-week course, and several the two-week. So they've all been trained and they all -- I won't say all -- most residents' offices will have the IPE on their bookshelf available to them. CHAIRMAN JACKSON: Five years old though it may be. MR. CALLAN: Yes. But I suspect, though, that most savvy residents tap into the licensee's risk process. Some have risk meters, as you know, and other similar types of methods for monitoring risk day to day and during outages, and I think most inspectors will in a sense plagiarize or use that information. It's -- CHAIRMAN JACKSON: But at this point, we can't -- in the sense of the bullets on the slide, we haven't started doing it totally systematically and there's not consistent guidance out there. MR. THADANI: That's correct. Initial guidance has been provided through our inspection branch in NRR actually, and the two activities underway, as Gary mentioned, one is revision of manual chapter 1145 that's going to include what I would call much more detailed guidance on the use of risk insights. In parallel, AEOD is working on training aspects and there is a pilot course . 79 that's being developed. I believe it's going to be -- it's going to be resource intensive, I think, about two-and-a- half weeks long probably. That pilot I believe is within - - it's either this month -- later this month, I think, and by the end of September, I think, we're supposed to finalize that course and start giving it to people. I think that will go a long way towards at least addressing the concern that Joe, Joe Callan raised. One has to be savvy. You can't just give insights. CHAIRMAN JACKSON: You're going to focus it on inspectors? MR. THADANI: Yes. That's part of the objective of the course. CHAIRMAN JACKSON: Okay. MR. THADANI: And it will include reviewers as well, yes. MR. CALLAN: Let me give you a candid perspective, and it's somewhat parochial, as I said. In general, though, the licensees that the inspectors deal with are more sophisticated than the inspectors are and more -- in terms of use of PRA, and so in a sense, the NRC is at a disadvantage in using this methodology and engaging licensees on issues. They can bring more resources to bear, more expertise to bear in rebutting an NRC perspective, and that's a source of frustration. You know, you all visit the . 80 regions and interact with regional staff; you probably sense that from your interactions. There is that -- something that may be approaching an inferiority complex in this area. COMMISSIONER ROGERS: On the other hand, they have the licensee's PRA as a working document to look at and guide their own inspection activities and leave it to -- MR. CALLAN: That's right, but there are, what, 75 stations or something like that, and each one of them probably has in-house PRA capability that equals that of the NRC. Each one of them. COMMISSIONER ROGERS: Oh, yes. MR. CALLAN: And exceeds that of any given region by far. So -- CHAIRMAN JACKSON: Well, I think that it's a comfort level, too, that I'm hearing and until and unless people, particularly the inspectors, have this systematic baseline training, there's going to be an extent to which the comfort is not going to be there. MR. HOLAHAN: I'll just summarize to say that what I've given you is some examples of the use of the follow-up on the IPE program. I guess the bottom line is really staff intends to use the IPEs like other PRA information to focus our activities on what's most important in a number of areas. Now, I did write down one question earlier and . 81 we'll see how far we can go in addressing it, and that is - - CHAIRMAN JACKSON: You've got two minutes. MR. HOLAHAN: TWo minutes? Okay. Good. How far will we go towards answering the question of whether these plants exceed the safety goal or not, and I think we will be addressing that at least in an indirect way, and it's not exactly clear to me whether what we're doing will completely answer that question. When we look at plants that might have some outlier issues, clearly plants that have large early releases above ten to the minus five as Mary mentioned as a sort of a screening tool, those will be captured. I think it's pretty clear that plants there and the issues that drive them there will be captured for our screening analysis. That will force us to go through additional analysis. If you recall how the regulatory analysis guidelines are established, there's a screening test that looks at core damage frequency and conditional containment failure probability. Those two together are somewhat comparable to large early release frequencies. I think these 14 plants will be captured as -- the issues that drive them I think will pass that screening criteria. The next stage is to do a value impact analysis. . 82 That is, after you go back to the licensee, to say, are we really dealing with the right set of facts today? Then after that comes a value impact analysis, and that value impact analysis goes all the way to dose, and in that sense it is a level 3 analysis capable of comparison with a safety goal. What I would think is that it's likely that plants that have large early releases which result in doses as high as, you know, some early fatalities will be candidates for some improvements. If those improvements can be made at a small or moderate cost, then I think the staff will just -- we'll deal with those on a plant and an issue basis. Now, it seems to me that it is possible that there will be some plants which are found to exceed the safety goal but for which the staff and the licensee can't identify any let's say what's obviously cost beneficial or cost justified remedy to that situation. Now, I think those are situations that might have to be brought back to the Commission to decide what does it really mean to have a plant which, you know, through further analysis appears to exceed its goal but for which the staff doesn't have any obvious remedy to the existing requirements. I think partly that's a policy question because the original safety goal policy of the Commission was not . 83 that all plants should meet this, but that the industry as a whole. And I think it may -- perhaps it shouldn't be too surprising that, you know, some of the students are below average. But I think that may be a situation that we'll have to deal with sort of at a later stage of this follow- up activity. MR. THADANI: In fact -- CHAIRMAN JACKSON: Thirty seconds. MR. THADANI: I think, in fact, it's very important to know that the Commission gave strict direction to the staff when we were looking at advanced lightwater reactors that the staff should not impose requirements beyond what could be justified in meeting the safety goals. So on advanced lightwater reactors, while the real risk is lower, but the staff requirements were based on not going beyond the safety goal for advanced lightwater -- COMMISSIONER ROGERS: Well, there was some body language in that and there was an expectation. MR. THADANI: That's right. COMMISSIONER ROGERS: There was an expectation that the design would lead to results which were -- MR. THADANI: Yes. COMMISSIONER ROGERS: -- about an order of -- MR. HOLAHAN: Yes. COMMISSIONER ROGERS: -- magnitude better than the . 84 current designs without explicitly referring to the safety goals. MR. THADANI: That's how containment performance goal was derived, actually. CHAIRMAN JACKSON: Any further questions? COMMISSIONER ROGERS: Do you mean on the whole thing? CHAIRMAN JACKSON: Yes. We're about to -- COMMISSIONER ROGERS: Yes. Sure. CHAIRMAN JACKSON: We've been here for two hours. COMMISSIONER ROGERS: A couple. I'll try not to take too much longer. You brought up the observation that the scope and boundary conditions were really very important in giving rise to differences between plants that were otherwise perhaps rather similar to each other in terms of the -- I mean, that's what I read into what you were saying, that because the licensees picked the scope and boundary conditions in doing the PRAs, therefore you get somewhat dissimilar results, somewhat dissimilar results for otherwise similar plants. So I wonder if the next -- what thinking there is in trying to go back and encourage some kind of uniformity on that basis if PRAs are going to be used for other purposes in the future so that we're taking a step or . 85 encouraging a step to go towards a more standardized approach? It wouldn't totally standardize how they did their PRAs, but at least those key items of scope and boundary conditions might be -- might help to bring things into much closer conformity. MS. DROUIN: And I certainly think it would, but I think, you know, you also have to ask the question, you know, given what application and everything, how much of that you really want to do. The other thing I would also -- trying to translate what you said, I don't want you to be misled that the variability is completely driven by the scope. COMMISSIONER ROGERS: No, I understand. MS. DROUIN: You will not -- you will always see variability in these results because the plants do look different. COMMISSIONER ROGERS: Yes. MS. DROUIN: I just didn't want to say that it's completely caused by plant design differences. COMMISSIONER ROGERS: But it may be very important in trying to arrive at something that's a little closer to a common approach in getting at a bottom-line number. MS. DROUIN: Right. But I just think you're going to have to start thinking about, you know, the application and the uses in determining what that standard should be or . 86 if it should be one. COMMISSIONER ROGERS: Yes. MR. HOLAHAN: I think in the guidance documents, we tried to have some balance between the obvious desire for high quality, consistent analysis and to allow licensees the flexibility to use what they currently have as opposed to having to wait until they have something else. COMMISSIONER ROGERS: Yes. MR. HOLAHAN: One would hope that licensees sort of figure out that the reviews are simpler on the staff's part and they're going to get more benefit from having a more of the state-of-the-art analysis tool, but, you know, we didn't draw our line in the sand to say if you don't have this tool, you can't play. COMMISSIONER ROGERS: Well, I just would remind everybody that when we started out with the safety goals, what they were designed to do, to make a very important statement about average expectation; and now if we substitute a surrogate for a safety goal, for a health effect safety goal, and then start to look very carefully and get very concerned if somebody doesn't quite meet that, that's a change in point of view. I think that the Commission ought to keep that in mind in looking at how far we want to go, because the safety goals were regarded as a definition of how safe is safe enough. That was really . 87 where we came down on that issue. The other point is a rather small one, but I just think that in talking about numbers, we ought to be a little bit more careful about how we throw them around. I happen to disagree with you when you say 4.1 -- I mean, I can't disagree with what you said as to how you would interpret it, but, you know, to me, 4.1 times anything tells me that in general practice, that's probably between 4.06 and 4.14 and not something else. I think that there's a sloppiness here, not just on our part, but there's an inconsistency with respect to how we state these numbers and then how we look at uncertainties and, you know, it's really quite sloppy. I think that it would be well to try to exercise some influence on a uniform approach to stating numbers. You know, there are standards that people do apply in this business -- maybe not in PRA, but in other scientific endeavors -- where when you state a number and it's got no decimal point after it, it means something, and when it's got a decimal point after, it means something else, and the number of figures after the decimal point means something else. I think we ought to revert back to standard scientific practice here and try to see that there aren't a lot of numbers floating around that really don't make a lot . 88 of sense when you consider the uncertainties in them. CHAIRMAN JACKSON: I agree with you, Commissioner Rogers, completely, but I think the only way that one is going to get at it in a realistic and honest way is to finally grapple in the best way we can, with the state of the art being whatever it is, with the uncertainty issues and the confidence issues. They come up, Commissioner McGaffigan raises them, I raise them in every meeting, but the numbers in and of themselves don't mean anything if you don't know something about the probability distributions on which they're based, how those uncertainties and so forth have been propagated through the calculation and that you come out with a number that you can say with some certainty, with a certain degree of confidence. If you don't do it that way, none of the discussion makes sense. So, you know, you can multiply .41 times .25 times whatever and you can come out with a number. It doesn't make any sense in this kind of context except in some very generalized way. And, you know, I'm sure that Mr. Holahan needs no defense, but I think that is the sense in which he gave the wide range in terms of what he thought a particular number meant. COMMISSIONER ROGERS: Well, I certainly quite agree with you, but I think the point is that, you know, your final observation that, you know, it -- those numbers . 89 don't make a lot of sense only within a certain kind of range and we have to say that. I mean, that has to be part of the statement. CHAIRMAN JACKSON: I think that is, in fact, covered, I hope, you know, at least in words, in your guides document subject to more fleshing out in the public comment process. MR. THADANI: It is covered in the guides. Yes, I do want to comment. There are certain elements that one can develop distributions about, one can talk about confidence levels. There are certain types of uncertainties that you can quantify; others you cannot quantify. COMMISSIONER ROGERS: Yes. CHAIRMAN JACKSON: That's right. MR. THADANI: I think the comment you're making is whatever the scope and the level of analysis when you're describing a quantitative measure, you have to say it at the same time with those boundary conditions around that. CHAIRMAN JACKSON: That's correct. MR. THADANI: And I think we need to -- CHAIRMAN JACKSON: I think that's what -- MR. THADANI: We're trying to do that. CHAIRMAN JACKSON: That's why Commissioner McGaffigan keeps asking you what do you mean by the . 90 difference between 4.0 ten to the minus five and 4.1 ten to the minus five. MR. THADANI: We're making -- that's an effort that's reflected I think in the guides. We're trying to do that. COMMISSIONER ROGERS: Yes. MR. HOLAHAN: I think we have a -- we have a real notation problem. COMMISSIONER ROGERS: Yes. MR. HOLAHAN: I think normally two digits are carried in PRAs not because you believe, you know, plus or minus that second digit, but it's not unusual to come to a circumstance where you want to subtract one number from another, and without two digits, you sort of don't know where you are. The other thing is without that rounding the numbers off, some -- it sometimes makes it difficult to understand exactly where the number came from. And to a certain extent, in my view, that second and sometimes even a third digit are just a way of telling you, well, it's these two numbers added together. You say, ah, okay, now I understand how you got that number. So it's an identifier. COMMISSIONER ROGERS: That's a fair comment. MR. HOLAHAN: But the idea that we don't express -- . 91 CHAIRMAN JACKSON: Okay. I think we've said enough. Commissioner Dicus? COMMISSIONER DICUS: No questions. CHAIRMAN JACKSON: Commissioner Diaz? COMMISSIONER DIAZ: Let's see. There's a quote from a philosopher that says the road to knowledge always crisscrosses the unknown, and I can't remember who wrote that, but it's a very old thing. I think the staff has made a very deliberate attempt this week to provide us with information, what they know, and also what they don't know, and I think that's very important and I want to thank you for that. I think everybody realizes and keeps commenting that all these issues are linked together. I think we need to recognize the fact that, before my time, at least, the Commission has recognized the importance of this issue, has accelerated the process to bring them to some closure, and I think the staff has captured that guidance and that drive. Saying that, I would like to say that I think it's important that in every one of these projects, we come to some closure, even if it's step-wise and even if it recognizes that it is, you know, a step, because if not, you know, we can go on and continue forever and never, never stop. So I think it's important that we -- . 92 CHAIRMAN JACKSON: That's right. COMMISSIONER DIAZ: -- close the issues. I have one comment which I don't know whether it's appropriate or not. When we put this database in the Internet and so forth and the fact that the information has not been updated, it might not be a bad idea to suggest to the licensees that on a voluntary basis, they can access their own information and update it. It might be a very, very simple way of getting additional information. You know, we'll protect our own database, but if they can actually go in there, they -- probably people that love to cruise the web might be able to give us some information on that. The last point, I want to express some concerns, and this has been something that has been mounting, is on the capabilities of the regions to practice these issues, and I think that we must realize that no matter what technique we develop, unless they are, you know, implemented at the region, we're just really a lot of bang -- a lot of noise and no bang. So I would like to stress that we need to move almost in parallel. CHAIRMAN JACKSON: I agree with that completely. COMMISSIONER DIAZ: Thank you. CHAIRMAN JACKSON: Commissioner McGaffigan. COMMISSIONER McGAFFIGAN: I have expressed my . 93 uncertainties about the uncertainties often enough. I think I'll just pass. CHAIRMAN JACKSON: Thank you. COMMISSIONER McGAFFIGAN: They have a very difficult job ahead of them. CHAIRMAN JACKSON: Exactly. And I would like to thank you very much for a very informative and candid briefing on the insight program, and I think you've heard all of us commending you for the progress you've made. I'm pleased that you've identified a number of follow-up activities related to the IPE program bearing in mind what Commissioner Diaz had to say about coming to closure on step-wise basis, and I'm particularly interested in the use of IPE results to assess the regulatory effectiveness of major safety issue resolution or at least what the crossing has been, and just to get a readout and understand where we are. I think it's very important, the issue of prioritization with respect to inspection activities, including the training of the inspectors and the development of the other regional capabilities on an expedited basis. You mentioned having the senior reactor analysts and sort of some wrinkles with getting them out, but if there's a need -- if there's a way to accelerate and get a bigger bench to . 94 start with, then we need to think about that. You mentioned the station blackout rule today and we talked about some others, and I believe you're also considering the regulatory effectiveness of the ATWS rule. I would expect that the regulatory effectiveness organization, including the Office of Research, will be involved in these activities? MR. THADANI: We will be in all the activities we've been talking about. CHAIRMAN JACKSON: And from the standpoint of regulatory effectiveness, I would encourage your continued focus on, you know, this particular aspect of the use of IPE insights as we transition into the risk informed framework and in terms of what you might contemplate. I think it would be appropriate for you to inform the Commission of your scope and schedule of activities. Then the last area I wanted to look -- and it does relate again to the closure and it overlaps with the others. You know, it's one thing to talk about using the IPE insights in a regulatory effectiveness framework; another is what -- a separate is what I'd call regulatory creep in the use of IPEs. Now, I'm interested in this tracking of all the regulatory uses we've made of IPE insights and how we intend to move from that to the risk informed framework based on . 95 the newer guidance documents, because you have heard the admonishment from Commissioner Rogers repeatedly that the IPEs have a certain purpose. The PRAs were a tool for achieving that purpose, but now we've laid out some guidance relative to PRAS and their regulatory use, and we want to ensure that that's where we're going and that we don't misuse what we started with, but what we do is referenced even as we look at what else we can glean. So unless there are any further comments, we're adjourned. [Whereupon, at 4:20 p.m., the briefing was adjourned.]
Privacy Policy |
Site Disclaimer |