ML20206J017
| ML20206J017 | |
| Person / Time | |
|---|---|
| Issue date: | 04/10/1987 |
| From: | NRC COMMISSION (OCM) |
| To: | |
| References | |
| REF-10CFR9.7 NUDOCS 8704150496 | |
| Download: ML20206J017 (75) | |
Text
dilGlNAL UNITED STATES OF AMERICA NUCLEAR REGULATORY COMMISSION l
Title:
Periodic Meeting with Advisory Committee on Reactor Safeguards (Public Meeting)
Location:
Washington, D. C.
Date:
Friday, April 10, 1987 t
Pages:
1 - 62 Ann Riley & Associates Court Reporters 1625 i Street, N.W., Suite 921
(
Washington, D.C. 20006 (202) 293-3950
- F2i3872""2 PT9.7 PDR,
4 o
1 D I SCLA I MER 2
3 4
5 This is an unofficial transcript of a meeting of the 6
7 United States Nuclear Regulatory Commission held on 8
4/10/87 In the Commission's office at 1717 H Street, 9
~ ~N. tJ., (Ja s h i ng t on,
D.C.
The meeting was open to public 10 attendance and observation.
This transcript has not been 11 reviewed, corrected, or edited, and it may contain (e.
g 12 inaccuracies.
13 The transcript is intended solely for general 14 informational purposes.
As provided by 10 CFR 9.103, it is 15 not part of the formal or informal record of decision of the 16 matters discussed.
Expressions of opinion in this tra'nscript 17 do not necessarily reflect final determination or beliefs.
No 18 pleading or other paper may be filed with the Commission in 19 any proceeding as the result of or addressed to any statement 20 or argument contained herein, except as the Commission may 21 authorize.
22 23 24 25
t 1
1 UNITED STATES OF AMERICA 2
NUCLEAR REGULATORY COMMISSION 3
4 PERIODIC MEETING WITH ADVISORY COMMITTEE 5
ON REACTOR SAFEGUARDS 6
7 PUBLIC MEETING 8
9 Nuclear Regulatory Commission l
10 Room.1130 11 1717 H Street, Northwest 12 Washington, D.C.
13 14 FRIDAY, APRIL 10, 1987 15 16 The Commission met in open session, pursuant to 17 notice, at 10:04 a.m., the Honorable LANDO W.
ZECH, Chairman 18 of the Commission, presiding.
19 COMMISSIONERS PRESENT:
20 LANDO W.
- ZECH, Chairman of the Commission 21 THOMAS M. ROBERTS, Member of the Commission 22 JAMES K. ASSELSTINE, Member of the Commission 23 FREDERICK M.
BERNTHAL, Member of the Commission 1
24 KENNETH CARR, Member of the Commission 25 S
4 3
1 STAFF AND PRESENTERS SEATED AT THE COMMISSION TABLE:
2 3
4 J. HOYLE C. WYLIE 5
W. PARLER J. EBERSOLE 6
W. KERR P. SHEWMON 7
D. OKRENT C. MICHELSON 8
F. REMICK C. MARK 9
C.
SIESS D. MOELLER 10 D. WARD G.
REED-11 H. LEWIS 12
~
13 14 15 16 17 18 1
19 20 21 22 23 24 25
i 3
1 PROCEEDINGS 2
CHAIRMAN ZECH:
Good morning.
3 Today's meeting with the Advisory Committee on 4
Reactor Safeguards is to provide an opportunity for the 5
Advisory Committee to inform the Commission of their 6
deliberations on improved safety for future light water 7
reactor plant design.
8 Formal recommendations were provided to the 9
Commission in the ACRS letter of 15 January 1987.
This is a 10 topic in which the Commission has a high level of interest as 11 it relates not only to discussion of advanced designs, such as 12 advanced boiling water reactor, but also relates to the 13 Commission's considerations on standardization.
14 This morning's briefing is an information briefing 15 and no formal Commission decisions are expected.
16 Do any of my fellow Commissioners have opening 17 remarks or statements to make before we begin?
i 18
[No response.]
19 CHAIRMAN ZECH:
If not, Mr. Kerr, will you begin, l
l 20 please, sir?
l 21 MR. KERR:
Thank you, Mr. Zech.
We welcome this 22 opportunity to discuss this important question with you.
You 23 can gather, I think, that we gave a considerable amount of 24 time and attention to formulating the letter that you have.
25 Mr. Okrent was responsible for sort of shepherding
O s
1 this letter through the Committee and I would ask him if he 2
will make some opening remarks and we would hope other members 3
of the Committee might comment and we certainly would welcome 4
at any point questions from you.
5 CHAIRMAN ZECH:
Thank you.
6 MR. OKRENT:
I do not plan to try to read through 7
the letter because you've had it since January, with ample 8
time for reflecting on it.
Let me just make a few comments 9
and then I hope to let the' discussion bring out and the 10 questions bring out things of interest.
11 I think the Committee feels, as the third paragraph 12 on the first page, that one that says "The mean estimates of 13 risk from generation of electricity by the use of nuclear 14 energy are at least as low as those for generation by other 15 methods.
However, the acceptability of these estimates is 16 much affected by the large uncertainty associated with them.
1 17 A compelling reason for implementing improvements, apart from 18 the fact that improvements are possible, is to reduce the 19 uncertainty in the risk estimates."
20 I think they do feel this is important and as a 21 footnote, one might look at the recent Surry event, where we -
22 had a set of systems interactions, and recently noted the fact 23 in an information letter by the staff, which had not been 24 previously accounted for in any PRA, to my knowledge, although 25 certainly Carl Michelson has been trying to get the staff to ww w--
--y--
c-
- +
+
7 e-r
'T ww
i 5
1 include just such things in their systems interaction studies.
2 It's just another example that not everything gets 3
into the current PRA's.
4 I'll note that the list was not intended to be a 5
complete list.
An effort was made to provide recommendations 6
that had some merit.
It notes specifically in the letter that 7
there is overlap that if one does implement certain 8
recommendations, others become less important.
If one 9
implements certain recommendations, one might be able to ease 10 other things that are currently required, for example, if you 11 had a completely independent protected way of removing decay 12 heat, it might relieve certain access stringencies that now 13 exist and it might well relieve certain requirements on fire 14 protection, since you could see what one still really needed, 15 given this back-up system.
16 I'll only make one personal comment.
The letter 17 notes the Committee is divided on sabotage and how much should 18 be done.
I'm on the side, as I think I have advised before, 19 that thinks the new plants should consciously include 20 provisions as they can for better protection against terrorism 21 and sabotage, both external and internal.
Right now, if it's 22 done, as far as I can tell, it's at the option of the designer 23 and the staff is reviewing it only in terms of existing j
24 requirements.
I think the Commission should reflect on this.
25 MR. KERR:
Are there other members of the Committee
o 6
1 who would like to comment at this point?
Mr. Reed?
2 MR. REED:
I was not present at the time the letter 3
was created but I'd like to try to make a comment favoring 4
dedicated alternate principles for decay heat removal, which 5
is item one on page two.
6 If you go back into the history -- I have to talk 7
PWR, that's my background experience mostly -- go back into 8
the history of the PWR when it was initiated with the Navy, 9
there were of course the dumping condensers in the normal 10 decay heat path, the benevolent path of getting rid of decay i
11 heat, you like to go through the secondary systems, which are 12 always complicated, more complicated and perhaps more difficult 13 to assure their operability.
14 All right.
Also, in the early days of the submarines 15 had port side and star board side closed heat exchangers or an 16 alternate principle for decay heat removal from the primary.
j 1
17 That was not a good way to do it, in my opinion, because of 18 thermal shocks and reliability and shut off heat exchanges
)
i 19 themselves.
20 As we come along to the scene of today and for 21 future reactions, I believe that General Design Criteria 34 22 should be changed and that we should have in there the 23 requirement for alternative principle for decay heat removal 24 from the core.
We have it for the containment, alternate 25 principles for decay heat removal containment in sprays and in
o 4
7 1
closed heat exchangers, but we don't do it for the core.
2 In my. opinion, it doesn't have to be a redundant 3
system but it has to be a highly reliable back-up system.
4 It's not the benevolent way again, the kind way to remove that 5
heat.
You'd like to go through steam generators.
You would 6
like to use auxiliary polar feeds and emergency polar feeds, 7
because they are much more gentle and more like normal 8
operations, you don't mass up things and spray things around 9
and perhaps make recovery more difficult.
10 But, I think the complexity of these secondary 11 systems and auxiliary systems relying on all kinds of things, 12 including service water, which is complicated as it feeds 13 those systems and relying on condensate storage and relying on 14 the electrical and cable and everything in the world, I really 15 think we should be going in future reactors anyway to an i
16 alternative principle called depressurization blow down and 17 direct heat removal from the primary to some let's say blow 1
18 down tank and then recycle it.
)
19 CHAIRMAN ZECH:
Thank you.
20 MR. EBERSOLE:
I think Glen comes from a 21 disadvantageous background, in that most of his technical life 4
22 has been oriented with PWR's, the translation of submarines l
23 into the commercial versions, and he is now trying to force f
24 this configuration into one~for which we have a standing 25 commercial design anyway, which is straight boiling.
I don't
o 8
1 think we should cringe from comparative analyses between 2
boilers and PWR's at this stage in looking at the workhorse or 3
the energy picture for the next 50, 60 or 100 years.
I think 4
we ought to make a deliberate and impartial and fully 5
technically oriented comparative analysis between these two 4
6 designs.
7 The kind of thing he is talking about comes so 8
easily with a boiler that you don't even have to talk about i
9 it, including saturated cooling at normal temperatures, 10 pressures right through to atmosphere prior to core damage.
I 11 CHAIRMAN ZECH:
Do you disagree with his 12 recommendations concerning --
l
^
13 MR. EBERSOLE:
Oh, no, I don't, as long as we are l
14 going to hang onto the pressure water reactors as a part of a 1
15 commercial picture with which we started.
We have ridden in
]
16 on the success of the' submarine into this commercial reactor i
17 configuration.
I think that's really largely been the basis 18 of our success.
We have tacked onto the tail of the successful 19 submarine program and carried it to levels which I think we 20 ought to reconsider in the national context for power from
]
21 light water reactors.
22 MR. REED:
I must rebut a bit.
I completely disagree 23 on the best route to follow in light water reactors.
24 CHAIRMAN ZECH:
There we go.
That's what we expect 25 from this Committee and the Commission, too, I might add.
9 1
1 That's why we are here, to air our views.
2 I think it is particularly important and valuable 3
from my standpoint to hear from the others.
I know that some 4
of you have different views that you have expressed in your 5
letter.
I think it would be helpful to hear from others, if 1
l 6
we may.
7 COMMISSIONER BERNTHAL:
I would like it, too.
I l
8 think this is the second ACRS meeting in a row where all of 9
these distinguished gentleman sat down with the Commission and 10 there is not a single member of the press present telling us 11 something.
12 CHAIRMAN ZECH:
Are you sure?
I'm not ever sure.
13 COMMISSIONER ASSELSTINE:
We wore them out yesterday.
]
14 COMMISSIONER BERNTHAL:
I consider this, and in the 15 last meeting, if I can remember what it was, it was also a 16 very important topic.
It may have been safety goals, in 17 fact.
Nobody here, it's just amazing.
You haven't discovered 18 our secret?
We bore the press to death.
19 MR. KERR:
Mr. Ward?
1 20 MR. WARD:
I'd like to make a comment which I think 21 Dr. Okrent -- I would really like to expand on a point that he 4
1 22 made.
I think that is why is the ACRS recommending i
i 23 improvements for future light water plants.
I think our 24 rationale might be of interest to you.
I think it's something 25 we struggled with.
I
1 l
10 1
First of all, we have a safety goal which the ACRS 2
has in general agreed defines an appropriate level of safety i
3 for nuclear plants.
Second, we have a population of existing 4
plants which there is at least some reason to believe in j
l 5
general conforms with the safety goal, at least the Committee 6
members don't recognize problems, you know, disparity between j
7 the safety goal and the existing plants to the extent that we 8
are recommending shutdown of the plants or anything like that.
9 Why then are we recommending that things should be 10 different, that there are necessary improvements?
I think we 11 have tried to explain that in the third and fourth paragraphs 12 of the letter.
Basically, I think that while we are generally 13 satisfied with existing plants and the safety goal, our
^
14 satisfaction isn't at a level of robustness that we would like 15 it to be.
16 As we have often said and as many people have often i
17 said, although we regard the plants as safe, there are large 18 uncertainties associated with our assessments of that safety l
19 and we would like to be able to reduce those uncertainties.
1 20 We think that reducing the uncertainties is not 21 simply an exercise in analysis, that is if we could just i
22 analyze them better and have more operational data, better 23 codes for calculating, that we would be able to reduce the 24 uncertainties, that will help but that's not the thrust that 25 we are talking about here.
1
11 1
We think that uncertainties in safety performance of 2
plants can be reduced by improvements in the design of the 3
plants themselves, that there are certain features which could 4
be included in plants which would inherently provide more
)
5 robustness in their ability to perform safety functions than l
6 systems in existing plants.
I think seeking robustness of the 7
conclusion that plants are safe enough through certain improved I
8 design features of the plant, I think that's the thrust of what 9
we are trying to say in our letter.
)
10 CHAIRMAN ZECH:
Could y3u discuss " robustness" just 11 a little bit more?
12 MR. WARD:
You get a lot of different opinions on 4
13 what we mean by this.
I think in one of the drafts of the 1
l 14 letter, we did attempt to talk about " robustness," but it's 15 something we couldn't reach consensus on so it is not in the 16 letter.
17 I see " robustness" as a characteristic, let's say, 18 of a plant system, where it would be forgiving of let's say 19 maltreatment in maintenance, maltreatment in operations.
It's 20 a system that doesn't depend on near perfection in how it's 21 treated and how it's operated.
I think too many of the 22 systems in existing plants will do their job but they will do j
23 their job only if they are maintained at terrifically high j
24 levels, nearing perfection.
25 I guess I have a concern that on into the future, we i
l i
4
12 1
are talking about plants that are going to be operated for 30
~.
2 years, 50 years, perhaps 75 years.
There is currently a lot 3
of energy devoted to excellence in operation.
That's a fine 4
goal.
A lot of speeches are made about it.
5 I personally have some concern that while we may be 6
able to inspire excellence in operation in the near term, that 7
as the operation of nuclear power plants becomes more routine, 8
as we hopefully have a future of the next several decades of 9
successful operation without accidents, that it might be 10 a little harder to inspire through speech making and even 11 through real programs this thing we call excellence in 1
12 operation.
( ~
13 I'd like to see the plants that are being designed i
14 today that might be built in 10 years and will still be 15 operated in 50 or 60 ysars from now, to have less dependence 16 on the need for being operated by an elite but have more 17 robustness in their physical design so that operation by 18 normal human beings at a more normal level of attention will 19 be sufficient to provide safe nuclear power 50 years from now.
20 COMMISSIONER BERNTHAL:
I have to say that I have 21 the same problem that Lando has with the term " robustness."
22 It seems to me what you are talking about, Dr.vid, is l
23
" simplification," not,"r,obustness."
I agree with absolutely 24 evynything you are saying as a philosophical matter, but I 25 don't believe we are ever going to be able to afford to make i
13 every one of these plants a Mercedes Benz driven by 1
2 Ph.D. chauffeurs, if you will.
That just isn't going to 3
happen.
4 Rather than robustness, it seems to me that what we 5
seek is an elimination of a wide variety of the systems and 6
the complexities in these plants so that you go to simpler 7
plants.
It seems to me that is the key word, which reduces 8
the uncertainty in trying to analyze the plant vulnerabilities 9
and finally then achieves the thing you apparently are seeking 1
10 and that I believe the commission referred to in the Advanced 11 Reactor Policy Statement.
12
.I think any illusions that advanced reactors are
~N 13 going to be something other than take your choice, light water f
14 reactors, high temperature gas reactors, liquid metal cooled 15 reactors has now gone by the wayside, because there aren't 16 going to be any reactors, advanced or otherwise in the next 10 17 years in this country, new ones, that is.
18 There is time, it seems to me, to sit back and look 19 at how we simplify these systems and 4chieve what you are 20 seeking.
21 Do you agree with that?
It seems to me that 22
" robustness" is not the right word.
r 23 MR. WARD:
I think I do.
I think you are saying, 24 you know, somewhat better what I was attempting to say, by i
25-this term " robustness."
Maybe it is not a very useful term
14 1
but simplification of systems is certainly a route to that.
m 2
Maybe it is the best route.
I don't mean gold plated.
3 MR. KERR:
Glen?
)
4 MR. REED:
I like that word " simplification," but I 5
would like to get in another pitch for the fact that if we go 6
to a back-up sure fire core melt prevention system, very sure 7
fire, then simplification throughout much of the balance of 8
plant and secondary plant and walls and barriers and security 9
access, how many feed pumps and how many condensate pumps and 10 how many pipes, all the water hammers and things that are 11 inherent in the very complex secondary path, the benevolent 12 path to heat removal, this simplification can begin to be 13 realized.
14 I very much favor this kind of approach.
Let me 15 make another comparison.
We talked about the Navy had it at 16 the outset, not perhaps with closed heat exchanges the way it 17 ought to have been, but in the military, the Army, we also had 18 something that we called a reserve parachute.
It was a small 19 parachute.
You had a large parachute.
If you came down with 20 your large parachute and it didn't fail, you came down probably 21 with both legs intact and you were able to walk away.
If your 22 main chute, auxiliary, we will call it, of the present way of 23 removing decay heat on PWR's, if you came down with the main l
24 chute, you were okay, but if you had to go on reserve, you had 25 a failure of the main chute, you probably broke your legs but L
15 1
you didn't melt your core or ruin your heart, you were alive 2
and you could walk away from it.
l 3
I think we should have more emphasis on preventing 4
core melt and less on severe accidents, which will only lead 5
to more complexity.
6 CHAIRMAN ZECH:
Jesse?
7 MR. EBERSOLE:
I think he stole what I was going to 8
say to some degree.
I was saying when you talk about 9
simplification, you really mean at the bottom line when you 10 are retrieving to safety, you must go into progressively more 11 simple configurations, more assurance that it will really 12 work.
13 COMMISSIONER BERNTHAL:
That's right.
14 MR. EBERSOLE:
I don't deplore complications if they 15 are to get me extremely high efficiency or some other asset or 16 advantage that is unrelated to the safety picture.
I can get 17 progressively complicated if I'm trying to melt the Btu field.
18 As I follow back to this simple small parachute, it 19 doesn't hurt if you break a leg and it doesn't hurt how 20 efficient you are either, but it works.
There is a range of 21 complexity you can tolerate.
Now, everything is complex 22 because it all has to aim toward the ultimate duty of 23 protecting the core.
24 I think that is wrong, to have invested all this 25 responsibility and extremely complex network of intersupporting
16 1
systems that is prevalent in our designs.
j l
2 COMMISSIONER CARR:
I would like to ask Mr. Ward a 3
question.
Are you really proposing over design, more safety i
4 margins, as the Navy plans are pretty highly over designed, 5
so-called, to make them sailor proof.
f 6
MR. WARD:
I think that could be part of it; yes.
I 7
never heard the term before, make them sailor proof.
8 COMMISSIONER BERNTHAL:
I'm not sure what that 9
means.
10 CHAIRMAN ZECH:
Very conservative.
11 COMMISSIONER BERNTHAL:
Like a brick outhouse.
12 COMMISSIONER CARR:
Design them so they can accept 13 more mishandling.
Right now everything is designed to save an 14 amount of money, get a little more efficiency out of the 15 plant.
It's all dollars.
You can design them to be safer i
than they are'today, if you want to put the money in.
16 t
17 COMMISSIONER BERNTHAL:
My concern about the term 18 again is over design doesn't mean still more bells and whistles j
19 over more complication in the design.
If you mean more 20 robustness in the design, then I agree.
21 COMMISSIONER CARR:
Yes, less margin before you 2
22 field them.
I mean more margin.
23 MR. KERR:
Mr. Lewis?
You have been very patient.
24 MR. LEWIS:
Every now and then I have to behave.
I 25 sometimes find myself in audiences in which I have to explain l
I
.-_.---.--_..-.,_.-.--._-_-l
17 or at least argue that the word " academic" isn't a dirty word, 1
2 because people use it that way, and I feel I ought to the 3
defense of uncertainty also, because Dave, and'I agree with 4
nearly everything Dave always says, he's a wise man, but I'm 5
not convinced that uncertainty is a justification for searching 6
for a safer generation of reactors because I think first of all 7
you can prevent it if you try because we learn things and we 1
8 would have to be extraordinarily stupid not to put what we 9
learn into practice, as people design a new generation of 10 reactors, but put into practice in a couple of different ways.
11 It could be put into practice by making reactors 12 which are certainly more safe at lower costs and less 13 complication and therefore more robustness or they could be 14 made safer at t?e same level of complication, costs, and so 15 forth, and that's a philosophical issue that one ought to 16 start out by resolving before one goes to the details of how 17 you want to design the reactors.
18 Uncertainty, I like uncertainty, not just because I 19 earn my living by exploiting the fact that most people don't 20 understand it, but because uncertainty is a form of robustness 21 because if you have an uncertain range of characteristics and 22 properties of something and if you do your job properly, which l
23 is to license toward the low end, toward the conservative end, j
24 that is licensing as distinguished from analysis, then that 25 range of uncertainty gives you robustness beyond your licensing
18 base of the plant, it's a form of conservatism which you can 1
2 depend on.
3 For example, we know very little about the pressure 4
at which most containments will fail.
There is a design 5
pressure which is conservatively derived and where people have recently done tests.
It has turned out that these things are 6
l 7
almost embarrassingly stronger than the design basis.
I can 8
remove that uncertainty very easily.
I just put in a charge 9
that detonates at the design pressure and then poof, all the 10 uncertainty will be gone and you will have an easier analysis j
11 to do, but you will have a less safe plant.
It's that j
12 uncertainty that protects you beyond your design basis, and I i
~'
i 13 applaud the fact.
It makes analysis harder but it makes the
~-
(
1 1
14 plant safer.
15 I am making this speech only because all too often 16 in this agency, people regard analysis as the objective but it 17 isn't the objective.
Safety is the objective.
We often see 18 airplanes land, and we say, how in the hell could that airplane i
19 come through that weather for which it was not designed and a
20 land safely?
The reason is people didn't know how to design 21 it.
They had a certain amount of uncertainty designed at the 22 low end, and deep in your heart, you know it is going to do a 23 little bit better than that.
I like that.
4 24 I'm just making that argument just to counter the i
l 25 argument that you need to make future plants safer because of i
1
,._------,,-,-.__,--n---,,:,
-,.--., ~,.,-'
19 I
the uncertainty.
I don't think that is so.
End of speech.
2 CHAIRMAN ZECH:
Very good.
Yes?
~-
3 MR. SIESS:
I was interested in the question as to 4
what was meant by " robustness."
I use the term briefly, not t
5 in this committee but another committee dealing with 6
structures.
I guess nobody ever asked me what I meant.
I was 7
trying to think what I really did mean.
8 I think " robustness" to me is a lack of --
i 9
CHAIRMAN ZECH:
Excuse me.
Could you get a mike, 10 please?
11 MR. SIESS:
-- fragility or maybe better stated, a 12 lack of sensitivity.
I have something that isn't as sensitive
~'s 13 7
to errors, to uncertainties, to abuse, to misuse and so 14 forth.
I know what it is, I'm not sure how to get it.
I 15 think that is not inconsistent with what Hal was saying.
16 MR. LEWIS:
No, that is right.
It's not i
i 17 inconsistent.
I 18 MR. SIESS:
We don't want something that you have to i
19 calculate out with a finite element analyses or computer codes 20 that take 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> to run on a CRAY.
It would be nice, what 21 we were told in connection with ECCS many years ago, and $1 22 billion worth of research ago, that it is just not something 23 you can show it works by a calculation on the back of an 24 envelope.
That was a very nice objective for an ECCS system.
25 I think there are other things we do that could be more robust
20 1
in that sense.
1 2
MR. LEWIS:
I would define " robustness" as the 3
abilities to survive under conditions for which you didn't 4
design the thing, under a variety of real live conditions.
5 Some things can be done that way.
Some can be designed very 6
specifically to a presupposed set of conditions and that's not 7
a very robust arrangement.
8 I used the term two days before this meeting, 9
chairing a committee over in the Pentagon, and we are trying 10 to design a system and the word " robust" came up every five 11 minutes during our two day meeting, design a system that will 12 work in a war whose characteristics we don't yet know instead
(^
13 of the one whose characteristics we remember from the last 14 time around.
15 MR. SIESS:
Something he said, I'd like to elaborate 16 on.
He mentioned containment as an example of " robustness."
17 That is not entirely fortuitous but considering the whole 18 spectrum of containments, neither is it an uniformly true 19 statement.
Some containments are quite robust.
They have 20 quite a bit of capacity in severe accidents and others don't.
l 21 This of course is not surprising.
22 Our containments have been designed in the past for 23 design basis accidents, loss of coolant accident temperatures, 24 loss of coolant accident pressures, loss of coolant accident 25 scenarios, like everything else has been designed.
l 21 1
We have one recommendation in here that says we 2
should have containment designs for future reactors, light 3
water reactors, designed based to mitigate severe accidents.
l 4
That should be specifically taken into account.
5 We have been lucky, not entirely lucky, we are 6
conservative people basically, with containments that were 7
designed for LOCA's, some of them turned out to be pretty good 8
for severe accidents.
We should be able to do better.
I'm 9
not talking about pressure alone.
I believe any containment 10 could be designed for 50 percent more pressure than we have 11 now, but that's not the real problem, and all the other 12 mitigation features, f'
13 This is a recommendation here and it is different 14 from what we do.
15 C'IAIRMAN ZECH:
Yes?
16 MR. MICHELSON:
I guess I have a little different 17 view of uncertainty from a different vantage point, namely 18 from the systems analysis vantage point, and that is there are l
19 system behaviors that are not in the PRA's, they are not in 20 the uncertainty analyses.
The most simple minded example, for 21 instance, might be the problems of fire protection, fire 22 protection isolation.
These simply have not gotten into i
23 PRA's.
We do not understand the uncertainties they are 24 introducing but we see from time to time the effects they 25 produce.
i
.,,,,,_-.,,.___,...---.--.__m-
____..._.,_,,,,,,m.._
,,.__,,.-._w-_,my..-
22 1
These are the kinds of uncertainties that can be
.m 2
eliminated in two ways.
One, of course, is to eliminate the 3
challenge, eliminate the source, in other words, don't have 4
fire protection and you won't have the inadvertent actuation.
5 The other approach is to. harden equipment against the
[
6 inadvertent actuation.
Neither of these are necessarily 7
desirable approaches by themselves, but we have to understand 8
these better and we have to make changes in future plants to 9
eliminate the challenges that we do see.
10 In the fire protection problems, we also have said, 11 well, what's wrong with Appendix R?
Isn't that a sufficient 12 fix?
The answer is simply no.
It was a patch to fix past
, ~~x 13 plants that had been miswired and so forth.
We put in i
14 temporary protections of conduits and tried to develop some 15 physical separations or barriers.
16 These are not going to take care of the problem in a 17 true sense.
In other words, if you are designing from a fresh 18 start, you need a different approach.
The problem is again to 19 take care of the uncertainties that I think presently exist in 20 plants und the predictions as to how serious that problem 21 might be.
We can eliminate some of those uncertainties by 22 design modification for futura plants and clearly, we ought to 23 consider that.
24 COMMISSIONER BERNTHAL:
If I may, I am troubled a 25 little bit, too, by sort of relying on uncertainty and using
23 1
that as an argument to prove that it's good somehow.
2 Have you looked at the uncertainties in NUREG-1150 3
recently?
I'm sure you have.
That's a rhetorical question.
4 I have always argued -- and occasionally, in fact, 5
to some objections form industry groups -- that this Commission 6
regulates to uncertainty.
There's no question that we 7
regulated to uncertainty.
8 MR. SIESS:
That's right.
j 9
COMMISSIONER BERNTHAL:
NUREG-1150 throws a bit of a 1
' 10 bomb in our lap, because of these huge uncertaintiss, apparent i
.I 11 uncertainties, at least, that the Commission now has to deal i
12 with, and I guess it's that kind of thing that seems to me essential that we somehow move away from in the next generation 13 14 of plants.
I i
15 I don't see how the Commission can take regulatory 16 action that's in the direction that many people would like to l
l 17 go on source term, for example, when we're faced with 18 uncertainties that are two and three orders of magnitude.
19 That's my problem with complexity.f 20 MR. SIESS:
Two or three orders of magnitude, 21 though, isn't a probability.
We don't have uncertainties, I
22 say, at two or three orders of magnitude in how much load a 23 containment can carry.
24 COMMISSIONER BERNTHAL:
No, I agree.
On an i
25 individual system.
l l
- - ~ -
- + -. -,
24 1
MR. SIESS:
Your problem with uncertainties in m
2 NUREG-1150 might be real for existing plants, but for future 3
plants, in many places, it is possible to make a design such 4
that the uncertainty goes away.
5 COMMISSIONER BERNTHAL: -That's what I hope.
6 MR. SIESS:
We are addressing future plants, and we 7
are hoping -- I think that is robustness in a sense.
8 COMMISSIONER BERNTHAL:
But simplification, again, 9
comes to mind to me, at least, as the way that -- I mean, if 10 there's one thing that I -- one impression I've gathered in 11 walking through what must be 75 of these things by now is that j
12 they're just too damn complex.
I simply do not believe that 13 in the long run that human beings and systems should be asked i
14 to cope with what we're asking right now.
15 MR. SIESS:
Have you ever been to Big Rock?
16
[ Laughter.)
j 17 COMMISSIONER BERNTHAL:
No, but I've been to Yankee 18 Rowe.
There are exceptions.
i 19 MR. LEWIS:
Can I once more come to the defense of l
20 uncertainty and answer Fred's question, if I may?
l 1
21 I never believed that this Commission should regulate 22 through probability.
I believe that the person who is licensed 23 has a right to know the criteria for licensing, and the only 4
i 24 way he can know the criteria for licensing is if they are 25 reasonably well spelled out.
But they have to have a basis in
25 1
a probablistic analysis, and I think your concern about 2
uncertainty is not that it's there, but that it tends to be 3
mishandled and misunderstood.
4 And I have also made the speech many times about the 5
agency regulating to uncertainty, but my concern is not that 6
the uncertainty is there, but if you have different 7
contributors that have different levels of uncertainty, by 8
regulating to the low end, regulating in a deterministic way 9
to the low and of the uncertainty band, you may invert the i
10 order of the danger, of the risk contained in the two things.
11 The other defect -- and you see it all the time j
12 around here, and this is a speech that goes with hand-waving
- (
13 which can't unfortunately appear on the tape -- but whenever I 14 hear friends of mine say that we need to do more research --
15 and ressarch is another subject, of course -- we have to do l
16 more research to reduce the band of uncertainty, they always I
17 wave their hands like that.
And I always say, yes, we do have 1
l 18 to do more research to reduce the band of uncertainty, because 19 if you know this is going to happen, then the uncertainty 20 wasn't this big in the first place.
I 21 The fact is that you do want to understand what 4
22 you're doing, and that's what the study of uncertainty is 23 for.
There's nothing wrong with uncertainty, if you know what 24 the distribution is and understand it and fold it into the i
25 analysis of the effectiveness of your regulatory system.
. ~
26 1
But analysis is not the same as safety.
T 2
COMMISSIONER BERNTHAL:
Well, not, if I may say so, 3
nor is deterministic analysis of uncertainty the same as the 4
kind of uncertainty that we're having to deal with as 5
regulators.
Those uncertainty bands, in a way that I have no 6
idea whether it's a valid sort of procedures that the authors 7
of 1150 have used, but whatever they did, what the public now 8
sees is huge uncertainty bands that are not based on an 9
analytical process; they're based on the opinions of experts.
10 They.have sample expert opinion.
11 And that tell me a number of things.
One -- well, 12 first of all, it raises a question in my mind as to the
~N 13 validity of that entire process.
I don't know how you deal 14 with uncertainties in an expert's opinion or in a group of 15 experts' opinions.
But it also raises the question of why it 16 is that so many alleged experts still find themselves scattered 17 over three orders of magnitude, based on presumably analytical 18 characterizations of hardware systems.
19 That's the problem I have with NUREG-1150.
20 MR. LEWIS:
Well, we have to have a conversation 21 about Bayesian statistics.
22 MR. SHEWMON:
They are not analyzing the behavior of
- l l
23 mechanical systems.
I got interested in the direct heating 1
j 24 situation of late, which is one of the uncertainties that 2
1 1
25 comes up here.
And there's the essential precursors to this,
?
,, - -, - -,. - -. -. - -. - ~.. -. - -, -.,.,. - - -, -.. -, -
- -.,. - _ ~ - - - -..... _ -. - - - -, -, - - -,.... - -.
..-_.-----,,-,.,.,,w--
27 1
which the experts and the Staff, in my opinion, have completely 2
neglected, and after that, it gets to be the question of what 3
somebody talks about as how things are going to spray out of a i
4 nozzle if they're this hot and if the nozzle lasts, and --
I 5
COMMISSIONER BERNTHAL:
No, I don't mean mechanical 6
systems.
I mean physical problems of physical systems, a 7
physical problem as opposed to how people then broadly perceive 8
the uncertainties of that problem.
l 9
MR. SHEWMON:
Well, when you get to things that have 10 never happened before and people start postulating what the 11 probability might be, it gets very uncertain.
You have no a
12 just no experience to go on.
13 MR. SIESS:
If you have two experts, and one says it j
14 can happen, and the other says it can't, that's a pretty good 15 range of uncertainty.
16 MR. LEWIS:
Not at all, because the second one is i
17 surely wrong, if he says it can't happen.
1 18 (Laughter.]
I j
19 MR. LEWIS:
No uncertainty at all.
20 MR. SIESS:
This is the kind of uncertainty we're i
21 talking about, not the uncertainty in physical quantities.
22 It's uncertainty in probability.
23 MR. LEWIS:
My God, I have to come to the defense of 24 Bayesian statistics.
There is a well-defined discipline for i
I 25 incorporating expert opinion with experience and putting them i
i U
28 1
together in a systematic, coherent, logical, and sensible way.
4 2
It doesn't happen around here very much.
3 COMMISSIONER BERNTHAL:
Has it been done on 1150, in 4
your judgment?
)
\\
\\
5 MR. LEWIS:
I'll tell you at a later time about j
l 6
1150.
I 7
COMMISSIONER.BERNTHAL:
I'd like to talk about it.
8 CHAIRMAN ZECH:
Well, let me just say -- go ahead, 9
Bill.
10 MR. KERR:
I wanted to comment that I think one i
11 thing that severe accident research has demonstrated is that l
)
12 there are, once you assume that you have gotten far advanced I
13 into the coremelt progression sequence and on from there, a 1
14 great many phenomena that are~ postulated with which we have
)
15 limited experience and with which, I hope, we never have i
j 16 full-scale experience.
1 j
17 That is where much of the1 uncertainty in predicting 1
18 the consequences of serious accidents occurs.
This says to 19 me that we do not want to neglect -- and indeed, perhaps we 20 should emphasize more than we have in severe accident research i
i 21 prevention of coremelt.
i 22 If you look at the things that we suggest should get 23 attention in the letter, many of them -- I believe most of 24 them -- are in the prevention mode.
Not all of them.
There 25 is a suggestion about containment performance, which is l
- ~
29 4
l 1
certainly a mitigation mode.
And I don't know that we j
o, 2
necessarily thought that all of these would improve safety, 1
3 but what they would do, we felt in some cases, would make a-i 4
system available which one could -- whose behavior one could 5
predict with more confidence and thereby remove some 6
uncertainty in our ability to predict performance.
7 And.I think experience would suggest that we perhaps 8
know more about and can predict better the behavior of 9
malfunctioning plants or plants that are operating in an 10 abnormal mode before we get to severe coremelt.
Once you get i
11 10, 20, 30 percentPcoremelt, the ability to predict within 12 certain confidences what is going to happen goes down a great 13 deal.
And that, I believe, was part of the thrust of what we
(
2 14 tried to write, j
15 Let me say a little bit about simplification.
I'm a 16 believer in simplification if it contributes to safety.
I am I
17 not certain in all cases that it does.
I go back far enough l
18 in the nuclear power business that I can remember when people 19 were predicting that reactors would be as simple as a pipe and 20 a pot and a steam generator, and it didn't work out that way
[
21 for whatever reasons.
22 The systems turned out to be somewhat more 23 complicated.
And I think complicated systems can be made 24 reliable and comparatively facile.
The human being, in spite 25 of the perversities that bs has, is one of the more complicated I
i
30 l
1 biological systems, and I don't think we go to a single-cell ie 2
animal to get more capability necessarily, even though maybe we 3
lose some other things.
4 So I'm not necessarily sold on simplification as an 5
and in itself.
It certainly has merit if, at the same time, 6
you can reduce uncertainty or you can decrease cost or increase 7
reliability.
But I think we have to be careful.
8 For example, we know, it seems to me, very little 9
aven yet about the contribution of people to either increase 10 risk or decrease risk.
We have looked not in very much detail 11 at whether new systems should be more highly automated than 12 they are in terms of risk, decreasing risk.
~
13 It may well be that in spite of the complexity that 14 this introduces, there are at least some emergency systems 15 that are not now automated that should be.
There may be some 16 that are now automated that shouldn't be.
17 It seems to me that these things need looking at, 3
18 and we are at a point at which, as you point out, one is 19 unlikely to build any new plants for awhile.
So we are in a 20 situation in which if the resources exist, one can have some 21 looks at some of these things.
22 It is expensive to do it, and we talk about saving 23 money on construction, and construction does cost a lot of 24 money.
Design costs a lot of money too, and if you have a l
25 design that is reasonably proven, there is a tendency to I
I i
31 1
continue building that design.
And I think what we're trying 2
to suggest is that, from our perspective -- and I'm certainly 3
no plant designer; there are probably people on the committee i
4 who design plants; I'm not one of them -- so what we had to do 5
as a group was to look at those things that to us looked 6
promising for further investigation.
i 7
But as has been said -- and I think it should be 8
emphasized -- I don't believe any of us felt that all of these l
9 things should be introduced into any new plant.
Rather from 10 our discussion of this and from the input we had, we felt that l
11 some of these things merited further consideration.
12 COMMISSIONER BERNTHAL:
Maybe I can try a different 13 word -- eloquence in design, a little different word than i
14 simplification.
i 15 MR. KERR:
I like that better.
16 CHAIRMAN ZECH:
Well, let me ask if there are j
17 other questions from my fellow Commissioners.
I 18 Commissioner Roberts, do you have any questions?
i 19 COMMISSIONER ROBERTS:
No.
20 CHAIRMAN ZECH:
Commissioner Asselstine?
21 COMMISSIONER ASSELSTINE:
A couple.
I guess I'd 22 like to return to the simplicity question as well.
23 I guess when I look at the current generation of 24 particularly the large plants, it seems to me that those 25 plants can be run well, but in many respects or at least in j
32 1
some respects, they pose real challenges to the utilities and em 2
particularly to the people that have to operate them.
3 And I guess what I'm wondering is, since we have a i
l 4
period of time when nothing is going to be ordered or built, 5
why it isn't useful to do much of what you were j.tst talking
\\
6 about, Bill, and that is to take a look at what kind of 7
capability you believe the target audience is, do you want to i
8 design these plants for what level of sophistication in terms 9
of the people who are going to have to run them?
10 And I think one of the concerns I have is the stress 11 and the burden that many of the plant staffs, particularly at 12 the larger plants, really have to face.
And if you look at 13 what's happening, there seems to be sort of a burnout process 14 in a lot of those people because of the burdens that are i
j 15 imposed upon them.
16 Why wouldn't it be useful to take a look at what is l
17 your target in terms of the level of capability and i
I 18 sophistication of the people who are going to be running these i
19 things and use that at least as one springboard for deciding 20 on how you want to go about designing the next generation of 21 plants and look at questions, for example, like do you want to 22 have some many systems of the plant that are all i
23 interconnected, that provide a variety of different functions, i
l 24 and that really require a fairly high level of sophistication 25 and understanding on the part of the operators about the plant 1
. ~
33 1
design, about the variety of systems, the functions that 2
individual systems may play, about the degree of 3
interconnections that now exist between those systems, and use 4
that, at least, as one measure for trying to decide on the 5
level of complexity and particularly the level of interaction 6
between systems and plants for the future?
7 MR. KERR:
I will try to respond to that.
Other 8
people may want to comment.
9 I don't have anything with which I quarrel on the 10 basis of what you have said.
I think, however, in order to 11 achieve that sort of study, it cer'tainly involves more 12 understanding of human performance than we now have, and as 13 you will recognize, we and you, I think, have advocated 14 further study of this.
15 It also would require, if these kinds of studies are 16 going to be done in the industry, some recognizable incentive 17 for doing this.
I think part of the stress that exists for 18 operators -- and again, Glen knows more about this than I do 19
-- has to do with what I'd call regulatory oversight -- and I 20 don't use the term pejoratively; I don't mean tot it's probably 21 necessary and required -- but much of the stress, I think, on 22 operators comes from a combination of the complications with 23 which they have to deal and with the recognition that almost, 24 if they aren't perfect, they get in trouble.
25 And I do work with some operators on smaller plants.
34 1
I know that this is a stressful situation.
But what I am
-3 u.)
2 trying to say is that I think if there were motivations 3
for doing this which were clear to plant designers and j
l 4
operators, this could perhaps occur.
But it seems to me that l
5 what you've said makes sense.
6 MR. OKRENT:
I wonder if I could comment.
l I
7 CHAIRMAN ZECH:
Could you move the microphone up, 8
please?
l 9
MR. OKRENT:
Yes, and I'll even talk to the 4
10 microphone.
{
11 CHAIRMAN ZECH:
Thank you.
Thank you very much.
1 1
12 MR. OKRENT:
First, I might note that some time ago 13 when the severe accident policy was being developed, and it 14 seemed that the way the Staff was pushing toward looking at 15 safety improvements in future reactors was in terms of a PRA.
j 16 In fact, initially the then commission thought about some j
17 possible specific improvements that should be required, and I I
18 think the committee recommended that just using a PRA on a i
]
19 design would leave things in some kind of an ad hoc state for i
20 each plant and might not really get one to where one wanted on I
l 21 the future plants.
l 22 So in a sense, this letter is an effort to get us 23 thinking about specific things.
I just want to, from a i
24 historical point of view, bring that up.
25 With regard to the burnout question you mentioned, I t
35 i
1 would have to assume there's burnout from the pressures of 2
having a reliable plant that doesn't have long, unplanned
)
shutdowns, and there's burnout and the problem of not doing 3
i j
4 something that would bring the NRC down on you with a fine, l
5 and then burnout from worries about, suppose I get into a very i
6 difficult situation that threatens safety.
So there are I
7 different kinds of pressures, and I don't know which affects l
8 the most.
1 j
9 I think simplicity, one has to be careful about how i
l 10 it applies for uses.
One can -- one certainly would like to 1
l 11 have a plant that is less complex in its interactions, if 1
12 possible, than, let's say, pressurized water reactors are 13 under certain events.
I'm not trying to pick on them, but 1
14 they are quite complex for certain events.
15 They are complex in part because of interconnection 16 and they are complex for analysis because of interconnection.
I 17 We see more and more of that so among the recommendations we 18 have made were more and more separation and not dual use of 19 important components, for example, and there is a trend, as j
20 you can tell, at least by some designers, and there is a trend I
l 21 in what is existing in fact in European countries, less and 22 less common use of more than one purpose of important systems.
23 You can achieve simplicity by things that look more complicated also, I would say.
Simplicity in being pretty 24 I
j 25 sure you are reaching your goal.
In other words, that the l
l
.. _ _ ~ _ _,. _ _..
l i
i 36 l.
1 uncertainty band is all pretty much where you want it, let's l
2 say, at the low side, you have achieved your goal or better, j
3 If you can do that, you have a kind of simplicity.
4 I would say that's what the British tried to do in 5
their sizewell design.
They went to diversity as well as 6
redundancy in their effort to I think, reduce uncertainty in a 7
sense.
What I have read is it is costing 20 percent more for i
8 the plant.
However, I suspect if they manage to get a plant 9
approved and have a relatively smooth sailing, let's say, in
)
10 further reviews, that ends up not being a big factor as I see I
11 plants escalate these days.
1 j
12 All I am saying is there are different ways in which 1
) ('T 13 simplicity enters and one wants to use each of these to their 14 best advantage if you can.
That's all.
15 CHAIRMAN ZECH:
Glen?
16 MR. REED:
Many years ago, a motor car company j
l j
17 created an automobile which I call the Corvair, which the l
18 operators -- if an analysis had been made of drivers and i
l 19 operators, someone would have found out that perhaps only 10 i
l 20 percent of the people who were drivers and operators could f
21 have successfully driven the Corvair under the environmental 22 circumstances which it would face, because it had an inherent 1
23 functional problem of what its center of mass was and its j
24 tendency to spin around, pull in the opposite direction.
In 25 fact, both ends of the Corvair sort of looked like the front l
1u
37 1
or the rear.
'^\\
2 This issue of simplicity and the operator burden, I 3
think we have arrived at the point where the operator burden, 4
trying to understand the complexity of all the systems that go 5
into decay heat removal and then also cope with the paper and 6
perhaps something that is creeping all the time called verbatim 7
compliance, it is such that he is under a great deal of stress.
l 8
I have to vote that we should be thinking about 9
something which I think is being suggested here, we ought to 10 be looking at in this interim period of no reactors being built at designing for the person who is liksly to be at the 11 2
12 controls and not burden him with so much complexity to do the
'r 13 key function, the only really important function, decay heat i
14 removal.
We ought to make that function and the system for 15 that, at least in the back-up non-benevolent mode, we ought to 16 make that easy, so that he really doesn't have to refer to 17 paper and as was remarked many years ago, one of the most 18 serious near accidenta at Savannah River, was the fact that 19 the operator turned two pages at once in the paper in trying 20 to follow through with what he was supposed to be doing.
21 COMMISSIONER ASSELSTINE:
On robustness, maybe just i
22 a couple of comments.
It strikes me that there is an advantage 23 other than the one we discussed earlier on robustness, in the l
24 sense that if we build in some added margin in safety system or 25 add in margin in terms of materials used in the plant, we can
,---.n.,,
-,-~_,----n--w
38 1
avoid some of the problems in the future, hopefully, that we 2
have seen in the past, where if we find surprises, then we are 3
likely to find surprises in the future, and if the margin is d
4 there and clearly there, it provides a way of avoiding what we 5
have had to face with some of the existing plants where the 6
original design has been so close to the design specifications 7
and when there turns out to be a problem, lack of capability, f
8 you and up with a fairly expensive fix, fairly expensive change 9
to the plant.
10 I wonder if you see that as an' advantage.
11 MR. SIESS:
Margin is what you provide to allow for i
I 12 uncertainties.
Robustness would be something that made it
'N 13 insensitive to the uncertainties.
14 COMMISSIONER ASSELSTINE:
All right.
i 4
l 15 MR. OKRENT:
I think to many of us, the appeal of a 1
16 dedicated decay heat removal system and I will add a word, bunker, was that if it is done correctly and if it doesn't 17 18 depend on too much of the original plans, and Glen is pushing i
19 toward one that depends on nothing in the secondary in effect, i
20 there are designs that depend on steam generators,~that this j
21 would give you a robustness for events that may occur despite
)
22 your best intentions, fire or CO2 inhalant in the control l
23 room, serious things.
24 There are different ways, I think, of achieving j
25 robustness.
I would say this would be one that warrants
]
t 39 really serious thought.
1 2
MR. SIESS:
It might be that probably the nearest 3
you can come in the light water reactor, the kind we r4re 4
talking' about, to the walk away concept that we are seeing i
5 advocated in the advanced reactors, I don't think you can have i
6 a completely passive system, but this would be essentially an 7
action system that would get you close to that capability, 8
walk away, at least for some time.
1
(
9 COMMISSIONER ASSELSTINE:
I see, I guess, some signs 10 that at least some of the ideas.that you are talking about are 11 being molded into the efforts that are now underway.
It also 12 appears to me that most of them probably aren't or if they
{~'
are, the kinds of considerations that are being given to them 13 i
14 are not bringing about very much change.
j i
15 I look at the Westinghouse advanced pressurized i
i j
16 water reactor, the advanced boiling water reactors, in the 17 EPRI effort, there are some signs of improvement in design, at 18 least looking at some of these issues, but an awful lot of it 19 still looks to be pretty much the same.
Perhaps part of that 20 is the target audience.
The Japanese have been extraordinarily 21 successful in operating large current generation plants and are 22 interested in the same kinds of things for the future, and that I
23 seems to be driving much of the design effort.
l l
24 I guess what I am wondering is how is it possible to I
j 25 build into the consideration of the designs for the next i
40 1
generation plants which are likely to be follow-ons from m.,
2 existing technology rather than the more advanced designs over 3
the next few years, when we have the time to do it, and at 4
least in my view, when our ability to do that is likely to i
5 determine whether or not there will be another generation of 6
plants.
7 Right now, I don't see the institutional structure i
8 moving towards -- at least on the industry side, towards i
9 consideration of the kinds of things you are talking about.
l 10 How do you break that' loose?
3 11 MR. KERR:
Is the Commission giving thought to the 12 possibility of some sort of carrot that would assist people in i
's, 13 making such decisions?
14 COMMISSIONER BERNTHAL:
Or stick, perhaps.
15 MR. KERR:
Whatever combination is desirable.
16 COMMISSIONER ASSELSTINE:
I'm not sure I see a lot 17 of carrots that you can offer realistically.
Maybe there are 18 some.
Clearly one is if you come up with a design and it 3
19 really incorporates new thinking, it incorporates substantial j
20 improvements, you ought to be able to expect a firm sign-off
/'
21 from the agency and that sign-off ought to remain valid for 22 long periods of time, unless there is a clearly demonstrated j
23 reason why that's not possible.
24 Apart from that, I don't see a lot of, carrots that 4
25 could be offered.
i l
41 1
MR. KERR:
That would be fairly important, it would
,q 2
seem to me.
3 MR. REED:
I think the ACRS should reach a consensus 4
on this issue of a decay heat removal dedicated system.
5 MR. KERR:
Only if it reaches the right consensus.
6 (Laughter.)
7 MR. REED:
If they would learn how to read, it would 8
be right.
They should reach a consensus and should place that 9
advice squarely in front of the Commissioners and there should 10 be some way to impose it in the new advanced light water 11 reactors.
12 MR. SIESS:
I think what we got in this letter is j
about as much of a consensus as you are likely to get out of 13 14 this Committee over the next 14 months.
15 COMMISSIONER BERNTHAL:-
I was afraid you were going 16 to say years.
j 17 MR. SIESS:
No.
There'will be a considerable influx 18 of new members in the next 14 months.
You might change.
You 19 are familiar with the response we got from EPRI and from GE?
20 COMMISSIONER ASSELSTINE:
Yes.
21 MRe SIESS:
For EPRI, of course, it's just words.
22 We don't really know what they are one to one.
For the GE 23 plant, we really haven't looked at it in that much detail.
24 Some of these things are in the GE advanced reactors, some of
~
25 them are in the Westinghouse, some of them are there simply
42 1
because they realized they were good ideas just as we did, but 2
they are aiming for good levels of core melt probability to 3
protect their investments, and some of them are there for 4
that.
5 Again, I'm not sure you have an one to one but then 6
I don't know how you get an one to one.
The Committee hasn't 7
quite agreed on what is one to one on some of these issues.
8 COMMISSIONER ASSELSTINE:
When I look at the list of 9
the items that you are recommending, my own view is they are 10 right on the mark in terms of the kinds of things that at 11 least ought to be considered for the next generation of 12 plants.
It also strikes me that they are in many respects
~-
13 very close in some respects and 'uite close in others, q
a 14 little bit more ambitious than some of the things that already 15 exist in some of the European plants.
16 I know one of the plants I visited last December was 17 in Switzerland, KWU, PWR, about 1,000 megawatts, that had 18 dedicated decay heat removal systems.
One relied to a certain 19 extent on steam generators, but at least a dedicated decay 20 heat removal system.
21 MR. WARD:
It relies completely on the steam 22 generators.
23 COMMISSIONER ASSELSTINE:
Yes, on the steam 24 generators.
That is right.
Also, a plant with heavy safety 25 system redundancy, four 50' percent trains in low pressure
43 1
injection, 6 50 percent trains actually in low pressure
'N 2
injection, four 50 percent trains on high pressure injection, 3
8 auxiliary feedwater trains, 6 of which are 100 percent 4
trains, 2 are designed at 50 percent but are also actually 100 5
percent in terms of actual capacity.
6 MR. SIESS:
Does that meet your criterion of 7
" simplicity?"
8 COMMISSIONER ASSELSTINE:
No, quite to the contrary, 9
but some things did go to my criterion on simplicity, extensive i
10 separation of safety systems, extensive. efforts towards 11 separation of all the electrical systems in the plant.
It has 12 some of the sabotage features in the bunkered system.
It has a
'-s 13 double containment, not to designed to withstand the core melt 14 but at least a double containment system.
It has full load 15 rejection capability.
It costs $1 billion.
It has had a 16 lifetime capacity factor of 82 percent and it is operated with 17 a plant staff of 215 people.
18 MR. SIESS:
And not regulated by the Nuclear 19 Regulatory Commission.
20 COMMISSIONER ASSELSTINE:
Not icgulated by the 21 Nuclear Regulatory Commission, but interestingly enough, 22 regulated by a strong regulatory agency that relies very 23 heavily on the body of regulations that we used to regulate 24 plants in this country.
25 MR. SIESS:
I was thinking about the 215 people.
r,
--r g
n..
.,y.
y
44 j
When you say a double containment, I'm seeing those words come 1
2 out in other places now, as is both containments were pressure 3
containments.
Were these both pressure containments?
Is one 4
just a leak collection containment, like we have on many of 5
our plants?
6 COMMISSIONER ASSELSTINE:
I think the exterior one 7
is less of a pressure containment and more of a leak 8
containment.
The inner steel one is the pressure containment.
9 MR. SIESS:
About half of our PWR's have double 10 containments.
11 COMMISSIONER ASSELSTINE:
I guess one of the things 12 I am wondering, would it be useful to look at the experience 13 with the design features of some of the European plants and 14 also to ansser some of the questions by those that had some 15 concern about this, are these things feasible, are they cost 16 effective, can you build a new plant at reasonable costs and 17 what kind of benefits do you get, not only in terms of accident 1
i 18 probabilities and consequences, but I would say also in terms 19 of plant reliability and challenges and burden on plant 20 personnel, including particularly maintenance people.
21 MR. LEWIS:
I am sort of uncomfortable about being 22 to slavish about following the lead of the Europeans, because 23 their conditions really are quite different.
For examples, 24 you mentioned sabotage protection in Switzerland, and I 25 suspect that the threat of sabotage in Switzerland is somewhat
45 1
less than it is in some neighboring countries in Europe, and 2
certainly I would -- I don't know whether it's less than in 1
3 the United States, but let me leave it at comparing European i
4 countries.
5 The second feature is that the European in general 6
are more conscious of the fact that there can be ground wars.
7 You know, it happens from time to time in Europe.
It hasn't 8
happened to us in a long time in the United States.
So that 9
one of the constraints toward a bunker-dedicated heat removal 10 system has to do with the potential of a conventional war.
11 Second, the Europeans are neither eight feet tall or 12 four feet tall.
They take many of their leads from us at the
{-
13 same time.
~
14 So I think it is worthwhile, because they are 15 intelligent and informed people, to deal with them and to 1
16 exchange information, and we try to do that all the time, even 17 going as far as the Eastern Europeans for that matter, with 18 some frustrations, but I think the whole idea of using the 19 world's resources and new technology is very sensible.
20 To your earlier point, though, Jim, you know, the 21 hiatus that we have is going to be solved by having more 22 apparently safe reactors.
I don't think that the problems 23 have anything to do with the safety of the reactors, nor do I 24 believe that there is any level of apparent safety that will 25 save any utility executive who orders a new reactor from ten i
46 1
or fifteen years of pure hell.
You know, it's just a situation 3
2 we've gotten ourselves into, and I think it's a real mistake to 3
believe that by having intrinsically safe reactors, all of 4
these problems will vanish.
5 That's a social comment, not a technical comment.
6 COMMISSIONER ASSELSTINE:
Yes, I don't disagree with 7
that, but I also think that there are some components about 8
existing plants, not only safety but clearly reliability and 9
complexity, that have a great deal to do with whether any 10 utility executive is ever going to order another one.
And I 11 don't see current industry efforts as coming fully to grips 12 with those kinds of concerns.
(~'
13 If you look at the EPRI effort, for example, 14 everybody says, "Aw, gee, we have to have simpler plants.
We 15 have to have less complex plants.
We have to have plants that 16 we can build faster.
We have to have plants that we can build 17 on predictable schedules and at reliable costs."
18 Then they get down to some of the touch decisions 19 about, well, how complex are we going to make these plants; 20 how much are we willing to give on thermal efficiency to 21 achieve the kinds of stability and reliability in terms of 22 construction and design that we want to achieve?
And the 23 process seems to break down a bit.
24 If we don't come to grips with those things, I 25 suspect you're not going to see tremendous, new resurgence in i
47 1
the future.
2 MR. LEWIS:
I agree in part with that.
They are 3
concerned about predictability and reliability and stability, 4
but those aren't the same as safety.' And in fact, if I had to 5
take any position, you know, if we were to set up a debate, I 6
would say that the utility executives by and large are less 7
concerned about safety than they should be, because very few 8
of them have had a coremelt at their plant, and therefore it's 9
quite natural that they would not be concerned about it.
10 But reliability, yes.
Sometimes reliability is 11 antithetical to safety.
You know, these things have to be 12 thought through at a philosophical level
~
(
13 CHAIRMAN ZECH:
Glen?
14 MR. REED:
I didn't want Commissioner Asselstine to J
15 be guilty of material false statement by omission.
16 (Laughter.)
17 MR. REED:
He talked about all these good Swiss 18 things and came down to a 215-person staff, which I think is 19 find and enough, but he didn't say that these people were very 20 carefully evaluated and selected and aptitude tested.
21 COMMISSIONER ASSELSTINE:
True.
And they are also 22 the product of an educational system that is quite different 23 from the educational system in this country, and they also 24 work in an industry where there are substantial advantages in 25 terms of stability of people, the ability to retain people for
48 1
long periods of time in the same kinds of occupational areas.
j TN ;
2 Some of those are substantial advantages, and 3
clearly they play a significant part in the kinds of successes 4
that they've been able to achieve.
5 MR. REED:
I was just trying to get in a dirty dig.
6
[ Laughter.]
7 CHAIRMAN ZECH:
Can we -- go ahead.
8 COMMISSIONER ASSELSTINE:
O'ne other question.
- Dave, 9
you raised some concerns in your views about quality assurance, 10 and I guess my own view is, quality assurance and how we 11 approach quality assurance for future plants is something that 12 also ought to be looked at during this hiatus pariod.
13
{
I guess where I come down is, I see problems where 14 I'm not sure the quality assurance programs that we've been 15 relying upon in the past have been successful.
I was recently 16 at Dresden, and I found it interesting that the company 17 learned, as a result of a consultant walking through the plant 18 about a year or so ago, the control panels were never bolted 19 down in the plant for sixteen or seventeen years.
And it's 20 not a very sophisticated thing.
There are all these little 21 empty holes on the back of the panel without any bolts in 22 them.
23 At the same time, I think the quality assurance 24 program that we now have has become very heavily paper-oriented 25 and is a tremendous burden on the utilities and the designers l
49
)
1 of the plant.
2 I guess my own view would be, we ought to take a 3
hard look at what kind of a quality assurance program we ought 4
to have for the future from both standpoints:
one, how can we 5
make.it more effective and more reliable, particularly so that 6
if there are problems, we find out about them early on rather 7
than at the tail end of the process or years after the plant 8
has gone into operation, and conversely, how can we make it 9
operate relatively efficiently in a way that imposes the least 10 burden on the people trying to design and build the plant?
11 I guess I wonder how we can go about doing that or 12 how the industry can go about trying to tackle that kind of a
("%.,
13 problem over the next few years, and whether you see that kind 14 of thing happening?
i 15 MR. WARD:
Well, that's a big order.
I certainly 16 don't have any ideas for how to fix the situation.
I think it 17 is a problem.
I think quality is important.
We all accept 18 that.
There is little indication that I've been able to find, 19 however, that quality assurance, as practiced, has much to do 20 with assuring quality.
21 And I guess I first began to consider this in ACRS 22 meetings in review of PRA programs that were being conducted, 23 where I'd question a PRA analyst as to whether they 24 differentiated in the -- you know, in their estimates of 25 reliability for systems or components or pieces of equipment i
i
. l
50
-- whether they differentiated between systems that were 1
?
2 installed under quality assurance programs and systems that l
3 were not.
4 And it soon became evident to me that most of the j
5 PRA analysts hardly understood the question even.
They didn't 6
really look at things from that perspective at all.
Probing a 7
little bit deeper, some of them concluded that when they did 8
attempt to, you know, see if in the experience database there 9
was a difference, they really didn't see one.
It wasn't clear 10 that in any quantitative terms that we could show, that 11 quality assurance programs were, you know, giving systems or 12 pieces of equipment that experience showed were operating
{^'i 13 better.
14 As to what to do about it, I guess honestly I don't 15 have any -- I don't have any idea.
But I think nothing is 16 going to be done differently unless the Commission exerts some 17 leadership and devotes some resources to rethinking the 18 process.
19 MR. SIESS:
I think there's two-things you can thing 20 about doing.
One is, you start thinking quality rather than 21 quality assurance and work from that direction.
22 The other, you can look at what's being done in 23 other countries.
I've heard that neither the Japanese or the 24 Europeans have our system of QA.
I can't guarantee that their 25 quality is as good as ours.
I find it difficult to see how it y-_,.y
,~-,.-.-, -,
51 1
could be much worse.
7m,,
/
2 But we have almost an implicit assumption that if 3
the QA is there, the paper is there, and the QA program is 4
approved, that the quality is good.
And yet when we see bad 5
quality -- a diesel engine breaks down the first time you try 6
to run it -- nobody goes back and says, " Gee, the quality 7
assurance program was bad."
8 Now you have to have assurance that there is the 9
quality, and the assumption is that if the QA is good, the lo quality is good, and if the QA is not good, the quality is not 11 good.
And that's an assumption.
12 COMMISSIONER ASSELSTINE:
Yes.
13 MR. SIESS:
We haven't seen -- we asked the Staff a 14 couple of times if they could establish an interrelationship 15 between quality assurance and quality and safety, and they 16 have really never responded.
They don't want to address that 17 question.
18 CHAIRMAN ZECH:
Can we move along?
We've got a --
19 COMMISSIONER ASSELSTINE:
One last quick question.
20 CHAIRMAN ZECH:
Go ahead.
21 COMMISSIONER ASSELSTINE:
What role does size play 22 in all of this?
Is that something that ought to be looked at 23 now?
Does it make a difference whether you build 1300 megawatt 24 plants or 500 megawatt plants?
Is that something that should 25 be considered at all in terms of deciding what it is we ought 4
e
~
~, - -
52 1
to be looking for in the next generation, or is that something 2
that you just leave to the industry and allow them to decide 3
what size plants they want to build, that they think they can 4
manage effectively?
5 HR. LEWIS:
In the aviation game, people argue 6
whether you should have two engines or one engine on an 7
airplane, and I, as the owner of a one-engine airplane, always 8
point out that if you have two engines, you have twice the 9
probability of an engine failure.
10 (Laughter.]
11 MR. LEWIS:
And it's no joke, because it depends on l
12 how much electricity you want.
If you build four 300-megawatt 13 plants instead of one 1300 or 1200 megawatt plant -- I haven't 14 done any analysis, but I'll bet a quarter you have a higher 15 probability of having a big accident.
It might not kill as 16 many people, to be sure, but it's a quantitative issue.
I 17 wouldn't do it off the bottom of my gut.
18 MR. SIESS:
But it seems to me, from the advanced 19 reactor program, that if you make them small enough, you can 20 get the passive inherent safety.
21 MR. LEWIS:
Yes, there is certainly level at which 22 you can do that.
That's right.
23 MR. EBERSOLE:
I think that's just in the advanced 24 class of reactors, the liquid metal and gaseous, not for 25 water.
I 53 1
MR. SIESS:
Well, we don't know.
I don't think
.s 4
4 2
anybody has tried it with water.
Maybe they can.
Maybe you 3
can approach it.
4 MR. EBERSOLE:
By the way, that engine analogy has 5
to be further qualified, though.
You were thinking about 6
getting off the ground.
Once you get up to 10,000 feet, you 7
can go a long way on half the power plant than,you can with 8
none at all.
9 MR. REED:
I don't think that size should be 10 addressed.
I think that it's an industry electrical grid 11 issue, and I don't think there will be those differences if we 12 straighten out a few safety systems that make size important, 13 that any size is okay.
14 CHAIRMAN ZECH:
All right.
Can we move on?
15 Mr. Bernthal?
16 COMMISSIONER BERNTHAL:
That's one thing that will 17 be driven by the marketplace, as they like to say.
18 I've been trying to think what I do not mean when I 19 say " simplicity."
We've tried hard to define what it does 1
20 mean in this context, and let me try something.
There will be 21 an electrical engineer somewhere here who will tell me I'm 22 crazy, I'm sure.
J 23 But surely today's solid-state transistorized radios 24 are simpler than the old tube-type radios were.
The physics 25 is simpler, I think.
The mechanical systems are surely much
54 1
simpler.
The manufacturing of the components is even simpler
( *.'
2 today.
We're even down to the point of no mechanical parts in 3
most of the controls.
And to me, that is not low tech, of 4
course, and the two are not to be equated, but it surely is a 5
simpler system than the old tube-type radio.
And that's the
+
6 kind of thing really that I'm talking about.
7 The same thing could be said about some of our 8
control rooms, I think.
9 I have a number of questions here which I'm not 10 going to get through, and I want to leave some time for 11 Commissioner Carr.
12 How much time do we have?
13 CHAIRMAN ZECH:
We really have a busy day, as you 14 all know.
I really think we've got to wind up here in just a 15 few minutes.
16 COMMISSIONER BERNTHAL:
It's a bad day, yes.
2 17 Well, let me see if I can pick one or two --
18 COMMISSIONER ROBERTS:
Submit them in writing.
19 COMMISSIONER BERNTHAL:
Submit them in writing, 20 right.
21 (La'ughter.]
22 COMMISSIONER BERNTHAL:
Let's start at the bottom 23 with the last question first.
24 What does the committee really have in mind that the i
25 Commission ought to do with this document?
What would you i
~
l e
55 like to see happen with it?
1 2
MR. LEWIS:
Memorize it and we will give you a test.
i 3
COMMISSIONER BERNTHAL:
It's a serious question.
j 4
I'd like to get some sense of what we ought to do with it.
5 There are no reporters here today.
You can say what you 6
wish.
It also means this could be dropped into the black hole 7
and be forgotten very eccily.
8 MR. SIE3Si We have already asked the industry to 9
comment.
Apparsntly General Electric was asked to respond and 10 comment.
Somebody asked EPRI.
11 COMMISSIONER BERNTHAL:
Is your point that we should-12 take a position then based on this paper and demand when we i
13 hear about the GE advanced reactor soon, for example, try to-14 get some sense of where they stand with respect to your 15 recommendations?
That still leaves the question, what do we 16 do with this ultimately.
17 MR. LEWIS:
Those are recommendations for 18 consideration.
I feel constrained to say that as one of the
\\
19 people who didn't sign onto this letter, I don't need to tell 20 you what I think you should do with it.
21 (Laughter.]
}
1 22 MR. LEWIS:
I speak only for myself.
23 MR. REMICK:
Let me try to answer that and it won't 24 be directly but it ties into the comment that Commissioner 25 Asselstine made earlier, that it appears that the vendors at i
1 56 1
least are not incorporating these in some of the advanced
,y 2
reactors and what should the Commission do.
3 I'm not sure the commission can do much.
I would 4
much prefer idealistically that the utilities demand that 5
their plants be better.
I'm not necessarily saying safer but 6
better.
I would hope that is where the pressure would come 7
from.
Then I have to ask myself, why aren't they.
That is 8
perhaps a question you could ask as the commission, why aren't 9
utilities demanding a better plant.
Maybe the answer is
~
10 because of the regulatory process, they might be willing to do 11 some of these things if they were assured that they would 12 relieved of something else.
13 We suggest that if you have a dedicated heat removal 14 system, that perhaps some of these other things you could be 15 relieved of.
There is surely no assurance that through our 16 regulatory. process, we would give up anything else and this 17 would probably be one additional added clap trap to what we 18 already have.
19 I think that might be a question you could ask.
20 COMMISSIONER BERNTRAL:
Most utilities aren't 21 demanding anything right now, good or bad.
22 COMMISSIONER ASSELSTINE:
Although the EPRI effort 23 ideally is supposed to be an utility effort to try to tell the 24 vendors, this is what we are looking for if you expect us to 25 buy one of these things in the future, this is what your
,n,,.--
- - + - - - - - - - - - - - - -
1 57 o
+
1 product has to do.
2 MR. REMICK:
I agree.
3 COMMISSIONER ASSELSTINE:
Whether it is doing that 4
or not is another question.
5 COMMISSIONER BERNTHAL:
Did you think at all about 6
what European design plant comes closest to the ideal, and I'm 7
not sure you envision an ideal here, this seems to be a 8
collection of parts, but did you try to come up with anything, 9
or American plants, South Texas seems to do one or two of 10 these things.
l 11 MR. KERR:
I don't think we did, although we 12 certainly took European experience into account in some of the 13 recommendations, but I don't know that we tried to say there 14 is one set of plants close to this.
15 COMMISSIONER BERNTHAL:
It might be of some use to 16 have a living example.
17 MR. SIESS:
I don't think we would look for an i
l 18 example that had all 12.
19 COMMISSIONER BERNTHAL:
I agree.
20 MR. SIESS:
These were things to be considered, to 21 be weighed.
I think some of them have disadvantages.
Some of 1
l 22 them don't fit together.
Some of them eliminate others.
We 23 didn't really have much interaction with either the staff or 24 the industry doing this.
It is based on a lot of our own 25 experience in looking at things.
-w.%v.~---
,,r--
e r
,c--.,
,r__
.,y,--.
g,.
_,-ry,.--+e
1
\\
58 1
One thing you might want to do is subject it to a
. _7 2
peer review, if you can find the peers.
3 COMMISSIONER BERNTHAL:
I am sure that would be 4
difficult.
5 One of the questions I had intended to ask and I 6
guess you have answered it, is whether you had much interaction 7
at all with the industry, GE, Westinghouse, staff, et cetera.
8 It seems to me the punch line to this whole process in some 9
sense might be that the ACRS thinks if such a plant exists 10 right now in service, that the ACRS thinks this or that plant 4
11 incorporates many of these desirable features that the next 12 generation should have.
13-MR. KERR:
I think that's a good suggestion.
14 COMMISSIONER.BERNTHAL:
We might want to think about 15 that.
Well, let's see, another short question.
Did you 16 confront the question of whether any core design or any 17 combination of core designs, safety system design, might be 18 such that a robust containment, if I may use that word, would' 19 no longer be necessary?
Whether you can imagine any new Fort 20 St. Vrain, if you will?
21 MR. KERR:
I believe the consensus was we are not 22 ready at this time to eliminate containment.
I don't think we 23 have reached such a formal conclusion, but in informal 24 discussions, I believe that is the consensus.
25 MR. OKRENT:
To what, eliminate containment for
,-e,,
---,--,-...-,n.
.-w
59 1
advanced reactors?
2 MR. KERR:
For water reactors.
3 MR. OKRENT:
If I could add a comment, I think there j
4 has been insufficient discussion of improved containment 5
capability in the next round of LWR's, during this meeting and 6
even in this letter, because I think for both technical and 7
sociological reasons, this should be done and I think it would 8
be really a mistake for the industry or for the NRC to not 9
pursue that.
10 MR. SIESS:
I don't agree.
I think if our 11 recommendation three were taken seriously, the need to mitigate 12 consequences of severe accidents should be considered g ~}
13 explicitly in the design of containment systems, that the 14 attention would be given.
I think we have said it very 15 clearly.
16 COMMISSIONER BERNTHAL:
In any case, you haven't 17 considered that in detail.
18 MR. SIESS:
Improvements would follow.
It's not 19 that difficult.
20 COMMISSIONER BERNTHAL:
One last small point.
You 21 also referred to the Commission's Safety Goal Statement of one 22 in a million per reactor year of a large release.
What do you 23 mean by "large release?"
24
[ Laughter.)
25 COMMISSIONER ASSELSTINE:
We need to define "large
.~
60 i
1 release."
2 MR. LEWIS:
One that appears in the International 3
Herald.
4 MR. KERR:
We take this question seriously and we i
5 are discussing it.
We have not reached a consensus.
6 COMMISSIONER BERNTHAL:
Good.
I appreciate that.
7 Thank you.
8 CHAIRMAN ZECH:
Commissioner Carr?
9 COMMISSIONER CARR:
I have one comment.
Mr. Ward, 10 I'd like to comment on your mention of the operators of the 11 future and how they are going to get bored with their 12 operation.
My experience over 30 years of watching an operator J
13 is that today's are any more elite than they ever were.
They 14 are the same kind of guys, very few have a college degree.
15 They are better trained than we were.
They are better able to 16 handle the casualties, as I watch them.
They know more about 17 what they are doing.
18 I don't think we can look 30 years down the future 19 and say operators are going to be much different than they are 20 today.
I think they all are going to be pretty conscientious 21 guys.
I do think we have to not encumber them with a lot of 22 non-essential things around the plant that they have to worry 23 about.
24 CHAIRMAN ZECH:
Let me just say we could go on.
25 These are very interesting and informative and important i
61 1
discussions.
I would frankly like to continue it but we do 2
have a busy day so we will have to wind up.
3 Let me just thank the ACRS.
I know we would perhaps 4
prefer to come to great conclusions on some of these 5
recommendations today but I suppose it is best for both the 6
Committee and the Commission to continue thinking along these 7
lines.
That is perhaps more valuable than anything.
I know 8
there hasn't been a complete consensus across the board.
I 9
respect that.
10 I think the discussion is very valuable and extremely 11 important as we look to the future and also discussion, I 12 think, is important.
I like to sort it out very simply, 13 perhaps too simply, but we are talking about a lot of design 14 things and about a lot of people things.
They really are both 15 extremely important.
The mix, you know, the human / machine 16 interface and all that, it really is crucial.
We are talking 17 simplicity.
18 I think the discussion was very valuable because 19 simplicity in my view of looking at it is relative.
You are 20 absolutely right.
We can be too simple or you can get too 21 complicated, but it's good to think about simplicity and does 22 in a can, in my view, contribute to safety.
On the other 23 hand, if you try to be too simplistic, you can perhaps detract 24 from safety.
It's a judgment call and it does require a lot 25 of thinking.
e 62 1
Anyway, we have had a very valuable discussion 2
today.
I would ask the ACRS if they would, to pursue some of 3
the things we have talked about, especially perhaps the 4
questions and comments concerning the European plants and 5
others.
I agree they are not 8 feet tall or 4 feet tall, 6
certainly, but some of the things you have discussed here we 7
have seen in plants overseas, and whereas I don't know that we 8
need to come down pointing to a specific plant, it might be 9
useful if the ACRS would carry this letter, at least in your 10 own discussions, perhaps to the Sizewell B and number of 11 others that are still kind of being discussed.
It might be 12 useful to try to do that.
I would ask if you would do that as 13 you pursue these discussions.
14 With that, I'd like to thank all of you.
Glen, it 15 is awful good to have you back.
We appreciate very much the 16 continuing good work of the ACRS.
17 Any other comments by my fellow Commissioners?
18 (No response.]
19 CHAIRMAN ZECH:
We stand adjourned.
20
[Whereupon, at 11:40 a.m., the meeting was adjourned.]
21 22 23 24 25 1
e 1
i
' ^"
REPORTER'S CERTIFICATE 2
3 1
4 This is to certify that the attached events of a 5
meeting of the'U.S. Nuclear Regulatory Commission entitled:
6 7
TITLE OF MEETING:
Periodic Meeting with Advisory Committee on Reactor Safeguards 8
PLACE OF MEETING:
Washington, D.C.
9 DATE OF MEETING:
10
' 11 were held as herein appears, and that this is the original 12 transcript thereof for the file of the Commission taken
{. -
13 stenographically by me, thereafter reduced to typewriting by s
J.4 me or under the direction of the court reporting company, and 15 that the transcript is a true and accurate record of the 16 foregoing events.
17 la
_J.__________________~___________
Marilynn Nations 19 i
20 21 22 Ann Riley & Associates, Ltd.
23 24 25
~
e p KErp UNITED STATES o
~,7, NUCLEAR REGULATORY COMMISSION E
ADVISORY COMMITTEE ON REACTOR SAFE' UARDS
^
G WASHINGTON, D. C. 20555 O
January 15, 1987 The Honorable Lando W. Zech, Jr.
Chairman U.S. Nuclear Regulatory Commission Washington, DC 20555
Dear Chairman Zech:
SUBJECT:
ACRS RECOMMENDATIONS ON IMPROVED SAFETY FOR FUTURE LIGHT WATER REACTOR PLANT DESIGN During the 321st meeting of the ACRS, January 8-10, 1987, we completed our discussion of improved safety requirements and objectives for future light water reactor power plants (LWRs). This discussion began during the 316th ACRS meeting, August 7-9, 1986.
The scope of our present comments is limited to nuclear power plant design.
Other factors, such as plant operation and management, are necessarily involved, but are beyond the scope of our present remarks.
The ACRS has on several previous occas~ ions recommended that future J
LWRs should be designed to be safer than current LWRs. This is not to ignore the excellent safety record thus far of LWRs in the United States. We believe this increased safety can be achieved with reason-able economy because better technology is available today.
Improved concepts for plants and improved understanding of risks have been i
developed over a generation of experience in design, op ration, and analysis.
But, not all of these concepts have been incorporated into the newest reported LWR designs.
We believe many of these concepts can be incorporated with acceptable effect on plant cost or operating efficiency.
With the expectation that future plants will be stan-dardized, the next group of plants to be licensed will probably set the safety design philosophy, and even details of implementation, to be used in nuclear power plants for several decades.
The mean estimates of risk from generation of electricity by the use of nuclear energy are at least as low as those for generation by other methods.
However, the acceptability of these estimates is much affected by the large uncertainty associated with them.
A compelling reason for implementing improvements -- apart from the fact that i
improvements are possible -- is to reduce the uncertainty in the risk estimates.
Future plants should be able to survive a wider spectrum of off-normal challenges and mistreatments.
For example, nonnal operating systems should be forgiving of most operational errors and imperfections in maintenance.
Accident management and mitigation systems should be b
designed, not for a narrow set of design-basis accidents, but to Cl
.~.,
The Honorable Lando W. Zech, Jr. January 15, 1987 reasonably accommodate a broad range, variety, and time sequence of threats.
Our recomendations are based on insights provided from quantitative risk analyses, lessons learned from operating experience, and continu-ing concerns.
In the sections that follow, we list and discuss a number of possible safety improvements. Several of these overlap, and we do not expect that all of them should be implemented.
Rather, we offer them with the belief that each is worthy of serious' consid-eration in connection with future designs.
1.
Dedicated and Protected Decay Heat Removal System (DHRS)
We recommend for consideration that future LWRs include a ded-icated, protected, redundant, decay heat removal system having its own power, fuel, and water supply, with a. capability for makeup, including coolant lost from very small LOCAs, and for recirculation from the containment sump. This system should have a large seismic capability such that its function is not threat-enej by earghquakes having an occurrence likelihood in the range 10 - to 10-per year.
There should be similar protection and seismic capability for the primary system and all components l
whose specific. function is required for proper operation of the dedicated decay heat removal system, as well as protection against fires, flooding, and adverse environmental effects. This system should be capable of actuation but not temination from the control room.
We list this item first because the provision of such a system would alleviate our concerns in several areas, including the following:
If the DHRS is protected against fire, internal or external quakes at the 10 y an ingider or by terrorists, and earth-floods, sabotage to 10-probability level, the degree of protection required of. Other portions of the plant against such events could be relaxed in many instances.
In addition to the economies these reductions might lead to, we believe that they might lead to relaxation or removal of many of the impediments to access and flexibility of operation that are now imposed by security and fire control.
The loss of all sources of AC power, both off-site and on-site (station blackout), would be of less concern if a J
DHRS is provided. However, vital DC power and certain vital cooling functions (such as cooling of primary pump seals in a PWR) now performed by using AC power would have to be dealt with appropriately.
In some of the further recomendations that follow, we indicate that the identified needs would be re-duced, or perhaps I
The Honorable Lando W. Zech, Jr. January 15, 1987 eliminated, if a dedicated, protected, decay heat removal system were provided.
2.
Safety Train Redundancy The general principle of "N+2" trains should be adopted for active, safety-re. lated functions.
N is defined as the number of trains required to perform a necessary safety function.
N is equal to one if the train has 100% capacity to perform the function.
N is equal to two if each train has 50% capacity.
Thus, an "N+2 rule" would require three 100% trains, or four 50%
trains.
Each of the N trains would have its own independent support systems.
Each train would be physically separate from
)
the others, and diverse designs or equipment should be considered
-if this can be shown to provide a significant safety advantage.
3 j
Exceptions to this general principle should be permitted for systems providing functions with low risk potential and for systems which can be demonstrated to be exceptionally robust and reliable.
The proposed high level of functional capacity could be used to l
improve plant availability by use of Technical Specifications which permit one of the extra trains to be out of service for maintenance and testing for somewhat longer periods than is now l
the practice for the first trai.n of redundancy.
3.
Design of Containment Systems i
The need to mitigate the consequences of certain severe accidents should be considered explicitly in the design of containment i
systems (structures, penetrations, sprays, vents, etc.).
The j
severe accident sequences to be considered should be those 'for which the mitigation provided by the containment systems is j
required to meet the Conunission's proposed general performance guideline that the overall mean frequency of a large release of radioa.ctive materials to the environment from a nuclear power
)
plant accident should normally be less than 1 in 1,000,000 per 1
reactor year of operation.
The severe accident sequences that need not be considered are those of sufficiently low probability I
that the releases, unmitigated by specially designed containment j
systems, will in the aggregate not exceed this objective.
I 4.
protection Against Sabotage j
We are not of one mind on the issue of the extent to which LWRs should be protected against the threat of damaging sabotage by terrorists and insiders.
On the one hand, there is reason to believe that certain design choices can lead to inherently better resistance against such a i
threat, even if these choices are not specifically directed t
i
\\
e t
The Honorable Lando W. Zech, Jr. January 15, 1987 I
l against sabotage.
For example, control rooms can be positioned so they are away from the exterior ground level and protected from truck bombs by existing massive concrete structures.
Good physical separation of redundant safety trains may provide significant inherent protection.
Some of us favor. hardening, or separation, or other protection of most vital functions such that they are relatively well protected against transportable explo-sives.
If included in the original design, part of these changes should result in modest added cost or modest loss of other beneficial plant characteristics.'
l On the other hand, some of the members are not convinced there is reason to believe nuclear power plants are particularly attrac-tive targets for saboteurs.
If a terrorist aims to actually cause injury to large numbers of the public, there are far easier
~
and more effective targets throughout the country.
Also, with 120 operating plants [today's population] built to a lower level.
3 of sabotage protection and a new set of plants built to a higher level of sabotage protection, this discrepancy will surely be i
noted and taken into account by a terrorist in the selection of a i
specific target, if the aim is to cause physical harm to the public.
It appears to these members that the resources society allocates for defense against terrorism would be more effectively used in areas other than nuclear power.
1 In the case of the insider, the ACRS believes the threat is of low probability.
This should not, however, discourage prudent design features which could impede insider actions or reduce the likelihood of success.
5.
Fire Protection Those responsible for conducting probabilistic risk assessments (PRAs) have not been very successful in quantifying the risk from i
large fires involving essential reactor systems.
As a result, the real benefit of existing fire protection provisions and backfits remains uncertain.
We believe future LWRs should be i
designed so that cold shutdown of the plant using safety-grade i
equipment can be accomplished quickly (within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />) in the event of any single fire which may burn up to 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br />.
Physical separation and protective barrier or compartment arrangements should include a reasonable accounting for the adverse effects of the spread of heat and the products of combustion beyond the fire zone, including consequential spurious actuation of fire mitiga-tion features and the resulting damage to safe shutdown equip-ment.
Fire mitigation features should be designed to f' unction properly, and not to spuriously actuate, during or after a seismic event.
If the plant has a DHRS as discussed -above, only those other portions of the plant vital to accomplishing safe shutdown would r
-w-----
y m-e-
m
.~,m,._
., ~ ~ _. _., -
--~n.-
.-,e--.,,-v.-
c The Honorable Lando W. Zech, Jr. January 15, 1987 j
f need to be protected against fire consistent with the more stringent requirements listed above.
6.
Anticipated Transients Without Scram (ATWS) i We suggest that design features be introduced that would make an ATWS event a much less serious, if not a negligibly small con-tributor, to risk.
For PWRs this might involve some combination of increased negative moderator temperature coefficient of 4
reactivity and increased pressure-relieving c'apability for the primary system.
For BWRs a partial contribution would be made'by something approaching 100% relief capability in the event of turbine trip or main steam isolation valve closure.
We also suggest that the combination of control and safety systems be examined for reliability, as well as for testing and maintenance i
of the systems, to reduce the need for some of what are now considered to be safety-related scrams, as well as to reduce the number of spurious scrams.
7.
Systems Interactions Operating experience and reviews of existing nuclear power plants
.I have provided evidence of unanticipated adverse interactions from supposedly separate systems.
These supposedly separate systems sometimes interact in unanticipated ways because they are depen-dent on common support systems (such as power supplies, connon piping systems, etc.) or because they share the same or. adjoining physical space. Those people responsible for performing _PRAs can j
successfully incorporate the effect of these interactions only if they are known and understood and if probabilities of occurrence can be established.
We believe that further effort is warranted 1
I to develop techniques and processes which can seek out and eliminate such interactions.
8.
Electric Power Systems We believe that the frequency of transients -and spurious reactor scrams should be reduced by providing electric power supplies that are less vulnerable to transmission network disturbances.
We recommend that General Design Criterion 17 be revised to require that the circuit which is provided to be immediately available to cope with a LOCA be the normal power supply to the plant auxiliaries and safety systems and be supplied continuously and unswitched from the low side of the main stepup transformer during and throughout startup, operation, and shutdown of the nuclear generating unit.
We believe that the capability of a plan to cope with the loss of all off-site power can be improved.
For one thing, the j
proposed resolution of Unresolved Safety Issue A-44, Station-l' Blackout, should be implemented in the design of future plants.
4
__.-.,_....,,..,_,..,,..,.._,_....m-
January 15, 1987 The Honorable Lando W. Zech, Jr. -
For another, the reliability of on-site AC power sources can be enhanced by designing the nuclear system with sufficient steam i
bypass, feedwater inventory and make-up, and run back capability to sustain unit load rejection from 100% power and to run back to
" house" electrical load, or by providing an additional, pref-erably diverse, standby electrical generating unit. The need for these features would be reduced if a DHRS is provided, as dis-a cussed in Item 1 above.
'i 9.
Probabilistic Seismic Design i
Important safety systems should be ex [icitlyI designed using probabilistic seismic design methodology.to survive and function during and after severe seismic events.
Only survivability and those functions needed to bring to and hold.the reactor at cold shutdown need be considered.
A DHRS such as discussed above would reduce the number of structures and systems requiring very stringent seismic design.
10.
Primary Pressure Boundary l
We recommend that the primary system pressure boundary be de-signed and fabricated to minimize the number of welds and opti-mize the ease of inspecting them.
- 11. Dedicated Systems and Sharing There should be minimum sharing of equipment, flow paths, and support facilities among nominally separate systems.
- 12. Control Room Protection for Severe Accidents Safe habitation of the control room and other necessary facil-ities should be ensured in the eve'nt of an accident that results in a large release of radioactive materials outside containment.
For multi-unit sites, this requirement applies to both the l
damaged unit and other units on'the site.
Additional coments by ACRS Members H. Lewis, F. Remick, P. Shewmon, and D. Ward are presented below.
Sincerely, i
William Kerr Chairmary i
4 e
G j
i
The Honorable Lando W. Zech, Jr. January 15, 1987 Additional comments by ACRS Members H. Lewis, F. Remick, P. Shewmon, and D. Ward.
This is a camel of a letter, describing a camel of a reactor. We have no reason to doubt that each of the features recommended in the letter may' improve safety, nor do we have any reason to believe that there are not better and more cost-effective alternatives. This problem is compounded to the extreme by putting them all together.
The purpose of. this lepter is presumably to distill the Committee's observations and experience with the current generation of reactors, designed over the last few decades, and to put that experience to work in expressing a design philosophy for the next generation of reactors.
There is no hint of a philosophy, but instead a laundry list of improvements, all unanalyzed.
Though the Comittee has often recom-mended that the next generation be safer than the past, that recomen-1 dation has never been justified.
It may be right, but seems to be inconsistent with the Comission's Safety Goal Policy.
There is no
)
doubt in our minds that, with new technology and years of experience, a new generation can be either safer at comparable cost and level of complication, or equally safe at lower cost and greater simplicity, and that choice is so fundamental that it is, in our view, not respon-sible for the Comittee to opt for greater safety and greater com-plication without analysis or justification.
We believe one can learn from experience and that the next generation must inevitably be better than the past (and thereby. safer), but we are uncomfortable about designing those reactors in comittee.
Additional coments by ACRS Member, David A. Ward.
I I disagree with the Comittee's recomendation that future LWRs should include a dedicated, bunkered decay heat removal system.
In my opinion,- the safety advantage from such a system is highly uncertain and likely to be very slight or even negative.
The cost would be great and there would be added ' complexity in operations.
I believe added reliability offered by adoption of the N+2 principle with some diversity and separation of trains is adequate and preferable.
The promises of trade offs, e.g., relaxation of requirements on main-line systems, are phantoms.
A systematic study to determine what should be included in a bunkered system and whether there would indeed 1
be important trade offs might be warranted at this time, but the Committee has not made such a study.
The recomendation is a hip shot.
i The Comittee has elected not to make recommendations relative to either of a pair of weaknesses in LWRs which I believe make them the object of criticism from the proponents of new reactor concepts.
j These are:
- 1) absence of a backup scram system and 2) the fact that every scram, real or spurious, becomes a challenge to the plant
'l g
i I
' The Honorable Lando W. Zech, Jr.
8-
- January 15, 1987 because of the necessity for emergency feedwater.
I believe consid-eration should be given to development of an independent backup scram system for LWRs.
This would include not only independent sensor and material (gic, but also an additional system of absorber rods or other control lo possibly a liquid) to rapidly and reliably enter the core.
Further, I believe there should be consideration of a passive or continuously operating decay heat removal system so that a reactor scram will not be a challenge, but instead always be an unambiguous shift to a safer operating mode.
j Beyond these two specific points, I believe the best approach for the NRC to take in implementing safety improvements, such as those sug-gested in this letter, in LWRs of the future is to incorporate them into a revised set of General Design Criteria.
Although iteration with designers and licensees will be necessary, the improvement process will best be served by establishing a clear new basis at the beginning.
In ddition, I am concerned that the concept of quality assurance, as 1
applied in the nuclear power industry, has not been successful.
I do not, of course, question the need for quality nor do I have major concerns about the quality of existing plants. However, I do question whether QA has had much to do with either. This might not be so trou-blesome except that QA as practiced is very expensive and uses re-sources that might better be spent in other activities, including more effective reactor safety programs.
I suggest that the present hiatus in plant design and construction provides an opportunity for the Commission to rethink i ts conunitment to the present concepts and practices of QA.
l l
l l
e G
~
7
~ ~ -
r-w,_
y-.
_.c
OFFICE OF THE SECRETARY CORRESPONQENCE CONTROL TICKET PAPER NUMBER:
CRC-87-0059 LOGGING DATE: Jan 23 87 ACTION OFFICE:
EDO AUTHOR:
W. Kerr AFFILIATION:
ACRS (ADVISORY COMMITTEE ON REACTOR SAFEGUARDS)
LETTER DATE:
Jan 15 87 FILE CODE: O&M-7 ACRS
SUBJECT:
ACRS recommendatons on improved safety for future LWR plant design ACTION:
Appropriate DISTRIBUTION:
RF SPECIAL HANDLING: None NOTES:
DATE DUE:
SIGNATURE:
DATE SIGNED:
AFFILIATION:
?
9 e
O
+
armvmrmmmmmmmmunnm mmwpmim j
~
h TRANSMITTAL T0:
X Document Control Desk, 016 Phillips
~
1 i
ADVANCED COPY T0:
The Public Document Room
~
M!P7 DATE:
FROM:
SECY Correspondence & Records Branch R
R Attached are copies of a Commission meeting transcript and related meeting AA i
document (s). They are being forwarded for entry on the Daily Accession List and E
placement in the Public Document Room. No other distribution is requested or j
required.
kh b( s efw b" Meeting
Title:
uG-4 C-t i
=
5
$d W M LS rm
- j Meeting Date:
4/to lg?
Open X
Closed E
t t[
Item Description *:
Copies 5
Advanced DCS
'8
{
to PDR Cg E
~
it:
- 1. TRANSCRIPT 1
1 I
,l:a.
- 2. ACR5 'Rce Ada,1) A S I
l
~
j
'g I,ll G t 9
,i =>-
c==
4.
k 2
l
=.
h
- ii::
l l
l 6.
Ei l
g
- PDR is advanced one copy of each document, two of each SECY paper.
3 i
C&R Branch files the original transcript, with attachments, without SECY g
papers.
- g
?
lE d/A6 l
l l
l l bYhk bYlkbYbYbl lflfIfbh bhkflflfb
_