ML20236H560
| ML20236H560 | |
| Person / Time | |
|---|---|
| Issue date: | 10/29/1987 |
| From: | Advisory Committee on Reactor Safeguards |
| To: | |
| References | |
| REF-GTECI-A-47, REF-GTECI-SY, TASK-A-47, TASK-OR ACRS-T-1619, NUDOCS 8711040197 | |
| Download: ML20236H560 (197) | |
Text
-
))c2ST-/4/1 OR G \\A_
O UnhtU STATES NUCLEAR REGULATORY COMMISSION
....=_.==...=.......=.....=..=..=====.===;.=.=.._.._........===_,
I IN THE MATTER OF:
DOCKET NO:
SUBCOMMITTEE ON INSTRUMENTATION AND CONTROL SYSTEMS I
O LOCATION: WASHINGTON DC PAGES: 1 - 179 DATE:
OCTOBER 29, 1987 i
l
..===.=.=.==...........===.___..=..===......=..=ar.==..=...
{
y hipd[n@d ! pb IDE D '-
IV 4 #1'
.. U,,%n. e 61. b "
1 f
2 JoJgt3.ergpvg,f;gm!\\C18 On.,
ce Heritage Reporting Corporation Q(ficial Recorters O
1220 L Strat. N.W.
Wuhangton. D.C. 20005 (202) 62N lic h [
71029 a%9 PDB c
~
1 PUBLIC NOTICE ~BY THE.
2 UNITED STATESLNUCLEAR REGULATORY COMMISSION'S 1
3 ADVISORY COMMITTEE ON REACTOR' SAFEGUARDS 4
5 6
7 The contents of.this stenographic transcript of the 8
proceedings of the United States Nuclear Regulatory 9
Commission's Advisory Committee on-Reactor Safeguards (ACRS),
10 as reported herein, is an uncorrected record of the discussions 11 recorded at the meeting held on the above date.
i 12 No member of the ACRS' Staff-and no participant at
- l
{
13 this meeting accepts any responsibility for errors or 14 O
inaccuracies of statement or data contained in this transcript..
15 16
- )
17 18 4
19 j
20 21 22 s
23 24 25 i
()
Heritage Reporting Corporation (202) 628-4888 1
j l
...)
l 1
1.
UNITED STATES NUCLEAR REGULATORY COMMISSION 2
ADVISORY COMMITTEE ON REACTOR SAFEGUARDS i
1 1
3
)
4 In the Matter of:
)
)
5 MEETING OF THE SUBCOMMITTEE
)
ON INSTRUMENTATION AND CONTROL
)
6 SYSTEMS
)
)
7
- Thursday, l
8 October 29, 1987 1
l 1
9 Room 1046 1717 H Street,'N.W.
10 Washington, D.C.
20555 l
11 The above-entitled' matter came on for hearing, i
12 pursuant to notice, at 8:30 a.m.
13 BEFORE:
MR. JESSE C.
EBERSOLE Retired Head Nuclear Engineer 14 Division of Engineering Design The Pennsylvania State University 15 University Park, Pennsylvania I
16 SUBCOMMITTEE MEMBERS PRESENT:
17 MR. CARLYLE MICHELSON Retired Principal Nuclear Engineer 18 Tennessee Valley Authority Knoxville, Tennessec 19 MR. GLENN A.
REED 20 Retired Plant Manager Pt. Beach Nuclear Power P.lant 21 Wisconsin Electric Power Company Two Rivers, Wisconsin 22 MR. CHARLES J.
WYLIE 23 Retired Chief Engineer Electrical Division
()
24 Duke Power Company Charlotte, North Carolina 25
__m-_-
i 2
1 ACRS COGNIZANT STAFF MEMBER:
O 2
Med El-Zeftawy
.3 NRC STAFF PRESENTERS:
4 A.
Szukiewicz D.
Basdekas 5
Newton Anderson Bob Baer 6
7 8
l 9
10 11 12 13 14 15 16 17 18 19 20 l
21 22 23 O
24 25 momvanem m mmmm m-om mmmmmmm- -
.-me,- ---
.3 1
IN- -. D E.
X.-
2 I_ TEM DI,SCUSSED PAGE 3
History and Background-7 4
Views of D.
Basdekas 99 5
l 6
l 7
j l
8 9
10 f
11 12 13 14 l
15 1
16 l
17 1
18 19 20 21 22 23 24 25 HERITAGE REPORTING CORPORATION --- (202)628-4888 l
1 4
1 P. R O
_C_.E _E
_D__I. N__G_. _S-2 CHAIRMAN EBERSOLE:
The. meeting will now come to 3
order.
4 This is a meeting of the Advisory Committee on 5
Reactor Safeguards.
This is the Subcommittee on 6
Instrumentation and Control Systems.
'I am Jesse Ebersole, l
7 Subcommittee chairman.
The other Committee members in 8
attendance today are Carl Michelson, Glenn Reed, Chuck Wylie, l
9 and we have today with us an advisor and invited speaker, 10 Elmer Patterson.
11 The purpose of this meeting is to review NRC's 12 proposed final resolution of the USI A-47, safety implications 13 of control systems.
It is an issue that has been submitted 14 for review and comments regarding the relationship of the B&R 15 plant reassessment to USI A-47.
Med El-Zeftawy is the 16 cognizant ACRS staff member for this meeting.
17 The rules for_ participation in th>s today's meeting 18 have been announced as part of the notice of the meeting 19 previously published in the Federal Register on October 14, 20 1987.
A transcript of the meeting is being kept and will be 21 made available as stated in the Federal Register notice.
It 22 is requested that each speaker first identify himself or l
23 herself, and speak with sufficient clarity and volume so he or
(
24 she can be readily heard.
25 I just have a few comments about this meeting.
It
i i
1 i
.f l
5 1
has been a long dry spell since we met on this topic, and just 2
I noticed here.that the, our last session on this topic was l
3 November 14, 1984, and I am a new Subcommittee chairman.
I 1
4 think Bill Kerr was the former one.
I am not sure, but that 5
this activity has been going on a long time.
Previous I
6 meetings were held on December 21, 1982, and'Nov' ember 16,
)
7 1984.
j i
8 In thinking about this topic, I looked at the title' 1
)
9 of it, and I just want to make a few comments.
I find that l
10 the topical material which is in here in fact is not in, does 11 not extend into the large scope of the title of the study that 12 we are supposed to--it says safety implications of control 13 systems, direct report for comment.
And in fact, when I 14 jumped into this, I find it limited, extremely limited just to 15 matters pertaining to steam generator overfill or loss of 16 feedwater.
That's all it is.
It gets nowhere into the larger l
17 scope of control system failures and implications of them on 18 the trip systems of safety systems which are outside the band 19 width of, range of those control systems.
I find immediately 20 the presence of extreme narrowness of scope of this particular 21 study, limited to just feedwater problems, either getting too l
l 22 much of it or not enough of it.
I 23 There are many other control systems in the plant we
(
24 can sit here and talk about, and all of them which have
)
25 implications of trouble and aspects to going beyond their
6 1
bounds either in amplitude and making-difficult.the operation O
2 of the safety systems that are supposed to bound the parameter 3
of performance they are supposed to control.
The classic one, 4
of course, is the old saturation problem of a~ reactor coming 5
up out of a hole in a short period and flooding the chambers 6
which is supposed to give a level trip, but the time gets 7
there too fast and they separate and it never trips at all.
8 That is one of the historical early control system 9
implications on safety systems.
There are many others, but 10 anyway, we have got a lot of--even so, even limited as it is, 11 this material here is extremely complex, and hard to get your 12 teeth into, and I think-at least I for one want to hear the 13 staff and others who may be contributing, Mr. Szukiewicz's 14 explanation of what we have here, whether or not it is enough.
15 Any other members have any comments?
l i
16 Well, if not, we will then plunge into the schedule, i
I 17 and this starts with--you are going to have to give me help in 18 pronouncing this name here.
19 MR. SZUKIEWICZ:
Good morning. My'name is Andrew 20 Szukieweiz.
I am the task manager of the USI A-47, safety 21 implications of control systems, and I work in the Division of j
i 22 Engineering, Engineering Issues Branch, which is now part of l
l 23 the Regulatory Research Office.
24 Today I would like to present and summarize and 25 provide an overview of the activities that were performed I
i mm-m-m -- ---_--_-_ _________ -
7 1
under USI A-48.
Hopefully we could dispel some of Mr.
O 2
Ebersole's concerns as far as the scope, and to show that we 3
have looked at more control system failures than just 4
feedwater, and level, and in my overview, I hope to show this.
5
-I also for this presentation provided a, the 6
proposed resolution package which you referred to just a.
1 7
minute ago, Mr. Ebersole, and this is the package that 8
includes the technical findings, new reg, which sums up all 9
the activities that were conducted in the last six, seven 10 years.
It also provides another new reg which includes the J
l 11 regulatory analysis and which provides the basis for findings l
l 12 and recommendations for the proposed resolution.
l 13 It also includes a generic letter, too, which we 14 plan on issuing to implement the proposed resolution.
And it 15 also provides additional guidance for the licensees and the 16 staff in their review of the implementation of the proposed j
i 17 resolution.
I 18 (Slide) l 19 MR. SZUKIEWICZ:
As far es background information, 20
.the Commission approved USI or task A-47 or the task to review 21 safety implications of control systems as a USI in late 1
22 December 1980.
Subsequently a task action plan was developed, 23 and proposed, commented on by the staff, and then finally
(
24 approved by the staff in 1982.
The activities were then l
l 25 started and the work was actually being conducted by two l
1 MQQOGnnQ ammmanoMn n A% mma n co nno ammah One denn
8 i
I 1
national laboratories, Oak Ridge National Laboratory and INEL 2
Idaho National Laboratory, and most of the work was completed 1
.i 3
and reports, the last reports were published in January 1986.
l 4
A first draft of the proposed resolution package was l
5 completed in September of '86 where it just received internal 6
comments by the laboratories and just internally to the 7
division, and then we went out for internal NRR review.ftr 8
additional comments, in November
'86, and in March of this 9
year, incorporating a lot of the comments from the other 10 offices, we issued the package that you see or initial package 11 that you see for division concurrence and approval so we can i
12 submit it to CRGR.
l O
l i
13 Because of the reorganization in April, and some 14 changes in personnel, we were forced to resubmit the package 15 and we did so in May 1987, this year.
We just-recently 16 received staff concurrence from NRR.
It is currently now in 17 our legal department for review and concurrence.
We were l
18 anticipating issuing it for, to CRGR the end of this month, 19 which only has two more days, so we do not anticipate making 20 that date, but we anticipate that we will get an approved l
21 draft to issue for review in CRGR the first week in November.
22 Subsequent to the review of CRGR, we' plan on issuing 23 a proposed package or proposed resolution for public comment 24 in March after next year.
Subsequently, we would go through a 25 review process again of public comments, incorporating
1 l
l 9
1 comments, making whatever changes we feel necessary, and we i
2 anticipate at this point again going back later with a. final l
l 3
resolution to CRGR, and anticipate publishing a final 4
resolution in April of 1989.
5 MR. MICHELSON:
Is this a record for how long it i
6 takes to implement from initiation to implement, to even final l
7 resolution of nine years?
8 MR. ANDERSON:
No, sir, that's not, not a record, 9
MR. MICHELSON:
Longer than that?
10 MR. ANDERSON:
Yes.
11 MR. MICHELSON:
For instance?
)
I 12 MR. ANDERSON:
A-17, for instance, was, that was 13 designated USI January 1978, and it is a little bit behind j
1 1
14 this one, l
1 15 MR. MICHELSON:
Okay.
16 MR. WYLIE:
They will outlast us all!
j l
l 17 MR. ANDERSON:
The procedure is vi.ry long and i
\\
l 18 time-consuming, all the peer review that is required.
19 MR. SZUKIEWICZ:
Also the procedure has been 20 modified substantially since the beginning of the reviews of
]
21 these USIs.
22 Background -- the review of control systems, 23 instrumentation systems, comprise two basic systems, one we 24 call safety grade perfection systems, which is, includes l
l 25 reactor trip systems, emergency core cooling systems, and
10 1
other systems such as main steam line operation valve control f3 V
2 systems, auxiliary feedwater systems and various pressure 3
relief control system--
4 CHAIRMAN EBERSOLE:
Where is that, the subject of 1
5 instrumentation control systems, and transfer systems that 6
belong to critical support systems such as component cooling, 7
service water, et cetera?
That certainly is not a part of 8
ECCS systems?
And when you say other safety systems in your 9
listing there--
10 MR. SZUKIEWICZ:
Are you talking about non-safety 11 grade?
12 CHAIRMAN EBERSOLE:
I am talking about the devices 13 that maintain continuity of heat removal or waste operations 14 or post-trip operations.
15 MR. SZUKIEWICZ:
Some of them like the low pressure 16 injection systems--
17 CHAIRMAN EBERSOLE:
No, no.
I am talking about the 18 very systems that are in the auxiliary category to make 19 possible the continuity of all systems to remain, to remain 20 waste heat removal both before and after the reactor trip.
21 MR. SZUKIEWICZ:
Some of these systems are safety 22 grade system.
23 CHAIRMAN EBERSOLE:
I just take the lowest on line 24 but the most important is service water systems.
25 MR. ANDERSON:
Mr. Ebersole, I think I can answer 1
(
11 1
that in kind of a general way.
When we look at emergency core Ov 2
cooling systems, for instance, for this type of function, we 3
also look at all the supporting systems that go along with it, i
4 Everything that is needed to operate that emergency core l
5 cooling system is considered to be part of this, so--
6 MR. MICHELSON:
There is a little problem with that l
l 7
definition which I had, too, and that is I can have a safety 1
i 8
grade protection system whose particular supporting system 9
might be non-safety grade because if it fails, then the safety l
10 grade protection system goes in the same direction.
That is 11 considered to be satisfying the GDC.
l 12 Let's assume for a moment you have such a case.
Now 13 the non-safety support system in terms of its failure will be, 14 it can be down safety grade because it is failure causing the 15 protection system to go into safe mode for certain kind of 16 protection, but I am wondering if we really thought it through 1
17 in terms of long-term protection versus short-term ECCS.
In 18 other words, ten days from now during a prolonged event, will l
19 that function now be needed?
Like a valve that might now have 20 to open although the non-safety air systems failed, the valve i
21 shut from loss of air, but a few days later I need to open it 22 again.
23 Now I have to depend upon a non-safety grade system e~()s 24 to get the valve back open again.
It wasn't normally 1
25 considered in the protection system because it wasn't in the
1 12 1
short-term ECCS which is a way you usually view a protection 2
system.
3 HR. SZUKIEWICZ:
Hopefully we looked, reviewed those 4
systems, and we did identify--
5 MR. MICHELSON:
Long-term decay heat removal after 6
severe accident, is that, is that all safety grade support 7
system?
I don't think you have looked at it that way.
8 MR. ANDERSON:
Not in that detail.
9 MR. MICHELSON:
That is not detail.
That's 10 criteria.
Should the support systems be safety grade if they 11 are needed for the first X number of days after an accident?
12 And how long is X?
13 MR. BAER:
That isn't part of this generic issue.
14 MR. MICHELSON:
You have to decide what your 15 criteria is in order to decide whether you are looking at a 16 safety grade, whether it should be safety or non-safety grade.
17 CHAIRMAN EBERSOLE:
I know we are going to run out 18 of time.
19 MR. MICHELSON:
I'm sure we are going to before we 20 are done.
21 CHAIRMAN EFERSOLE:
Just to maybe pick the apex of 22 all these things, let me talk about the voltage control oro the 23 DC systems.
That is, the control system that holds the 24 voltage, whatever it was, 125 or 250?
25 I don't know when that goes crazy, the voltage might
13 l
l 1
double or triple or.just goes up five percent, but I call that
]
)
2 a control system malfuncton, consequences of which must be 3
limited, and I like to imagine that it doesn't do such nasty i
4 things as lock the jacks _on the control rod if it goes too l
5 high.
It is a control system malfunction, and it is I
6 malperformance just to be intercepted in some safe way.
I am 7
just going to drop it at that point.
8 MR. SZUKIEWICZ:
I think we did look at, at a lot of 1
9 these kind of events, sometimes because we couldn't exactly 10 determine what the mechanistic failure was.
We did try to 11 evaluate what the consequences of, you know, certain failures 12 were, whether they were 50 percent, whether they were fully l}
13 open.
Now I will get into this a little bit more.
14 MR. MICHELSON:
Did you look a overvoltage and as 15 well as undervoltage and underpressure?
16 CHAIRMAN EBERSOLE:
We have parameters we have to l
l 17 control, we control them with, and each case there is a span, 18 band width of control that the system is supposed to hold 19 within, that is, there are certain rates you have to stick l
l 20 with, and that rate includes spikes and aberrations in rates, l
21 including enormous spikes.
And the system that has to survive 22 these transient imperfections, whether control system or goes 23 out of bounds, some external end system catches the parameter 24 and holds it.
I am trying to do what ACRS is supposed to do, 25 the global, cosmic, at least take a global view of the whole
14 1
problem.
I really don't see that-in the paper I have been C:)
1 2
looking at.
3 MR. SZUKIEWICZ:
What we,did was we analyzed those 4
events and what we tried to do is determine whether if it was 5
a voltage regulator or a module, whatever it could be, to 6
determine the worst case condition could be for a particular 7
event like increase in pressure, increase in temperature.
8 CHAIRMAN EBER50LE:
Did you look at control 9
aberrations from whatever the band width of that and voltage 10 on lower voltage control systems?
11 MR. SZUKIEWICZ:
Yes.
We felt that we tried to look 12 at the worst case, in the case when you have a support system 13 failure, and you lose air, what would happen to the systems, 14 whether they would go fully open, fully closed mid-range, et 15 cetera.
16 CHAIRMAN EBERSOLE:
Classic is when.you lose it, it 17 is a step function, one which has frequently been overlooked, 18 when you lose it, get too much of it.
You.know, like too high 19 control air pressure, too high voltage, or when you have 20 deviations in the context of erratic operation of the supply 21 system, whatever it is, whether voltage or air or whatever.
22 MR. MICHELSON:
Save that is a nOn-safety grade 23 system.
i O
l
\\/
24 CHAIRMAN EBERSOLE:
I don't see this is covered.
l 25 MR. MICHELSON:
Did you look at those kind of
15 1
control systems?
g
' ^
2 MR. ANDERSON:
If you will bear with us a minute, 3
let Mr. Szukiewicz explain the logic.
4 MR. MICHELSON:
The SER seemed to have eliminated 5
those as I read it.
6 MR. ANDERSON:
It ought to be become more clear, at 7
least the questions will be in better context after he has 8
gone through how he did this.
9 CHAIRMAN EBERSOLE:
Let's move it.
10 MR. SZUKIEWICZ:
All right.
The non-safety grade 11 control systems that are within the scope of the review of 12 A-47 are all those systems that maintain pressure, temperature 13 limits during shutdown, start-up and normal power operation,
~-
14 include controls for pressure cross, temperature, level, 15 flows, and vessel inventory.
16 These are systems that are.sometimes referred to as 17 important to safety, but they are not relied on to protect the 18 reactor or mitigate the accidents.
The control systems that 19 are the first three--
20 MR. MICHELSON:
Now we can ask the question.
Now 21 you have presented it.
Now--
22 MR. BAER:
Come on!
23 MR. MICHELSON:
How did you view the power supply 24 controls, for instance, like the voltage chargers, battery 25 charges?
mAm~
mmm
-~ - __--
--_-s
1 16 1
MR. ANDERSON:
They were reviewed in the context of O
2 what systems are needed for prevention of mitigation of each 4
l 3
one of the' events concerned.
4 MR. MICHELSON:
Certainly doesn't control 5
temperature control.
6 MR. SZUKIEWICZ:
Could affect pressure temperature 1
7 controls.
8 MR. MICHELSON:
You, indeed you go back to all 9
support auxiliaries that have control systems-on them such as I
I 10 air-conditioning, so forth, and look at those control system 11 failures for impact on safety systems.
l l
12 CHAIRMAN EBERSOLE:
It didn't come out in the text, 13 Mike, like that.
14 MR. MICHELSON:
They don't come out that way at all.
15 The chiller systems, they have some pretty fancy things on l
16 there.
17 MR. ANDERSON:
I can't answer whether the chillers 18 were specifically.
19 MR. MICHELSON:
They certainly impact safety-related 20 systems.
21 MR. ANDERSON:
The coupling.
22 MR. MICHELSON:
Fire protection is another one.
23 That system sets off, sprays water.
It certainly can affect
(
24 safety-related components.
We already know from experience 25 that happens.
I l
1 17 1
MR. SZUKIEWICZ:
We also tried a lot of them--the 2
object of this whol,e program is to make cura.that everything 3
can affect protection system or control systems.
The concern 4
that we have is to make sure that it can, that it does not 5
affect it deleteriously or that the transients that it 6
produces are not as, that can be handled by--
l 7
MR. MICHELSON:
How did you handle the control 8
system on fire protection, for instance, which is a non-safety 9
system?
10 MR. SZUKIEWICZ:
If I may, I would like to develop 11 the approach that we took and discuss the single and multiple l
12 failures that we did look
<t, and then go from there and maybe l
l 13 that would--
14 CHAIRMAN EBERSOLE:
I think that, I think most of j
15 these questions are coming from having read the text that we l
16 got as background and having none of this stuff mentioned, l
17 anywhere, as you are talking about it now.
18 MR. WYLIE:
Or is it?
We missed it?
19 MR. MICHELSON:
That's right.
If that's pointed out 20 to us, we will be happy.
i 21 MR. SZUKIEWICZ:
Actually the text'is intended to 22 provide a summary of all the activities that were done.
This 23 was a very complex program.
A lot of people were involved, 24 and a lot of different laboratories were involved.
The l
25 details, the text references, the specific accounts of a lot I
1 i
l l
1 l
l 18 1
of the transients, the specific failure modes and effects l
L.)
2 analysis can be provided.
3 MR. MICHELSON:
The new reg 1217, is that the one I 4
am supposed to be reading to get all the details?
Or at least 5
they brought the details.
i i
6 MR. SZUKIEWICZ:
Summary of details, yes, but the 7
specific ones that you have concerns with and wbat kind of 8
systems that we did look at, you really have to go back to the 9
reference documents and--
10 CHAIRMAN EBERSOLE:
You are saying this is not a 11 summary?
12 MR. MICHELSON:
I thought this was the contractor's k'
13 report.
14 MR. BAER: lists ten references, many of 15 which--
16 MR. MICHELSOM:
There is always references in every 17 report.
18 CHAIRMAN EBERSOLE:
This is really not the 19 collective statement f what.
l 20 MR. SZUKIEWICZ:
This is the collective.
The l
21 specifics are provided in the specific contractor new regs.
22 CHAIRMAN EBERSOLE:
I am saying if it is collective, l
23 what it hao done is boiled out everything and not even 1
s
(_/
24 mentioned except those things that have to do with overfill 25 and loss of feedwater.
That's all that is here.
,~ ]
19 1
MR. SZUKIEWICZ:
But that's the conclusions where we O
2 found that those were the most important systems.
3 CHAIRMAN EBERSOLE:
When you read a report, this 4
broad, glorious title, you need to dismiss at least in the j
5 text the concerns that we are talking about.
6 MR. SZUKIEWICZ:
We do make statements that we have l
7 identified all control systems and we focused on control 8
systems that can interface with the reactor fluid systems, the 9
steam systems in the secondary side, and the feedwater q
l 10 systems.
Now we stated what we didn't look at, for instance, I
l l
11 like refueling systems, and some waste disposal systems.
We 12 do make a statement in there to what degree.
Maybe it is too s-)
13 general for you to--
4 i
14 CHAIRMAN EBERSOLE:
It may be too brief.
It says 15 these are the only things that count.
l l
16 MR. SZUKIEWICZ:
There are numerous documents and l
17 these documents are about this thick, What we tried to do is l
l 18 instead of having you folks look at all that in detail, is to I
1 19 summarize the activities.
20 CHAIRMAN EBERSOLE: -You should say here we don't l
21 need to look at that some place.
l 22 MR. SZUKIEWICZ:
The objectives, the objectives of 23 A-47 was to identify control system failures that could cause j
D)
(_
24 transients or accidents to be more severe than those 25 identified in the FSAR, so we looked at design base accidents l
~ - - - - ~ - - - - - - - - -. _ - - - - - - - - _ - -
20 1
and we looked at operating, abnormal operating occurrences to
(
2 see if control systems can affect that.
3 CHAIRMAN EBERSOLE:
Not be more severe, but just 4
more frequent?
5 MR. BAER:
There is a bullet on that.
We do not, as 6
you know, have the definitive requirements on frequency.
~
7 MR. SZUKIEWICZ:
We did look at literature, and 8
again, we are'not getting into--I was trying to present the t
9 more systematic approach.
We did look at that.
What we did 10 not look at, one of the activities that we did not address was-11 unacceptable challenges to control, or to protection systems.
12 CHAIRMAN EBERSOLE:
You did not address unacceptable 13 challenges.
What do you mean by unacceptable challenges?
14 MR. SZUKIEWICZ:
The frequency, what is, what 15 warrants unacceptable challenges to the protection systems.
16 CHAIRMAN EBERSOLE:
I imagine a voltage transient on 17 a DC system that runs into 200, that might be an unacceptable 18 challenge to a safety system.
19 MR. SZUKIEWICZ:
Hight not cause a transient.
20 CHAIRMAN EBERSOLE:
'It might kill a critical system.
21 MR. SZUKIEWICZ:
It may, 22 CHAIRMAN EDERSOLE:
Then you are without support.
23 MR. SZUKIEWICZ:
It could kill a, critical system.
24 We would have I think in our methodology, wouldlhave 25 identified that.
Let me continue on.
t
21 1
CHAIRMAN EBERSOLE:
On that first statement, I just 2
don't want to go find a relay someplace which will have an j
i 3
effect equal to but not more severe than a loca, in the I
4 context of more frequent events.
l 5
MR. SZUKIEWICZ:
The approach that we took was that 6
if it was bounded by the loca, even though it provided a 7
significant transient.
l l
8 CHAIRMAN EBERSOLE:
I don't want to have a loca put l
9 in parallel with a loca that is so improbable.
I wouldn't 10 want to have some control component produce the same effect in 11 magnitude.
12 MR. BAER:
Andy, I think--correct me if I am 13 wrong--I think we looked at all the, or the contractors did, 14 all the Chapter 15 events.
15 MR. SZUKIEWICZ:
Exactly.
16 MR. BAER:
It wasn't a question of a feedwater 17 malfuncton being compared to a loca.
It was a feedwater 18 malfuncton being compared to the transients and Chapter 15 SER 19 that dealt with feedwater malfunctions.
20 MR. MICHELSON:
Chapter 15 of the FSAR generally 21 takes credit for the availability of certain ECCS systems in 22 the analysis, in the bounding analysis.
23 MR. SZUKIEWICZ:
Exactly.
24 MR. MICHELSON:
In this case, depending upon the 25 initiating cause of all of this, control system problem, you
i
\\
l 22 1
may have lost part or all of your ECCS, too.
7_
2 MR. BAER:
This was looked at, and nobody found any 1
3 such cases.
j 4
MR. MICHELSON:
What you said in essence is that 5
there is no fire that causes this.
There is no earthquake 6
that causes this.
There is no internal function.
7 MR. SZUKIEWICZ:
We didn't say that.
8 MR. BAER:
Carl, I am not saying that.
9 MR. MICHELSON:
That's how you get outside the 10 bounding analysis.
11 MR. BAER:
But am I correct we couldn't find single 12 or multiple equipment failures of the type you were just
("/
s N-13 talking about that was--
14 MR. SZUKIEWICZ:
That could disable both protection 15 systems.
16 MR. MICHELSON:
I hope we are well enough designed 17 so that is the case That is a basic design criteria.
18 CHAIRMAN EBERSOLE:
We have lost ten minutes, folks.
19 It is the same man.
20 MR. SZUKIEWICZ:
We, the objective also was to 21 identify control system failures that could adversely affect 22 any assumed or anticipated operator action during the course 23 of a transient.
D l
(~
24 CHAIRMAN EBERSOLE:
This implies that in these l
l 25 accidents the operator is fed through visual and audible l
_--~~m
23 l'
contact mechanisms, some independent string of information 2
that governs his actions.
Did you not find that inputs to the l
3 operator's brain through his eyes and ears were interdependent 4
to control systems sometimes, and the very failure of a 5
control system fails his indicator or his ears or whatever?
6 MR. SZUKIEWICZ:
Our review focused only to the 7
extent that if there was valid and important indication to 8
mitigate.
9 CHAIRMAN EBERSOLE:
You just qualified it.
You said l
I 10 if there was.
I am asking you was there?
11 MR. SZUKIEWICZ:
We did not identify any transient l
12 caused by control system failures that could negate operation 13 of protection, both protection systems.
I 14 CHAIRMAN EBERSOLE:
The generation of false' signals?
15 MR. SZUKIEWICZ:
That's true.
Yes.
i 16 CHAIRMAN EBERSOLE:
There is no coupling between the 17 operator's input and the actual failure of control system per 18 se?
19 MR. SZUKIEWICZ:
The human factors aspect I think is 20 where you are coming from.
21 CHAIRMAN EBERSOLE:
All I want to do is find out 22 that the operator has things he can see and hear, to take 23 valid action and that the control system doesn't when it
(
24 fails, simultaneously cause these inputs to him to be l
25 influenced.
Now did you find that to be so?
l 1
24 1
MR. SZUKIEWICZ:
That's correct..There were, we O_
2 could identify in control systems failures that could give 3
false readings to certain instrumentation to the operator.
4 However, if the operator had valid--
5 CHAIRMAN EBERSOLE:
Don't tell me if.
Say but the.
6 other had.
3 1
7 MR. SZUKIEWICZ:
What we.were trying to decide to ~
l 8
see if he had other protection. grade control systems, and 1
1 l
l 9
those, or indications--
10 CHAlkMAN EBERSOLE:
Okay.
l 11 MR. SZUKIEWICZ:
To, to mitigate an accident; if as l
12 a result of control failure, he didn't negate the minimum i
l O
i 13 number of indications required for him to shutdown safely, 1
l 14 then that would have been a flag that we would raise.
l 15 CHAIRMAN EBERSOLE:
But you found he did?
)
16 MR. SZUKIEWICZ:
We found that as a result of 17 control system failures, we did not find any failure that 18 would give the operator or would not give the operator enough 19 information to shut down the plant.
20 CHAIRMAN EBERSOLE:
Did you' find in the hierarchy of 21 reliability when the control system failed he knew which 22 hierarchy or which indications to believe and which not to 23 believe in?
p(-
24 MR. SZUKIEWICZ:
We have evaluated that, and I think 25 we did, the contractors looked at it in that term, because
4 l
25 1
they did try to make a determination was there'enough
(
l 2
information in the plant and could an operator shut down'the i
l l
3 plant and were there procedures?
And this is what we in cases i
4 had to go back and verify that procedures were there to 4
5 mitigate certain transients.
6 CHAIRMAN EBERSOLE:
Do you regard the safety display l
7 systems as control system feeding the operator who is the
/
8 actuator, safety parameters. display system?
9 That would be, I regard that as a, it is an unsafety 1
l 10 grade display system which feeds the operator, who is an f
11 actuator.
And he better abandon it when he gets into trouble f
12 which is not a loca type problem.
That doesn't influence that 13 system itself, but the kind of emergency which influences the 14 output of the safety parameter display system.
Do you find 15
'this to be the case?
I rather regard the safety parameter 16 display systems as being a trap that the operator will fall 17 into because it is such a handy thing.
What do you call it, 18 in the control context?
l 19 MR. SZUKIEWICZ:
The scope of the review did not 20 take into any detailed extent of the human factors aspects of q
I 21 can an operator do something wrong because of certain
'I J
22 information that he shouldn't focus on but he does.
That 23 really is a human factor study which is, there is a whole 24 division looking at these kind of problems.
25 CHAIRMAN EBERSOLE:
Well, let's go ahead.
26 y',
/j p 1
MR. MICHELSON:
Let me ask the question one other 2
way to make sure I understood what you said a little while 3
ago.
4 Did you find any, cases wherein a failure of a, o
5 either a safety or a non-safety pcwer supply caused the loss 6
of one safety grade train of instruments plus the non-safety 7
instrumentation control?
8 MR. SZUKIEWICZ:
Yes.
9 MR. MICHELSON: 'Now facing two incorrect instruments 10 on the papel, how does he know that he is to follow'the third 11 one which he better not follow the two that went sour?
He has 12 got to follow the third one.
13 MR. SZUKIEWICZ:
I think it all depends on the 14 transients, exactly.
15 MR. MICHELSON:
And are you feeding him enough 16 knowledge to know which one is the. correct one, keeping in 17 mind he has got two out of three incorrect ones staring him in 18 the face?
He has got to know which two are sour so he can 19 pick the third one and that has to be factored into your 20 analysis in terms of whether or not he has even got the 21 information with which to make the correct. decision, let alone 22 the probability of' picking incorrect one because of other 25 factors.
'24 MR. SZUKIEWICZ:
That was part of the scope of the
)
25 review, and we did look at it.
In fact on--
]
i
27 1
MR. MICHELSON:
Didn't come through to me in reading V
2 the reports again how that was treated, but I am sure there 3
are many cases wherein you are facing two out of three 4
incorrect channels.
5 (Slide) 6 MR. SZUKIEWICZ:
The next slide discussing 7
specifically that we looked at in a very concise fashion, 8
failures of, that could cause, for example, bus failures that 9
can cause both one channel protection system and one channel 10 of control or certain vital control systems to give you a 11 transient, and in fact, what we did was we looked at very 12 systematically single failures of control systems, very 13 systematically two at a time failures, and we did look at 14 failures of protection system and control systems when we i
15 found control systems sharing a common power supply bus, that 16 kind of a thing.
17 okay.
18 (Slide) 1 19 MR. SZUKIEWICZ:
Again, we tried to identify if 20 there were any control system failures that could exceed the j
21 cause or exceed the technical specifications safety limits and 22 I don't mean just an alarm at a tech spec, tech spec 23 enunciation.
I am talking about the safety and then to, we 24 also, the objective was to look at control systems to see if 25 they can cause transients or accidents to occur at a frequency 1
l l
28 1
in excess of those established for abnormal operating l
l 2
transients and design base events.
)
l 3
Now we looked at the, when we did this was looking 4
at licensing event reports, nuclear experience, nuclear power 5
experience reports, certain AOD reports, to see if there were 6
control systems that could cause this.
7 Now again, I'm getting ahead, anticipating your 8
question.
We did not identify any control systems in this 9
area.
We did identify that there were a number of transients 10 in the past, but they have been corrected, and we did not find 11 any that were repeating.
12 CHAIRMAN EBERSOLE:
Let me go out on the turbine AkY 13 standard, and ask you a few questions out there.
I think you 14 would probably argue because those are not seismic or 15 otherwise qualified, those are control systems that they'get 16 the safety systems extend out to give and anticipatory signals 17 which if they are missed I guess produces somewhat more severe 18 consequence, but still acceptable.
So I sort of regard all of l
19 these as anticipatory devices, improvements to already not i
20 pleasant but acceptable situations like, you know, trip.
I 21 Over the years, the NRC had gotten away from the 22 concept of turbine explosion at a 180 percent by frequent 23 inspection.
I don't know whether it is called incredible now O-24 or not, but I don't believe it, and I wonder also over the 25 years what you are doing with the progression toward
29 1
maintaining exitation and continuity of output on the turbine 2
generators when they are in an overspeed mode possibly to-l 3
severe overspeed conditions?
4 My concern, of course, is that no longer will you 5
just consider the turbine generator explosion.
You would now 6
have to consider the parallel electrical apparatus which is 7
being ruined as it runs up attempting to overhouse the load.
8 Do you have protection against excessive frequency 9
on the AC systems that could derive from main generator power?
i 10 Do you follow me?
11 MR. SZUKIEWICZ:
I follow you, I think we have l
12 frequency protection, overvoltage protection, but I don't know O'
l 13 to what extent.
14 CHAIRMAN EBERSOLE:
Is it in a safety context?
15 MR. SZUKIEWICZ:
That I don't know.
16 CHAIRMAN EBERSOLE:
The shadow, we will ruin all the I
(
17 interconnected AC systems which normally run in parallel by j
18 excess frequency and high speed, and these normally would 19 transfer to a safety grade power supply, but they are not i
20 there any more.
I just ask you that question and in the 21 context of where is the scope of your study here?
22 MR. SZUKIEWICZ:
Yes.
I' don't know the answer to 23 your question.
24 CHAIRMAN EBERSOLE:
We will pursue that later.
Is 25 it clear what I am telling you?
- - - - - - - - - - ~ - - - _ ~
30 1
MR. SZUKIEWICZ:
I think so, but I am not sure.
O 2
CHAIRMAN EBERSOLE:
I am carrying not just the 3
turbine up to destructive overspeeds, but all the parallel 4
apparatus that is being turbine, issued power by that turbine 5
generator, the local grid inside the house.
It is the 6
disconnect of the external grid.
You have lost the standard 7
add grid.
You are carrying house load now to excessive 8
frequency.
9 MR. WYLIE:
You say under those plans you are 10 designed reject load?
They may run away?
11 CHAIRMAN EBERSOLE:
That is correct.
12 MR. WYLIE:
That's what he is talking about.
13 CHAIRMAN EBERSOLE:
That's all.
l 14 MR. SZUKIEWICZ:
I don't know the specifics of that.
15 CHAIRMAN EBERSOLE:
All you looked at was the big 16 chunks that came out of the turbine generator at a 180 17 percent.
If you do it this way, you have to look at the i
18 accumulated damage from all the interattached system.
19 MR. SZUKIEWICZ:
We do have a review of the on-site 20 and off-site power sources and their safety grade isolation 21 devices to prevent us from transients.
Whether that is a 22 problem, I can't say.
23 CHAIRMAN EBERSOLE:
I don't know whether the voltage 24 or the frequency will be intercepted to protect the apparatus 25 which will subsequently have to run on diesel power..
1
)
-31 l
1 MR. MICHELSON:
You have got-to have overfrequency 2
protection.
Not everybody puts this on even if they have got 3
the breaker.
4 MR. WYLIE:
If you don't trip, you are still tied to 5
the system.
Now if you trip, you shift your generator from 6
the auxiliaries.
7 MR. MICHELSON:
You have got to detect 8
overfrequency.
i 9
CHAIRMAN EBERSOLE:
It is just a. scoping question.
10 MR. WYLIE:
In any case, you have got to do this.
11 MR. MICHELSON:
Not overfrequency.
12 CHAIRMAN EBERSOLE:
You learn too much.
{}
13 MR. SZUKIEWICZ:
I don't believe that specific 14 concern was even looked at.
15 CHAIRMAN EBERSOLE:
The scoping question, and my 16 original statement, I don't find myself looking at this as a, j
17 you know, really as a broad scope study.
l 18 MR. SZUKIEWICZ:
There may be concerns that you do i
l l
19 not feel that, you know, have been addressed, and that's why 20 we are here, to get your input.
1 21 MR. MICHELSON:
It is hard to tell whether you have 1
22 addressed them or not when you don't identify them in your i
23 evaluation document.
All we can do is wonder.
24 MR. BAER:
I have a statement I was going to make as j
25 a sumr -
statement, but I think to try and maybe focus this, i
i 32 l
1 this USI has been in existence for what,.six,.seven years?
2 MR. SZUKIEWICZ:
Seven years.
3 MR. BAER:
We have used three national labs, and 4
spent I am sure several million dollars.
We have identified 5
only a limited number of items that we feel withstand the 6
scrutiny or have withstood the scrutiny of a cost / benefit 7
analysis.
1 l
8 Now the choice really is move forward, and try and
\\
\\
l I
I 9
post those modest additional requirements, or we-could go f
l l
10 study it for another five years, spend several more million
{
11 dollars if we can get the money, and still make no changes in i
12 the plants.
13 Now, you know, there is more what ifs that you can 14 ask, and in fact that I asked, than can be answered, and I am 15 sure this situation will exist five years from now.
If you 16 let--Andy tried to or the contractors and Andy tried to 17 systematically look at this, and see, and look at actual 1
18 operating experience.
We now have a thousand reactor years of l
19 operating experience so you have got to kind of give some 20 credence to what has happened and what has not happened, and 21 como up with those requirements that we thought that made 22 sense, and I don't want to mislead you.
I don't think Andy 23 does, that we have looked at every possible thing that could 24 go wrong, tried to bracket it, try to look at worst cases, 25 but--and certainly if he, when he gets to the assumptions, we
33 1
clouded a bunch of things to get the scope down to something l
(~).
l
\\~/
2 that was managable because for many years, it was an amorphous l
3 issue that no one could get their arms around,.around enough 4
even to apparently start it.
5 MR. WYLIE:
Let me ask a question, and I guess it's 6
what is bothering myself and the others.
You mentioned 7
enclosure something.
I couldn't find it, 8
MR. BAER: I think it is.
l 9
MR. WYLIE:
I couldn't find it, but anyhow,.am I to 10 assume that if I look at Enclosure 4, or these other 11 references, that it will lead us to all the events that you 12 looked at and discarded?
i O
'i 13 MR. SZUKIEWICZ:
Yes.
14 MR. WYLIE:
It will?
15 MR. SZUKIEWICZ:
Not in the enclosure that you see 16 here, but the, what we did was summarize the findings, and the 17 kind of failures that we looked at.
You have to go back to 18 the original contractor reports for the--
19 MR. WYLIE:
If I take these references and enclosure 20 you have got here and you go back to the original contractor 21 reports, we would be able to look the, all of the ones that 22 you considered and either said they lead to a problem or they 23 don't?
24 CHAIRMAN EBERSOLE:
Before we do this, Charlie, 25 there should be a deposition by these fellas that we won't
n I
34 1
1 find anything and we go look for it anyway.
{
7
\\
I 2
MR. ANDERSON:
Then you look anyway!
3 MR. BAER:
We can't give you a list of everything we l
4 never thought of.
q I
5 CHAIRMAN EBERSOLE:
That's the only way to run the 6
business.
I don't know what else you do.
You are supposed to 7
have looked at it and said there is nothing in it, j
8 MR. SZUKIEWICZ:
We looked at the control systems 9
aspect.
We had to assume--this is in the other' slide, because 10 we were not privy to every single detail of what is out in a 11 plant.
We were not, we had to assume that at least one 12 channel of protection or minimum number of channels of 13 protection would be available.
For this particular study, 14 this is what we have to assume, so--and we had a basis why we 15 felt that that was a good basis.
16 CHAIRMAN EBERSOLE:
You had one left and only one.
17 MR. SZUKIEWICZ:
For instance, you had the, if the 18 reactor had to trip, because of the transient, it did trip 19 because of the protection systems.
If you had--let me finish.
20 If you had a high pressure injection system that was needed, 21 at least one of those would be available, and that was the 22 assumption for this particular project.
23
-CHAIRMAN EBERSOLE:
Well, did that one that is l
24 available, had it been, had one random failure then permitted 25 a set of failures that occurred which left this one, led to 1
l
35 1
this one function, I am saying normally you put redundant O
2-systems in for the express purpose of surviving a random 3
functional failure of one or two, so in the collection of' 4
events including the transient or accident, was there one 5
random failure of a protection system included in that set 6
rather and one functional failure due to influence?
7 Do you know what you have got now if you have a 8
system which is influenced by the accident in progress?
You 9
have to discard it and then retain the privilege of a random 10 failure in one of two left.
That always requires three.
Are 11 you with me?
12 MR. SZUKIEWICZ:
Yes.
Yes.
Because there are two 13 contractors and there are some differences in, you know, the 14 degree that they envelope certain transients.
I am trying to 15 give you a correct answer.
16 CHAIRMAN EBERSOLE:
Even includes impulse line l
17 failure where there is lots of transients.
18 MR. SZUKIEWICZ:
But in order to determine the worst 19 case transient scenario, we in fact, and I know extensively on 20 the INEL work, have taken a lot of multiple failures of 21 protection systems, one train, not both.
Included in that l
22 were multiple failures of control systems, the non-safety
}
23 grade control systems, so to answer your question, yes, we 24 did, we did look at, depending on the transient that we were 25 focusing on, if a train of protection system could aggravate
3.6 l
1 it, we did look at it.
O 2
There is, the member from INEL that did a lot of 3
this work is here, and before I get myself into hot water, I 4
would just like to ask him, did I represent that correctly?
5 MR. BRUSKE:
My name is Stan Bruske from Idaho Lab.
6 I was principal investigator in a portion of this test.
I'm 7
sorry.
I had a hard time hearing your questions exactly, but 8
if I understood what you said, we did look at random failure 9
of safety grades systems.
10 CHAIRMAN EBERSOLE:
I said the concept of the single 11 failure criteria to permit random failure of protective 1
12 channel.
Still have one functional channel, to use the J
13 protective function.
That random failure does not include a 14 causal failure due to some gyration in performance of the 15 safety system.
Any failures that are derived from possible 16 things cannot be included in the random failures.
You are 17 supposed to have the privilege of accepting the random failure 18 in the package that is left for you to do the safety function.
19 Do you always hace that?
Tell me while you are 20 doing it, you want to be talking about impulse lines as well l
21 as other failures.
I 22 MR. BRUSKE:
I believe we actually did look at that.
23 I remember that was one of the transients we calculate up with 24 on boiling water reactor, I guess the line brcak that caused 25 the reactor trip, disabled part of the protection system.
37 l
1 CHAIRMAN EBERSOLE:
Caused a loca, and did you-have 2
redundancy?
3 MR. BRUSKE:
In all cases we assumed, one thing we 4
did not include, we assumed a basic separation criteria and 5
redundancy was indeed the, there were no common mode failures 6
without the direct, I guess the word we used is causal effect.
7 We had directly linked it to an initiating event.
8 MR. MICHELSON:
You certainly didn't take random 9
failure in the opposite train at that point in time or you 10 would lose both trains of protection systems.
You can't risk 11 one instrument line on train A and remove the power supply 12 from train B.
(
l 13 MR. SZUKIEWICZ:
No, no.
i 14 MR. MICHELSON:
As a single failure; you know, you 15 can't do that.
You have only got two trains.
You have lost i
16 them both.
17 MR. BRUSKE:
I am trying to think of some specifics 18 here.
19 MR. MICHELSON:
What you want to do is show the 20 instrument line failure on train A does not jeopardize train B 21 equipment, but you can't go over and assume a random failure 22 in train B.
Then you are out of business on the train system.
i l
23 It would take a four train system or three train.
24 CHAIRMAN EBERSOLE:
GE has one --
l l
25 MR. MICHELSON:
You have got to talk about both the
38 1
control protection functions being accomplished to see whether 2
or not you are okay.
3 MR. BAER:
Not every--I think you are assuming that 4
every control system failure wipes out one train of protection 5
system.
That's -- I think that--
l 6
MR. MICHELSON:
I didn't say that at all.
The 7
instrument line is what we are talking about specifically, 8
impulse line, and it has both the control instrumentation on 9
it and one train of safeguard instrumentation on the same 10 sensing line, and that's.the case in many plants.
And then 11 if, if the other, if it is a two-train protection system, you 12 certainly can't take random failure.
If three or four train, 13 then you can still take random failure somewhere else.
14 CHAIRMAN EBERSOLE:
It is true with Westinghouse.
15 MR. BRUSKE:
We are working on generic issue 101.
16 MR. MICHELSON:
There are two train instruments but 17 not four train power supplies necessarily.
They are 1
18 oftentimes two train power supplies.
l 19 CHAIRMAN EBERSOLE:
I think it is true that 20 Westinghouse, which has been a constant bone to pick, that 21 every time a control system fails, a system goes with it.
You 22 lose the signal, if nothing else.
You have to rely on the two 23 that are left, and have no influence being spread to them or 24 whatever caused the third system to fail.
I think that is 25 true of the Westinghouse logic.
Anyway, let's go on.
We can
39 1
get bogged down anywhere in this business.
2 MR. SZUKIEWICZ:
Okay.
We are really getting bogged 3
down.
Haven't gotten into the whole methodology-yet, bitt some 4
of the questions that you have raised hopefully will be 5
answered.
6 Again, the objective was to verify the adequacy of 7
the current licensing design requirements which are identified 8
in Section 7.7, and if necessary, propose additional 9
guidelines to assure acceptable risk due to non-safety grade 10 control system failures.
11 CHAIRMAN EBERSOLE:
Let me fire a shot in the dark.
12 In the course of doing all this, I am sure you got into the f\\-
13 General Electric loop selection logic.
14 MR. SZUKIEWICZ:
Yes.
I 15 CHAIRMAN EBERSOLE:
And did you look at the--I I
16 thought those things had been outlawed years ago, but I find 17 they are still present.
Have you in the--
18 MR. SZUKIEWICZ:
You are talking about the i
19 protection systems?
20 CHAIRMAN EBERSOLE:
Yes.
I guess that would be--not l
21 really.
That would be the quality or lack of it of the 22 protection system.
1 23 MR. SZUKIEWICZ:
That's right.
24 CHAIRMAN EBERSOLE:
Okay.
Forget it.
l 25 (Slide)
I
\\
q 40 l
t 1
MR. SZUKIEWICZ:
The assumptions that were made, 1
2 again, we just touched on some of these assumptions already.
)
3 We assumed that a minimum number of safety grade protection 4
systems were available if needed to trip the reactor initiate 5
overpressure protection or the ECCS systems.
j l
6 CHAIRMAN EBERSOLE:
What does that mean, minimum 7
number?
Why didn't you say one or two?
8 MR. SZUKIEWICZ:
Well, for example, if there is, if 9
there is two trains available, high pressure injection, we 10 only looked at the transient, that only one was available.
11 CHAIRMAN EBERSOLE:
Okay.
l l
12 MR. SZUKIEWICZ:
Now it is not to say that we--this O
13 was an assumption, and we said we wanted to find out if we j
l 14 could tolerate a failure of one system, one protection system, 15 and still mitigate control system transients.
16 Common cause events specifically such as the 17 earthquakes, flooding and fire, sabotage or deliberate or 18 operator errors of omission or comission were not addressed to l
19 any degree of detail.
We did look at multiple failures and l
l 20 took non-mechanistic multiple failures of control systems i
i 21 assuming that they would become causal, but we don't want to i
l 22 imply that we have addressed what could occur as far as l
l 23 seismic event or flood.
,/
i 24 What we did was we did look at the significant I
25 control systems.
We identified what the impact was at i
I 41 1
different levels.
Then we tried and then we failed in certain 1
(
2 combinations to see if combinations of these systems could 3
cause you a more severe transient.
q l
4 MR. MICHELSON:
Looking at those combinations, I' 5
thought you, a little earlier you looked at only one transient l
6 at a time by multiple failure within the train.
Is that 7
correct?
8 MR. SZUKIEWICZ:
I am talking about the multiple 9
failures of protection systems.
I'm sorry--multiple failures i
10 of control systems.
11 MR. MICHELSON:
I thought you also looked at 12 multiple failures in protection systems?
Maybe I I
13 misunderstood.
l
.]
14 MR. SZUKIEWICZ:
Maybe if I could defer that to a q
15 couple of--
16 MR. MICHELSON:
Control systems are single train 17 oftentimes and multiple failures will just aggravate -- let me 18 ask you, though, when you said flood, did you mean internal 19 flooding as well as the floods -- is that what you meant by 20 flood?
Internal floods were not included in this study?
21 MR. SZUKIEWICZ:
That's right.
22 MR. MICHELSON:
So-called external events,. internal 23 to the plant, such as flooding?
24 MR. SZUKIEWICZ:
Floods internal and external.
25 MR. MICHELSON:
When you said fire, you also meant
1 1
42 1
to include no inadvertent actuation of fire protection? 'Was O
2 that part of that?
3 MR. SZUKIEWICZ:
We did not focus on that.
4 MR. MICHELSON:
It wasn't said explicitly.
It isn't 5
even implied in the word fire necessarily.
You did not s
6 include inadvertent actuation at all?
7 MR. SZUKIEWICZ:
No, we did not, but we did, again 8
to stress that we did look at, we chose some significant 9
control systems that could impact significantly on the, on a 10 transient, and in some cases did fail both.
11 MR. MICHELSON:
The problem with the failure modes, 12 if you do it for a dry, for a dry panel, you get some A
-s/
13 different kinds-of failure modes.to think about than if you do l
14 it for a wet panel, for instance.
15 MR. SZUKIEWICZ:
During the failure modes and 16 effects analysis, we attempted to describe what, what kind of 17 a failure mode could be the worst case to give you the worst 18 case transient.
I 19 MR. MICHELSON:
You didn't include wetting it down l
l 20 by fire protection equipment, though, for instance.
21 MR. SZUKIEWICZ:
A lot of types we did not take a 22 mechanistic failure.
That is true.
23 MR. MICHELSON:
When you do, you get some different 24 failure modes to think about than when you just go into a 25 cabinet and start postulating.
l J
43 1
MR. SZUKIEWICZ: 'You could, but you coilld have the 2
same fire, two different conditions for the same situation,
)
3 and have a different failure mode for it.
I 4
MR. MICHELSON:
Oh, yes.
Environmental temperature 5
rises or another consideration, which I'm.sure you didn't take I
6 into account but you didn't list,_I assume you didn't include 7
any adverse environments at all?
j 8
MR. ANDERSON:
Tilat is correct.
9 MR.'MICHELSON:
Probably should have been listed as i
l 10 you did not include adverse environments, earthquakes, floods
)
11 and so forth.
12 CHAIRMAN EBERSOLE:
Tell me, in your view, something I
l
.O 1
13 like the common auxiliary battery that performs non-safety j
j 1
14 grade functions sometimes in the control, in the turbine hall 15 or even out in the switch yard, as far as you.are concerned, 16 that is an element of control device?
It is not a safety 17 device to you.
It is non-seismic, and one can hypothesize a 18 severe seismic event and the very first thing that fails is 19 that battery.
1 20 Now what that does is an interesting thing.
It 21 precludes your turning off equipment which you dearly want to l
22 turn off because you don't have the DC power pulse to turn it 23 off.
It may be a, the circulation, circulating water pumps O( /
24 which are facing now burst condenser gaskets or whatever and 25 you are facing a niagara of water and no way to shut it off.
l 1
44 1
You need a shotgun to blow the breaker or whatever.
O,_
2 Do you look at such, such peripheral aspect as that, 3
as control system that you have to do something about?
4 MR. SZUKIEWICZ:
Well, we looked at the effects, if 5
this particular battery could cause a certain transient 6
because your control system has been changed.
7 CHAIRMAN EBERSOLE:
Lack of continuity of function 8
which is undesirable and you can't tolerate.
9 MR. SZUKIEWICZ:
We did not really identify any of 10 those, but what we did look at was loss of a support system 11 that could affect a control system.
In that, we looked at 12 what the worst case mode for that control system could be.
A l
2 13 Once we identified that, then we analyzed to see what that 14 effect could be on the overall transient.
In a lot of cases, 15 for example, that you have witnessed on the simulator, we ran 16 quite a number of control system failures, and in some cases, 17 the more failures we took, the better the transient came out.
18 So what we, again, in cases where we didn't have the 19 information, the specific information, to clearly define what 20 multiple conditions you could have, what we did was we 21 combined certain failure modes, for example, certain valves go 22 wide open, certain valves go wide closed.
23 Case in point, and this is a fairly simple example, 24 when we looked at overfill protection, we looked at what kind 25 of control systems can affect level. 'We identified, for
2 1
45 1
example, the main feedwater system.
The control system, we 2
identified certain valves on the steam side that-if they came 3
open, they could change the level conditions.
We want further 4
down and identified certain bypass valves.
We identified the 5
turbine bypass valves, if they stay open, and what we then did 6
was not only did we take a failure of a main feedwater system, l
0 7
but at the same time, failed these valves as well to see what l
8 the transient was to see if we could actually get water or 9
moisture into the, into the main steam line, 10 To give you an example as to the severity that we I
11 looked at on a boiler, for example, we took failures that 12 included a maximum feedwater flow, and if the feedwater, r
\\
\\
13 maximum feedwater flow was tripped at a high-level, but then 14 in sequence, we tripped a lot of the ADS valves meaning they 15 opened, and I think what we did was when we postulated all six 16 atmospheric dump valves would open, if we tripped that 1
17 feedwater system, by the time it reached the high-level alarm
)
l 18 point, then you wouldn't get overspill.
I 19 Now we also decided to say well, how much volume do 20 you need or suction do you need to get spillover, and we did i
21 identify that if we opened I think seven or eight additional 22 valves or total of seven or eight, then you started getting an I
23 impact.from those valves for spillover.
You went back then to 24 see if these kind of events were really credible, and of 25 course, they were not.
1 I
(
Iy
1 l
46 i
1
. CHAIRMAN EBERSOLE:
Earthquake--good thing that you H
2 said you did--has a negative aspect.
While you were doing' 1
3 this, you were seeing the transient on the primary loop.
1 4
MR. SZUKIEWICZ:
That's true, so overfill condition 5
can give you a steam generator overfill concern plus an j
6 overcooling' concern.
]
l l
7 CHAIRMAN EBERSOLE:
Were you busy depressurizing at i
8 rapid rate the primary loop?
l i
9 MR..SZUKIEWICZ:
We looked at--and this goes into.
10 the next slide, but we did try to identify all the systems 11 that could affect overfill, all the systems that could affect
)
l 12 overcooling.
A lot of them were very similar systems that l
N 13 could in fact in overheating, change pressure.
All those, l
14 reactivity control, for example, you know, we went and tried 15 to, identified all those systems.
Not.tried to--we identified 16 all those systems.
i 17 CHAIRMAN EBERSOLE:
Some of the plants, I think even i
18 the better ones, have motor-driven made feedwater pumps.
I j
19 remember series, got two of them in series, may have separate l
20 breakers, any of them in separation.
This is great for I
21 continuity of feedwater flow but it also brings with it as 22 everything else does the negative aspects, how do I know how I 23 am going to turn it off when I want to?
You have looked at w
l l
24 all of these?
i 25 MR. SZUKIEWICZ:
We have looked, regardless of i
4
47 1
whether they were motor driven or turbine driven.
We O
V 2
postulated maximum flows, and you know, the valve goes wide 3
open at a condition which would be--we did sensitivity studies 4
to determine, for example, at what point you can get i
1 5
significant transients.
For example, in overfill, we found 6
that at higher loads, the, probability of overfill was much 7
less than at loads somewhere in the area about 60 percent 8
where both main feedwater pumps, for example, may be on.
9 Below that value, maybe only one feedwater pump would be on, 10 and therefore, it would not be as significant transient, solae 11 did try to look at what the worst case conditions were, and at 12 what kind of conditions.
13 Some transients and some failures were significant
~
i 14 during start-up or low power operation.
Other transients were l
l 15 more significant in a transitional stage where there was a lot l
l 16 of energy available or maybe the equipment was throttled down, 17 and others may have been more significant at higher values.
i 18 For example, at higher values we didn't, we had a difficult 19 time trying to get overfill as long as the-reactor was on 20 power.
At any rate, can I continue?
21 CHAIRMAN EBERSOLE:
Yes.
We will have to move 22 forward.
23 MR. SZUKIEWICZ:
Another important assumption that O
(_/
24 we did was that we assumed that during limiting conditions of 25 operation where you have one protection channel bypassed or in
i 48-1 test' or whatever, we did not under those conditions, look.at, C:)
u 2
you know, the implications of' control system failures, and we l
I 3
have to assume that we did not have, and at last event that l
4
.was a s'eparate study by itself.
5 MR. MICHELSON:
You are assuming you just didn't get l
6 control system failure while you were in anLLCO?
Is that-kind I
7 of what you are saying?l J
8 MR. SZUKIEWICZ:
That's the. limitation, yes.
9
,MR..MICHELSON:
Is it a realistic assumption?
1 10 MR. SZUKIEWICZ:
A lot of the LCOs are, they have a 1
J 11 time limit on them for the plant to correct 1
12 MR. MICHELSON:
I.was thinking, for' instance, if I 13 lost power, a particular safety grade power supply, and I had 14 to go into LCO to do something, that power supply is also 15 linked to a control grade circuit.
Let's take a case where I 16 am working on the. problem and it got me into the LCO.
Is 17 there a danger at that time of depending on the kind of i
18 equipment you are working on accidentally screwing up the,
)
19 going into a transient because you got the leads.in the wrong i
20 places on the panel and your control system, which is not ever j
l 21 looked at as carefully, went screwy, at the time you were 22 working on the LCO problem?
That's the way you would get one f
23 train out plus LCO, the second train.
O (m) 24 MR. BAER:
I think that's what the LER researched-25 and I guess didn't find anything of significance, and if you, j
l 1
l
49 1
if one starts postulating situations with the LCO, you will l
f-
. lg 2
have to think about it when you read, when you are going to do 3
the reg and cost / benefit analysis, and the fact that this 4
piece of equipment might be out, you know, three days out of i
5 300 days a year, you are going to end up with another factor 6
of ten to the minus two in your reg analysis.
7 MR. MICHELSON:
Is there a risk when working on the 8
LCO that you might trip the non-safety grade control system, 9
as a result, you impair operations?
10 MR. ANDERSON:
Experience doesn't bear that out.
11 MR. MICHELSON:
That's what you are saying.
Okay.
I 12 Thank you.
3
\\ ')
13 MR. SZUKIEWICZ:
That kind of a dacision is factored i
14 into describing what the LCO limits would be.
I l
i 15 CHAIRMAN EBERSOLE:
What are you doing about this 16 recent legal flap we have had about' adequate safety not being 17 subject to a monetary value analysis?
And you know, the play 18 on words we currently have, that if we are searching for 19 adequate safety, there shall be no economic consideration, but I
20 more than adequate safety, you.have to go through the agonies 21 of these.
Are you searching for adequate safety in this j
i l
22 study, or improving on adequate safety and therefore subject l
23 to the cost / benefit?
l 24 MR. SZUKIEWICZ:
We are looking for adequate safety.
l 25 Now as far as I understand--
l 1
50 l
1 MR. BAER:
Andy, just you are asking the wrong
/~T.
i V
2 person the wrong question' I will start off by saying there 3
is no one in this room from the staff qualified to' answer that
)
'd question.
5 MR. ANDERSON:
We didn't bring our attorneys with-6 us!
1 7
CHAIRMAN EBERSOLE:
You have to work with what the 8
brass hands you.
So what have they handed you?
l 9
MR. BAER:
.They have said the stuf f we are doing cn1 l
10
.the generic issues is subject to cost / benefit analysis.
They 11 may lose that argument in court later, but that's the ground i
12 rules we have to work with.
1 I
O's 13 MR. MICHELSON:
Our attorneys informed us'as to what 14 is the subject of cost / benefit.
I think the next few generic 15 issues are going to get a little different kind of scrutiny.
16 CHAIRMAN EBERSOLE:
When you enter, when filtered 17 all these things out and found up, out you had as far as I am 18 concerned only inadequate feedwater flow or,too much of it, 19 which is overfill, one aspect of this at least in the overfill 20 context but not in the inadequate, we know if we' don't get 21 adequate feedwater we are going to have problems unless we can a
22 vent the thing.
23 MR. SZUKIEWICZ:
If you don't get adequate bl 24 feedwater, yes, but --
ss l
25 CHAIRMAN EBERSOLE:
We have lost the secondary
51 l
i i
system and must rely on something else, l
2 MR. SZUKIEWICZ:
We have protection grade auxiliary i
l l
3 feedwater systems to do that.
I 4
CHAIRMAN EBERSOLE:
Beyond the secondary systems, a
5 there is supposed to be the privilege of cooling the core with
]
1
{
6 through-put flow, through-put through vein or whatever.
Some l
7 plants cannot, and that's a'.different package, but in the 8
matter then of looking at the residual consequence, it has to 9
do with what happens when water goes through the main steam 10 isolation valves and runs on down, and I guess impacts on the 11 stop valves.
What happens to the pipes?
Did you pursue in 12 any detail whether you might just be able to tolerate that?
i
(")\\
l
\\-
13 My current understanding is that many plants, if not 14 all of them, can't stand static load if you just fill up water 15 because that's, in the course of operation they really do 16 that, and I suspect the problem is the violence of boil, the 17 water hammer, and the impact effects on that pipe which may 18 tear it up and burst it, and that would be tolerable in the 19 old context of main steam line failure as long as the main 20 steam line valves were closed, if you have got any, which some 21' don't'have, I think is what, is one plant doesn't have.
22 MR. SZUKIEWICZ:
There is a few.
There is one or 23 two B&W plants that don't and I think a Westinghouse.
24 CHAIRMAN EBERSOLE:
Did you look at the tolerability l
l 25 of having this accident happen, and try to escape through that l
l l
1 u
I, 52-l J
1 route?
- I
\\/
2 MR. SZUKIEWICZ:
Yes. 'When we did the risk i
l 3
analysis, we did some conservative analysis, and we assumed--
j 4
CHAIRMAN EBERSOLE:
I thought they might be too i
5 conservative.
h I
6 HR. SZUKIEWICZ:
Well, we, what we did was we had a 7
program to evaluate, you know, some of transients that we 8
identify, identified pressure and temperature conditions,'and 9
extend that to identify what kind of pressures could occur in 10 the steam lines, and did some elastoplastic analysis.
Now we 11 did very conservative analysis on this, on my particular 12 project, and we did find that we could not eliminate the 13 possibility of a rupture based on the kind of analysis that we 14
- did, so--
15 CHAIRMAN EBERSOLE:
Do a water. hammer?
l 16 MR. SZUKIEWICZ:
Did do a water ham hammer, right, 17 so what we did was we, recognizing that, what we tried to do 18 in this USI was to identify any control system failures that I
i i
19 would cause this event.
The way we wrapped it up.in our area l
J 20 was to try to come up with recommended solutions to prevent
)
21 spillover.
22 Now because there is still a lot of unanswered I
l 23 questions about, you know, whether you can really do severe j
24 damage to the steam line, and other associated protection l
25 systems that are connected to the steam line, this particular 1
1
. ~ - -. - -
53 1
issue as far as the thermal hydraulics and as far as', you O
2 know, the integrity of.the other systems, is I believe under a 3
generic issue.
4 MR. ANDERSON:
135.
5 CHAIRMAN EBERSOLE:
Originally it was taken for 6
granted that those steam pipes attached to turbine on seismic 7
inferior grade to primary loop life, whatever, that they were l
8 scratched as non-safety grade pipes.
And for that reason, we 9
had main steam isolation valves to intercept flow of steam at 10 least to faulted pipes.
There is intrinsic possibility you 11 are going to blow the pipes for some other reason like they 12 wear out or something.
13 MR. SZUKIEWICZ:
So as back-up to the turbine stop 14 valves to bottle up the system.
15 CHAIRMAN EBERSOLE:
Not a back-up to those because 16 that turbine will flow before those valves can even get 17 started so they are to prolong flow of steam into an open hole I
18 in the turbine hall.
L 19 That wouldn't matter because there is hopefully l
i 20 nothing in the turbine hall that supports continued cooling 21 but sometimes you find that there is by mistake, and then-you' 22 have an environmental problem.
But anyway, it was I think a l
23 generic proposition that the main steam isolation valves were 24 to permit loss of the main steam lines.
Do you understand 25 that to be so?
_ ~ _ _ _ __ _ _ _ _ _ _ _ _ _ _ _ _ _ _
l
\\
54 l
1 MR. SZUKIEWICZ:
Yes.
O 2
CHAIRMAN EBERSOLE:
Now unfortunately, it was not at
~
3 the time they were put in place confirmed that they would act 4
in the presence of two phase or mixed or heavy water flow, and i
5 therefore, I doubt that they will intercept the flow.
6 Did you find that if you lose the main steam line 7
for whatever cause, that the valves will perform their 8
intended function and shut you off and leave you alone'anyway?
1 i
9 If you could, maybe you are well off.
10 MR. ANDERSON:
Mr. Ebersole, Generic Issue 13 which 11 is getting pretty well along now,Hwe are looking at a number 12 of these concerns.
A lot of them are raised by Mr. Michelson O
i 13 about the weight of the steam line and the impact on i
14 instrument lines and other, operability of other components 15 due to two phase flow or solid water, and gross movement of 16 the steam line, so we have, I think we are taking a pretty 17 broad look at that in this other issue.
18 CHAIRMAN EBERSOLE:
You may be coming up from behind 19 and finding this, this is more tolerable than you thought?
20 MR. ANDERSON:
Well, or we will, we may discover I'
21 there are problems in some of the areas, too, but it was one 22 of the specific thing's.
23 CHAIRMAN EBERSOLE:
Is that including study to 24 confirm the valves will execute their gyration function in 25 mixed phase flow?
l
--n--n
-~ ~~ _- ~-- --------__-_
55 1
MR. ANDERSON:
That is correct.
O 2
CHAIRMAN EBERSOLE:
Let's go on.
I don't know where 3
you are on your own agenda.
4 MR. SZUKIEWICZ:
We will finish it by the time you 5
want us to.
6 And the last assumption which was an important-7 assumption, was that in 1979, well, lec me just finish what I 8
have to say.
9 The plant specific designs, all of them were 10 appropriately modified to comply with INEL BULLETIN 7927, 11 which addressed loss of power to instrument buses for safety 12 and non-safety systems, and new reg 0737 which is the TMI 13 action plan.
l 14 In our review of the plant specific designs, we 15 verified for those particular plants that 7927, for example, l
16 was indeed adhered to and the design adequately addressed it 17 because the requirements were sent out and a review in the 18 past has been provided by the staff for these.
No additional 19 requirements were needed.
We just assumed that all plants 20 adequately addressed this particular issue.
21 Again, now that you all were getting ahead of my 22 slides, let me just bring up a point,.that on 7927, as a 23 result of the Rancho Seco event of December 1985, end of 24 December, 1985, that there were certain failures and failure 25 modes of control, of certain valves that raised the question
56 J
1 to what degree Rancho Seco complied with the particular 1
2 requirement, and as a result, because of the transients and I
3 the complexity of the transient, there was a B&W owners group
)
4 activity that has been initiated, and one of the specific l
5 functions or tasks of that owners group is to go back to each l
l l
6 particular plant, B&W plant, and make sure that because one of i
7 these plants, the degree of conformance was questionable, to l
l 8
make sure that all these other plants are, indeed do indeed 9
conform to the requirements and to what degree.
That is being 10 done right now as a part of the owners group reassessment 11 progr m.
l 12 CHAIRMAN EBERSOLE:
I would like to comment on I
13 bullet No.
2, and in I think a managerial context, you are 1
14 talking about earthquakes, flood, fire, whatever, operator 15 errors, and I think--and you would also put up there A-17s and 16 other USIs and so forth.
17 I believe that these other, USI A-17, 46 and so 18 forth, they have the charge to investigate potential 19 consequences to control system items components, equipment, 20 whatever, but having done so, it would appear rational to me 21 to say that they would tell you people who are control system 22 experts and in a functional context to investigate the finding 23 they made in the detailed context which you will pursue which 24 they cannot because it is not their expertise.
You know, 'his 25 whole business is project and functional engineering work f
57 1
division, and it would seem certainly more rational-to me to O
2 hand back to you a finding from the earthquake people like 3
relay chatter on control systems, to go into this and find out
)
4 what it means, because we are not, that's not our expertise.
5 We told you we found it with chatter, now do something with 6
it.
j 7
Could you comment on the managerial assignment 8
process that makes possible I think your being able to point l
9 your finger off at fourteen directions, say I am not going to 10 do that, somebody else is doing it?
11 MR. SZUKIEWICZ:
In this case, I would like to point 12 my finger at Newt Anderson.
.O k/
13 MR. MICHELSON:
Let's get one answer at a time.
i 14 CHAIRMAN EBERSOLE:
I don't care--just one at a I
15 time.
16 MR. ANDERSON:
Let me go first.
Okay.
The first 17 thing I would like to note is that Andy as manager of A-47, 18 sits within twenty feet, his office space is within twenty 1
1 19 feet of the task manager for the other two issues, and they do 20 talk to each other and we do discuss these interfaces.
I 21 CliAIRMAN EBERSOLE:
I am putting it in the text.
22 MR. MICHELSON:
Where is it in the documentation?
23 MR. ANDERSON:
If you would like to see in the text
(
24 which ones of these issues you are not considering in A-47 25 because they have been taken care of by other issues, that's
58 1
something that we can take care of.
J O
2 MR. MICHELSON:
There is no discussion in here of 3
those things that you left1out because somebody else is 4
picking up on them.
5 MR. SZUKIEWICZ:
Excuse me.
I would like to make a 6
correction on that.
On the Enclosure 5 which is.new reg 1217, 7
in the appendix we have specifically identified areas which 8
are called other related studies programs and issues, and in 9
there we talk about size and--
10 MR. MICHELSON:
Would you go to Table A1, page A5, 11 and tell me where A-17 is?
That's in your, in what you are 12 now citing and that's exactly what set me off a wee bit as I 13 went to that table and I couldn't find Generic Issue A-17 14 unless I just flat out didn't see it right.
Gee, you just are 15 not even going to consider it.
It is not on your table.
I 16 didn't find it in the text, either, by the way, but I 17 certainly didn't find it on the. table.
18 MR. SZUKIEWICZ:
We just made a passing statement on 19 A-17, but we did not look specifically.
20 MR. MICHELSON:
Which statement are you citing as 21 the passing statement?
22 MR. SZUKIEWICZ:
I think it was as far as the basis 23 for assumption of having a minimum number of safety grade 24 protection systems available, and that would be on page 2.2 of 25 the reference document.
I 59 1
MR. MICHELSON:
Not in the appendix, but in 2.2, 2
okay.
I think back in the volume somewhere you said --
3 MR. SZUKIEWICZ:
We have not, we did not' cite that 4
resolution of A-47 requires resolution'of A-17.
5 MR. MICHELSON:
This is the only place in this 6
document-where you cited A-17, and it says they are going to-7 take care of it.
I thought.I would see it.in your appendix 8
since that is where you gathered together in reference, and it 9
was omitted in the appendix, although it was back here.
This 10 is the only place it is.
And I was going to ask, of course, 11 what all is involved, but you are going to tell us later about 12 A-17 I guess today.
I mean you are going to tell us what A-17 l
13 is picking up that A-47 passed on to you?
14 MR. ANDERSON:
Okay.
We will reiterate to you what 15 the scope of A-17 was.
1 16 CHAIRMAN EBERSOLE:
If you just read the title, gee i
l 17 whiz, that is an infinite title.
j 18 MR. SZUKIEWICZ:
That is why we tried very, very --
19 it is, and the whole world could be infinite.
One of the most 20 important things--
21 CHAIRMAN EBERSOLE:
Qualify the title or in the 22 first few pages state the limitations on it.
Do so exolicitly 23 rather than by inference that you ought to know this.
24 MR. MICHELSON:
This is, this is interim resolution 25 or partial resolution, but it certainly isn't a complete
i 60 1
system.
It wasn't presented as either of those alternatives.
l 2
MR. ANDERSON:
It is like water hammer, like A-17, 3
like a number of other issues that are stated and defined 4
initially in such broad scope that there is just no way you I
q 5
can get your arrs around it.
All of them are limited.
6 MR. MICHELSON:
When you leave part out for whatever 0
7 reason, you need to identify that part and indicate how the 8
agency is going to handle it, and one answer is I am not going l
l 9
to even consider it in the future.
That's fine.
Say so, but f
10 here you just left us uncertain as to what your intention was.
q
~
l 11 CHAIRMAN EBERSOLE:
There was a black hole in this 1
12 document here.
13 MR. ANDERSON:
I understand.
14 CHAIRMAN EBERSOLE:
One final thing, on bullet No.
)
15 2,
with Chernobyl behind us and the flap that is going on in 16 the community at large to look at our plants and see whether-j 1
17 there is any unique switches that we can mill operate, in very 18 few of them there is the incorrect combinations that create 19 chaos.
I think all the labs are working, looking at them.
20 Everybody is looking at it.
21 I would have thought it would have been within your 22 purview uniquely to look at control systems in the context of 23 the operator performs and sets the wrong combination of i
l k.
24 equipment up.
We know he can fail to turn anything on, but if i
25 it is on the line and running, and he makes a malsetting with 1
61 1
a control switch, in my specifications of a control system, he O
2 would see what happened instantly and have the privilege of l
3 backing out in a comfortable time element.
That would be a 4
specification that I would have to satisfy--if he made that-l 5
mistake, he could come out of it.
6 I gather you are not going to look at this at all?
7 MR. SZUKIEWICZ:
We did look at some of the operator 8
actions.
In our failure mode scenario, we did.
In fact, some 9
of the scenarios did assume that the operator would not 10 actually do anything about certain control system failures.
11 CHAIRMAN EBERSOLE:
I am talking about he does the 12 wrong thing.
13 MR. SZUKIEWICZ:
We have identified some of those, j
l 14 too.
l f
15 CHAIRMAN EBERSOLE:
How do you decide whether that 16 some is enough?
17 MR. SZUKIEWICZ:
I don't know.
I don't know the 18 answer to that because we could be looking at--
19 CHAIRMAN EBERSOLE:
Did you find a trend?
20 MR. SZUKIEWICZ:
Hundreds and thousands of specific l
21 little scenarios, that a case in point, Rancho Seco event when 22 it occurred, when we tried to analyze the event, and I talked 23 to the contractors, they ran a very similar event, but then 24 what they did not do is they did not assume that the operator 25 would deliberately put feedwater into the, into the system and
62 1
not shut off the auxiliary feedwater systems and'the' transient (E) i 2
that they ran with atmospheric valves inadvertently opening up, 3
the overcooling event was not really significant.
I.think~if l
4 my memory serves me correctly, I think the overcooling 5
transient was something in the area of 60 degrees.
l Now yes, coupled with operator errors where they 6
l 7
specifically lock out equipment that procedure-wise says that 8
they have to be available, I firmly believe that that is not 1
9 part of a control system problem.
That is a human factors 10 problem which there is a division that is looking at all of 11 these things and trying to improve the training, the 12 operability of, and minimize these kinds of events, so we O
13 could, we could be here, I could retire and still not address 14 every specific failure, and what we tried to do is to limit it 15 to the scope of just control systems.
And we felt that 16 because of the way we ran the failures, the selected multiple 17 failures, and in some cases unlikely failures, to give us an 18 indication of what kind of transients that can occur, we 19 basically concluded that their safety is maintained as long as 20 the projections that we have identified as necessary are l
21 available.
22 Now we have a completely different game if those 23 control systems, those protection systems, are locked out.
24 Case in point was Davis-Besse, which was also a fairly major 25 event.
From what I recall, this was in June of '85 I believe,
I 63 1
in that case, both protection systems were unavailable, O
V 2
auxiliary feedwater, so in one case you had a situation where l
3 you did not turn off protection systems when there were 4
procedures and indications and assuming training that 5
indicated you should do this, and the other case where it was
)
6 just the reverse, where they were not available.
7 Now I believe these are not control system problems.
8 They are administrative problems.
In fact, this is one of the 9
reasons, one of the main reasons that the Commission took a 10 very strong stand with the B&W owners group, and you know, 11 said hey, start improving your system because you are getting 12 a lot of transients, a lot of embarrassing transients.
So far 13 they have not degraded the system below any acceptable level, 14 but you know, improve collectively your operations, and when 15 you look very closely at the data, you find that really only a 16 few of the plants are culprits where they have to improve 17 their administrative procedures to make sure that these 18 protection systems are available, but I thought that, that was 19 really the whole objective of control system, because in the 20 past, we have looked at control system failures only on an 21 audit basis.
We have never really conducted a detailed 22 review, and the purpose of A-47 really was to conduct a 23 detailed review.
(
24 CHAIRMAN EBERSOLE:
Control system is put in when it 25 is impractical for a thousand reasons for an operator to keep
64 l
1 it manually controlled.
There is a set of reasons.
In the I
(:)
2 course of looking at control systems which you are doing and
]
i 3
what they can and cannot do, isn't it your, in your purview to 4
say that I have found this point and this control system i
5 wherein the automatic function, they didn't go far enough and i
6 they left too much for any operator of common ability and 7
expertise and capability to cope with?
I have imbalance.
I 8
don't have enough automatic control.
It superimposes on the
)
l 9
operator more than he can handle.
Isn't that part of your i
l 10 problem in the implications of control system malfunctions and 11 inadequacies, that you find there is too much handed to the l
12 operator in certain situations?
l 13 MR. BAER:
Operating experience base.
14 MR. MICHELSON:
I thought you did look at it because l
15 I read in several places where you said it was not automatic 1
16 trip say on high vessel level, and that you, then you l
17 questioned whether the operator could respond and then you 18 decided that it needed to be automatic.
I 19 MR. BAER:
If you would let Andy to get on to the 20 next couple of slides, we try to show the methodology we used l
21 to try to get our arms around this, it would really be 22 helpful.
23 MR. MICHELSON:
Okay.
Let me clarify,.though, for 24 my own edification a couple of remark' at were made about
.l i
25 human factors.
1 i
- - - - - - - - ~ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _
i 65 1
Clearly you have looked at the control, the hardware 2
control aspects of these plants and you have specifically said 3
you wouldn't look at the human factor aspects, but I thought l
l 4
you also said that because we have got other people who are j
5 looking at it, and if anybody else is looking at this, would l
1 l
6 you tell me briefly who is doing it so I know who to talk to?
l l
7 I hadn't heard anybody else was doing it.
I 8
MR. BAER:
In general terms, Frank Kaufman.
I don't 9
know I could quote the title.
l 10 MR. ANDERSON:
Human factors issues.
1 11 MR. MICHELSON:
Do you know if he is actually 12 looking at control, the human factor interface with control O.
13 systems, to see if he sees any unusual problems that 14 malcontrol could get the plant in deeper troubles than you 15 predict with hardware problems?
16 MR. BAER:
I don't know.
He is just down the hall 17 from me.
I will talk to him in the next couple of days and we 18 will give you a call.
19 MR. MICHELSON:
That's the aspects I would expect 20 they would look at.
Can control system get me into trouble I 21 hadn't even thought about by maloperation?
You didn't look i
22 really at maloperation?
That wasn't your commission.
Maybe 23 you can't.
Maybe there is no way to screw it up by turning 24 things on and off in the wrong sequence to get new, worse 25 trouble.
66 1
MR. BAER:
No.
We have a, one prime example of that U
2 which is TMI, there is no doubt--I used to work for a fella 3
that used to say you could design these systems to be 4
fool-proof, but that damn fool will get you ever7 timell 5
MR. MICHELSON:
My point is safety systems to some 6
extent have been looked at from time to time in history, but 7
have we gone and looked at control systems from the same 8
viewpoint because they are non-safety and we don't think about 9
them as far as--have we looked at them from the viewpoint of 10 maloperation?
11 MR. BAER:
I will have to talk to Frank Kaufman and 12 either one or both of us will call you back.
13 MR. MICHELSON:
Just like to know roughly what you 14 are doing.
15 MR. BASDEKAS:
I am Demetrious Basdekas from the i
16 Office of Research.
I think the basic position enunciated by l
17 the staff, subscribed to by the Commission, is that the 18 control system functions will be taken care of by options or 19 functions of existing safety systems.
That has been the basic 20 premise on which we have operated for a long time.
That's why l
21 you see issues like this being on the back burner for a long 22 time.
And I think this is, this basic parameter does not l
23 change, and I think we are going to have difficulty.
24 I would expect TMI, a lot of people have cited TMI 25 II not as a problem pointing to the problems of control system l
--__~__- __-- _ - _ _ _
67 1
functions, but to the system does work.
Nobody was killed.
I 2
think that is, that sums up the basic premise.
3 CHAIRMAN EBERSOLE:
We are going to sure stall out 4
if we don't move along.
5 MR. ANDERSON:
We are through the introduction now 1
6 so--
)
l 7
MR. MICHELSON:
We haven't gotten through the end of j
l 8
the slide.
9 MR. SZUKIEWICZ:
I would like to point out that one i
10 of the objectives of A-47 was to see if there is any 11 malfunctions in the control systems that could aggravate the 12 system to the point of having a plant unacceptable.
I think 13 so far, to my knowledge anyway, based on the literature 14 searchings and the information that I have available, or 15 understanding, is that a lot of the problems were not because 16 of the control system, but because of the protection systems, 17 and operator errors, that caused problems with controlling the 18 protection systems.
l 19 MR. MICHELSON:
What did we mean by manual control 20 system, your bullet near the bottom there?
21 MR. SZUKIEWICZ:
There is a number of control 22 systems that, that you can, that you need deliberate operator 23 to open a valve, close a valve, and stroke it.
l
(
24 MR. MICHELSON:
Every hand switch that controls the 25 valve is a manual control system?
l 68 i
1 MR. SZUKIEWICZ:
That is true.
Every, every O
2 automatic system has a feature that you can manually control 3
it as well.
4 MR. MICHELSON:
You evaluated every hand switch in 5
the control room?
6 MR. SZUKIEWICZ:
Evaluated every control system and 7
its manual mode and automatic mode, right.
I 8
MR. MICHELSON:
You evaluated every manual control q
I 9
switch?.Because you just told me every manual switch is a 10 manual control system.
I i
11 MR. SZUKIEWICZ:
Yes.
12 MR. MICHELSON:
You went through the entire control 13 room on every switch?
14 MR. ANDERSON:
No.
No.
You have got to wait and 15 look at the logic for how we reduced the number of control 16 systems to that we are interested in for these events.
That's 17 the next slide.
18 MR. MICHELSON:
I was asking for definition of 19 manual non-safety grade control system.
20 MR. ANDERSON:
Manual means it takes deliberate 21 action of the operator to actuate it.
I 22 MR. SZUKIEWICZ:
We evaluated--
23 MR. MICHELSON:
Hand switch on valve is.
24 MR. ANDERSON:
It doesn't say they went through the 25 control room and checked every one, i
I
d 4
69 1
MR. MICHELSON:
It says evaluated all.
I just O
2 wondered if they evaluated all the hand switches because 3
that's the way I read it.
i 4
MR. SZUKIEWICZ:
We evaluated functionally what 5
occurs when the operator opens and closes certain valves and 6
those systems associated with those valves went on manual i
7 control, so we include that in.the design.
8 MR. MICHELSON:
The word "all" to me has, I just j
9 couldn't figure out what you were doing there.
I don't think-j 10 you evaluated all the manual' control' systems.
4 11 MR. BAER:
That's right.
j 12 MR. SZUKIEWICZ:
Well, that interface with the l
O 13 primary fluid system, and steam and feedwater system, I j
14 understand we did, yes, as far as the functional importance of 15 those particular systems.
16 MR. ANDERSON:
Let's move on.
17 MR. SZUKIEWICZ:
We are starting to get into the 18 overview, what we really have been talking about a little bit l
19 in circles here.
20 (Slide) 21 MR. BAER:
I hate to slow us down, but maybe, I 22 think you jumped from the first bullet to the last, to the 23 footnote on the other side, and might just want to go back and 24 make the point.
25 MR. SZUKIEWICZ:
Did I miss that?
l l
a 70
-j 1
MR. BAER:
We looked at one each -- I think that is 2
a key point.
3 MR. SZUKIEWICZ:
I'm sorry.
I thought I covered the; 4
whole thing.
Sorry.
Yes.
Our review approach -- we looked 5
at and performed detailed review of four reference plants, one 6
from each of the NSS suppliers.
7 We, the B&W plant and the Combustion Engineering 8
plant was reviewed by Oak Ridge and those plants are the 9
Oconee and the Calvert Cliffs plant design.
10 At Idaho National Laboratories, we looked at the GE, 11 General Electric plant, and the Westinghouse plant, and those 12 plants specifically were the Brown's Ferry and H.W. Robinson 13 plant.
14 CHAIRMAN EBERSOLE:
In view of the fact as your 15 study boiled down to feedwater problems, either too much or 16 too little, and the fundamental designs were not done by the 17 vender but by architect-engineers and the owners, it seems to 18 me your alignment to venders when you finally got done had 19 nothing to do with the variations that might be present in 20 feedwater systems, but that would be a, more nearly a vender 21 commonality than it would be, I mean AE commonality rather 22 than a vender one.
23 MR. SZUKIEWICZ:
The feedwater control system is 24 brought by, a lot of times by the balance of plant.
- However, 25 what we look at is the functional aspects of the impact of the
- ~_-_- ___--_- _ _ _ _ -
)
71 1
feedwater control systems, and the flows, and we did O
2 mechanistic failure and non-mechanistic failures to determine 3
first of all if maximum flow or minimum flow could cause a 4
problem.
5 Those kind of similarities, regardless of whether it 6
is a balance, an architect-engineers, one architect-engineer 7
or another one, they are very functionally similar, and we 8
suspected that the failure moles of those kind of designs 9
could be the same, meaning that you have maximum flow, minimum 10' flow, some throttled flow, and you.could probably find 11 failures in any of the AE designs that could give you similar 12 conditions, and so what we did in a lot of cases, because we 13 didn't know the specific designs, we assumed or we evaluated 14 to determine what the worst case conditions would be for 15 exceeding pressures or exceeding temperatures, or impacting on 16 other systems, and so we got around that particular issue as a 17 design.
18 CHAIRMAN EBERSOLE:
If I jump just to the boiler for 19 the moment, you were looking.at normal feedwater flow to the 20 main feedwater pumps and possibility of overfill, and we put 21 some trips on those things and then there was the high 22 pressure core injection which is a big pump, little RCIC and 23 then the whole host of depressurization pumps.
24 Did you develop a criterion that would say-if I am 25 in a normal mode, like main feedwater, I must put some sort of
(
___.__m
~
72 3
1 intercept on excessive f'eed flow which is going to turnJoff, 2
prevent the overcooling and high-level?
Have to put 3
supervision on this of a safety grade caliber or something 4
near that.
l 5
MR. SZUKIEWICZ:
Or reliable system.
l
'i 6
CHAIRMAN EBERSOLE:
But I must stand clear of the
]
7 degrading the function of the emergency systems b"y putting a 8
device that will act as an inhibitor to function which would 9
be high-level control or whatever, and therefore I will permit i
1 10 the risk to remain that if I am on emergency feedwater flow, 11 for any reason, RCIC, low pressure, after semi-automatic 1
12 relief, that under those conditions, the operator with his l
1 13 independent visual. contact with where the level is, is going 14 to have to keep it from happening.
15 Did you separate the emergenc; mode from the normal 16 mode in the context of looking at this overfill case?
i i
17 MR. SZUKIEWICZ:
We in the case of, in the case of a 18 boiler where there is commonality between sensors and 19 protection and, and controls, we evaluated the possibility of 20 a commonality of that kind, and so yes, we did address that 21 particular issue.
22 CHAIRMAN EBERSOLE:
Well, did you attempt "-
]
1 23 MR. SZUKIEWICZ:
As far as control systems go; now (O/
24 again our assumption was that as long as the protection system 25 is available--now we looked at failures, for example, rupture
-_-____m
_m
____a mm es a m
.A a a a a
A A
A
~__..
73 1
of a common sensing line, and estimated the probability when 2
we factored the consequence into our risk, but we are also 3
looking at this particular problem in more detail in another 1
4 issue called Generic Issue 101, and that focus is to-look at 5
the effect of protection systems, so in A-47, we looked at.it 6
strictly from, in terms of control systems, and Generic Issue 7
101 is expanding it now and looking at it in terms of
]
l 8
protection systems, because what we assumed was that at least 9
one channel would be available.
We felt that the loss in, you 10 know, the common cause failure, was fairly, the probability 1
11 was fairly' level.
l 12 CHAIRMAN EBERSOLE:
In a nutshell, are you going to 13 put inhibiting-type controls on emergency feedwater' supplies 14 to preclude overfill?
15 MR. SZUKIEWICZ:
Yes.
16 CHAIRMAN EBERSOLE:
So you are going to put that 17 burden on him, to. avoid overfill, that is, degrade their 18 reliability doubt?
19 MR. SZUKIEWICZ:
Of feedwater systems, yes.
20 MR. BAER:
You said inhibit.
21 CHAIRMAN EBERSOLE:
It is another way to turn off 22 the feedwater like Davis-Besse had.
They had to cross-connect 23 and they turned off the feadwater when they couldn't afford to 24 turn off the feedwater.
You add one, you know, the criticism 25 is always these crazy regulators, they are going in to do
I 74
.]
I 1
something they think is good but it is a killer.
J 2
MR. SZUKIEWICZ:
We are recommending an inhibit i
i 3
high-level feedwater trip.
j 4
CHAIRMAN EBERSOLE:
You are going to rationalize 5
degrading effects of that is not being too severe?
6 MR. SZUKIEWICZ:
Yes, and this is the reason why we 7
felt that we could not justify' putting the same inhibit on the j
8 emergency feedwater control systems as well.
j i
9 CHAIRMAN EBERSOLE:
I just, that's.what I was 10 talking about.
1 11 MR. SZUKIEWICZ:
Talking about the main feedwater.
I f
12 CHAIRMAN EBERSOLE:
No, no--on the emergency, on the r"
13 other hand, you put inhibit on the Westinghouse emergency I
14 feedwater in this paper here.
15 MR. BAER:
No, sir.
16 MR. SZUKIEWICZ:
Not at all?
17 MR. BAER:
We didn't mean to.
18 MR. SZUKIEWICZ:
We discussed it because we found 19 one of the --
20 CHAIRMAN EBERSOLE:
Maybe I read it wrong.
21 MR. SZUKIEWICZ:
We discussed it because ofLthe 22 other factors as far as risk goes, we said it was not a viable 23 option.
O
\\~/
24 CHAIRMAN EBERSOLE:
As a policy sort of thing, you 25 are not going to inhibit emergency feedwater flow with level
l 75 1
override?
O 2
MR. SZUKIEWICZ:
That's true.
3 CHAIRMAN EBERSOLE:
As a general proposition.
4 MR. SZUKIEWICZ:
That is exactly--
l 5'
CHAIRMAN EBERSOLE*
The boiler is going to have to l
)
6 survive its HBCI injection, the operator stopping it?
1 7
MR. SZUKIEWICZ:
That's right.
8 CHAIRMAN EBERSOLE:
RCIC, which is much. smaller 9
type, and~if you pump the river into it, you'have to stop'it, 10 too.
i 11 MR. SZUKIEWICZ:
That's true.
I 12 CHAIRMAN EBERSOLE:.PRR.will be in like procession.
j 1
O 1
13 MR. SZUKIEWICZ:
In BWRs this is going back'to some 14 of the operating experience, we have identified four overfill j
l 15 transients now, overfill meaning actually water going into the I
16 steam lines.
Four or five, I'm sorry; three of them were, 17 occurred in, very early during the plant life in the
]
18 seventies, very early seventies, 1970, 1971.
Subsequently, 19 they provided I believe it was commercial grade feedwater 20 overfill protection on those designs, and they had not for the,
21 last 17 years or 16, 15 years had any kind of an overfill 22 event.
23 Now that's not to say that they haven't had' 24 transients that gave you a high level, but it was not of a 25 safety concern in the sense that it did not go into the steam mam-oana mammmmomo m am mmo n eomno omaanoma oa m
l 76 1
lines.
l
/~
l
\\~T) l 2
CHAIRMAN EBERSOLE:
I wonder if maybe you ought to j
i 3
reconsider, you know, the HBCI is a big water pump.
It is on 4
a single train.
It is part of a diverse system of getting i
i
~
I 5
water in.
It is not your last chance because you have got 6
some automatic blow-down.
7 Regarding it as a fallible system, it is driven by
-i 8
turbines that don't work well, et cetera.
And driven by 9
systems that can overfill pretty rapidly.
I don't think it 10 might be a substantial degradation of the HPSI function to j
j 11 stop it.
Unless I am wrong, I think we put one on it at l
i 12 Brown's Ferry to stop it and keep it from doing that, but not 13 on RCIC and certainly on any of the post-semi-automatic --
)
i 14 MR. SZUKIEWICZ:
Yes.
A level eight is what you are l
15 referring to.
I l
16 CHAIRMAN EBERSOLE:
It is not entirely true when you 17 say HPSI is an emergency feedwater function, but you do 18 inhibit its function by high-level trip.
Am I correct?
19 MR. SZUKIEWICZ:
It is part of the protection-l 20 system, that;is correct.
21 CHAIRHAN EBERSOLE:
You don't do it for RCIC.
22 Certainly you don't do it for low pressure injection.
23 MR. SZUKIEWICZ:
Wait a minute.
I have 24 misunderstood your question; As far as the protection 25
' systems, there is a high-level trip, it is definitely on.
If
q I
i 77 1
you have a high level, you will--I think 54 inches, you will'
<:)
7 2
trip the high pressure injection and you will trip the RCIC as 1
3 well.
4 MR. MICHELSON:
Depends on the plant I think.
5 CHAIRMAN EBERSOLE:
I think we put that in there as i
1 i
6 a first step years ago.
1 l
7 MR. SZUKIEWICZ:
That was part of the protection 8
system from my perspective.
I misinterpreted your question, l
9 I thought you were talking only the non-safety grade control J
I 10 systems.
f I
11 CHAIRMAN EBERSOLE:
That was a hybrid.
You had I
12 protection system with inhibit on it.
Then you had SAR, and-
]
(:)
l 13 then below that you didn't have any overflow protection at l
14 all.
1 15 MR. SZUKIEWICZ:
In fact, this particular issue is i
i 16 being reanalyzed as part of the Generic Issue 101 to look at I
17 the effects on protection system and on mitigation because of 18 the potential of nullifying the neededtaction.
19 CHAIRMAN EBERSOLE:
After that Davis-Besse case, I 20 think the inhibitors to safety function ought to be studied as
'l 21 a set because that was a deadly thing.
They cut off all l
22 water, which is absolutely anybody -- that's not, that doesn't 23 make common sense.
/'T 1
(-)
24 MR. SZUKIEWICZ:
That's true, and in fact, because 1
25 of the transients, when we, when we looked at the transients, i
l l
i l
78 l
1 and we identified, primarily in the reg analysis we did O
2 identify that auxiliary get overfill with auxiliary feedwater 3
as well, and it was not as fast of a transient or an overfill 4
transient as the other systems and we felt that the operator 5
should be trained enough and there are procedures and he 6
should rely on manual tripping or throttling.
In fact, some 1
7 of the systems do have a throttling control now, rather than
'8 tripping because of the potential problems that we can get 9
into as requiring a system to top another at some point, then 10 to trip at some point.
It is a very hard system to design.
11 CHAIRMAN EBERSOLE:
The problem, back to the; j
12 operator, do you contemplate putting in something like the 13 warning system on semi-automatic blow-down which says in 90
\\
l 14 seconds if you don't do something, there is going to be hell l
15 to pay?
16 MR. SZUKIEWICZ:
No.
17 CHAIRMAN EBERSOLE:
You are not putting the advisory 18 notice up for the operator that he better get with it?
19 MR. SZUKIEWICZ:
This is not to re-evaluate the
)
20 protection systems.
I 21 CHAIRMAN EBERSOLE:
I kind of regard that as an 22 asset above and beyond. enunciators and bells and whistles.
23 Well, that's what they are, but if it tells him he has got a 24 limited time to take action, and rather than his usual ten 25 minutes routine, he has got to expedite.
You are not doing 1
-mm m--
--A m_-
m
______m
79 1
anything like that?
l 2
MR. SZUKIEWICZ:
Not as far as the A-47, no. It may i
3 be something that you may like to recommend and we would 4
address it, you know, we have the system to look at the 1
l 5
concerns, try to prioritize them and address them 6
correspondingly.
1 7
CHAIRMAN EBERSOLE:
It is a pretty significant thing-8 to happen.
And it might just have the same character.
I will 9
watch it.
I am going to blow down in 90 seconds.
Go ahead.
l 10 MR. SZUKIEWICZ:
I agree.
If there is a condition I
11 where your protection systems aren't available, you definitely 12 can get into trouble with control system perturbations.
13 Control systems, what we found ws.s that you do get transients 14 from control systems.
I think we all knew that before we even 15 started this, but we did not find any that could aggravate 16 conditions, what were previously analyzed.
17 MR. ANDERSON:
Moving right along now.
18 MR. MICHELSON:
You are leaving the introduction now 19
.I think.
I have a question on, a general question that is 20 introductory in nature.
21 I realize, of course, that you have not included a 22 fire in your study, and I won't argue that at the moment.
I 23 would like to point out, though, a condition that concerns me
(
little bit relating to control systems during fires, and 24 a
25 that is as an example, in case of a fire in the control room,
i a
80 1
we have been very careful to identify certain critical things O
2 like opening of relief valves that we don't want to happen so 3
we put in transfer switches at the local panels to divorce 4
those kind of functions from control room event.
5 Have we looked'at the possibility of vessel overfill 6
during a control room fire, and making sure that we have 7
transfers to interrupt the overfill of the vessel which is a 8
control function, not a protection function?
Have we taken 9
care of those kind of things?
I haven't heard it ever 10 highlighted.
11 MR. SZUKIEWICZ:
When we ran transients, we looked, 12 in a lot of cases, we assumed that after you have the 13 transient, the operator does not do anything for the first ten-14 minutes.
Now the control system automatic trips, for example, 15 if you have a control room fire, and if for some reason your 16 control system is on automatic, then it is causing an overfeed 17 of some reason or another.
At high-level, you would trip the 18 system independent from the control room.
19 MR. MICHELSON:
I thought, looking at~the various 20 places, I found thLt you didn't always trip automatically.
21 Even a couple of plants were even on manual.
Where there was i
l 22 automatic, it was single train and now I am saying that single 23 train is screwed up by the fire and it doesn't generate its 24 trip signal.
The trip signal doesn't get through to it.
25 MR. SZUKIEWICZ:
You need some other failures in
81 1
combination.
2 MR. MICHELSON:
Heating up rooms, and the solid 3
state controls in them and whatever, all kinds of interesting 4
things that could happen.
I think we have looked at safety 5
system.
We kind of looked at primary pressure boundary to 6
make sure we bottle it up and so forth.
Did we make sure we 7
didn't keep feeding into it as opposed to losing from it?
8 MR. SZUKIEWICZ:
In our regulatory analysis, in new 9
reg 1218, we discussed the likelihood of requiring different 10 levels of redundancy, and we have found that for example, on 11 the boilers, a lot of boilers now have a two out of three 12 high-level trip.
Some of them are safety grade.
13 MR. MICHELSON:
What does the high-level trip do in 14 the case of boiler in terms of feedwater?
It goes back and-15 trips the pumps.
How do I know the trip signal got through to 16 the control system in view ~of the fact if I heat up the solid 17 state panel controlling feedwater flow, it may ignore trip 18 signals coming in for all I know, depending on the failure 19 mode of the devices in the panel.
20 MR. SZUKIEWICZ:
Some of them will trip not only the 21 pumps, but shut off certain isolation valves.
22 MR. MICHELSON:
The same argument--how do, have you 23 looked at it from this viewpoint?
()
24 MR. ANDERSON:
You can postulate the fire will be, 25 that if you postulate the fire is going to be that broad in
32 1
nature, you know, it could be the end --
)
I 2
MR. MICHELSON:
The heat-up of the room is pretty 3
fast.
Thermal heat-up has all it takes to make the cabinets 4
en the opposite side of the room even start misbehaving, and 5
this is a, very likely a solid state control panel thatLis 6
controlling the feedwater.
7 MR. ANDERSON:
That wasn't' considered in this issue.
i 8
MR. MICHELSON:
And it is those kind of things I
)
1 9
think is. going to get some day a plant in real deep trouble.
10 It is not going to be all the things you thought of, the j
11 3 straightforward and hard-wired things, but rather the 12 e,'vircnmental things that are caused by fires and inadvertent 13 actuati'en of fire protection and things of this sort.
And I 14 just warted to express it as a concern because we have been l
15 awfully carefr.: to divorce the things that lose liquid from i
16 the system, but-and we have done equally making sure no more 17 good liquid tetc 2n r. hat we want to control from some local 18 panel.
I am tot sure we have looked at it that way, but 1
19 that's a quescion.
20 MR. SZUKIEWICZ:
Okay.
I 21 MR. ANDERSON:
Why don't you proceed?
22 (Slade) 23 MR. SZUKIEWICZ:
Okay.
Maybe I can speed up the 24 process here since we have talked about a lot of these things, 25 but this gives you sn overview in flow diagram.
The.both t
L---
l
83 1
laboratories conducted the review in a similar fashion.
The f'%
2 activities were basically broken up into two groups.
One 3
group conducted failure modes effects analysis study.
Another 4
group developed a plant thermal hydraulic model, and'also a 5
control systems model, so to eventually run complex 6
transients, which I show right here on this particular model.
7 The model, of course, to develop some credibility, had to, it 8
was, that was model verification performed, and in a lot of 9
cases, to see if the simulated model was, does indeed simulate 10 the actual designs that were from, a number of transients that 11 from actual experience, that were factored into the model to 12 give us confidence that our simulation was adequate.
O)
N 13 MR. MICHELSON:
I think it is reasonable to assume 14 your thermal hydraulic model also includes any return 15 considerations if they exist like in a pressurized water 16 reactor, you cool the primary too much, you return to power.
17 Is that the thermal hydraulic model?
Are you sure?
18 MR. SZUKIEWICZ:
Well, let me ask.
I don't know if 19 you heard the question, Stan.
i 20 MR. BRUSKE:
There was some level of detail in 21 kinetics in the model we used.
1 22 MR. MICHELSON:
The question is did you include l
23 neutron kinetics in your model for return to power so you know
()
24 what you are really dealing with?
25 MR. BRUSKE:
Ycu are--the neutron kinetics in the
1 84 1
model on the overcooling, what we used for criteria was the
/"T V.
2 tech spec cooldown in most cases.
We didn't--
3 MR. MICHELSON:
Didn't flood the generator out, open 4
' relief valve as a consequence and start boiling the generator 5
down and.really cool down the primary side?
6 MR. BRUSKE:
But some, I think that is one of the 1
7 transients we did. -After probably 70 or eo we stopped 8
transients and we had a problem with overcooling.
9 MR. MICHELSON:
I think you will find that gets you l
10 below the ability of the rods to hold the power, because you 11 haven't done anything about borine yet, and you better check 12 your people and see if return to power is included in the 13 calculations because I was led to believe it was not.
14 MR. BRUSKE:
Do you understand what I am saying?
I q
15 think the model was capable of doing it.
Typically we stopped 16 the analysis prior to that point.
l l
l 17 MR. MICHELSON:
Check to be sure.
I would like to i
18 get that point clarified because I get different answers from 19 different people as to whether they are, included return to l
20 power or not, r
l 21 CHAIRMAN EBERSOLE:
It suppresses the cooldown, j
1 22 MR. MICHELSON:
The mechanism is well understood.
23 The question is do our thermal hydraulic models include return l
24 to power?
And the staff told me not too long ago that it does 25 not.
l~
85 l'
HR. SZUKIEWICZ:
There are two different models that O
2 we=ran, so the other--
)
l 3
MR. MICHELSON:
Do we really know what happens?
You j
4 don't improve return to power -- I do not think it' includes i
l l
5 return to power.
So therefore, you should nave said inLthe l
i 6
report now that that's a limitation on your work because it is 7
a real, could be a serious limitation.
I just don't know, I
8 have an appreciation yet'for what these can do starting with'a 9
full generator and then opening up-the relief valves.
Had a a
10 lot of water to boil down.
It is really cool,'ought to. cool 11 the primary very well.
12 CHAIRMAN EBERSOLE:
Do you.go through especially in l
O I
13 the B&W plant the differential between the shell and tube 14 temperatures that you develop on these transients, leads to 15 compression of, stretching of the tubes, and thus enhancing 16 the possibility of tube failure in the B&W plants?
17 MR. SZUKIEWICZ:
No.
What we did was to determine 18 if you do have a, we had a criteria that if you exceeded a 19 certain rate of cooldown, by definition, that already was.a 20 problem, and then so that we identified that as a potential 21 failure mode that could give us, could give us a problem.
We 22 didn't go into it to follow up as to what happens afterward.
23 MR. MICHELSON:
One more question--in modeling this O
(_/
24 overfill of a B&W type steam generator which I asked for a 25 thermal hydraulics modeling and they promised to get back and
86 1
tell me and I haven't heard yet and it has been a long time --
0 2
and that is the B&W steam generator has kind of a funny 3
overflow situation.
You have to, think you have to get to the 4
top of the shroud to overflow, to get down to where the steam 5
line is with the generator.
And I understand, though, that 6
there is some kind of a funny little trap arrangement at the 7
bottom of that where it turns, goes out to the main steam 8
line, and there ir a trap there because there is about a foot 9
deep, 18 inches of dead space that has to be-taken into 10 account.
Otherwise -- find out.
Maybe that's the reverse l
11 flow trap as well and allows water--once you wet to that high l
12 a level of generator you don't have to get to the top of the 13 shroud to fill the steam line.
They were going to go back 14 because nobody knew how the B&W steam generators were arranged 15 as far as what happens --
16 MR. BAER:
Your question really is, is the, well, 17 all the B&W plants exempt the Oconee have a high-level trip 18 steam generator.
19 MR. SZUKIEWICZ:
They either have or committed to 20 provide.
21 MR. BAER:
Your question really is, is it set at the 22 appropriate level?
23 MR. MICHELSON:
No.
The question is do we start 24 overfilling into the steam line long before we think we 25 overtopped the shroud?
Which I think is the calculational
l 1
87' 1
basis for the amount of time you got in which to manually-2 respond if other things don't work.
3 MR. BAER:
If we are proposing that they put in an 4
automatic protection system that will shut off the feedwater i
5 pumps, at some level, to prevent filling the steam lines, 6
isn't the question is that level set appropriately?
7 MR. MICHELSON:
It is also a question, yes, it--is 8
it well below if indeed you can flow back into that trap 9
arrangement and go up the steam line without every overtopping 10 the shroud; I couldn't find anybody that knew.any of the 11 detail, but clearly there has got to be some way of entraining 12 that area.
It is a deep hole where the steam line is.
13 MR. ANDERSON:
I remember that question, but I 14 don't, I don't really remember how it was resolved.
15 MR. MICHELSON:
It never has been fed back to me 16 yet.
I am just repeating now because you people can pick up 17 and find out.
I assume that you can't back water into the 18 steam line for that group, but that's a question.
19 Then the set point, I would hope a set point on your 20 high-level trips is still below that point unless you are real l
21 confident that this reverse flow arrangement that would 22 prevent reverse flow is there.
Don't even know what it looks 23 like and nobody else knew, either.
24 MR. BAER:
We will try and find out.
25 MR. MICHELSON:
You may.be surprised and find there
88 1
is some holes that bypass the steam all the time.
I don't O
2 know.
3 MR. BAER:
We will try and get with our B&W' people, 4
It is getting kind of'far afield from the control systems.
5 MR. MICHELSON:
It is very important, though, 6
because it is exactly a part of our consideration here today 7
as to where you are going to set'the set point on the 8
overflow.
l 9
CHAIRMAN EBERSOLE:
We have got eight more slides to 10 go.
Are you going to make it?
(
11 MR. SZUKIEWICZ:
It is up to you gentlemen.
Okay.
12 Quickly, the overview then is that we identified areas of O
l' 13 concern that we wanted to focus on, specifically overfill, 14 overcool, overheat, increase in reactivity, design base 15 accidents, and transients, and we provide in the handout, in 16 fact in the new reg 1217 specific selection criteria that we 17 used to identify potentially safety significant systems.
18 We also did a data gathering search to identify all, 19 what we felt was a complete study of all control systems that 20 could, that interface with the reactor cooling system fluid, 21 and with the steam and feedwater systems, and having all these i
l 22 systems, we did a failure modes and effects analysis on a 23 system level to determine, for example, which systems 24 contributed to which areas of concern.
25 CHAIRMAN EBERSOLE:
Such system as voltage
i 89 1
controlling on DC.
(')N.
2 MR. SZUKIEWICZ:
Include support systems as well.
3 CHAIRMAN EBERSOLE:
Would include the band width of 4
AC power for controls, ten volts or whatever, and the air 5
pressures _for pneumatically operated equipment?
6 MR. SZUKIEWICZ:
If we identified--for example, the 7
primary one was not the DC supply.
It was what, how it 8
affected some, some dynamic control system.
So initially, 9
what we did was in the system level failure modes in the 10 effects analysis we didn't really look too much into'the 11 support systems.
We did that further down to identify these 12 significant failure mechanisms.
At this point what we did was 13 we found that, for example, simple case of the feedwater 14 because, and the only reason I am talking about that is two 15 reasons--one is that we identified that as a concern.
The 16 other one, it is a relatively simple system that we could 17 comprehend.
18 CHAIRMAN EBERSOLE:
Let me ask you this.
It's like 19 in the context of a forest fire.
Did you look for the match 20 that started the cascade?
21 MR. SZUKIEWICZ:
We think we did.
22 CHAIRMAN EBERSOLE:
Like it was the air being used 23 to the mineralized resins washed out of the TMI tube.
24 MR. SZUKIEWICZ:
Yes.
The looking at the match was 25 doing the FMEA on a component level.
90 1
CHAIRMAN EBERSOLE:
Went back to DC/AC pressure.
O 2
MR. SZUKIEWICZ:
First of all,'for example, we did' 3
not want to look at every single control system.
4 CHAIRMAN EBERSOLE:
Wait a minute.
You just shot 5
yourself in the foot.
6 MR. SZUKIEWICZ:
We didn't want to do the component 7
level failure modes and effects analysis on every system.
8 What we did first was to look at the system level and then to i
9 determine if these control systems had a significant impact on 10 these events of concern.
If they did, then these were termed 11 potentially significant control systems.
From from there, we i
12 developed failure scenarios to see, you know, what kind of 13 failures could aggravate and cause significant transients.
l 14 CHAIRMAM EBERSOLE:
Let me go back'to just' air 1
15 system, normally 125 pounds, at some point regulated to 16 control air pressure I believe, and in then the diaphragm 17 blows, and you have 125, you ought to have had whatever it 18 was.
That does some nasty things to the control device.
19 MR. SZUKIEWICZ:
Right.
20 CHAIRMAN EBERSOLE:
Did you pick up those?
21 MR. SZUKIEWICZ:
We-looked at the nasty control l
22 systems at the final element, and, for example, if we found 23 that in one particular transient, a closure of a pump was the 24 culprit that caused us a significant transient, then we went l
l 25 back and mechanistically go back to see what kind of control 1
i
1 93 1
system failures can occur to give me that kind of a transient.
(:)
2 Now if we found that a pump closure was not a l
1 3
significant contributor foi that particular system--
4 CHAIRMAN EBERSOLE:
What do you mean by pump 5
' closure?
l 6
MR. SZUKIEWICZ:
Stopping a pump, was not a 7
significant contributor, or opening a. valve was'not a 8
significant contributor, we didn't go back to find out what 9
kind of mechanistic failures can occur to give you this kind l
10 of a failure mode.
j
)
11 CHAIRMAN EBE'nSOLE:
You worked really backwards 12 toward support systems.
13 MR. SZUKIEWICZ:
Exactly.
Right.
I 14 CHAIRMAN EBERSOLE:
Rather than forward, you worked 15 backwards into the control system rather than forward from 16 their failure.
17 MR. SZUKIEWICZ:
Exactly.
18 MR. ANDERSON:
It is important I think that you 19 understand the first couple of blocks up there because I think l
I 20 it really explains how we approached this problem.
First, the j
21 selecting what events we are really concerned about, a lot of 22 thought went into this.
These are really the events that we 23 are concerned about, the control systems causing.
We looked 24 at as complete a list as we could'get of all the control 25 systems in the plant.
We put together a huge matrix on the l
t i
92 1
road with the events of concern and the columns with all the O
2 control systems and we looked at what control systems and 3
combinations of control systems could have any remote chance 4
of affecting that event, and then from that, selected the 5
systems and combinations of systems that we should concern-6 ourselves with for each event.
And then we went to the-7 component levels and the support systems and looked at all the
.1 8
ways that these systems or where combinations of systems 9
could, could fail, that would affect it.
10 CHAIRMAN EBERSOLE:
When you looked at all control l
11 systems, that was all control systems that we can call it 12 control systems including air devices and everything?
I I
13 MR. SZUKIEWICZ:
Support systems.
14 CHAIRMAN EBERSOLE:
Whatever, but you did not having I
1 15 identified them go necessarily to all of them and find out 16 what happens when they fail?
You only went to those through j
17 which you could obtain a connect?
18 MR. SZUKIEWICZ:
Exactly.
Yes.
19 CHAIRMAN EBERSOLE:
You didn't look at the wholesale 20 failure of every control system?
21 MR. SZUKIEWICZ:
That's right.
Sometimes what we 22 did was we, we looked at the effect of--
23 CHAIRMAN EBERSOLE:
You were event oriented and then 24 you backtracked into control system events that would start 25 that event?
93 1
MR. SZUKIEWICZ:
That is correct.
That is correct.
t")
V 2
And what we did, for example, if, well, in the case that I 3
gave you some time back, where we looked at overfill, where 4
you had the feedwater effects to cause a high-level but also a 5
number of valves, I remember the transients that we did, and 1
6 one of the reasons we decided to simultaneously fail the j
7 feedwater system and the ADS system, because we found that if j
8 we, we did this particular transient, and found that there was 9
no problem with this particular. system, then all these other 3
)
10 smaller valves that could independently fail were bounded by.
l 11 this big valve failure in effect, so that's how we tried to.
12 bound the control system failures as well.
13 MR. MICHELSON:
One of the shortcomings of what you 14 have done in picking your sample of plants, they are all of 15 somewhat early vintage, which meant that they likely did not 16 have environmental room cooling problems and so forth because 17 the approaches were different, the rooms were much bigger and 18 whatever, so they didn't--and they also did not include in i
19 most cases solid state devices for power inversion and control 20 and so forth.
21 Now when you get to the later plants, we are trying 22 to draw some conclusions from the look at these earlier 23 plants.
24 Now how did you rationalize that you could draw 25 generic conclusions in the later plants from this limited
94 1
sample of earlier plants,.none of which necessarily include l
O 2
extensive solid state control, environmental room cooling i
3 problems,'and so forth?
'j 4
MR. SZUKIEWICZ:
I guess you are not going to let me i
5 finish all these slides, so let me--
6 MR. MICHELSON:
Let's go on to the one that answers l
7 the question.
)
I 8
MR. SZUKIEWCIZ:
I'm sorry?
9 MR. MICHELSON:
Let's just go on to the one that
)
10 answers the question.
11 (Slide) 1 12 MR. SZUKIEWICZ:
This is in a handout.
It is the j
13 generic applicability.
What we, once we identified a number 14 of potentially significant failures, and transients, we had 1
'j 15 some overpressure transients, overfill transients, overheat 16 transients, and I think two transients on a Westinghouse 17 design that we felt could potentially impact safety as a 18 result of a steam generator tube rupture.
What we did then 19 was on those particular transients, we have looked, we looked i
20 at the thermal hydraulics of the plants, and we also looke' at 21 the kind of control systems the plants had, and if we could I
22 conclude that the major--
I I
23 MR. MICHELSON:
You look at control systems 1
4
\\
24 controlling high-level trip and so forth?
25 MR. SZUKIEWICZ:
I'm sorry?
l
y I
95 l
1 MR. MICHELSON:
You looked, what did you mean you e
2 looked at control systems?
I think you looked at-the ones 3
that tripped the reactor, tripped the flows on high-level.
l 4
MR. SZUKIEWICZ:
Exactly.
5 MR. MICHELSON:
But not necessarily what I am
'l 6
talking about, back over on the inverters and so forth, the J
t 7
power supplies that might have got you into the transient to-t 8
begin with.
I l
9 MR. SZUKIEWICZ:
That's right, because what we found 10 out, for example, in the overfill protection, that as long as i
11 the transients that we ran, as long as you had a trip on 12 feedwater, on a high-level on feedwater, regardless of what Q
l N/
13 other failures occurred, if you tripped the feedwater, you can l
14 mitigate the overfill event.
l 15 MR. MICHELSON:
But perhaps the device that trips 1
1 16 the control cabinet that is performing this function, that got
)
l 17 you into the problem to begin with because the room was l
I 18 heating up, before you ever got to the trip point, of course, l
l 19 if you reached trip point, the instruments say shut me down, 20 but the control cabinet is already overheated and ignores the i
21 instruments.
i l
22 MR. SZUKIEWICZ:
That's a different issue.
)
l 23 MR. MICHELSON:
That is the control system 24 interaction.
25 MR. BAER:
The assumption was the protection system
96 1
is still functional.
We didn't expand--
1 2
MR. MICHELSON:
This is control now.
We are talking I
I 3
about high-level trips circuitry.
4 MR. BAER:
We are saying we want a protection.
5 MR MICHELSON:
I am talking about what is there l
l 6
today before you implement your resolution because your 7
resolution didn't say safety grade and so forth in many cases, l
8 and therefore I don't assure that I have got environmental 9
protection of the cabinetry and whatever, so I just wondered,
]
l 10 though, did you go back and look that way to postulate, for l
I 11 instance, that your room cooler failed, your control cabinet 12 heated up, valves wide open on the feedwater, and when the O
13 trip signal came into the cabinet, because it was a non-safety 14 trip signal, the cabinet just ignored it and kept on feeding 15 water in, all because the room cooler in the room quit?
16 CHAIRMAN EBERSOLE:
I think he is pointing out the 17 problem with the folks who are doing A-17.
18 MR. MICHELSON:
You didn't see this in the earlier 19 plants because I don't think you had that situation.
20 MR. SZUKIEWICZ:
I mean to get an overfeed you need 21 a certain number of things to occur, and what we did was we 22 postulated first of all, a failure of some or all of a control 23 system failure event where you would have an overfeed event.
24 MR. MICHELSON:
Power supply in the cabinet' failed.
25 Hold the valve wide open in most cases.
i l
l
-4
.J t
97 1
MR. SZUKIEWICZ:
Then what we did was'the other C) l 2
failure was the operator would not mitigate your transient in 3
time, which is a fairly high probability.
We assumed a fairly 4
high probability.
And then--
5 MR. BAER:
Probability that he would not.
6 MR..SZUKIEWICZ:
That's right.
Then if you do have 7
some additional failures because you happen to have a fire in 8
the control room, or some place in a cable spreading room--
9 MR. MICHELSON:
Room cooler quit, no big deal.
10 That's the initiating event in fact, which caused the power 11 supply to burn out, which caused the valves to go wide open, i
12 which also caused the loss of the ability to trip.
I 13 MR. SZUKIEWICZ:
All these things just don't happen 14 like this.
There is a certain amount of time.
15 MR. MICHELSON:
Room coolers, you have got plenty of 16 history on those.
That is not an iincredible event.
17 MR. PATTERSON:
Assuming these cabinets have cooling 18 fans, you don't always know the darn fan has stopped working.
19 MR. MICHELSON:
That may be all that it takes.
20 CHAIRMAN EBERSOLE:
For years we have been trying to 21 get particular, Combustion Engineering to recognize that the 22 consoles and cubicles, in-house solid state equipment are in 23 excessive temperature and therefore safe action should be 24 invoked before they become inoperable.
We have been l
25 unsuccessful, and I was sort of hoping maybe you all might be 1
b
t 98 1
successful to say I want among other things environmental 2
cutoff of malfunctions.
You follow me?
It is a=very easy
'3 thing to get selective, collective signal that says I am about 4
to go crazy and my protective auxiliary a.t my side here'may go i
5 crazy witc me if it is in the same box.
6-MR. MICHELSON:
My only point was, though, that for 7
the plants you looked at you probably didn't run into this l
l l
8 situation.
It is still a real potential situation, and it
]
l 9
ought to really be looked at as a part of this as a special j
l i
10 case or something.
Somehow you ought to decide that your 1
11 selected four sample was weak in some areas, try to identify-j 12 where it really was weak, and maybe do some supplemental work i
f'\\
13 in those areas.
I 14 CHAIRMAN EBERSOLE:
I think it is really astonishing.
15 that we don't have ambient protection of our control systems
]
16 and their associated protective arms against the common 17 influence of over-temperature as we go into solid state i
i 18 design.
Surely we can easily do that with just thermocouple.
j 19 The fact we are going dead slowly and take emergency and i
20 anticipatory action which we are not taking may be also l
l 21 applicable to this overfeed, or for that matter loss of feed.
l 22 MR. SZUKIEWICZ:
I thought a lot of the designs did l
23 have an alarm system of some sort to indicate that cooling l
l 24 systems were not there.
4 i
i 25 CHAIRMAN EBERSOLE:
Not to my knowledge; you can go-I I
l
l 99 1
1 there, throw a drop cloth over these things and put them out
(
2 of business.
Suppose nobody let's the painter in?
Bu't 3
anyway -- well, go ahead.
We are running--by the way, are you 4
coming to a point where we can have a ten-minute break?
5 MR. SZUKIEWICZ:
I can--right now I am all'over the 6
place, so.we could.
7 CHAIRMAN EBERSOLE:
.Let's have a ten-minute break i
8 until five after.
Then I am going to suggest we put 9
Demetrious up here and let him fire his speech at us and that
~
10 will give you thirty minutes later to finish.
Ha is on the 11 schedule here at 11:00.
j l
12 MR. SZUKIEWICZ:
Sure.
C'/T 1
13 CHAIRMAN EBERSOLE:
Ten minutes.
We will be back at 14 five after eleven.
15 (A brief recess was taken.)
16 CHAIRMAN EBERSOLE:
We are going to reconvene the 17 meeting.
I am purposely putting Mr. Basdekas up here.
Demi j
18 now is as hard to turn.off as I am.
I am going to warn you 19 you have got thirty minutes.
You have got half an hour to 20 speak your piece, and then we--in fact, it will be 21 advantageous to continue the residual part of your program 22 after we are done here because you will have the benefit of 23 what Mr. Basdekas wants to say personally.
You have got it 24 until then, okay?
Watch it.
25 MR. BASDEKAS:
Okay.
Thank you,;Mr. Chairman.
My 1
l 100 1
name is Demetrious Basdekas.
I am with the Office of'Research O
2 and I-am here to say nothing new as'far as I am concerned, and 3
probably'to some large degree, this committee or. subcommittee l
4-is concerned, but nonetheless, since the Chairman suggested or 5
requested or directed as the case may be, to bring these 1
6 issues here and try to discuss them within the charter of the 7
ACRS, I think this was the appropriate thing to respond.
8 I did prepare a memorandum which I believe'you do 9
have.
It is addressed to Dr. Kerr, Chairman of the ACRS, i
10 dated August 14, 1987.
I did not have, I have not prepared a j
11 presentation just for this meeting because I believe it was 12 not necessary.
The best concerns that I do have and have had 6O 13 for sometime are contained in this memorandum I cited, and I 14 certainly will be glad to answer questions you may have 15 regarding the points I make there.
16 I wish to draw your attention to some of the 17 references, but there are fourteen of them.
They are not 18 extensive.
I notice your disinclination to go through 19 references, but I think that the majority of them, if not all 20 of them, are available to the Committee.
Some of it has been 21 generated by the Committee, and it may be instructive to 22 refresh your memory by looking at them either selectively or 23 collectively.
24 I heard the part of the presentation, and I have 25
.certain points that I agree with, what was said, and certain
I 101 1
points that I have some difficulty with.
2 One thing that I agree is that this issue has been 3
long enough in the, you know, resolution stage, whatever that 4
means, and I think it is about time to, to get it out and let l
5 some light come in.
I think that in itself will be useful, l
6 but I think as Bob Baer pointed out, there are some things 7
that have been identified, need acrention, need correction.
8 Might as well have them get this done, and then depending on 9
what additional needs can be identified or accepted as valid 10 needs, then we can go from there.
11 However, at the same time, I totally agree with Mr.
12 Michelson's statement that to qualify this report, is 13 something that needs either partial or change the title or 14 whatever here.
My inclination will be to not to lose sight of 15 the rather large extent of the issue in order of its 16 importance to leave this alone and call this a report, the 17 progress report, but this is something that I suppose the 18 staff will ultimately decide.
19 Now I believe the basic malady this issue has 20 suffered from along with a number of similar issues is the 21 fact I alluded to earlier when I felt I should make a comment 22 at that time, namely, that it is a basic staff position which 23 you know I have great difficulty with, to say that control
()
24 system malfunctions will be taken care of by auxiliary safety 25 systems or put it a different way, the envelope is fool-proof HERITAGE REPORTING CORPORATION -- (202)628-4888
k 102 i
1 or no holes, nothing there that will dri'e the plant outside v
2 that because of control system: malfunctions, and I don't 3
believe this is the case.
I think it is self-evident that l
4 this is not the case.
i 5
Then the question you may ask, why are we doing 6
this?
Why spend all this money?
The reason for that is there 1
7 are two, at least, two.
One is that even if the staff says 8
it, don't believe it.
That's one, and B is to shut up some 9
members of Congress that were working on it who are doing 10 something about i t -.
11 Well, whether or not the reasons are good or bad, 12 the fact is we are doing something, spend some money doing it, 13 we want to do it right.
One of the problems we have suffered 14 during the progress of this program was the unavailability of 15 needed information about how the plants were designed,.what 16 the procedures for these plants were, during normal and 17 abnormal operation, and without having this information 18 available to make some sense, we have to resort to assumptions 19 of one sort or another, a lot of wishful thinking inevitably 20 into these assumptions, and therefore, in this process for 21 going through under the constant pressure of having to meet 22 schedules, which I am not saying we should not present about i
23 schedules, but not make it great consideration in all of this.
A
(~)
24 The program has seen some difficulties, and I think the staff 25 and the contractors that have worked on this have tried to do
103' 1
their best.
They ought to.be commended.
2 However, I think there is some more' basic, basic I L.
3 think policy question here that the staff, management of the l
l 4
Commission for that matter must address, and face and do 5
something about before we.can expect a, a reasonable-6 resolution of these type of issues.
7 The basic thrust of this I guess invitation to me to 8
come down here stemmed from the fact that, concerns that l
9 relate to A-47, A-17 and A-49 which are very closely related 10 issues and all of them important legally, have a bearing, and l
11 a very direct, substantial bearing on the reassessment of B&W-i 12 plants, and you see in the memorandum that I prepared for Dr.
13 Kerr, and your benefit, I presume you all have copies of it, I 14 am trying to set the stage for making the. connection between 15 these three issues, among other things, but primarily these 16 issues and the B&W reassessment.
I understand that the 17 Committee decided to consider this in three parts, A-47, A-17 i
18 and 49 separately, and then the B&W separately, and then put 19 the thing together and report it to the full committee and go 20 from there.
I don't intend to go on a detailed point by point 21 debate here.
Some of you may recall several years ago we had 22 some interesting donnybrooks taking place in this room, but I 23 think time and environments-have taken their toll, so I'm 6'
24 basically tired of going over the same things over and over 25 again.
I may be tired.
I'm not dead.
As a matter of fact, I i
MERV@An2 BM96BWVMc en89&BAWVWM
- 969tS9@m482@
m-
104 q
1 am trying to postpone the inevitable, you know, event, so I am O
2 trying to optimize, you know, my contributions here, and-as j
~3 long as the Committee, this Committee, and I know this issue 4
and many others, you do ask some very good questions, some 5
strong questions, some valid questions, but.for some reason, l
i 6
as a rule, not always, but as a rule, when you go out with a 7
letter to the Commission or to the Congress for that matter, 8
you sound like pussycats.
I can understand some of that, but 9
not all after it, so I think you shouldn't be bashful, you j
10 shouldn't be bashful to state what your statements mean.
That 11 is a valid concerns, very important concerns, okay.
J 12 I am not here, I am not here to tell you what to do t
O 13 or what not to do, but I can make a point of suggesting as to 14 what is needed here because the Commission needs to get some 15 explicit, for instance, if you agree, I have a hunch you do, 16 that the staff position is not a valid one, namely, all 17 control system malfunctions will be taken care of by actions 18 of the safety systems.
Well, by golly, say so, so the staff 19 can explain to them once more perhaps and I hope with as much 20 success as in the past of what they are talking about.
Okay?
)
l 21 And furthermore, this is something that does not j
22 concern this Committee directly, but I should say, for the 23 record, for whatever it is worth, that for as long as the
)
24 Commission, for as long as the Commission does not have 25 impediments that promote free and uninhibitive exchange of l
1 1
1 105 1
technical views within the staff, whether in open or closed O
2 sessions, I think we are going to continue to have problems.
~
3 Now if you have any questions, Mr. Chairman, and 4
members, to the points I am making in this document, this I j
5 prepared for this routine, addressed to Dr.'Kerr, I will be 6
glad to.try to answer them the best I can.
7 MR. MICHELSON:
I have got one small question.
You 8
didn't mention A-46 in the discussion.
Any particular reason 9
why?
10 MR. BASDEKAS:
Well, I made the one related to the 1
11 lack of consideration of seismic effects or other contributor 12 to failure, environmental, seismic, floods, fires.
13 MR. MICHELSON:
A-46 was supposed to address those.
14 MR. BASDEKAS:
But it.does not.
15 MR. MICHELSON:
That has already been pointed'out I 16 guess maybe in pussycat fashion.
I don't know, but we l
17 certainly pointed out that, you know,-it tC es--even a j
18 simple-minded approach to it would at least check to see what i
19 happens to the water when the tank falls over, and where it 20 might go and possibly interact with safety-related equipment, 21 and we didn't even win that battle.
That's about as 22 simple-minded as you can get, so I don't know whether it pays 23 to--we said it adequately.
24 MR. BAER:
We are going to'look at.that in A-17 or 25 plan to.in the flooding context without being--
]
l 1
)
106 1
MR. MICHELSON:
These guys are walking up and down
'%)
2 and ignoring it and you have to go back and walk up and down 3
again.
Then when you get a resolution of A-17 if it is 4
decided it was important, then you are going to go back for 5
yet another walk-down.
The agency can't keep--
6 MR. WYLIE:
Is that the end?
Maybe they can nail it 7
down for us.
8 MR. ANDERSON:
I guess I don't agree A-46 hasn't 9
taken care of the seismic issue.
10 MR. MICHELSON:
The water was the question. -When 11 the tank falls over, they are only looking at physical 12 interaction, not water --
l 13 MR. ANDERSON:
That's true.
The intent is to look 14 at the physical interaction.
That's true.
I think, as I 15 think we pointed out or a point that we may when they had this 16 recent discussion on A-46, that if we ensure the structural 17 integrity of the tanks in that region, that's pretty well all la we can do to ensure the flooding.
19 MR. MICHELSON:
Make sure'they don't fall over.
But 20 the analysis says only you have to look if the tank can fall 21 over and physically impact, then you anchor.
If it doesn't 22 physically impact, you don't anchor.
Then the water runs 23 across the floor and gets in the inverter.
24 MR. ANDERSON:
That's right.
That doesn't say we 25 are not concerned about it.
107 l
1 MR. MICHELSON:
We are not doing it by regulation at l
2 least.
It was not a part of the requirement.
3 MR. ANDERSON:
Not in A-46; the flooding requirement 4
is a part of A-17, however.
5 MR. MICHELSON:
Yes, and we will try it all over
'i 1
6 again when we get_to it.
J l
7 MR. BASDEKAS:
I think your point is well taken.
8 There are a couple.
A-46 is somewhat limited, certainly j
9 addresses seismic-related issue, some of them.
l 10 MR. MICHELSON:
A-47 is in the same category.
It is 11 somewhat limited, and now we have to,_it_would be nice at 12 least to indicate how you are going to handle the part that I~h
{
V-13 you didn't handle by A-47, indicate where it will be handled i
14 or how it will be handled.
There is no discussion or 15 indication that I could find as to how we are handling the 16 residual.
17 Now you might argue it is an insignificant or not j
18 safety significant residual.
Fine.
If you can establish l
19 that, that's even better.
Then you can ignore it.
It has not 20 been identified or established.
21 CHAIRMAN EBERSOLE:
The thing that is missing from 22 this is the same statement, that I referred to it earlier as a-l l
23 deposition.
It is a statement which you have to stand behind 24 and be guilty of being right or wrong or--it is, in other 1
1 1
25 words, it is a position on'these, on these black holes that-
108 1
are not here.
I don't see this.
I mean it is analogous to A)
- '~
2 the old question you used to give licensees is there anything.
3 you haven't told me that you would, that you should_tell me 4
that you know about?
And that puts the hammer on it, and I 5
think we need to put it here.
I was going to ask --
6 MR. MICHELSON:
There are some questions on the 1
i 7
actual resolution of A-47.
Are we going back to it now?
We 8
never--you discussed your process.
You never discussed your 9
answer.
10 CHAIRMAN EBERSOLE:
At 1:35 we are going to go back 11 and let him finish up to the formal limit.
We will sit here 12 and listen to the planes take off or whatever.
13 MR. WYLIE:
We could take, I would like to hear Mr.
l 14 Basdekas' comments on these points he raised in his letter to 15 Kerr.
If we started off with one A bullet, you know, and it 16 says the assumption in this particular, in resolution of A-47, 17 that all requirements of bulletin 7927, reg 0737, were assumed j
18 to be implemented, and I think I heard that again this 19 morning, that that was a premise on which they based their 20 analysis, and it was based on that those particular plants you 21 are looking at, you assumed that these things had been done, 22 in your analysis, and that the staff would follow through to 23 see that these things were implemented on all plants
(
24 eventually.
25 Now you say the staff has identified that this is l
l i
109 1
not the case.
Would you like to expand on that a little bit?
2
<MR.
BASDEKAS:
Well, even as this process was going l
3 on, reviewing the four plants we have chosen for A-47, and 4
subsequently, by subsequently 1I mean after the Rancho.Seco and 5
Davis-Besse events, as the staff was going through reviewing 6
the systems that were involved in those events, they were 7
determining it and I believe they reported to this 8
Committee--I was here.
That's where I haard it, as a matter 9
of fact, right here,-in this room, 10 MR. WYLIE:
They had not been as of that time.
j l
11 MR. BASDEKAS:
That is correct.
This report was
]
i 12 written up --
13 MR. WYLIE:
For this particular resolution, it is 14 assumed that on a schedule they will be.
Is that not correct?
15 MR. BASDEKAS:
Okay.
I cannot speak for them.
i j
16 MR. WYLIE:
I am talking about the, talking about 1
17 item one on the, regarding the requirements of the bulletin 18 7927 and new reg 0737, that those requirements will be 19 implemented to the satisfaction of the staff eventually.
Is 20 that correct?
I mean that's the way I understand what you l
l 21 said, that was a premise on the basis of the resolution.
I a
22 MR. ANDERSON:
Yes.
23 MR. BAER:
And the staff has looked, we have had a 24 number of discussions within the staff on the relationship 25 between 7927 and A-46, A-47 rather, and I guess I have to make
l l
110 1
a couple of comments.
(~)
2 One, the regions did go cut and inspect all the
'j 3
plants.
Now it is an audit inspection and the regional 4
inspectors were satisfied on the B&W plants, they have that 5
documented, that they were satisfied with the implementation, 6
but it is an audit inspection like everything.else the staff l
7 does.
j 4
8 The owners group is apparently committed to 9
relooking at that issue under the B&W on, that. issue on the 10 B&W plants.
11 But there is a philosophical. problem, and I don't I
12 think it is appropriate to come out with new requirements to j
(~
1 13 implement old requirements.
I think if there is an existing
)
i 14 requirement, the staff has mechanisms and they use them and I l
15 think they are going to be using them more, that more of these l
16 team-type inspections to make sure the licensees haN e i
17 implemented the existing requirements.
18 My own personal feeling is that this is the way to 4
19 handle it and not to try and come out with yet another 20 requirement that you still have the same problem of licensee 21 implementation, and that's speaking for myself, and I think my 22 observation is that CRGR and the EDO that has to approve new l
23 requirements, have the same feeling.
You know, even if my 24 views, even if my views were different, I don't think that we 25 could get_through the system a new re irement whose purpose Ammm w+m m
i 111 1
it was to go really make the licensee go back and do.an old o
2 requirement separate from inspection and enforcement.
i 3
MR. ANDERSON:
.That has been demonstrated, too, and 4
that's really the reason that some of these other issues have 5
been limited in scope, because we have initially proposed that 6
we go.do something that was allegedly done before, and we are 7
told, no, you-can't go back and make them do the same-things 8
twice.
Either they are, did it right or they didn't, so--
9 MR, WYLIE:
If you had a requirement initially, why 10 do you have to go back?
11 MR. ANDERSON:
Well, we shouldn't have to go back, D
12 but you know, the questions continually arise like the fire 13 protection issue, what happens with inadvertent actuation of 14 fire protection or what happens if you get a fire in the room?
l 15 Fire protection should have taken care of that.
We shouldn't 16 have to be required to rework the fire protection issue as l'
17 part of A-47 or any other issue.
As a matter of fact, we are 18 not allowed to.
]
19 MR. WYLIE:
A-17 I assume is going to address the i
20 interactions of inadequate operation of fire protection?
21 MR. MICHELSON:
I would hope so because Appendix R 22 didn't address it.
23 MR. ANDERSON:
Only in the sense of flooding, that 24 is correct.
25 MR. BAER:
Or water intrusion.
112 1
MR. WYLIE:
Not CO 2 dousing of control system?
DU 2
CHAIRMAN EBERSOLE:
In that first bullet that you 1
3 are picking up, is it the staff agrees that this, that it was-4 not the case that these requirements of these-bulletins has 5
been implemented, but that they will be implemented sooner or 6
later by --
7 MR. BAER:
I think all the licensees have 8
implemented the 27, and inspectors have gone out and checked 1
9 on it on some' sort of an audit basis.
i 10 CHAIRMAN EBERSOLE:
What about 737?
)
11 MR. MICHELSON:
0737.
12 MR. BAER:
Those are the TMI requirements.
Yes.
l O'
)
13 When I was in INE there was a huge tracking system, and as of, 14 oh, eight months ago, six months ago when we were we
.J 15 organized, there was about 95 percent implementation.
16 CHAIRMAN EBERSOLE:
You would argue that the staff 17 has determined that this is the case, that these have been l
18 implemented or at least you are at the tail end of that 19 implementation process?
20 MR. BAER:
This is my impression.
21 CHAIRMAN EBERSOLE:
There is a clean-up in progress.
22 MR. MICHELSON:
The word adequately wasn't inserted 23 in your comment.
That's the reason--wasn't it?
It was not 24 even in Rancho Seco that earlier, you know, they implemented 25 the previous requirements, they found out they hadn't done it
113 4
1 adequately.
And now we think they have implemented them
/
2 again, but this time we really are sure it is adequate as 3
well, what they have done.
'I 4
MR. BAER:
The inspections, having worked both in 5
NRR and INE, and now in Research, I.will make an observation 6
that NRR, talked to people at NRR and they realize that their.
l 7
reviews are audit reviews dealing largely with criteria, but l
8 yet when I was in INE I get a call from the region, one of my q
i l
9 branch's functions was to help out the regions and they 1
10 thought that boy, somewhere in NRR there is a reviewer that 11 knew the detailed design of every pump and every valve, and 12 that simply isn't the case.
13 Conversely or the corollary really is that there is 1
14 only a couple of residents at each plant, and now plants have 15 staffs of four, five hundred people.
Those residents.try and 16 they work very hard, but they are obviously not watching 17 everything that is done by four or five hundred people, and so 18 the inspections for 79 are, 7937 and for the TMI action items 19 are limited to audits.
People look at a few things, and come l
20 to a conclusion.
If they look at a few things, and decide 21 that they look all right, chances are they don't broaden the 22 inspection.
If they see some problem, then it tends to get 23 broader.
l
)
24 MR. MICHELSON:
You can't expect a resident 25 inspector to do what I would call a technical review, either.
1
i l
I 114 1
MR. BAER:
Thac's true.
O 2
MR. MICHELSON:
He is limited in his various 3
disciplines that he is.somewhat competent in and'he more or l
4 less assures that somebody had looked at it in the utility and I
5 they assure that the, whatever they decided was implemented, 6
but.he can't go and do a technical review of the adequacy of 7
what they did.
8 CHAIRMAN EBERSOLE:
It comes out in the middle k
9 someplace, doesn't it?
A lot of.them are being picked up.
1 I
10 Some are not.
It is not a clean sweep by any means.
1 11 MR. BASDEKAS:
And the specific example that I think j
j 12 Mr. Michelson referred *o is a very good one where after the 13 Rancho Seco and Davis-Besse, lots of items cited here in 737 l
14 either were not implemented or implemented wrong.
Give you an l
15 example, let me give you an example of a fix, Okay?
16 Seventy-nine went out to provide back-up power supplies for 17 ICS.
When you lose power of one power supply, you don't lose 18 the entire ICS.
So we are going to fix it; 7927'went 19 out--Andy is shaking his head.
He will have a chance to tell 20 his story.
What they did, they put provisions, and I am 21 addressing this under the section B of my letter where I have 22 the B&W reassessment, okay?
23 CHAIRMAN EBERSOLE:
Yes.
24 MR. BASDEKAS:
They took, it is my understanding, 25 that they took the buses from where ICS loads were. supplied
115 l
l 1
from and they put them into the multi-transfer function, 2
without any design provision to avoid transferring of faults 3
from one bus to the other, so when the voltage drops because 4
of a fault say in bus A, that power ICS loads, it transfers 5
them to another bus.
So you have a fault, you detect it, then 6
your transfer the fault from one bus to the other, and who 7
knows to what extent that's a fix?
8 CHAIRMAN EBERSOLE:
Didn't they put interposing 9
device that says we won't transfer under fault conditions?
l 10 MR. BASDEKAS:
No.
Automatic transfer did not take 11 place because of the fault.
It did not work.
You have got to 12 rely on fixes that they should not work.
I am having a little
("'/
i s-13 problem with this logic.
14 CHAIRMAN EBERSOLE:
You run straight into the creed 15 we have of not, of the instruction not being prescriptive 16 which would preclude that sort of thing.
l 17 MR. BASDEKAS:
I am hearing you, okay.
I am glad.
18 CHAIRMAN EBERSOLE:
I don't believe in being less l
19 prescriptive, advocate of prescriptiveness.
l l
l 20 MR. BASDEKAS:
I am just stating a fact.
Whether or 21 not this can be --
22 CHAIRMAN EBERSOLE:
What is the staff's defense 23 against that argument, they issue such generalized O
l
\\./
24 instructions, the interpretation of the vender or owner l
25 operator can be so broad as to he can just really screw up.
116 1
GDC-19 is a case in point which has led to all these new O
2 auxiliary control. rooms.
3 MR. BASDEKAS:
That goes to the next item.
4 MR. BAER:
The bulletins are usually pretty 5
specific.
6 CHAIRMAN EBERSOLE:
Here was a loophole apparently.
7 MR. SZUKIEWICZ:
Whac they had to do was look at 8
every single bus, and to look at what is on the bus and 9
address what happens if you lose power to that bus.
10 CHAIRMAN EBERSOLE:
They transferred into a fault I l
11 understand.
12 MR. SZUKIEWICZ:
I am not familiar with all the 13 details.
{
l 14 MR. BASDEKAS:
One fault from bus A, B and C--who 15 knows what instead of losing one bus and having to cope with 16 this, you may lose two or more.
17 CHAIRMAN EBERSOLE:
The golden rule of transfers is 1
1 18 you don't transfer faults.
I 19 MR. BASDEKAS:
That is correct.
20 CHAIRMAN EBERSOLE:
That's a good generic i
21 simple-minded requirement.
You don't transfer faults.
You l
i 22 detect faults.
Then you don't transfer.
You live with l
23 whatever you have got.
Isn't there a rule in-the book that A)
(-
24 says you don't do that?
That's not a prescriptive rule.
25
'Jhat 's-a general rule.
I mmmm-_ _- _____-__ _________.
117 1
MR. WYLIE:
How many s.mes does this happen?
J 2
MR. BASDEKAS:
I don't know, frankly.
3 MR. WYLIE:
Has it happened?
4 MR. BASDEKAS:
One time I know they, one.of the 5
subcontractors we had was involved in a site at one plant, and 6
a fault did happen.
Automatic transfer did not take place 7
because the system did not work.
8 MR. WYLIE:
Protective devices didn't isolate the 9
fault?
There are protective devices on every circuit.
10 MR. BASDEKAS:
It has been some time.
I am not sure 11 about the details of what happened actually.
12 MR. WYLIE:
You know, the real problem was the fact 13 you didn't have a back-up power supply, and that was what was 14 addressed.
Then they use automatic transfers to alternate 15 power supply.
16 CHAIRMAN EBERSOLE:
If they had a back-up and 17 transferred a fault into it, it would be dead, too.
18 MR. WYLIE:
You put in protective devices on every 19 branch circuit.
20 CHAIRMAN EBERSOLE:
You intercept bad transfers.
21 MR. WYLIE:
That is why you put in fuses.
22 CHAIRMAN EBERSOLE:
Right.
23 MR. WYLIE:
To isolate.a fault.
(
24 CHAIRMAN EBERSOLE:
We walked into some of these 25 things it looks to me full face.
I couldn't believe that B&W l
118 1
didn't have some provision for consequences when the. power i
O 2
supply failed.
3 MR. WYLIE:
That's a detail.
4 MR. BASDEKAS:
I am guilty of what I said I will not 5
do.
I will not get into the details, but there is no chance 6
we are going to finish on time.
I want to make some general' 7
points, not general in the sense, you know, of trying to, of 8
what I am saying here, not emphasize but bring them out.
9 CHAIRMAN EBERSOLE:
We won't have time to run 10 through each point you made, but I am going to say this--we 11 have an hour and a half at the full committee meeting, and I n
12 am going to expect the staff to come in and have at least some 13 observation made against the bullets that you put in here in a 14 dafensive mode, okay?
Whatever it is, even to say no comment.
l 15 I don't know any way of escaping that some sort of answer to 16 the bullets that you put in here.
They are. good questions.
17 The turbine trip to me is an example, is an example 18 of the matter of a stuck bypass, when the mode switch ir in 19 the wrong position and you don't have any way of closing the 20 main steam operations valves.
I have a horror of thinking of 21 SCRAM reactor looking at this vacuum through the main steam 22 lines and so I hope you are going to tell me it is not going 23 to be a prolonged event.when that happens.
24 MR. SZUKIEWICZ:
In that particular one, we 25 identified that concern and it is in the reference letter for
119 1
the CRGR package.
We basically stated that yes,.We did not O
2 look at it, and if we did need to look at it, then the basis 3
should be provided.
We are going to send this through the 4
office to prioritize it and then we will look at it, but we 5
have discussed this quite often, and we wanted to identify 6
what the concern is and specifically what the failure 7
scenarios were.
I 8
CHAIRMAN EBERSOLE:
This is called the break.
i 9
MR. SZUKIEWICZ:
7f there is some money in it, we 10 will be glad to run it and we admitted to that.
11 CHAIRMAN EBERSOLE:
One of the. interesting things, 12 they didn't develop containment pressure because it is a two-13 line break.
14 MR. BAER:
Could you describe that?
15 CHAIRMAN EBERSOLE:
I have got an open steam line 16 into this condenser from the boiler, and I haven't got the 17 intelligence to close the main steam isolation valves.
18 Because the mode switch is in the wrong position, you have got 19 to have lower pressure on the main steam lines to get started.
20 Most the GE plants have mode switch.
I understand other 21 okabts don't have it.
If you transfer to start-up position 22 you are not going to detect the lower pressure used to strip 23 the NSIVs and you are looking at 29-inch vacuum right off the 24 top of the filter, and then you have a tremendous discharge 25 through the system limited only by orifaces in the steam l
neavence seanaevue enemaanevam --.a969tses eaes
120 i
.]
1 lines, and the capacity of the bypass valves.
In essence it O
2 is a two line.
What it does is avoid triggering the makeup i
3 systems because there is no containment pressure.
It is the
)
4 through line loca.
With me?
I 5
MR. BAER:
I am with you.
And obviously that mode 6
switch--
4 7
CHAIRMAN EBERSOLE:
Is kind of a focal point of the 8
problems I think.
It is like the old mode switches you used l
9 to transfer to higher range on nuclear trip.
When you saw you 10 were coming up out of lower power period but it was too fast,
)
11 you transfer into it and whistle through the high-level. trip 12 without it, beino able to stop it.
So you had to put time i
O j
13 delays on the mode switch.
I don't know whether you all have 14 looked at this or not, but it is a variation on the stream 15 without turbine trip.
It may be worse, Demitrious.
1 16 MR. BASDEKAS:
We have not looked at it, Jesse.
17 All of this, all of these gaps, the holes, whatever, flow from I
18 the basic parameters I stated earlier that I believe, that I I
19 believe this Committee should take issue wit.1, namely, control 20 functions taken care of.by safety systems, that is not true.
21 MR. REED:
I haven't had a thing to say.
I have 22 been overwhelmed by all the conversation I think.
I would 23 like to try to find out because I have' read down these items 24 that Mr. Basdekas has listed, like to try to find out under 25 item 2 on page 3, where he says that under certain conditions HERITAGE R3PORTZMG CORPORATION -- (2029628-4888_
121 I
1 of local cooling transient, may be returned to criticality.-
(
2 You are talking overcooling.
When you are talking 3
overcooling, what you are doing is getting mascive shrinkage 4
on the primary side, and krobably the pressurizer would go 5
empty.
6 Now the means that I would expect for refilling to 7
get to the water level that you talk about, would be a 8
refilling with borine water.
And therefore, are you saying l
9 that you have analyzed the fact and you find it borine water s
10 will not--
l 11 MR. BASDEKAS:
I have not analyzed it.
I have
)
i 12 determined that the staff does not have the capability to j
13 analyze it, and I suggest we do get capability and analyze it.
1 1
14 MR. REED:
I would think that is fundamental.
I 15 MR. BASDEKAS:
It is.
l 16 MR. REED:
I have the feeling that you would find 17 yourself sub-critical with the one rod out.
l 18 CHAIRMAN EBERSOLE:
Before you get the highly l
l 19 borated water where you do go critical, it is in the analyses 1
20 already.
21 MR. BASDEKAS:
There is a full spectrum of time 22 involved from shortly after shutdown into the transient.
i 23 MR. REED:
You might have one rod stuck, a slow 1
24 return to criticality, but I don't understand why the water 25 is--as soon as your pressure goes down, you are going to get naavPaca assaaevma enessanevam __ seastassmassa
122 i
1 injection.
Now these, most of these I will accept Davis-Besse i
O 2
ar e 200 pounds injection of borine water.
3 MR. MICHELSON:
The cooling is much faster even i
4 without any rod stuck.out.
j I
5 CHAIRMAN EBERSOLE:
There is an interval in which I
6 the cooling transient precedes the introduction of borine 7
water.
8 MR. REED:
I hope we get all the inputs here.
My l
9 off-the-cuff remarks would be that the borine water would cope l
10 with your sub-critical even in the worst condition which would l
l 11 be a new core prior to any build-up, because even the 1
12 shrinkage then would be even more massive, therefore, more 13 injection.
l
\\
14 CHAIRMAN EBERSOLE:
Isn't it a fact--go back to all 15 the analyses of the venders.
They all take and support the 16 fact that tney have depressed the temperature; where a rod is 17 in, they are going to go critical again, during these cold 18 water shutdowns.
19 MR. REED:
At some point if there is no boric acid 20 injection--
21 CHAIRMAN EBERSOLE:
They haven't got in there yet.
22 They will get it, but they haven't done it yet.
There is no 23 time to get it in there.
24 MR. BAER:
You don't have the pressurizer.
I am 25 with Mr. Reed.
I am trying to read this and listen tt the mmmemnem a m mmm monom ammmmmuoomm _. _ oaaeteae_omaa
i 123-1 same time.
I don't see how the pressurizer gets solid where O
2 you get the borine water in there.
l 3
MR. REED:
It says it goes solid.
Now I want to 4
make a further point because I haven't had a. chance to talk 5
very much.
I have no great love for the B&W reactor.
In 6
fact, I have neen throwing darts it like that, but it is 7
funny, in my list of problems or concerns about the B&W l
8 system, I don't get into this return to criticality. =This is 9
new and different to me.
10 MR. BASDEKAS:
Mr. Reed, the only thing I am saying 11 here, I am not stating the fact other than we have not 12 analyzed it and we do not have the capability to do it.
13 MR. REED:
Isn't it in the FSAR on Westinghouse-type 14 reactor, you analyze return to criticality, even for the 1
15 beginning of life?
l 16 MR. MICHELSON:
Some simple calculations were done a l
17 long time ago to try to predict roughly what was happening.
18 Now long after that we learned how to do a good thermal 19 hydraulic calculations, really sophisticated.
We haven't put
]
1 20 the neutronics back into the new and sophisticated 21 calculations.
Things are showing up we didn't know about that 22 may or may not be affected by the criticality-question.
23 CHAIRMAN EBERSOLE:
Let me' call your attention to
(
24 the Daddoni's current concern is with the history of new 25 reloads.
We have lost the general understanding of-what is neaveAas assaaerma cassaagerau -- ashotsna-Ames
1 l
l l
124 l
1 really happening to the moderate coefficient, and go back to l
2 Daddoni issued a bulletin or letter.
l 3
MR. BASDEKAS:
Don't have the basic. data t'o fit to j
i 4
the model even if we had the model in place.
I 5
. CHAIRMAN EBERSOLE:
May be some new answers coming 6
up to the old criticality questions arising up out of a long 7
history of core changes and so forth without critical 8
attention to moderate coefficient.
That's what he is bothered 1
9 by.
That was a week or two ago.
10 MR. BAER:
I have to talk--I thought at least one 11 time we had the, reviewed all the FSAR Section 15 transients-12 for the new core, including the new moderator coefficients, f\\
l sd 13 stopper coefficients, rod insertion limits, et cetera, every 14 reload.
I will go back to Daddoni.
15 CHAIRMAN EBERSOLE:
All I can say is we will go out l
16 of here with instructions to talk about your issues when we 17 talk to the full committee.
18 MR. BASDEKAS:
The point I am making, let me stress 1
19 it, is that we have not analyzed it',
neither do we have the I
i 1
20 capability to analyze it, and I am saying let's get, analyze l
j 21 the transients.
There is a wide spectrum of operation from 22 time zero after you drop the rods, or most of them or all of l
23 them at minus one, until down the pike where you may end up 24 with a severely overcooled primary solid and then attempt to l
25 return to criticality possibly where you may give the system emmoanea ammmmaamm maammonoomm ommes,a.
ome.
l 1
4 i
L l
l
~
125 1
the primary pressure pump.
That may be the last thing it O
.2 r.c eds.
3 MR. MICHELSON:
What you really worry about is 4
overfill the generator which now means it is full and then 5
some.
You get water out in the main' steam line which vill a,t 6
least perhaps stick a safety valve in the process of it trying l
l l
7 to relieve, yet you might' break the steam line, you suddenly 8
blow down a full generator.
We haven't calculated the full q
j l
i 9
generators on the cooldown on the primary side.
Chapter 15 10 starts off with normal water levels, maybe even high water 11 level trip, but not the kind we are talking about, and it is a 12 relatively modest amount of water to be blown down compared
]
l l
13 with a truly full once-through generator, for instance, where 1
14 it is overtopping the load.
It is a heck of a big difference l
15 in the cooldown.
16 Now I think criticality might be an important 17 consideration, but we don't know how to delay it in.
This is 18 how the question first got started on hydraulics.
We said how 19 are we going to calculate cooling down the big generators full 20 of water when they are truly full?
B&W is the worst case.
It 21 has got a lot of thermal coupling.
The whole thing is right 22 on the tubes.
And it can pull the primary down very fast.
23 MR. BASDEKAS:
Relative time constant of pressure, 24 temperature, and checking with the primary.
Ought to be--
25 MR. BAER:
That is one reason we ought to get
__mm m
__u A
m A
m &
mA n
e M
A A
126 1
protection against overfitting.
I am an analyst at heart,.but o
)
2 there is another way of approaching it which is to try and 1
3 prevent the problem from happening.
4 MR. MICHELSON:
I would like safety, grade.
That's 5
another discussion that will come up in a little bit, whether 6
it is safety grade or not.
7 MR. BAER:
May I ask a question?
Earlier before we 8
got into your memo, you made.the point obviously correctly l
9 that one of your concerns about the assumptions we used on 10 A-47 was that the protection systems would actually handle 11 control system failures.
Have I paraphrased that reasonably
]
12 correctly?
13 MR. BASDEKAS:
I took issue with the position that 14 has been taken by the staff and endorsed by the Commission to 15 the effect that control system functions will be taken care of 16 by the action of the safety systems in place.
17 MR. BAER:
I am aware of Davis-Besse which certainly 18 had an element of that or partially other reasons.
Are you 19 aware of any other at least significant or any events where 20 there has been control system malfunctions that have fed over 21 into the protection system where the protection system wasn't 22 able to take care of it?
23 MR. BASDEKAS:
Let me give you an example of if 24 safety systems work, as they should work, as designed and 25 expected to, in many instances, they work.to your detriment.
I F
127 1
To give you an example, ECCS injection under some transients 2
is the last thing on earth you need.
So here you have a-l 3
competition of systems, functions, of safety systems meaning 4
you let alone control systems where instead of helping you, it l
5 is driving you to an unsafe condition.
These things need to l
6 be looked at, at least understood before.we say what we need 7
to fix them.
8 CHAIRMAN EBERSOLE:
There is always a down side.to l
9 safety function.
10 HR. BASDEKAS:
There is a down side, but--there is a i
l 11 down side.
4 12 CHAIRMAN EBERSOLE:
It is a question of degree.
i l
I 13 What are you losing for what you gain?
14 MR. BASDEKAS:
The whole thing 15 started by that, at least one of the starting problems there 16 was of the sticking up of the PRV in the primary.
Now that l
l 17 was part, it was declared a part and it was part of the ICS, 18 the integrated control system, but we were not paying 19 attention because we kept telling ourselves and the world--
20 MR. BAER:
TMI, if the operators hadn't shut off I
l 21 safety injection pumps, it would have been a significant 22 event, but there wouldn't have been. damage.
23 MR. PATTERSON:
If he had sat back'and done this, 24 you wouldn't have had the problem.
25 MR. BASDEKAS:
But the~important thing is they did
l i
128:
1 not do that and the operator is an integral part of the O
2 control system for the reactor.
3 MR. PATTERSON:
Not the safety system.
4 MR. BASDEKAS:
Integrate system.
i 5
MR. BAER:
Let me go back to my question.
I am not 6
trying to engage in a debate.
I and Newt and Andy, and Dale t
7 when it is his turn on A-17, we have another forum that we 8
have to deal with besides ACRS, which is the CRGR and if we l
9 are to change our assumption about protection systems not 1
10 handling safety system, control system malfunctions, I am 11 going to need or we are going to need some specific examples, 12 and that's where I have asked my guys hey, do you know of any 13 other than Davis-Besse because I am pretty familiar with that 14 one and I am searching for something that I can say here is a 15 case where this happened.
Not that it may happen because 16 there is no doubt that it may hap en, but I am just 17 saying--and I don't need an answer now.
Give me a call 18 tomorrow.
19 MR. BASDEKAS:
I will be glad to.
As a matter.of 20 fact, in 1976 by God,
'77, these infamous donnybrooks in this 21
. room, the whole issue of control systems implications safety I
22 started by the single event where the reactor protection I
23 system was being fooled basically by the control system, and 24 making believe that there was nothing going wrong because it i
25 was compensated by withdrawal of control rods to make up for I
129 1
one or driving in of the control. rods for the other that stuck O
2 out, so you have a very severe tilt in the. flux inside the 3
core and not know it because the core detectors read the 4
average flux, okay?'
5 CHAIRMAN EBERSOLE:
Yep.
6 MR. BASDEKAS:
Bob, I will be glad to look you up 7
after the meeting.
8 MR. BAER:
Okay.
That's a good point, and I know I
9 some of the Westinghouse plants have disabled that. feature of 10 withdrawing rods to handle, to accommodate a dropped rod just
~
i l
11 for that reason, but yes.
I 12 CHAIRMAN EBERSOLE:
That's a good example.
13 MR. BASDEKAS:
That was a starting, say the trigger.
14 Some of us thought maybe the systems here, they are not just 15 sitting.
16 CHAIRMAN EBERSOLE:
It is older than that.
They 17 could go back to the British gas reactor as a result.
They 18 were at 75 percent power when they thought they were at 50.
19 MR. BASDEKAS:
With respect to bullet one, because a
20 this is as far as we got, the importance of that is not that 21 we should go, is not that we should go again reimpose existing 22 requirement.
No. I am saying that the fact.that the 23 assumption was made, that some of the things were either in 24 place, basically as far as the analysis go, okay, while they.
25 were not, as became apparent after the Oconee and Davis-Besse
_ - ~ _ ~ _ _ _ _ _________
1 I
130 1
events, of course the question of validity of the results of 2
the analysis, it is a simple as that.
It is nothing toEdo
]
3 with going back imposing one requirement twice or something to I
i 4
that effect.
This is out of, you know, my thinking here as R
l l
l 5
far as making this comment.
6 CHAIRMAN EBERSOLE:
We will take your memo and we 1
7 will work on it for the full committee meeting later, and I l
)
I 8
would like the staff to pick up where they left off.
I am 9
going to say continue until you think you have done the best 10 you can with the time available.
I don't know what the time i
11 limits are on the members here.
What are they?
Who has got 12 an early plane or something?
13 MR. MICHELSON:
How early are you talking about?
14 CHAIRMAN EBERSOLE:
One thirty, two o'clocP; I am 15 talking about opening up the staff until--we can die from i
4 16 hunger here if necessary.
I don't care.
17 MR. REED:
Somebody might applaud that!
i l
l 18 CHAIRMAN EBERSOLE:
We will go as far as we can go, j
l 19 We are a little short of time here.
I would like to invite 1
1 20 the members to consider Demetrious' letter.
If there are any 21 points to address to the staff while they are here, go ahead 22 and do it as their presentation unfolds.
I got the impression
-l 23 a while ago, and in essence that you said that the CRTR says j
24 unless you can point to something that has already happened, 25 you don't make any progress.
131' 1
MR. BAER:
Well, I am saying"that we think,'and I 2
guess I still think we made a very valid' assumption 3
considering operating experience about.the. ability of the 4
protection system to handle the control system malfunctions, 5
and if we are going to revise that very4 basic assumption, I am 6
going to, you know, we will have to think about.it ourselves 7
but I think they are going to need some facts.
8 The contractors that worked on this looked for that 9
sort of problem, weren't able to identify it in terms of 10 single failure effects and modes analysis, and we looked at 11 LERs.
You know, there is now a base of about a thousand 12 reactor years of experience, and an obvious question on O
13 imposing new requirements is' hey, has there been some
{
14 experience that shows that that has happened or this.is, new 15 requirement is needed?
16 CHAIRMAN EBERSOLE:
Witness for the first time a
{
l 17 thing like TMI II.
18 MR. BAER:
Right.
This's the very hard part.
l 19 MR. MICHELSON:
The only way to get things done is l
l 20 to have bad accidents.
21 MR. BAER:
This shouldn't be our goal.
We all agree l
22 to that.
23 MR. MICHELSON:
You have.got to wonder on occasion 24 if that is not what our criterion might be.
25 CHAIRMAN EBERSOLE:
I think this'might be kind ofLa
r l
132
=1 creed we have.
Don't do anything until'it happens.
O 2
MR. MICHELSON:
Until you have got proof that you 3
need to do something, hard proof, the body, the corpus 4-delecti, maybe more than one even.
5 MR. SZUKIEWICZ:
.Since I detect that some people may 6
be hungry,-and we have really discussed the approach, I think 7
some of the slides are self-explanatory.
I would like to 8
continue on and wrap this up by discussing the proposed 9
resolution.
10 CHAIRMAN EBERSOLE:
'Yes.
The first bullet, you mean I
11 main feedwater only, don't you?
But you don't say that.
.12 MR. SZUKIEWICZ:
That is correct.
We say that 13 really in the, in the generic letter, and this, and--
14 CHAIRMAN EBERSOLE:
That first btllet should be' 15 modified to say main and in certain cases emergency feedwater, 16 right?
17 MR. SZUKIEWICZ:
I'm sorry?
18 CHAIRMAN EBERSOLE:
In certain cases emergency 19 feedwater.
20 MR. SZUKIEWICZ:
That is already provided.
1 21 CHAIRMAN EBERSOLE:
I am saying even if it is l
l 22 already provided, you are going to require it.
I am~ assuming 23 it might not always be provided.
I don't know whether it is
(
24 universal or not.
25.
MR. MICHELSON:
Going to go down to a finer.
1 133 1
structure right now; you haven't said anything about safety O
2 grade or whatever in that statement, single train versus two 3
train, so on.
4 MR. SZUKIEWICZ:
That's right.
We--
5 MR. MICHELSON:
Some kind of protection I think is 6
all that says.
7 MR. SZUKIEWICZ:
What we are saying is, well, 8
two-fold, that all plants provide automatic overpressure,-
9 overfill protection for the main feedwater system.
10 MR. MICHELSON:
Doesn't even say automatic, does it?
)
11 CHAIRMAN EBERSOLE:
I don't think it would be i
I 12 criminal to invade this business of prescriptivity to say it 1
13 shall at least be coincident to preclude an inadvertent' 14 closure when it should not.
Are you with me?
15 MR. SZUKIEWICZ:
Yes, I do.
In the enclosure that I l
16 provided for you, we have a generic letter, and this 17 particular qeneric letter has three enclosures.
You have the i
18 general requirements, and then you have Enclosure 2, which 19 specifically gives additional guidance on different plants 20 designs.
Basically if a plant has certain things but doesn't 21 have certain other things, this is what the staff requires.
l 22 And we talk about plants that have a two out of three, plants 23 that have a two c.t of four, plants that have a one out of 24 two, plants that have no protection systems, and this is 25 extremely prescriptive.
134 1
Now to summarize--
O
%.)
2 MR. MICHELSON:
Excuse me.
Was there some reason, 3
some reason why the generic letter is worded differently than 4
the regulatory analysis requirements?
5 MR. SZUKIEWICZ:
The regulatory analysis?
6 MR. MICHELSON:
First one is you are talking in the 7
regulatory analysis about one out of one or better, for 8
instance.
You don't--
9 MR. SZUKIEWICZ:
The regulatory analysis, the way we 10 provide it in a new reg, we do not include specific 11 recommendations, so the, the regulatory analysis, all it 12 provides is a basis for staff positions.
We tried very hard 13 not to include any kind of a statement thr.t in a new reg would 14 say this is a requirement.
We have gotten into trouble'in the 15 past about that and that is really the format that the 16 Commission has taken, not to include requirements in a new reg 17 document.
18 MR. MICHELSON:
You call them alternatives instead 19 of requirements.
20 MR. SZUKIEWICZ:
Exactly.
But what we did was we j
21 looked at overfill protection systems, and we looked, first of 22 all, we did risk analysis on the significance of overfill, and 23 we attempted to determine what the contribution to risk
)
24 reduction would be by incorporating redundancy, different 25 levels of redundancy.
Two out of power to--I'm sorry.
l l
135 1
CHAIRMAN EBERSOLE:
What'about coincidence?
I don't 1
2 even-think the manufacturers will take the position that one 3
out of one doesn't impose reliability jeopardy to the main 4
feedwater systems and thera come licensing and do two out of 5
two.in any case.
6 MR. SZUKIEWICZ:
A lot of designs, it is nice to 7
have some degree of diversity, and what we did--
8 CHAIRMAN EBERSOLE:
I didn't say diversity.
I said l
9 coincidence.
It says I have got to have two channel signal to 1
10 turn off feedwater.
11 MR. SZUKIEWICZ:
That's true.
We could not based on 12 operating experience, for example, and there are plants out 13 there right now that have a one out of one system, and they 14 had no problems with inadvertent operation of that system, and 15 no problems as far as overfill.
16 CHAIRMAN EBERSOLE:
So you are relying then on the 17 quality of that system?
18 MR. SZUKIEWICZ:
As far as feedwater goes, what we l
19 looked at is variations in the kind of coincidence, and what, 20 because of the kind of contribution to risk this particular 21 sequence has, we could not justify a full-blown system.
22 What we are doing, though, is we are saying to the 23 people provide an automatic overfill protection, but also we 24 are also saying by God, make, make sure that your technical 1
25 specifications include periodic verification to' assure that
136 1
that equipment is available.
2 Now we feel that if the, if the utility chooses to 3
design a system that is one out of one, which precludes them 4
from operating because they have problems with that and they 5
have to shut down because this equipment is not available--
6 CHAIRMAN EBERSOLE:
Then come up.
7 MR. SZUKIEWICZ:
That's the way we are getting 8
around it.
i 9
MR. MICHELSON:
Isn't this non-safety grade that you l
)
10 are talking about?
11 MR. SZUKIEWICZ:
Yes, sir.
12 MR. MICHELSON:
Why would it even be in the tech d
13 spec?
14 MR. SZUKIEWICZ:
Tech specs have, there is quite a
]
15 few pieces of equipment that is used, that are not necessarily q
16 safety grade but still can be non-safety grade and still tech 17 spec, as long as they are used to mitigate certain design 18 basis events.
19 MR. MICHELSON:
You are saying this can be a single 20 channel non-safety as long as it is tech spec?
21 MR. SZUKIEWICZ:
That's right.
22 MR. MICHELSON:
Put limit on how long you might have 23 it on?
24 MR. SZUKIEWICZ:
As far as backfit goes; now--
25 MR. BAER:
We have had extensive discussions within
1 i
137 1
the staff, including the very extensive discussions.with the' O
2 tech spec group, and they are agreeable to this.
3 MR. MICHELSON:
Your, you finally concluded that a
4 there is somewhat of a problem with overfill but you are 5
perfectly happy to address it with a singla train-of-6 equipment?
7 MR. SZUKIEWICZ:
Yes.
We have concluded--
i 8
MR. MICHELSON:
No question about the reliability or i
9 no specification how reliable this should go or whatever?
i 10 Just as long as there is a one on one you are happy?
And as 11 long as it is in the tech spec so it can't be out?
12 MR. ANDERSON:
We can assure it is there and O'
13 available and it can operate for a certain amount of time 14 vithout it.
15 MR. MICHELSON:
No question about its quality?
16 MR. SZUKIEWICZ:
We feel commercial grade equipment q
17 is good, l
18 MR. WYLIE:
No previous experience?
19 MR. SZUKIEWICZ:
I'm sorry?
4 20 MR. WYLIE:
No previous experience with the 21 equipment?
This is a partial break.
22 MR. MICHELSON:
How reliable?
23 MR. SZUKIEWICZ:
There are a number of plants out I
24 there that have commercial grade equipment, and it is, we 25 don't have any evidence of overfill.
I
I 138-1 MR. PATTERSOH:
The thing that bothers me about that O
2 one out of one, in this particular case where you say if.it is 3
not in' operation, plant has'to shut down, in other words, you 4
are saying put it in the tech spec if it is not there and 5
available, he can't operate his plant.
That's'the way I q
6 understood'what you said:
l
,\\
7 MR. BAER:
There would be some time' frame.
l' 8
MR. SZUKIEWICZ:
Yes, exactly; there is a timeframe.
9 MR. PATTERSON:
The problem with that approach is 10 that the passing failure, you have no criteria.on the design 11 of the equipment that you are going to allow this man to put 12 in here, and I can have all kinds of passive failures 'take 13 place in that equipment, so it won't operate.
Nobody even 14 knows.
15 MR. SZUKIEWICZ:
The tech spec will require f
16 verification of operability on a periodic basis.
And--
17 CHAIRMAN EBERSOLE:
The second bullet.
18 MR. SZUKIEWICZ:
That's right, and these, these 19 requirements include, and again it is'very prescriptive, that 1
20 you would have on a, and I am going a little bit from memory, 1
21 but it is on a daily basis so itois almost like the' protection
)
i 1
22 system surveillance, that you have to on a daily basis, verify j
-l 23 that the equipment is there and then channel calibration is l
1 24 there.
1 25 MR. PATTERSON:
On a daily basis?
____s
139 1-MR. SZUKIEWICZ:
On a daily basis, that is true.
2 Not calibration; just to verify that.
3 MR. MICHELSON:
That's the only way you know the 4
instrument has gone bad sometimes is to run a calibration and 5
find out it has gone sour.
You don't bring the water level 6
that high I hope.
Only do it by going in --
7 MR. PATTERSON:
I guess if you make it uncomfortable 8
enough for the operator or the plant, that it will choose to 9
go to the two out of two.
Was that thought in the back of 10 anybody's mind?
11 MR. SZUKIEWICZ:
There are. designs out that are two 12 out of two also, yes.
6 13 MR. MICHELSON:
Is there some reason GE is okay for 14 one out of one but Westinghouse has to use two out of three on 15 the steam generator?
16 MR. SZUKIEWICZ:
No.
17 MR. MICHELSON:
I think they had to go safety grade, 18 too, didn't they?
Is there some reason why Westinghouse has 19 to be safety and this one doesn't?
1 20 MR. SZUKIEWICZ:
No.
The design, the way i-21 Westinghouse has is that they are, they are taking the design 22 and they are sharing it for safety and non-safety, and what 23 they did was they just said okay, we are going to just make
~
24 the overfill safety as well because we don't want to get into 25 any NRC hassle.1 and we are going to be checking it because
140 1
some of the equipment also is used to actuate protection O
2 systems.
3 MR. MICHELSON:
Made it a requirement because the 4
vender.said he is going to do it.
5 MR. SZUKIEWICZ:
No, no. They, all Westinghouse 1
6 plants except for three which I identify in the report which 7
are very old plants, all of them have either a two out of
{
8 three protection system, or a two out of four.
9 MR. MICHELSON:
But non-safety?
10 MR. SZUKIEWICZ:
They are all safety. grade.
11 MR. MICHELSON:
They didn't used to be in the old 12 Westinghouse.
They weren't safety grade.
13 MR. WYLIE:
He is talking about protection systems.
14 MR. MICHELSON:
I am talking about high-level trip.
15 MR. SZUKIEWICZ:
The high-level trip to trip the 16 feed pumps is safety grade, except for those three plants.
17 MR. BAER:
We specifically asked that, right?
18 MR. SZUKIEWICZ:
Yes.
l 19 MR. BAER:
And all we said we are not requiring are 20 those plants, those three.
We are saying if it is already in, 21 you have the equipment and it is already in your tech spec you 22 just have to --
23 MR. MICHELSON:
I hope you asked the question in the 24 right way making sure the safety grade all the way to the 25 actuated device and not just three safety grade instruments I
nea,mune amemomews amammanmemm _ _ _
oaanseea_#ae.
e 141 1
hanging on to the steam generator.
2 Is there three channels going all the way back?
3 MR. SZUKIEWICZ:
From what I' understand, that's__
4 true, yes.
5 CHAIRMAN EBERSOLE:
What happens over' Westinghouse 6
plant systems, and they are unique, in all the plants that do 7
this, they don't ramp down the_ main.feedwaters,. don't have any 8
way to ramp them down and follow it at equal rate, so.they 9
trip them on a turbine trip or SCRAM and they' invoke 10 automatically all the aux feeds and then they again 11 introduce--
12 MR. REED:
They trip them one minute after reactor 1
i42 13 turbine trip.
14 CHAIRMAN EBERSOLE:
Okay..So well, in many cases --
15 anyway, they invoke forcibly without recourse I think, the 16 challenge to the aux feeds to do their thing, and that 17 includes the aux feeds potential for overfill on which there 18 is no inhibit.
Am I correct?
19 MR. SZUKIEWICZ:
That is correct.
20 CHAIRMAN EBERSOLE:
So they have not_provided as 21 your first bullet says overfill protection for aux i eds at l
l 22 all?
23 MR. SZUKIEWICZ:
It isn't--
24 CHAIRMAN EBERSOLE:
I think as a policy matter you 25 are going to say you are not going to require it.
mmmoanma mmmmmoomm mmmmmancomm
,amesome__oese
m-142 1
MR. SZUKIEWICZ:
As I pointed out, the overfill O
2 protection, automatic overfill protection is limited.to the 3
main feedwater system.
l 4
MX. MICHELSON:
I thought it was all sources.
5 CHAIRMAN EBERSOLE:
I think'you ought to refine that 6
first statement to be sure.
7 MR. BAER:
Those are bullets.
8 MR. SZUKIEWICZ:
These.are bullets.
The way the j
9 generic letter reads is all--for instance, in this case, item 10 A for boiling water, all boiling water reactor designs except l
l 11 the ones that we noted, should provide automatic reactor 12 vessel overfill protection to mitigate main feedwater overfeed 13 events.
14 CHAIRMAN EBERSOLE:
Let me make another comment.
15 Also our capacity emergency systems such as APCI also are 16 provided with those but low capacity systems and systems used 17 under the deep pressurized conditions will not have any.
I am 18 trying to get the whole truth here.
19 MR. SZUKIEWICZ:
I understand, but that part, part 20 of it, the only reason I am questioning it, I am not arguing 21 with you, that's part of the protection system, and what we 22 are doing in scoping is non-safety grade. control.
23 CHAIRMAN EBERSOLE:
You argue that is not here 24 because it is a protection system?
25 MR. SZUKIEWICZ:
Exactly.
We didn't really look at,
143 1
we didn't go back and sit back and said are.all the. protection 1
0 2
systems good the way they are designed?
All we did was are 3
the protection systems that.we have good enough to mitigate 4
controls non-safety. grade. control system failures, and that is 5
really the only thing we focused on.
6 CHAIRMAN EBERSOLE:
Even if the Westinghouse plants 7
had automatic' trip on overfeed, on aux feed, you-wouldn't 8
.s mention it?
9 MR. REED:
On that-auxiliary feed jets you are 10 talking about a quantity.
11 MR. SZUKIEWICZ:
It is not an automatic, but I 12 think, and I think I talked about it with Verplanck, I think 13 they don't have an automatic trip, but what they have is they 14 have an automatic run-back, a throttling of the auxiliary l
15 feedwater, and that's the only plant that has that.
16 CHAIRMAN EBERSOLE:
Didn't I find three minutes 17 through feedwater flow from the aux feed you would be at the 4
18 overfill point on Westinghouse?
19 MR. REED:
No.
Auxiliary feed is only thousand 20 gallons per minute or one 20th of the feed.
21 CHAIRMAN EBERSOLE:
The overrun of the main feed 22 pumps, you are ready for trouble.
23 MR. REED:
Supposed to get back near normal' limits; 24 you don't get water hammer, all these J tubes and things like 25 that, back to the feed ring; now you ar.3 tripped on the main i
1
144 l
1 feeds, and you have only got auxiliary feed which is one 20th l
2 of the feed and it isn't going to go up like a rocket.
l 3
CHAIRMAN EBERSOLE:
How many minutestyou got'for the 4
operator to stop flooding due to offspeed flow?
j 5
MR. REED:
Divide a thousand by 20 minutes.
6 MR. BAER:
Power history early on, you would be 7
boiling off 400; with hot stand-by you might be in bigger
)
l 8
trouble.
I 9
MR. SZUKIEWICZ:
Potentially, yes.
In fact, I 10 think--
11 MR. BRUSKE:
The main feed pump, when going-to the 12 high-level trip, it worked the aux feed.
I think it was a 13 matter of minutes in that.
14 MR. SZUKIEWICZ:
It was you say in--
15 MR. BRUSKE:
Worst case scenario, i
16 CHAIRMAN EBERSOLE:
The operator has got to jump to 17 it in three minutes I think.
I think it is a low bar 18 condition.
Let's go ahead.
l 19 MR. SZUKIEWICZ:
Second bullet, we discussed.
Now l
20 just to talk about the overfill protection, give you an idea 21 of what, how this impacts all except the ones that I 22 mentioned, Westinghouse plants have overfill protection.
Most 23 of the GE plants have some sort of overfill protection.
24 MR. MICHELSON:
What do you mean by some sort?
25 MR. SZUKIEWICZ:
Most of them heve a two out of
145' 1
three system.
O 2
MR. MICHELSON:
Safety grade?
3 MR. SZUKIEWICZ:
It is a mixed bag.
4 MR. MICHELSON:
Two of, out of three doesn't tell me 5
a thing because all three channels could come from the same 6
power supply for all I know, which is the way we'found'some 7
plants lashed-up in old non-safety systems.
Lashed them all 8
on a common power supply.
l l
9 MR. SZUKIEWICZ:
We, for example, Brown's Ferry has 10 separate power supplies and we identify a number of them that 11 specifically have separate power supplies.
There were a few-12 that we couldn't verify and it could be a single power supply.
13 But based on the risk contribution of--
i 14 MR. MICHELSON:
In the case of Brown's Ferry, for 15 instance, okay, I got a good arrangement to generate the 16 signal.
Now what do you. trip with the signal?
Do you just 17 close a valve or close a-valve and trip a turbine or how do
'l 18 you redundantly shut off the potential source of water?
Or do 19 you just do it on one device?
20 MR. SZUKIEWICZ:
I just don't recall any more what 21 we said.
22 MR. MICHELSON:
Some plants just shut the feedwater 23 control valve.
Other plants trip the turbine as well as 24 shutting the feedwater control valve and so they really in 25 some casos converge to-single train logic even though they use maaT9aca mesaaevma eassaanevam m-asnetsoemmess
146 i
i 1~
multi-train sensing logic.
You have to look at the whole l
O 2
ball.
3 MR. SZUKIEWICZ:
I think we discussed this, in fact 4
I know we discussed it in the appendix or in Enclosure 3.
1 5
MR. MICHELSON:
When I read it I came to the I
6 conclusion there was indeed a mixed bag.
You are making some 7
generalized statements which I think have many exceptions to 8
them and we have to be very careful that we are not to get a 9
false sense of security from these kinds of generalized 10 statements.
11 MR. SZUKIEWICZ:
One of the problems is when we made i
12 them too specific, then the comment was that you are too
{
l
\\
13 prescriptive.
14 CHAIRMAN EBERSOLE:
It is an accordian process.
15 MR. SZUKIEWICZ:
Exactly.
16 MR. MICHELSON:
What is, what is wrong with just 17 requiring a redundant, a safety grade high-level trip which to 18 most people means all the way through to the device being 19 tripped, the whole works safety grade?
I 20 MR. SZUKIEWICZ:
It is rather expensive.
I 21 MR. MICHELSON:
Is that the problem?
Just it is 22 expensive?
So then you decide it costs too much, you do a 23 cost / benefit and you start backing off and somehow you ended 24 up with these ridiculous things like GE okay for single train, 25 no safety grade, Westinghouse'has got'to be safety grade n
_mnnnn -- --------- - - ~ ~ - - - - - - - -
l
147 1
multi-train.
It is ridiculous.
The only reason you ended up O
2 that way is because Westinghouse said they were going to do 3
it.
4 MR. ANDERSON:
Westinghouse has committed to that.
5 That's right.
6 MR. MICHELSON:
That leaves the reader kind of 7
wondering what kind of political process was used.
8 MR. ANDERSON:
I don't think we want to put in the 9
package the reason we are not requiring safety grade redundant 10 systems is because we couldn't justify it on cost method 11 basis, because that's the fact.
And it costs considerably 12 more money to put in a redundant safety grade system, and we 13 can't show-that it is cost effective to do it and we could not 14 propose a requirement on that basis.
15 MR. MICHELSON:
I really have to conclude that 16 boiling water reactors don't have a problem on overfill and 17 Westinghouse, and PWR, Westinghouse does because in one case 18 you said non-safety grade, the other case you said had to be 19 safety gfrade.
I had to conclude Westinghouse is worse for 20 some reason.
Not knowing that Westinghouse was --
21 MR. REED:
The rate of fill-up-is faster on any PWR 22 versus the great big jug --
23 MR. MICHELSON:
Reactor vessel is very big compared 24 with steam generators.
05 MR. BAER:
I am looking at the generic letter.
I
148 1
know we went through the logic, and Westinghouse designed PWR O
2 plants.
I am looking at page 4 I guess of whichever enclosure 3
I'am at.
And I guess I thought it said, it makes a 4
distinction here.,
and it says-those plants where 5
there is a group one, and the plant design has an overfill 6
protection system initiated, et cetera, we say that's i
7 acceptable, and only ask for the tech specs.
And then we say 8
the plant design has a safety grade or commercial grade 9
overfill for the two, and there we say design may be found 10 acceptable provided that one justification on a plant specific 11 basis is provided, and two, that they put in technical spe:s, 12 so I thought we left it open.
O.
13 MR. MICHELSON:
What you said is really even on 14 Westinghouse, you don't need safety grade.
You are allowing 15 one out of one, on the group 2?
16 MR. WYLIE:
Are you looking at the generic letter?
17 MR. MICHELSON:
Page 5 of Enclosure 3.
18 MR. WYLIE:
Oh.
19 MR. BAER:
These are the proposed requirements.
20 MR. MICHELSON:
I didn't read it quite that way.
21 That means then that not all Westinghouse has to be safety 22 grade or more than one out of one.
l l
23 MR. SZUKIEWICZ:
That's right.
24 MR. MICHELSON:
Is that right?
25 MR. SZUKIEWICZ:
Yes.
149 1
MR. MICHELSON:
Group 3 is one that doesn't have O
2 any.
You are saying they have got to do something, but you u
3 don't say what.
4 MR. SZUKIEWICZ:
Well, the something is that they 5
'have to provide an automatic overfill protection system.
6 MR. MICHELSON:
But-single train is good enough, say 7
j i
8 MR. SZUKIEWICZ:
If that's what they choose and they 9
can justify it, right.
10 MR. BAER:
The plants we are talking about there, we 11 wanted to leave this one open because at least in one case we 12 are talking about Yankee-Rowe, and it is conceivable to us 13 that they could come in with an argument that look at their 14 power density, and their volumes and just like we looked at 15 Big Rock and say hey, we really can't get in very much 16 trouble, so the, I think the three plants are Yankee-Rowe, 17 Haddam Neck and San Onofre, there are three relatively old 18 plants of somewhat dissimilar design.
Haddam Neck and San 19 Onofre are.
20 CHAIRMAN EBERSOLE:
Of all the nuclear plants, 21 Westinghouse is the only one that trips its main feedwater 22 pump through the entire transient.
They are the only ones who 23 also put safety grade protection against overtill so there is-24 a double-ended attempt here to avoid overfill in those two I
25 regions.
150.
1 MR. SZUKIEWICZ:
The newer plants on'GE also provide I
()
2 safety ~ grade.
l i
3 CHAIRMAN EBERSOLE:
They do.
I am saying it looks
{
4 like Westinghouse is more nervous about overfill than anybody 5
else.
6 HR. SZUKIEWICZ:
Well, a lot of it has to do with 7
the traditional way that we'do business', we did business, and 8
during the review the staff encouraged that the, some sort of 9
protection system be provided.
l 10 CHAIRMAN EBERSOLE:
I am saying Westinghouse can j
11 find justification which CRDR cannot apparently, and I wonder j
12 what that is.
You wonder what is-under the rug.
13 Did you identify how many plants are-in groups one, 14 two and so give an idea if we are talking about minor or j
15 majority?
16 MR. SZUKIEWICZ:
Yes.
17 MR. MICHELSON:
Where was that?
18 MR. ANDERSON:
Do you remember where it is itemized, 19 Andy?
20 MR. SZUKIEWICZ:
Oh, yes.
Not--
21 MR. MICHELSON:
In the generic letter they just 22 referred to --
23 MR. SZUKIEWICZ:
There is an Appendix A which shows, r
24 and this is in the reg analysis, where it discusses the B&W 25 plants, I'm sorry, the BWR plants, the GE plants.
I think it mmmoonma mmmmmmomm mmmmmmnmomm namesene..ooee
1-q l
I, 151
)j
'l is A1, Table A1.
(:)
1 2
MR. BAER:
In the reg analysis?
3 MR. SZUKIEWICZ:
I think it is the reg analysis, i'
4 MR. MICHELSON:
Where is it?
5 MR. EL-ZEFTAWY:
It.is A6.
1 6
MR. SZUKIEWICZ:
Sorry.
7 MR. MICHELSON:
Now I am looking for the 8
Westinghouse bit.
9 MR. SZUKIEWICZ:
In the Westinghouse, we don't have l
10 a table.
All we do is mention that all, in the writeup, what 11 the status is and it is really all except three.
12 MR. MICHELSON:
I thought perhaps it incorrectly led
)
i O
13 you to believe that all Westinghouse had safety grade'high l
14 level trip.
Then we went back into the generic letter and l
15 found there is a group 2 of Westinghouse plants'that don't' 16 have safety grade and don't have the one channel of high-level 17 trip, so I was wondering is that one or two old ones or is 18 group 2 a large group?
19 MR. SZUKIEWICZ:
It really--okay.
l l
20 MR. MICHELSON:
It wasn't quite correct when you l
21 first led us to believe all Westinghouse have safety grade.
l 22 MR. BAER:
I don't think all three of those were in 23 group 3.
24 MR. SZUKIEWICZ:
That is correct.
Yankee--
25 MR. MICHELSON:
I was trying to get a feel.
maavenaa aasneerma cassaanevam -- seau sos maes-
152 1
MR. BAER:
It is a small group.
j 2
MR. SZUKIEWICZ:
The Yankeee plant and the Haddam 3
Neck plant do not-have any kind of overfill protection.
The 4
San Onofre plant I belief has a one out of one', but it is--
~
5 MR. MICHELSON:
That's the group 2.
~
6 MR. BAER:
I misspoke.
Group 2, I think that is 1
7 that one plant.
l l
8 MR. MICHELSON:
Funny, the way group 2 is worded it i
9 s,ounds like there is several plants, some have two out of two.
l I
(
I 10 Now we are talking about only one plant all together.
11 MR. SZUKIEWICZ:
We tried to make it clear that we i
12 are only talking about three plants that are, don't fall into l
}
13 the group one category.
14 MR. MICHELSON:
All but three.
15 CHAIRMAN EBERSOLE:
Is there an experience record 16 within the recording capability that says how many times these 17 systems have in fact prevented overfill?
Is that a matter of 18 record that we keep those challenges?
And you know, we have 19 been accumulating the statistics about what we are trying to 20 stop?
21 MR. SZUKIEWICZ:
I suppose you can accumulate the, 22 there is in some cases--
23 CHAIRMAN EBERSOLE:
I think we ought to have a 24 record either that we do not or we do have a record of these 25 systems saving the day.
153 1
MR. SZUKIEWICZ:
Just recently there was one within 2
the last two months, I remember on one of the Westinghouse 4
3 plants that--
4 CHAIRMAN EBERSOLE:
It was stopped by that system?
5 MR. SZUKIEWICZ:
Yes, and in fact, most of the l
6 plants, there is a lot of transients that go into what people l
l 7
call overfill, but when we' started looking at the LERs in more 8
depth what they meant by overfill transient was that it' hit 9
the high-level on the vessel or the steam generator.
There i
10 were, when we went back, there were three plants that had 11 water, actually moisture and water into the steam lines and 12 that was the Oconee plant in 1982, and then Rancho Seco two l
1 l
13 times.
One was the light bulb event, and.the other one was 14 the most recent Rancho Seco transient and the other ones, that 15 they had a number of other ones, but.we could not ascertain or 16 we ascertained that water did not get in there.
17 Now as far as the boilers, as I mentioned, two 18 Dresden units in the very early. seventies did have an overfill 19 transient.
They put in--I am not sure what Dresden has.
They 20 put in an overfill protection.
I don't believe it is safety 21 grade, and they never had a transient since, another one.
22 CHAIRMAN EBERSOLE:
Never had one?
I 23 MR. SZUKIEWICZ:
Another overfill.
l 24 CHAIRMAN EBERSOLE:
How many transients did they j
l 25 have since?
)
l i
MR@TT&GE BM9689?MS F6BBBBA976M
- 989hS9Bm48@@
==
1 154 1
MR. SZUKIEWICZ:
I don't know.
Dresden in June of'
)
O.
2
'70 had an svent and another' event was December of
'71.
And
)
'3 since then, they have put in the overfill protection, and 4
didn't have another transient.
5 CHAIRMAN GBERSOLE:
I am reminded of the case where 6
.the breakers were failing all the time and nobody knew it 7
because it was a shunt trip.
See, we are blind.
After we put 8
the system in like Dresden, you don't keep records anymore 9
because it doesn't happen much.
What is happening is that the 10 overfill protection system is doing its thing but there is no 11 record of it.
Is that not a current state of affairs, that 12 you don't know what the challenge frequency is on that safety 13 system?
14 MR. SZUKIEWICZ:
I believe there is some new I
i 15 requirements as far as reporting requirements because there 16 are, it wasn't a wealth, we didn't get a wealth of knowledge i
17 by reviewing licensing event reports to really try to get a 18 good idea.
19 CHAIRMAN EBERSOLE:
I think it is important to know 20 what safety devices are doing their thing.
21 MR. SZUKIEWICZ:
I agree.
22 CHAIRMAN EBERSOLE:
We ought to set up a records 23 system that tells us when they are saving the day.
It might l
l Q) 24 be more often than we think.
]
l 25 MR. SZUKIEWICZ:
I agree, but at the same time, 1
m_momemm mmmmmme_m
__mm mme __
4 emm m e e m e e.
E 1
l 155 H
l 1
there are a lot of transients that occurred that people; 2
suspected it was the problem of control systems where when.you 3
start analyzing,.yes, a control system initiated a-transient,-
l 4
an upset, but to mitigate the event,
- a. lot of other things i
l 5
exacerbated it and not the control system, so I think it is,.
6 it is a little too simplistic to start blaming control systems 1
7 every time you have a transient.
8 The precursor to the TMI event, the Davis-Besse-j 9
event, I think a year before that, the precursor was a' 10 start-up feedwater control valve that went open, but the 11 problems were in what the operator did and in what they had 12 removed from the system as far as administrative controls for 13 protection systems.
4 I
14 CHAIRMAN EBERSOLE:
Yep.
i 15 MR. SZUKIEWICZ:
So it is a very difficult fine
)
16 line, and what we are, what now after all these years,=what we 17 are trying to do is we have also I think learned quite a few 18 things as far as looking at unresolved safety issues, and it 1
19 is very dangerous to get something resolved if we start 20 putting a, identifying these issues as an open-ended bucket.
21 where people--just there is a tremendous amount of related 22 concerns, but sometimes not really germane to the~ problem.
23 Should I continue on with the other?
24 CHAIRMAN EBERSOLE:
I was going to ask the 25 Subcommittee here, I would expect that the Subcommittee would J
_----m
-_ ~______-_ _ _ _ _ _ _ _ _ _ _ _
l
156 1
want to talk among yourselves while the-staff is still here O
2 even about what we need to take to the fu11' committee, what--
o 3
MR. MICHELSON:
Don't we.want to hear about the 4
resolution ~first?
5 CHAIRMAN EBERSOLE:
I understand.
I'am just 6
bringing this up'and ask you to start thinking about what we 7
are going to do when he gets finished.
I am not going to stop 8
him, but we are working to some sort of conversion here where 9
we are going to ask ourselves what we are going to take the 10 full committee, have the staff do here.
11 Carry on.
12 MR. SZUKIEWICZ:
Okay.
13 MR. MICHELSON:
Let me clarify your item on j
l 14 Westinghouse now.
You are requiring automatic overfill 1
1 15 protection but you, are you going to say that it'has to be 16 safety grade?
17 MR. SZUKIEWICZ:
No.
l l
l 18 MR. MICHELSON:
So they can put in a one out of one 19 if they wish, if they want to, for whatever reasons.
What I 20 am getting at is the only requirement, are you going to 21 require only that there be automatic high-level protection, 22 not necessarily safety grade, but it will be in the tech spec, i
23 whatever you put in, is that it?
(
24 MR. SZUKIEWICZ:
Exactly.
25 MR. MICHELSON:
I guess they could pu't in two out of mea me n o m mmmmmacom mmmmmmmmom-ommm.,mm
.mmme
. l 157
)
l 1
three system in the tech spec, one of the three channels would 2
be okay, couldn't they, if they want to?
There is.no 3
requirement that the tech spec be all three channels because 4
you are only requiring a single track--
5 MR. ANDERSON:
That's right.
6 MR. MICHELSON:
Protection; is that your intention?
7 MR. ANDERSON:
It is not our intention to do that, 8
but--
9 MR. MICHELSON:
It sure doesn't come through from 10 the reading.
These are certainly nebulous requirements at 11 best.
If it doesn't need to be safety grade, you should say 12 so.
Right now it just says automatic.
13 CHAIRMAN EBERSOLE:
Well, I think it goes back to 14 the fact that the terminal point of the signal goes back to 15 single device anyway, the valve or breaker on an electric pump 16 or something.
It is single track.
If it--
17 MR. MICHELSON:
That is what safety device--they 18 have got to go to two.
19 CHAIRMAN EBERSOLE:
Here they have parallel inputs 20 all over the place.
21 MR. SZUKIEWICZ:
That's true.
Okay.
22 MR. MICHELSON:
I am just trying to find out what 23 the requirements are.
O)
\\_
24 CHAIRMAN EBERSOLE:
There is lots of pumps out there 25 and lots of valves.
Maarvana aapasevma ensenanmenu -- constsea-asse
1 158 1
'MR. MICHELSON:
Just trying to find out what his i
2 requirements are.
In no case on any of the plants will you 1
a l
3 require safety grade, is that'right?
j
)
4 MR. ANDERSON:
That's right.
'l 5
MR. MICHELSON:
-All of them, and have to be single 6
track?
7 MR. ANDERSON:
I think part of the confusion is we 8
tried to point out that a number of the plants do already have 9
safety grade of various types, and this is more than what we 10 currently require.
I 11 MR. MICHELSON:
I am sure you have found out when 12 you went and looked at two out of three systems you found they
(~)/
/"
13 only use one power supply form.
And thatHis still okay?
1 1
14 MR. ANDERSON:
Yes.
I I
15 MR. MICHELSON:
That is what I am trying to qualify.
16 It is a single channel system.
Then'it can, only need go to 17 one device, either valve, flow control volume, or trip the 1
1 18 turbine and that is good enough, too?
19 MR. ANDERSON:
That satisfies our requirements.
20 MR. MICHELSON:
Did you understand that?
I didn't.
21 MR. ANDERSON:
We will have to clarify that, but i
22 that's certainly what our intention is.
23 MR. MICHELSON:
Yes.
It is fairly clear on the a
1 24 boiling water reactor.
It says got to be at least one out of 25 one.
But it didn't make those statements for Westinghouse.
l I
i ommomomm mmmmmmomm mmmmmmmmem. __
,eaeseee_o ee
159 1
MR. SZUKIEWICZ:
The way'the generic letter was, and 2
maybe this is subject to criticism for the format, ~ but'we 1
3 wanted to keep the. requirements pretty general and then go~
4 into the guidance in appendix or Enclosure 3 to the generic 5
letter to specifically point out if you have this, this and 6
this, this is okay, and unless--or-you need to provide certain 7
things.
And hopefully we made that clear, but we will go back
'I 8
and address your comment and see what we could do.
Okay.
I 9
Should I continue?
I l
10 CHAIRMAN EBERSOLE:
These are the fundamental' rules 11 here.
Beyond this, it is details point by point by point?
12 MR. SZUKIEWICZ:
That is true.
()
13 CHAIRMAN EBERSOLE:
I expect this is as good a point
]
l l
14 as any just to ask the committee, the Subcommittee, what their 15 opinion is.
I will take comments around the table what we 16 should take to the full committee from this meeting we have l
17 had here.
18 I would almost suggest we invert the process, and 19 you go to what you are going to require, then back up and 20 defend why you did it as a minimal way in time consumption to 21 cover the thing.
22 What would be your thoughts about that?
Say we are 23 going to do what you'are going to do, and then hear the
()
24 reasons.
What you did here, you developed the reasons and 25 told us what you were going to do, I don't know whether this i
I
@@@T9hO@ @@@O397MO fd390@S9?OM d309h@9$eM@@@
==
1 i
160 1
is the most efficient way or not.
I think the committee will' 2.
be, full committee, they are going to be worse.than we'are l
i 1
3 asking about questions.
1 4
MR. REED:
I think the first thing you have to do is 1
5 very clearly smack on the' projector the basis, the assumptions 1
1 6
and limitations under which you do'this, and then say we will i
7 reject any question that diverts from this!
We will not take J
l i
8 them up.
l j
j 9
Because there is work all over the place, coalescing 10 in the work; we don't know how that takes place--assuming it
)
.i 11 takes place elsewhere, but certainly for you folks, you should 12 stay on your basic assumption and conditions of work.
(
13 I think I agree with you, Jesse.
We ought to hear i
14 from Basdekas on his points.
I haven't had a chance to do any 15 rebutting to the points.
Some of the points are okay, but I 1
16 think I would like the one on return
~,o criticality, I don't 17 think that's real and maybe the staff wants to go out and get 18 some input from the people on that.
)
l 19 MR. BAER:
The return to criticality may be real, 20 but I don't think you can fill the pressurizer at the same 21 time.
22
.MR.
REED:
It is the point you fill the pressurizer, 23 you put in several thousand gallons of borine water.
()
24 CHAIRMAN EBERSOLE:.These are not coincident 25 problems.
You fill the pressurizer; maybe it is a problem you
l 1
i 161 1
come up against what was vapor and now it is liquid.
2 MR. REED:
The shrink is going to be quite large.
i I
3 Needed water for injection is going to be quite large, and you 4
are going to put a lot of borine in with that injection.
l t
5 MR. MICHELSON:
If you put a lot of water in without 6
taking it out, you are going to raise the steam pressure'in i
i 7
the system somewhere real fast, probably form a big bubble and j
l 8
pump up at the same time that you have got perhaps -- I am not
{
l 9
agreeing with the pressurized thermal shock problem.
Yout l
1 10 certainly are going to presourize the system.
You are going 11 to put the power --
12 MR. REED:
The issue now is he, you don't shut off 13 the safety injection pumps.
That's against tne-law now, 14 right, in the B&W?
15 MR. PATTERSON:
My experience what is going on in
'1 16 the B&W is some years ago.
17 MR. REED:
If it pressurizes at full 340 inches, it 18 is supposed to shut off, and they did shut off.
The safety 19 injected, if you go by there again, they are not going to shut 20 it off.
21 MR. BAER:
They have to meet the sub-cooling 22 margins.
I am not that familiar with the, all the operating 23 procedures, but there are projections, limitations ~that should
(
24 avoid that problem.
25 MR. REED:
You have got a. chart on sub-cooling l
t on m m m - m -~ --__--_ _
l l
.162 I
1 pressurized, and you follow that.
O 2
MR. MICHELSON:
The point is you have lost 3
reactivity control.
There is no way to keep it from going up.
4 The rods are already in and you can't bring boron in fast 5
enough.
We are talking transients will be all over in couple 1
6 of minutes.
7 MR. REED:
'You have got to -- you are going to void l
8 in the core if you are' going to do that.
Let the pressure go l
9 to hell.
You have got injection to raise the pressure back i
10 up.
l i
11 MR. MICHELSON:
To pressurize the void you have to l
12 do a real terminal dynamic calculation, and our codes can't do 13 it, can't account for the void traction formation because you i
14 are pumping up the pressure, j
15 MR. REED:
You are getting to the point you are I
16 going to have to address some of these basic questions, after 17 you do your basic clean-up.
18 CHAIRMAN EBERSOLE:
Return to power on a boron 19 system is an ancient problem.
It is in the book.
1 i
l 20 MR. REED:
I know this one plant that has more, two 21 plants that have more rods than any other Westinghouse plant.
22 CHAIRMAN EBERSOLE:
Yes.
l 23 MR. REED:
So I looked into the problem quite a lot.
24 CHAIRMAN ESERSOLE:
What about assumptions, Charlie, j
i 25 from you about the full committee?
I J
163 1
1 MR. WYLIE:
I think what you proposed is fine.
P&
2 CHAIRMAN EBERSOL.E:
How about yours, Carl?
3 MR. MICHELSON:
-I think it would be best to-start 4
out with the resolution and kind of work from there.
You will 5
never get to it otherwise, which is what. happened here today.
6 I have a small question on the resolution'that we 7
streamed through so quickly.
Go ahead.
l 8
MR..BAER:
The full committee meeting I assume is t
9 next week?
We will certainly try to address as many--
10 MR. SZUKIEWICZ:
Friday.
11 MR. BAER:
As many of the concerns as possible.
All l
l 12 right.
I think we will work hard just to help, but within one 13 week there is a limited amount of stuff that we can do.
l 14 CHAIRMAN EBERSOLE:
Sure.
Some answers are you 15 haven't done it, as he says.
What to do about that is 16 something we can take up.
I don't know.
There is one little 17 technical matter that I was bothered by.
You mentioned
]
18 depressurizing the CE plants bring operating bypasses and the 19 atmospheric dumps.
It doesn't happen because you have got 20 that jump of water in the pressurizer that doesn't move out l
21 and become part of the secondary system.
It hangs up and is
]
22 subject to fast depressurization only if you do something to 23 the bubble, so I think there is a time question that is in C)
\\_
24 front of us about how rapid you can in fact depressurize a CE l
25 plant that haven't got PRVs and got some' problems with its-l ummemnas a mmam aonom n om m am a mo ano immas omm nm.m
164 1
spray systems.
O 2
You found out in some months, oh, several months 3
ago, when we were lookinig at this funny:little system they I
4 have got at Palo Verde, they have a list of little puny spray 1
5 that goes in.
There are, when you use, when you use the 6
atmospheric dumps, and the steam bypasses, you depressurize, 7
you cool, you cool the working loop, but you don't cool the.
l l
8 side arm heater out there because it doesn't enter into the 9
circuitry process.
i 10 MR. SZUKIEWICZ: -So you--
l 11 CHAIRMAN EBERSOLE:
Hang up at high pressure.even 12 though your water is cold.
The pressure--you follow me?
If j
13 you have got a hot pressurizer, that'is not a part of the 14 cocling process and the evaporative mechanism.
I 15 MR. SZUKIEWICZ:
Then you can decrease the pressure;
)
16 on your pressurizer.
l 17 CHAIRMAN EBERSOLE:
If you_can do that. 'They don't 18 have PRVs and they have somewhat fallible' spray systems, one 19 of which is through a, I think the quarter inch oriface for 20 punching water.
These CE plants don't cool down like the ones i
21 with PRVs 22 MR. SZUKIEWICZ:
The way the whole system was 23 identified was that we identified that_there is a narrow 24 window in the small break'loca condition where you, and their 25 procedures say that_you can shut down by using the system.
memomune mammmoomm ammmmanmemm __
onaes,ee_oaea
... - - - _ ~
i 165 1
However, when we looked at the system, we found that in.some LO 2
cases, during an ECCS condition, some of those systems could 3
be taken off and have no power to them so they wouldn't be 4
able to actually operate them.
5 That was the initial conceru, but what you are 6
telling me is that even if you you have these systems, you 7
couldn't depressurize?
8 CHAIRMAN EBERSOLE:
The Palo Verde plant has got a-9 high pressure relief system involving, they had to invoke the 10 use of a system that they had there as a qualified safety 11 grade, went very slow.
They defend slow depressurization in a 12 plant.
That's one of the peculiarities, because they don't 13 have PRVs.
I have always had some kind of horror which is the 14 fact I have lost water in the primary circulating loop in 15 refilling it with whatever I got going into it over here.
I 16 have got the side arm heater that is still applying pressure 17 to the, this cold vessel which is getting colder all the time.
18 MR. SZUKIEWICZ:
Palo Verde doesn't use that system 19 to depressurize.
20 CHAIRMAN EBERSOLE:
It is so slow it doesn't help.
21 MR. BAER:
If I may interject, I think the problem 22 we were focusing on was the small break loca with those 23 particular plants that had a particularly low safety injection 24 discharge pressure, and I have a list here, and I think these 25 are, I guess the newest of these plants is the St. Lucie 2 and HERITAGE REPORTING CORPORATION -- (202)628-4888
L l.
166 1
1 1
I think those all have the PORVs.
]
2 CHAIRMAN EBERSOLE: 'May be low pressure, but it can 3
be high pressure, the vessel temperature you have got 4
circulating, cool loop with hot pressurizer.
5 MR. BAER:
Yes, I understand that.
I think the 6
problem here was more fundamental, and you get hung up, You 7
can't even get safety inject.
8 MR. SZUKIEWICZ:
It was the concern, right.
9 CHAIRMAN EBERSOLE:
Let me suggest that yqu invert 10 the presentation process and try to collapse it as best you 11 can, and in view of the less time, I am sure you will face 12 questions worse than the ones you have today from the 13 committee at large on what to say about that, but we will just 14 have to fight our way through it.
15 MR. SZUKIEWICZ:
Well, like I say, this is an 16 iterative process.
If you notice one of the slides that we, l
17 we do value your input'because we are right now in a draft 18 resolution stage, and we will also be taking in CRGR comments-19 and trying to improve on this.
20 CHAIRMAN EBERSOLE:
I think this is a status report 21 for the committee.
22 MR. MICHELSON:
You are not going to wind it up yet, l
23 are you?
I have got another question.
j 24 CHAIRMAN EBERSOLE:
Go ahead.
I am just, I think we 25 are not going to write any kind of terminal letter at this l
.--~.--.. - -
w 167 j
1 time.
I think we are in the-information gathering mode,.and
)
2 we like you are on the same track, I guess we might be 3
obligated to comment on the rate of progress or something.like
-)
-l 4
that, whatever direction we are going.
Carl?
5 MR. MICHELSON:
Was that the intention, that you 6
just issue a letter that--
1 7
CHAIRMAN EBERSOLE:
Coinment on the progress, but it 8
does not--
l l
9 MR. MICHELSON:
You are going to wait until the 10 public comments?
l 11 CHAIRMAN EBERSOLE:
We are not going to close out.
l 12 MR. BAER:
In order to get to the--we need at least l
13 I think some positive indication that you don't have an 14 objection to publishing a proposed resolution for public 15 comment.
We can't even get to that point.
As Andy was 16 indicating, there is at least one more bite at the apple.
17 MR. MICHELSON:
We will have to tell you now, of
)
~
l 18 course, that even when you come back later, with the absence 19 of certain kinds of things we talked about today and systems 1
2'O interaction, I don't think we-can still give you a unanimous l
l 21 letter.
At least I don't know whether the majority of l
22 committee--
23 CHAIRMAN EBERSOLE:
It could be a letter.
You are 24 talking about a blanket approval.
I am talking about just 25 comment.
ommoonmm m ammm emom mmmmmmmmem-ommm.om.
z.--
i 168 1
MR. MICHELSON:
If we aren't going'to give them O
2 blanket approval on the basis of what we already know, there 3
is no use of waiting another six months for public comments or 4
four months or whatever to tell them then that we aren't, we 5
don't like it.
Might as well tell them now.
It would be to 6
everybody's benefit if we don't like what they are doing, to 7
say as soon as possible.
8 CHAIRMAN EBERSOLE:
I agree.
9 MR. MICHELSON:
A.id there are some areas where I 10 just don't like it.
Resolution is fine if it was cleaned up
]
11 enough to understand.
12 Let me point out a problem I have.
I recognize that 13 you said okay, we will forget earthquakes and forget fire and 14 forget flood and so forth because~just assume we forget it.
4 15 That basic assumption, I said okay, that's all right.
You end 16 up with a resolution that says I am going to put in some I
17 additional trip mechanisms that will help me, but then I said 18 well, none of these mechanism are going to be seismically 19 qualified, none of them are Appendix R qualified, no 20 requirements of any sort.
I can put this wire wherever I wish 21 as long as I put it in.
You didn't anywhere recognize that 22 whether or not it should be seismic, or at least even 23 seismically qualified structures.
You didn't say whether or O
i 24 not it should be included in the Appendix R so the same, make j
25 sure the rules by which we regulate the plants, okay, today i
169 l
1 are going to be continued to be recognized, when you wander 2
through this resolution, you get all that you call safety 3
grade.
If you don't call it safety grade, then you have to 4
prescribe to what extent you want special considerations.
5 MR. SZUKIEWICZ:
We actually did focus on that in j
6 our regulatory analysis,-and what--
7 MR. MICHELSON:
I.didn't pick'it up on fire.
Let's 8
take fire, for example.
Your regulatory agency says you are.
9 happy that fire is a non-problem.because they have done 1
10 Appendix R already.
l 11 MR. SZUKIEWICZ:
Let me take that back a little bit.
12 We did an analysis assuming very conservative values for 13 overfill, and we basically, what we did was we had a 1
14 transient, and these transients that had a certain initiating 15 frequency, and based on the data that we used and correlated 16 to the real world, there were within a, you know, factor of 17 the analysis that we, you know, presented.
18 We also--
19 MR. MICHELSON:
On that point, what does that have 20 to do with fire and fire frequency and overfill during fire?
21 MR. SZUKIEWICZ:
We also looked at and took 22 conservative assumptions to go to core melt contribution for l
I 23 this particular, for the overfill protection.
We assumed that 24 if you get water in there, there was a very conservative 25 assumption of there is a probability of.95 probability that
170 1
you will get a main steam line break.
2 MR. MICHELSON:
Let's stay on fire here a minute.
3 MR. SZUKIEWICZ:
We took conservative assumptions 4
when we did the analysis all the way down to core melt.
In 5
some cases, we took the break that was, you know, that 6
couldn't be isolatable because it was downstream, or 7
downstream of'the isolation valve and outside containment and 8
we looked at the, took it all the way down to core melt, and 9
the figures that we came up with were somewhere in the area.of 10 ten to the minus five.
11 MR. MICHELSON:
That's not a fire analysis now.
12 Those core melts were not precipitated by fire.
13 MR. SZUKIEWICZ:
That's true, but independent of 14 this, we found that these things are not that significant 15 contributors to risk, the overfill event, and we have some 16 very good data that--
17 MR. MICHELSON:
I think we are on the wrong tact.
18 First of all, we do have a finite probability of fire.
Don't 19 know how big it is going to be yet.
Somebody is going to tell 20 us in a couple, three months how big it is going to be, but 21 given a fire, and which is the starting point, now if I have 22 gone through and designed redesigned my plant, fixed it under 23 Appendix R such that if I have a fire as a given, in any area 24 of the plant, one area, and confining the prescriptions on 25 this area, but if I have a fire in this area I have shown that HERITAGE REPORTING CORPORATION -- (202)628-4888
'171 1
even if I lose redundant equipment, I still have a safe O
2 shutdown capability, might even be commercial grade all the i
3 way down eventually to cold in three days I think.
Now we 4
have shown'that.
We are happy.
But that was never predicated 5
on the idea the fire might be precipitating the steam line f
6 water, you know, steam generator overfill situation to.begin 7
with because some of the equipment I am going to depend upon 8
is going to be in' terms of controlling level that steam 9
generator and so forth.
10 Now we have to go back and say given that same fire 11 in all these possible areas of the plant, that I still will 12 not get a steam generator overfi'l situation even though I 13 might have even put in this new protective feature which will 14 undoubtedly be in one of the fire zones.
It is only single 15 track.
It is going to be consumed by the fire.
It is not 16 going to be effective, so I still have to look at the risk 17 involved in steam generator overfill given a fire.
You won't 18 have data to do that with.
You don't have fire experience.
19 MR. SZUKIEWICZ:
That's true, but the point is we 20 had overfill events even if we have the events.
21 MR. MICHELSON:
In conjunction with the fire now l
22 which has perhaps even lost--you remember we didn't' protect j
J 23 engineered safety features from fire.
We just protected f'\\
l
(_/
24 features required to get the heat out.
Not safety injection 25 and so on; those weren't protected, only to get the heat out.
172' 1
You should get the. rods in and take the heat out.is'all we O
2 protected for fire, and I certainly don't want the steam 3
generator overfill aggravating that delicate situation that we 4
have, and you are going to assure me we won't get it by some 5
means.
6 MR. BAER:
The comment was.made earlier that I made 7
a note on, it was a question on the solid state overheat, and 8
I think maybe it needs a--not that the overheat is from the 9
fire.
I am not making that point, but I want to discuss with 10 Andy, Newt and maybe we need some requirement that at least by 11 some separation between the feedwater controller 12 instrumentation, and the overfill protection, that might solve 13 both of those problems.
14 MR. MICHELSON:
I-think what you want to do is you 15 want to be sure that the equipment that protects the vessel 16 against overfill is, is not jeopardized by any of the fire 17 situations that we have analyzed under Appendix R which in 18 themselves have taken out equipment that you might not need to 19 address the overfill.
We never considered overfill as being j
20 an unsettling equipment.
You just have to do some real 21 careful thinking and it needs to be in the generic letter that-22 they have to, they have to do this, they clearly have to go 23 back and analyze their pipe breaks now from the viewpoint off 24 this protective circuitry or whatever.
I haven't thought it 25 through.
Fire is the one I have really Peen impressed.
Pipe HERITAGE REPORTING CORPORATION -- (202)628-4888
173 1
break may not be.
I don't know.
I haven't thought about it.
2 CHAIRMAN EBERSOLE:
You are talking about separating 3
the overfill particularly function from the water supply i
4 function?
q i
5 ~
MR. MICHELSON:
That is going to be' single track.
]
6 It is going to be hard to protect it against all 7
possibilities.
8 MR. BAER:
There is all the possibilities,that 9
bothered me.
I think you could perhaps have a requirement 10 that separates them, would take care of, you know, more j
11 common, the overheating of equipment, or a fire in a single 12 location, that would hopefully not knock out both the 13 feedwater control and the overfill protection.
14 MR. MICHELSON:
For instance--
15 MR. BAER:
To go much beyond that is probably 16 going--
I 17 MR. MICHELSON:
You have got to think through what 18 kind of prescription is needed.
I think, though, it needs to 19 be somehow addressed since fire is something you said you 20 weren't going to consider because you thought you had already 21 taken care of fire in Appendix R.
22 CHAIRMAN EBERSOLE:
Is it implicit in the gravity of 23 the situation of overfill, that when you have a steam line 24 break, you in fact cannot isolate by proper functioning of the 25 main steam isolation valves?
Is that taken as a pair?
In seavesse essassema cassaanevas -- genesseseases
1 j
174 1
order to materialize this severity of the situation?
You O
2 know, we are ready to have main steam line failures' as long as 3
we can isolate it.
That's design basis.
4 MR. SZUKIEWICZ:
On plans for main steam line f
5 isolation valves, then we assumed that, you know, you would 6
get isolation of one steam generator anyway and you can 7
tolerate the blow-down of another.
From'what I understand, 1
8 there were--
l l
l 9
CHAIRMAN EBERSOLE:
On that topic right there, you 10 are implying I need pressure in one of X generators to get 11 heat out.
You in fact can get it out at very low pressure, 12 can't you?
13 MR. SZUKIEWICZ:
Yes.
14 CHAIRMAN EBERSOLE:
You don't have to, have to 15 maintain pressure to get heat of the. primary loop.
In fact, 16 it is enhanced by depressurizing.
Why are you holding 17 pressure in one steam generator?
18 MR. SZUKIEWICZ:
The analysis shows you can blow 19 down one steam generator but not both.
Now from what I 20 understand, there are three plants out there that don't have 21 main steam line isolation.
One of them is Oconee.
Another l
i 22 one is I believe Rancho Seco, and another one is San Onofre in 23 Westinghouse.
Those are the only ones that I am familiar that
(%
24 don't have it.
l' 25 Now from what I understand, San Onofre and Rancho
)
175 1
Seco have provided to the staff their blow-down analysis.of O
2 both steam generators.
I don't-know what the status is of San 3
Onofre, but'then if that's the case, and I have to assume 4
that's the case, you don't have a generic problem there.
You-l 1
5 have a plant specific problem, so the only one thatLI am not 6
comfortable with, but this, that's not my background, is the 7
Oconee.
8 CHAIRMAN EBERSOLE:
If you have-the valves,-though, 9
isn't it, isn't it implicit in the overfill case that they may 10 not work anyway because of'the presence of water in the lines?
11 MR. SZUKIEWICZ:
We assume that they would work.
12 CHAIRMAN EBERSOLE:
You assume the valves will work.
O l
13 You do have valves--do you have valid basis for.that?
14 MR. SZUKIEWICZ:
I thought we did.
15 MR. BAER:
Really just make the conservative 16 assumption that if we got water into the steam line, that 17 somewhat of unknown, could be water hammer, we could fill it, 18 they might break, and we just said that was'the undesirable 19 condition.
l l
20 MR. SZUKIEWICZ:
In one line, but we assume'that you i
21 know, in the other line, we would not break.
22 CHAIRMAN EBERSOLE:
Oh,'yes.
The other one wouldn't 23 be a party to this common failure.
ON 24 MR. SZUKIEWICZ:
The one, we did-assume you would 25 get a main steam line break where we did the analysis.
l l
l l
l
-M2&T9AGM 9296&PTWG c6MBa&AVV6M 1969t%22eA822 e-
176 1
CHAIRMAN EBERSOLE:
.That boiler?
2 MR. SZUKIEWICZ:
Exactly.
3
.MR.
BAER:
.I' don't want to open up another Pandora's 4
box, but I think the analysis as you and I discussed at 5
length, that you just couldn't overfill multiple steam 6
generators at one time.
7 MR. MICHELSON:
I think you can, but you couldn't 8
rupture more than one steam line.
As a consequence, there is 9
no rationale to believe you can't overfill more than one at a 10 time.
11 MR. REED:
You have to assume the control valves 12 failed--
13 MR. MICHELSON:
The control signal is what' failed.
14 MR. SZUKIEWICZ:
We actually tried to simulate on 15 the Oconee both steam generators overfilling.
46 MR. MICHELSON:
You have single track.
17 MR. SZUKIEWICZ:
We couldn't because of certain 18 other automatic trips on low suction pressure.
Now what--and 19 so depending on the transient, to get all that feedwater.in a 20 fast enough time to make it a real concern--
21 MR. MICHELSON:
You are saying the system can't 22 handle valves wide open on more than one?
23 MR. SZUKIEWIC7:
They can, but then you would get 24 less flow and the overfill concern wouldn't be as great as 25 when you would all of a sudden go from one value to another.
HERITAGE REPORTING CORPORATION -- (202)628-4888
[
177 1
MR. MICHELSON:
The valves all went wide open.
O 2
MR. SZUKIEWICZ:
If you are at, well, if the valves 3
went wide open, what the simulation showed is that you tripped 4
the pumps on low suction pressure.
5 MR.'MICHELSON:
In their particular instance?
I I
6 don't know.
Depends on how you assign the suction line.
l 7
MR. SZUKIEWICZ:
Now that we have put in overfill 8
protection, it is an academic thing anyway.
9 MR. MICHELSON:
No, it is not academic because you
)
i l
10 have not put in safety grade overfill.
You haven't assured me' l
l 11 yet that the power supply going to the flow control valves is j
)
12 the very the same power supply that is. coming off the single f
O l
13 trip that you put in.
14 MR. SZUKIEWICZ:
At that point we agreed that we 15 would address this, and--
16 MR. MICHELSON:
It is irrational to me.
I can't 17 imagine a lot of extra money to put in fill requirement.
One 18 is you can't power the feedwater control system at the same 19 power supply as you do the trip.
That won't cost I don't 20 think much extra money; just a matter of closing the right 21 board-and so forth.
Just common sense, but you don't even 22 require that.
23 MR. SZUKIEWICZ:
To make it safety grade and 24 separate.
25 MR. BAER:
Those are the sort of things--
nemm-m - - ~ ~ ~ _ - - - - _ _ _ _ _ _ ~ _ - _ _ _
1
l 178-1 MR. MICHELSON:
I don't argue with the commercial l
O 2
grade.
I do argue with the need for some--
3 CHAIRMAN EBERSOLE:
Specs requirements.
4 MR. MICHELSON:
That's just a few common sense 5
things.
That happened.
That is what was the trouble at 6
Rancho Seco and the other.
Initially you power them off the l
7 same power supply.
[
l 8
CHAIRMAN EBERSOLE:
Common signal generated by some 9
source--I don't know, voltage or air pressure that will get 10 them all.
1 11 MR. SZUKIEWICZ:
I think on Rancho Seco, although
)
)
I 12 they committed to overfill protection, they didn't implement
(
13 it, so they didn't have any kind of protection.
14 CHAIRMAN EBERSOLE:
It is now one o' clock.
I am 15 about to say that we have squeezed this lemon as dry as we 16 can.
l 17 MR. MICHELSON:
Oh, no!
18 CHAIRMAN EBERSOLE:
At this time.
l 19 MR. SZUKIEWICZ:
Which lemon are you referring to?
20 CHAIRMAN EBERSOLE:
The A-47; any comments from the 21 Committee members or any questions about what we are going to 22 do next week?
23 MR. MICHELSON:
I have only one comment. I have 24 misread the requirements.
I was happy with their generic, 25 with their resolution until I understood it.
Now I am not 1
.e 179
.j 4
1 happy.
I just read into'it; things that.weren't-there.
I.
2 thought it was much better than it is.
3 CHAIRMAN EBERSOLE:
On that note, I am going'to
\\
1 4
close this meeting, and I appreciate everybody being here.
5 (Whereupon, at 1:00 p.m..
the meeting was 6
adjourned.)
7 8
9
.+
10 V
11 12 0
13 14 15 16 17 18 20 21 22 23 0
24 l.
25 l
l
- - - - ~ - - --~ ~-- _ ____-_____
1 REPORTER'S CERTIFICATE-2 i
O 3
oocx== xuxaza:
i 4
CASE TITLE:
Advisory Committee on Reactor Safeguards, l
Subcommittee on Instrumentation and-5 HEARING DATE:
Control Systems - October 29, 1987 6
LOCATION:
Washington, D.C.
7 I hereby certify that the proceedings and evidence
{
8 are contained fully and accurately on the tapes and notes 9
reported by me at the hearing in the above case before the 10 NUCLEAR REGULATORY COMMISSION 11 12 O
13 hd Date:
October 29, 1987 l
14 1
l l
l
~
15 l
l fMu
,'2 b,-
l*
Official Reporter
/
1 HERITAGE REPORTING CORPORATION l
10 1220'L Street, N.W.
Washington, D.C.
20005 g
20 21 l
o i
22 Q;7 23 O
l 25 HERITAGE REPORTING CORPORATION (202)628-4888 l
O 1
l Uf1 RESOLVED SAFETY ISSUE (USI) - TASK A-47
" SAFETY IMPLICATI0f1S OF C0llTROL SYSTEMS" PRESEllTATI0l1 TO THE ACRS SUBCOMMITTEE MEETIf1G Oil IllSTRUMEl1TATION AllD C0llTROLS OCTOBER 29, 1987 O
A. J. SZUKIEWICZ -- TASK MAllAGER ENGIllEERIllG ISSUES BRAllCH DIVISI0fl 0F El1GIf1EERIl4G OFFICE OF flUCLEAR REGULATORY RESEARCH.
O
[])
UllRESOLVED SAFETY ISSUE TASK A-47 MILEST0llES o
COMMISS10ll APPROVES A-47 AS A USI DECEMBER 1980 o
TASK ACT10f4 PLAll APPROVED SEPTEMBER 1982 o
TECHillCAL WORK COMPLETED JAllUARY 1986 o
PROPOSED RESOLUTI0ll PACKAGE SEPTEMBER 1986 COMPLETE o
IlllTI ATE IllTERilAL REVIEW (10VEMBER 1986 o
A-47 PACKAGE FOR DIVISI0ll Af4D OFFICE MARCH 1987 C0llCURREllCE A
~
o RE-SUMITTED A-47 PACKAGE FOR OFFICE MAY 1, 1987 C0l4CURREf1CE (BECAUSE OF REORGAlllZAT10tD o
STAFF CONCURREllCE OF A-47 PACKAGE OCTOBER 18, 1987 o
A-47 PACKAGE ISSUED TO CRGR OCTOBER 1987*
o A-47 PACKAGE ISSUED FOR PUBLIC COMMEl4T MARCH 1988*
o FIllAL RESOLUT10ll 0F A-47 APRIL 1989*
AllTICIPATED O
"S' ^-47
~
O
" SAFETY IMPLICAT10llS OF CollTROL SYSTEMS" l
i lilSTRUMEllTAT10ll SYSTEMS COMPRISE TWO BASIC GROUPS o
1.
SAFETY-GRADE PROTECTION SYSTEMS A.
REACTOR TRIP SYSTEM B.
EMERGEllCY CORE C00LillG SYSTEMS C.
OTHER SAFETY SYSTEM (1.E., MSIV, EFW, PRESSURE RELIEF l
1I.
fl0N-SAFETY GRADE C0llTROL SYSTEMS A.
MAINTAIN PLANT PRESSURE AllD TEMP LIMITS O
DURlflG SHUTDOWil, START-UP AllD fl0RMAL POWER l
OPERATION B.
IllCLUDES C0llTROLS FOR:
PRESS, TEMP, LEVEL, FLOW AND VESSEL INVEllTORY C.
fl0T RELIED UP0fl TO PROTECT THE REACTOR OR MITIGATE ACCIDENTS o
USI A-47 FOCUSED ON GROUP II.
O
USI A-47 OB'JECTIVES ~~
~~
'{
\\
1, IDEflTIFY IF C0llTROL SYSTEM FAILURES COULD:
CAUSE TRAllSIEllTS OR ACCIDEllTS TO BE MORE SEVERE thall o
THOSE IDEllTIFIED Ifl THE FSAR(S)
ADVERSELY AFFECT Al1Y ASSUMED OR AllTICIPATED OPERATOR o
ACTIO!1 DURIllG THE COURSE OF TRAllSIEllTS OR ACCIDEllTS CAUSE TECHillCAL SPECIFICAT10fl SAFETY LIMITS TO BE o
O EXCEEDED.
CAUSE TRAflSIEilT OR ACCIDEllTS TO OCCUR AT A FREQUEllCY 111 o
~
EXCESS OF THOSE ESTABLISHED FOR ABil0RMAL OPERAT10ilAL
~
TRAflSIEf4TS AllD DESIGll BASIS ACCIDEllTS, 2.
VERIFY THE ADEQUACY OF CURREllT LICEllSillG DESIGil REQUIREMEllT (SRP SECT 10ll 7,7) 3.
PROPOSE, IF llECESSARY, ADDITI0llAL GUIDELillES TO ASSURE THAT fluCLEAR POWER PLAf4TS D0 fl0T POSE UllACCEPTABLE RISK DUE T0 fl0ll-SAFETY GRADE C0flTROL SYSTEM FAILURES.
O
ASSUMPTI0lls O
0 Mll11 MUM (1UMBE.R OF SAFETY GRADE PROTECTI0ll SYSTEMS ARE AVAILABLE, IF flEEDED, TO TRIP REACTOR AllD It!ITI ATE OVER PRESSURE PROTECT 10tl SYSTEMS OR ECCS, o
COMM0ll CAUSE EVEllTS (SUCH AS EARTHQUAKES, FLOOD, FIRE, j
(
SABOTAGE, OR OPERATOR ERRORS OF OMISSI0ll OR COMMISS10ll) ll0T ADDRESSED.
O o
TRAllSIEllTS DURlllG LCO AllD ATWS EVEllTS ARE (10T ADDRESSED, t
o PLAtlT-SPECIFIC DESIGilS WERE APPROPRIATELY MODIFIED TO COMPLY WITH IE BULLETIll 79-27 AllD llVREG-0737 (TMl ACT10ll PLAll).
z
'O
REVIEW APPROACH
~
i o
PERFORMED DETA! LED REVIEW 0F FOUR PLAflT DESIGilS, OllE FOR EACH llSSS SUPPLIER i
B8W OC0 flee (REVIEW BY ORNL) i l
CE CALVERT CLIFFS (REVIEW BY ORf1L)
I 1
l i
O GE BROWNS FERRY (REVIEW BY INEL)
J i
l H. B. ROBINS 0fl (REVIEW BY IflEL)
~
W 1
1 o
EVALUATED ALL MANUAL AND AUTOMATIC NON-SAFETY GRADE C0l1 TROL SYSTEMS THAT IllTERFACE WITH THE PRIMARY REACTOR FLUID SYSTEM AflD THE STEAM AflD FEEDWATER SYSTEMS o
IliCLUDED BOTH I-lSSS AllD BOP C0f1 TROL SYSTEMS, i O
m-USI A-47 PROGRAM OVERVIEW
' EVENTS OF CONCERN (OF,00,OH,DBA, A00,...)
U PMLA IDENTIFY ALL DEV. PLANT S
MODEL m
SYSTEMS
~
CONTROL SYST.
MODEL 4---
VERIF.
LEVEL d
1 r "IDENT. SIG OPERATING EXP.
CONTROL SYST.
LERs, INP0.
FMEA I
COMPONENT LEV.
g PERFORM 1 r I
TRANSIENTS for diff.
DEVELOP FAIL.
. conditions SCENARIOS.
O g
DETERMINE T/H ESTIMATE FAIL FREQ.
DIFF. on plants for selected scenarios.
of same NSSS P
btItKMihc Luni.
l PERFORM PRA l SYST.DIFF. on plants of same NSSS.
U Authi. Muud. Anu ~
~
PERFORM COST ESTS.
O ASSESS 6ENtRIC w
APPLICABILITY U
NRR RtyltW DEV ELOP STM F ACRS REVIEW POSITIONS
, _CRGR REVIEW t
155UL FKUPUdtU l
RESOLUTION O
l
USl A-47 PROGRAM OVERVIEW L
o C0l4CEllTRATED Oli IDEllTIFYlilG, 1.
STEAM gel 4ERATOR (REACTOR VESSEL) OVERFILL 2.
. REACTOR VESSEL OVER COOL 3.
REACTOR CORE OVERHEAT 4.
EVEllTS OR ACCIDEllTS MORE SEVERE thall PREVIOUSLY AllALYZED 111 THE FSAR.
n o
IDEl4TIFY ALL C0llTROL SYSTEMS THAT COULD AFFECT THE AB0VE, o
PERFORM FAILURE MODE AND EFFECTS AllALYSES FOR C0llTROL SYSTEMS (BOTH SYSTEM LEVEL' & COMP 0llEllT. LEVEL).
O
~
^
o REVIEW OPERATillG HISTORY, (LER'S, IllPO, AE0D, ETC.,),
o DEVELOP PLANT T-H TRAllSIEllT MODELS TO SIMULATE THE DYNAMIC RESPONSE OF THE PLAllT DURIllG TRANSIEllT CONDITI0l4S, o
PERFORM MODEL VERIFICAT10ll USIllG ACTUAL'PLAllT DATA, O
g
t
' n USI A-47 PROGRAM OVERVIEW (C0llT'D)
V o
EVALUATE CollTROL SYSTEM FAILURES DURillG AUTOMATIC AllD l
mal 1UAL MODE OF PLAllT OPERAT10ll AllD FOR DIFFEREllT REACTOR l
POWER OPERAT10llS.
o EVALUATE THE C0flSEQUEllCES OF POSTULATED WORST CASE FAILURE i
SCEllARIOS AllD COMPARE THFM TO THE FSAR TRAllSIEllTS AllALYSIS.
i o
FAILURE COMBINATI0lls EVALUATED:
1.
SELECTED SIllGLE AND MULTIPLE IllDEPEllDEllT C0flTROL SYSTEM FAILURES, l
l 2.
MULTIPLE DEPEllDEllT FAILURES OF SAFETY AllD l10ll-SAFETY GRADE SYSTEMS RESULTil1G FROM A SINGLE EVEllT (SUCH AS Q
A LOSS OF POWER),
3.
SELECTED SIl1GLE AllD MULTIPLE FAILURES OF ECCS SYSTEMS,
)
o C0flSEQUEllCE OF POSTULATED WORST CASE FAILURE SCENARIOS'WERE COMPARED TO THE FSAR TRAllSIENTS AllALYSIS, i
o CORE-MELT FREQUEllCY AllD RISK C0llTRIBUTI0fl WERE ESTIMATED i
FOR SIGillFICAllT FAILURES SEQUEllCES.
l 0
C0llTROL SYSTEM MODIFICATI0llS TO MllllMIZE SIGilIFICAllT TRAtlSIENTS WERE EVALUATED, i
i O
l
GEllERIC APPLICABILITY
({}
FOCUS Oll THE SIGillFICANT FAILURE SCEllARIOS IDEf1TIFIED o
DURIllG REVIEW, ASSESSMElli BASED ON El1GillEERillG CHARACTERISTICS, EVALUAT1014S o
CONDUCTED BY INEL Af1D ORilL, AflD STAFF JUDGEMEllT.
RESULTS OF REVIEW OF THE REFEREllCE PLAllT WERE C011SIDERED o
GEf1ERICALLY APPLICABLE FOR OTHER PLAllTS OF THE SAME VEliDOR 1F 1,
NAJOR FLUID SYSTEMS ARE FUllCTI0llALLY SlhlLAR TO THE REFEREllCE PLANT.
2.
POWER-TO-VOLUME RATIO AND VARIOUS VOLUME-TO-FLOW RATIOS ARE
($)
SIMILAR TO THE REFERENCE PLAllT.
3.
THERMAL-HYDRAULIC TRAL 4SIEllTS AllALYZED FOR THE REFEREllCE PLANT ARE SIMILAR TO OR C0flSIDERED MORE SEVERE THEll TRA Off OTHER PLAllTS OF THE SAME CLASS, 4.
DIFFERENCES IN DESIGli 0F CONTROL SYSTEMS AT OTHER PLAllTS ARE f10T SIGNIFICAf1T Ef10 UGH TO SUBSTAf1TI ALLY ALTER THE FAILURE SCEllARIOS THAT WERE IDEllTIFIED, 5.
DIFFEREf4CES Ill DESIGft 0F PROTECTI0ll SYSTEMS AT OTHER PLANTS ARE fl0T SIGl11FICAllT ENOUGH TO SUBSTANTI ALLY ALTER FAILURE SCEllARIOS THAT WERE IDEllTIFIED, 73V
O C0llCLUSION o
RESULTS OF REFEREllCE PLAIT AllALYSIS cal 1 BE GEllERALLY APPLIED TO ALL PLAllTS OF THAT CLASS.
t o
CONTROL SYSTEM DESIGil 0F PLANTS BY THE SAME (llSSS) SUPPLIERS ARE FUllCTI0llALLY SIMILAR.
O o
TRAllSIENTS RESULTING FROM THE FAILURE OF THE SAME [10N-SAFETY
{
GRADE CONTROL SYSTEM ON DIFFEREllT PLAllTS OF THE SA.c NSSS SUPPLIER i
WILL PRODUCE SIMILAR OR BOUNDIllG TRAllSIEllTS.
1 o
IMPROVEMEllTS MADE AFTER THE TMI-2 EVENT FOR THE AUXILIARY FEEDWATER SYSTEM AND FOR OPERATOR IllFORMATI0ll AND TRAlllIllG GREATLY AID Ill RECOVERY OF COMPLEX TRAllSIEllTS.
l l
O
l O
c 'iCtuSiOri (C0iiT,D) o PLAllT TRAllSIEllTS RESULTillG FROM C0llTROL SYSTEM FAILURES Call j
BE ADEQUATELY MITIGATED BY THE OPERATORS PROVIDED THAT FAILURES D0 fl0T COMPROMISE OPERATI0ll 0F THE Mll11 MUM I4 UMBER 3
j 0F PROTECTION SYSTEM CHAfillELS, (EXCEPT10llS fl0TED RECOMMEl1D PROCEDURE AllD OPERATOR TRAll1IllG AT CE PLAllTS),
]
t o
TRAllSIENT OR ACCIDEllTS RESULTil4G FROM C0flTROL SYSTEM FAILURES ARE LESS SEVERE THAN, AllD BOUNDED BY THE TRANSIENTS rU)
AllD ACCIDEliTS AllALYZED Ifl THE FSAR.
HOWEVER, 0,F, EVEllTS WERE fl0T AllALYZED 111 THE FSAR.
l l
O PWR PLAl4T DESIGilS HAVING REDUllDANT COMMERCI AL GRADE (OR BETTER) OVERFILL PROTECT 10fl SYSTEMS (FROM MAlfi FEEDWATER OVERFEED EVEllTS) THAT SATISFY THE SIl1GLE FAILURE CRITER10l1 WERE DETERMINED TO BE ADEQUATE, k
h o
BWR PLAllT DESIGIIS WITH COMMERCI AL GRADE (OR BETTER) OVERFILL l
PROTECT 10ll SYSTEMS (FROM MAIN FEEDWATER OVERFEED EVEf1TS) WERE DETERMillED TO BE ADEQUATE,
1 i
' q*
PROPOSED RESOLUTI0ll
)
l 1
o REQUIRE ALL PLAllTS TO PROVIDE AUTOMATIC STEAM GEllERATOR OR l
REACTOR VESSEL OVERFILL PROTECTI0ll - MOST PLAllTS ALREADY COMPLY.
l 1
l t
o REQUIRE ALL PLAllTS TO PERIODICALLY VERIFY OPERABILITY OF OVERFILL PROTECTION.
MOST GE AllD li PLAllTS COMPLY.
j O
o REQUIRE OCollEE PLAllTS TO PROVIDE AUTOMATIC IlilTIATI0li 0F EFW.
Oil LOW STEAM GEllERATOR LEVEL - ALL OTHER B8W PLAllTS PROVIDE i
THIS FEATURE.
o REQUIRE ALL CE PLAllTS (WITH LOW HEAD SAFETY IllJECTIO!1 PUMPS)
TO REASSESS EMERGEllCY PROCEDURES AllD OPERATOR TRAlilING AllD MODIFY (IF llECESSARY) TO ASSURE PLAllT SHUTDOWil FOR Al1Y SB LOCA.
O
i 1
I)
SCHEDULE FOR FIllAL RESOLUT10f4 REVIEW BY RES DIRECTOR OCT., 1987 REVIEW BY CRGR fl0V,, 1987
)
1 it i
l f])
ISSUE FOR PUBLIC COMMEllT MAR,, 1988 1
l RESOLVE PUBLIC COMMEllTS AllD PREPARE FIllAL RESOLUTI0ll SEPT,, 1988 j
1 1
CRGR REVIEW 0F FillAL RESOLUT10fl J All,, 1989 i
i l
ISSUE FIllAL RESOLUT10!l APRIL, 1989 i
,~.
U l
B8W PLAllT REASSESSMENT
',3
,U p
o IlilTI ATED BY TiiE RAllCHO SECO EVENT - DEC. 26, 1985 1
o EVALUATI0l1 CONDUCTED BY BWOG AllD llRR I
o IMPACT Oli USI A-47 L
j t
1.
AllALYSIS OF LOSS OF POWER EVEllT EXTEllDED TO 1
THE RAllCHO SECO AllD DAVIS BESSE PLAllT DESIGN TO C0l1 FIRM APPLICABILITY OF gel 1ERIC FillDil1GS.
2.
ESTABLISH AllD Mall 1TAIN All IllTERFACE WITH THE BWOG i
O AllD NRR REVIEW ACTIVITIES o
IllDEPEllDEllT OF USI A-47 0
BWOG SCOPE 1.
REDUCE CHALLEl4GES TO THE PROTECT 10ll SYSTEM 2.
IMPROVE MITIGAT10110F COMPLEX TRANSIEllTS o
llRR WILL COMPLETE REVIEW 0F BWOG STUDY - APRIL 1988 O
_