ML21285A172
| ML21285A172 | |
| Person / Time | |
|---|---|
| Issue date: | 10/12/2021 |
| From: | NRC/SECY |
| To: | |
| Shared Package | |
| ML21260A069 | List: |
| References | |
| M211008 | |
| Download: ML21285A172 (45) | |
Text
1 UNITED STATES NUCLEAR REGULATORY COMMISSION
+ + + + +
MEETING WITH THE ADVISORY COMMITTEE ON REACTOR SAFEGUARDS
+ + + + +
- FRIDAY, OCTOBER 8, 2021
+ + + + +
The Commission met via Videoconference, at 10:00 a.m.
EDT, Christopher Hanson, Chairman, presiding.
COMMISSION MEMBERS:
CHRISTOPHER T. HANSON, Chairman JEFF BARAN, Commissioner DAVID A. WRIGHT, Commissioner ALSO PRESENT:
ANNETTE VIETTI-COOK, Secretary of the Commission MARIAN ZOBLER, General Counsel ACRS MEMBERS PRESENT:
VICKI BIER, Member, Advisory Committee on Reactor Safeguards (ACRS)
DENNIS C. BLEY, Member, ACRS CHARLES H. BROWN, Jr., Member, ACRS
2 GREGORY H. HALNON, Member, ACRS DAVID A. PETTI, Member, ACRS JOY L. REMPE, Vice Chairman, ACRS MATTHEW W. SUNSERI, Chairman, ACRS
3 PROCEEDINGS 1
10:02 a.m.
2 CHAIRMAN HANSON: Okay, great. All right, good 3
morning everyone. I convene the commission's public meeting with our 4
Advisory Committee on Reactor Safeguards, or ACRS. This is a periodic 5
meeting to hear from ACRS on several important topics recently reviewed by 6
the committee. Before we begin today, I'd like to welcome two members of 7
the ACRS, Dr. Vicki Bier, and Mr. Gregory Halnon, who were appointed as 8
new members effective April 2021.
9 Dr. Bier joins us after a distinguished career in academia, 10 and as a professor emerita at the University of Wisconsin-Madison. Her 11 areas of specialization include risk analysis, decision analysis, and 12 operations research. She has more than 40 years experience in risk 13 analysis for nuclear power, chemical, petrochemical, and the aerospace 14 industries, as well as Homeland Security, and critical infrastructure 15 protection.
16 She's served on various advisory committees for the EPA, 17 and the National Research Council. Mr. Gregory Halnon comes to us with 18 more than 40 years experience in the nuclear, and utilities industries, most 19 recently as the Chief Nuclear Officer of Three Mile Island Unit 2. Mr.
20 Halnon has experience in all aspects of nuclear plant operations, as well as 21 quality standards, security, maintenance, and engineering processes.
22 Welcome to both of you, and I look forward to working with 23 you on the committee. Mr. Halnon, it's nice to see you again, I think we met 24 several years ago when I had the opportunity to tour Three Mile Island. So, 25 welcome aboard to both you, and to Dr. Bier. I'd also like to take a few 26
4 minutes just to recognize one member who has recently left the committee, 1
and one member who will soon depart. Dr. Peter Riccardella retired in 2
August of 2021 after serving two terms, including one year as chairman of 3
the ACRS.
4 Since joining the agency in 2013, Dr. Riccardella made 5
significant contributions to the committee in areas of structural, and seismic 6
analysis. Among other important work, Dr. Riccardella led the ACRS's 7
review of the agency's first design certification renewal, the ABWR. Dr.
8 Dennis Bley, who is with us virtually today, will depart the committee in 9
December 2021. He's served as a member since 2007, and has chaired 10 the ACRS.
11 Dr. Bley has been a significant contributor to the work of 12 the ACRS for many years and has led the committee on important issues 13 involved in probabilistic risk assessment, Fukushima lessons learned, 14 external hazards, and recently, the work on preparing for licensing advanced 15 reactors such as 10 CFR part 53. Dr. Riccardella, and Dr. Bley, thank you 16 for your service. The independent role of the ACRS is critical to fulfilling the 17 mission of our agency, and you've helped lead us through many novel and 18 challenging reviews. I am grateful for your unwavering commitment to the 19 protection of public health and safety over the years, and I wish you both 20 well in the future.
21 With that, we'll get started. I'd like to notice we're hybrid, 22 Commissioner Baran, and I are here in our headquarters are here in One 23 White Flint in Rockville, Maryland, and I believe Commissioner Wright is with 24 us from his home in South Carolina.
25 And, of course, our ACRS members are hither, and yon as 26
5 they will be in their home offices, or other environs. So, leading the way as 1
we probe further into the recesses of pandemic life with a hybrid meeting this 2
morning. And I'll just note, I'll give my colleagues at this point then, an 3
opportunity to make any remarks they'd like to make. Commissioner 4
Baran?
5 COMMISSIONER BARAN:
- Thanks, Chairman.
6 Welcome to our new members, and I just want to take a moment to echo 7
what you said about Dennis. Dennis, you are really going to be missed.
8 It's hard for me, it's been seven years that I've been on the commission, 9
you've been on ACRS for that time, and longer, and just such an integral 10 part of ACRS, you are really going to be missed. Your contributions to 11 ACRS have really just been huge, and we have all benefitted from that, so 12 thank you.
13 CHAIRMAN HANSON: Thank you Commissioner Baran.
14 Commissioner Wright?
15 COMMISSIONER WRIGHT: Good morning, I really don't 16 have much to add, except I do want to echo what Commissioner Baran said, 17 welcoming the members, and also to welcome Mr. Bley. There's been a lot 18 that I have learned in a very short time from this committee, and they're very, 19 very important. So, we're going to miss the ones that are moving, and we 20 really are welcoming, and look forward to working with the ones in the future, 21 the new ones.
22 CHAIRMAN HANSON:
Excellent, thank you 23 Commissioner Wright. So, with that we'll begin with Dr. Rempe, who is vice 24 chair of the ACRS. Dr. Rempe, the floor is yours. I think you're on mute 25 Dr. Rempe. Well, not quite.
26
6 DR. REMPE: How about this, is this better?
1 CHAIRMAN HANSON: There we go, perfect, love it.
2 DR. REMPE: Thank you. Good morning, as you 3
acknowledged, I am Joy Rempe, and I do serve as vice chair of the Advisory 4
Committee on Reactor Safeguards. We do appreciate the opportunity to 5
greet you today, and we appreciate the kind remarks that you've made in 6
your opening statements today. Slide 2 shows the agenda for this briefing.
7 First, I will provide a general overview of the activities that we've completed 8
since our last briefing to you in December 2020.
9 Then Member Petti will summarize the ACRS advanced 10 reactor activity, focusing on our review of staff's 10 CFR part 53 non-light 11 water reactor rulemaking activities, and development of associated 12 guidance. Member Brown will next discuss our most recent letter regarding 13 unidirectional communication. And last, our chair, Matthew Sunseri will 14 discuss our review topical report submitted by NuScale on the Control Room 15 Staffing Plan.
16 Since our last briefing, we have produced 14 letter reports.
17 As indicated on slide 3 -- hopefully slide 3 will come up soon -- several of 18 these reports pertain to agency activity regarding non-LWR, and small 19 modular LWR submittals. As mentioned previously, briefings by David Petti 20 and Matt Sunseri will focus on two of these reports. As indicated on slide 4, 21 we continue to review, and offer advance that -- excuse me -- offer advice for 22 digital instrumentation and control and, mentioned earlier, Charles Brown will 23 be discussing one of these reports today. As also indicated on slide 4, we 24 have provided letter reports on several other topics, and today I'd like to 25 highlight two of these reports. First, we completed our final review of the 26
7 multiyear effort by the Office of Regulatory Research to develop the 1
Integrated Human Events Analysis System, or IDHEAS general methodology 2
for assessing human reliability at nuclear power plants, as well as several 3
applications for the IDHEAS methodology.
4 Issuance of this letter report also completes our response 5
to a 2006 commission staff requirements memorandum directing ACRS to 6
work with the staff, and external stakeholders on this topic. Second, we 7
provided a report regarding the Office of Reactor Regulations review of the 8
seven nuclear company submittals to address generic safety issue 191 at 9
Vogtle Units 1 and 2.
10 This is the second application involving the use of risk 11 information to resolve a generic safety issue associated with debris 12 accumulation effects on long term core cooling, a topic that ACRS has 13 followed for many years. Slide 5 highlights other ongoing ACRS activities 14 that may be of interest. First, we do continue to follow agency 15 transformation activities and initiatives. Since we last met with you, we 16 were briefed by the staff on their EMBARK and Be riskSMART efforts.
17 We stayed abreast of staff efforts to prepare for advanced 18 LWRs, as well as non-LWR submittals. In addition to briefing, our own 19 ACRS staff keeps us informed by providing reports on relevant agency 20 activities, such as meetings with stakeholders regarding advanced reactor 21 licensing efforts. Second, we continue to implement improved processes 22 for completing our own safety-focused reviews with increased operational 23 efficiency.
24 Our Chair, Matthew Sunseri successfully led an effort for 25 us to update our bylaws, carving out a new approach that weve adopted 26
8 over the last few years. Many of these improvements take advantage of the 1
flexibility offered by the virtual meeting technologies that the agency 2
acquired during the pandemic. As we observed staff efforts to focus on risk 3
important activities, we've also tried to improve the effectiveness of our own 4
activities, focusing on reviews that had the most safety impact.
5 Members debate whether optional letters will actually 6
benefit the agency before we embark on the letter writing effort. We also 7
are continuing efforts to respond to the RES request that in lieu of our quality 8
reviews, we provide informal comments during information briefings on 9
topics of special interest, such as the staff approach to address the loss of 10 the Halden radiation testing capability, and the RES progress of Future 11 Focused Research projects that are designed to close technical gaps and 12 prepare the agency for new technologies.
13 Finally, as you indicated at the beginning of this meeting, 14 there have been committee membership changes with several members 15 departing, and two new members joining us. Today, I'd also like to note that 16 we're pleased that you've approved our request for a new member, and 17 inform you that the solicitation for this new member has now been posted in 18 the Federal Register. This completes my overview, and I'd now like to call 19 on member Petti to provide his report on advanced reactor activity. Dave?
20 DR. PETTI: Thank you Vice Chair Rempe. Today I'd like 21 to talk to you about advanced reactor activities, the advice we're providing in 22 part 53, fuel qualification and source term. Next slide please. So, first it's 23 important to note that the advanced reactor technologies under 24 consideration, and the sizes in which they're being developed really vary.
25 Many of the technologies derive from the Generation IV initiative that started 26
9 around 2000.
1 We have things like sodium fast reactors, high temperature 2
gas-cooled reactors, those are two at the top that I show. These also 3
happen to be the two that DOE has provided funding for in the advanced 4
reactor demonstration project. But there's also gas cooled fast reactors, 5
lead cooled fast reactors, molten salt reactors, fluoride high temperature 6
reactors, and even heat pipe reactors, as shown in the lower right, that's 7
Westinghouse eVinci microreactor.
8 We also are being asked to look at fusion, and that ranges 9
from fusion experience, so called next steps, to try to evaluate burning 10 plasma physics up to fusion power plants where one has breeding blankets 11 to close their fuel cycle, and the hazards are very different. They come in a 12 range of sizes, microreactors tend to be less than ten megawatts thermal, 13 but then many of these designs are larger modules with multiple reactors on 14 a single site, up to probably around 600 megawatts thermal.
15 Next slide. The characteristics of these advanced 16 reactors are very different than light water reactors. First, their hazards vary 17 with power level and radionuclide inventory. Microreactors in the fusion 18 experiments are similar in many ways from a hazard perspective to medical 19 isotope facilities, test reactors, and even TRIGA reactors. Whereas the 20 advanced reactors that are larger, and LWR SMRs tend to be more similar to 21 the current fleet when one looks at it from a hazard.
22 But in all of these, we would expect reduced source terms 23 with these technologies. This would affect siting, emergency planning with 24 smaller EPZs and LPZs than the current fleet. They also have a high 25 degree of passive safety, whether that be passive heat removal, they have 26
10 inherent characteristics that result in highly retentive fission product barriers, 1
such as molten salt, and TRISO fuel, for example, that are very retentive of 2
fission products.
3 They have strong negative reactivity feedback, cores with 4
solid moderators, neutron leakage, and small sodium reactors, these are 5
characteristics that really define a lot about the technology. And most of 6
them, if designed properly, don't need AC power to operate safety systems.
7 If we look at the reactor technology through a defense-in-depth lens, we find 8
that there's much more emphasis on prevention, and much less on 9
mitigation.
10 It's different than the current fleet, and the role of the 11 operator is different. And you'll hear a little bit about that when Matt Sunseri 12 talks about NuScale in the control room staffing, you'll see that illustrated.
13 Next slide please. Let me talk a little bit about part 53. It's a very high 14 level, top down approach, and it's flexible to be technology inclusive, and to 15 cover the range of power levels, and hazards that I talked about earlier over 16 the entire life cycle.
17 Starts with a safety objective, protecting the public.
18 Discusses the safety criteria, these are the numerical values that are in the 19 law today, for instance the 25 REM siting criteria, and then identifies what's 20 the principle safety function that must be executed successfully to meet 21 those criteria that's limiting the release of the radioactive material. And then 22 there are supporting safety functions that must be accomplished to ensure 23 that the principal safety function is met.
24 Those are things like removing the decay heat, controlling 25 nuclear reactivity, controlling chemical energy. From that, then there are a 26
11 number of design criteria that are established that reactor designers must 1
meet. A handful of them are technology independent, and those are in part 2
53 today, things like defense-in-depth, ALARA, QA, and the need for codes, 3
and standards. But then there's a number of technology-specific design 4
criteria that are required by the applicant to propose to the agency, and to be 5
reviewed by the staff to be found acceptable.
6 For instance, there was a large effort by DOE and NRC to 7
develop advanced reactor design criteria, and that's an example of those.
8 This is still a work in progress. We meet with the NRC staff monthly on part 9
53, and many detailed comments from us. We think the approach is logical, 10 and coherent, and we do support the approach being taken by the staff.
11 Next slide please. One of the major comments that we have had to do with 12 flexibility versus regulatory certainty.
13 With a rule this broad to cover this range of hazards, 14 flexibility is really important. That's what the staff is hearing from 15 stakeholders. The more specificity one puts into the rule, the more certainty 16 there is, but the less flexibility, and so this is an inherent trade-off in part 53.
17 As we've discussed with them some of the rationale behind the rule, we've 18 asked them to try to embed more of it into the rule itself to help with clarity.
19 We've asked for a better definition of the risk-based approach to the 20 reliability of structural safeties, and components that replace the single 21 failure criterion.
22 We've suggested that advanced reactor surrogate metrics 23 are needed for the qualitative health objectives, not the ones that are used 24 for the existing fleet core damage frequency, and large early release 25 frequency, because those are not necessarily applicable in terms of the way 26
12 accidents evolve in some of these advanced technologies. And we've had 1
many recommendations regarding clarity in the wording related to the safety 2
analysis requirements, and those have all been accepted by the staff. Next 3
slide please.
4 We've continued to stress in multiple letters, the need for 5
systematic searches for hazards, initiating events, and accident scenarios.
6 When one has a new technology, some sort of a systematic approach is 7
necessary to compensate for, in many cases, the lack of operating 8
experience with these technologies to make sure that biases are minimized, 9
and there are a number of techniques available from other industries that 10 can be applied.
11 We've recommended a licensing pathway like prototype 12 testing remain to be available to applicants, particularly those that have very 13 little operating experience. We noted that the schedule to issue all the 14 needed detailed guidance looked very ambitious to us. Getting the rule out 15 is a challenge, and then all the detailed guidance, which is where the rubber 16 meets the road in a lot of ways, will be a challenge for the staff.
17 That said, we all felt that the staff's ability to graciously 18 accept comments from all sources, and to seek resolution of competing 19 requests is really quite commendable. They are getting comments on all 20 ends of the spectrum, and their ability to balance that is remarkable to us.
21 So, we felt to note it in the letter. Let me turn now to a couple of other 22 activities that are underway. The first is fuel qualification, on the next slide, 23 yes, thank you.
24 The fuel qualification for advanced reactors is an issue that 25 stakeholders have talked about over and over again. And the staff has 26
13 developed a NUREG to outline the requirements that they see for fuel 1
qualification. There's an assessment framework, and it focuses on the need 2
for data, which we strongly support. And it includes requirements, for 3
instance in fabrication, radiation performance, accident performance, source 4
term, code V&V, quality, the need for data, all the important things that we 5
tend to want to see in fuel qualification.
6 Also notable is that they plan to apply this framework using 7
a high technology readiness and a low technology readiness fuel. A high 8
technology readiness fuel would be the metallic fuel for starting fast reactors 9
shown here in the upper right. A low technology readiness fuel is a carbide 10 fuel with certain carbide cladding for a gas cooled fast reactor being 11 proposed by General Atomics. We've also reviewed a topical report on fuel 12 performance from KAIROS based on TRISO fuel.
13 And last year we reviewed a baseline particle performance 14 topical report on TRISO fuel. There's also been a report on older legacy 15 metallic fuel data from the old EBR II days that serve as a foundation for that 16 fuel system. And actually this week in subcommittee, we reviewed the --
17 where the fuel is dissolved in the salt. So, lots of activity here, all coming 18 together quite nicely, and actually critical in terms of supporting part 53.
19 Next slide please. We talked a little bit about source 20 term. As you know, it's at the heart of many regulatory activities. It's a key 21 onus basically, as one qualifies the fuel, the fuel is where the source term 22 begins, so it tends to be owned by the fuel developers. It's important in the 23 traditional safety analysis, but also in PRA. It affects public and worker 24 safety, siting, emergency planning, and overall licensing.
25 But we note that the source term for the advanced reactors 26
14 differs from light water reactors. There's different source strengths because 1
of the different power levels, and the isotopes; tritium for instance, is a major 2
concern in lithium based molten salt, and in fusion, and that tends to be less 3
of an issue in the current fleet. There's differences in what I call the degree 4
of releasability. There's inherent retention in coolants like molten salt, in 5
sodium, and in fuel forms like TRISO fuel.
6 The volatility, the timing, and the accident response, which 7
is all part of the definition of source term is very different in these systems 8
because of their different physical characteristics. We are basically seeing 9
and will be seeing numerous upcoming source term related activities over 10 the next three to four months. And so, as we were talking, ACRS felt that it 11 was important to have a road map showing how all these pieces fit together.
12 We actually had a phone call with NRR, and they were on 13 the exact same page, and recommended that they come to us, and show us 14 how all the pieces fit together, and we take that horizontal view, which is so 15 important I think for the ACRS. We see each of the topics separately, but 16 this is one that integrates across the entire spectrum, and so we're very 17 looking forward to that. And you'll see a letter on that some time next year.
18 Next slide please. So, in summary, I'll just say that the 19 regulatory activities related to advanced reactors really are in full gear. Part 20 53 is a major undertaking by the staff; we find the approach coherent, and 21 logical. The schedule to issue the detailed guidance that will be needed 22 looks very ambitious, and the fuel qualification, and source term activities, 23 which are really key underpinnings of the regulatory process are also 24 underway. With that, let me turn it over to Member Brown to talk about the 25 digital I&C work. Thank you.
26
15 MR. BROWN: Thank you Dave. I will be addressing our 1
March 30th, 2021, letter to the commission on unidirectional digital 2
communications, and digital instrumentation and control, and monitoring 3
systems. Next slide. Background, our letter report of November 23rd, 4
2020, on Branch Technical Position 7-19, Revision 8. Guidance for 5
evaluation of defense-in-depth, and diversity to address common cause 6
failure due to latent defects in digital safety systems noted that the 7
November 2019 version emphasized that interconnections between high 8
safety significance, and lower safety significance systems should be through 9
one way digital communication devices, rather than bidirectional devices that 10 reduce independence, and defense-in-depth, and compromise control of 11 access. Thus, the external plant access and compromised software in 12 lower safety significance systems, or in plant networks do not compromise 13 high safety significance systems. This language was deleted in all later 14 revisions of the draft branch technical position, including Revision 8.
15 As a result, we recommended that Revision 8 be revised to 16 ensure that interconnections between high safety significant systems, and 17 those of lower safety significance are one-way, unidirectional, not 18 implemented in software digital communication devices. Next slide please.
19 The staff response disagreed, stating that BTP 7-19, 20 Revision 8 is guidance for staff reviewers, and cannot prescribe, or impose 21 specific design requirements, such as those described in our 22 recommendation. We strongly disagree that our recommendation 23 unnecessarily imposes either specific design requirements, or a specific 24 component design. In previous discussions, the staff has stated that they 25 cannot review electronic controlled access, and unidirectional data 26
16 communications for internal digital I&C systems, or in plant to external 1
systems during the design review phase. Instead, it is viewed as an 2
operational issue, and cyber security concern during licensee programmatic 3
review under 10 CFR 73.54, where guidance is provided by Regulatory 4
Guide 5.71, Cyber Security Programs for Nuclear Facilities.
5 It's important to note the difference in the terminology that 6
we've used in this particular slide. The ACRS is focusing on control of 7
access in accordance with IEEE standard 603-1991, which is invoked in 10 8
CFR 50.55a(h), and part 52 for design of reactor protection systems, and 9
safety systems. The staff still considers this a programmatic issue to be 10 dealt with long after the reactor protection systems, and safety systems have 11 been designed, manufactured, and possibly even installed.
12 Next slide please. In our March 31, 2021, follow up letter 13 to the Chairman, our main points were that computer-based digital 14 instrumentation, and control systems for reactor protection safeguards, and 15 other reactor, and steam plant control and monitoring systems results in 16 significant improvements in plant performance. Second, computer-based 17 I&C systems drastically, and I want to emphasize drastically, increase the 18 vulnerability for control of access to critical reactor protection systems, 19 safeguards, and in plant networks through communication of digital data, 20 and control systems.
21 With digital I&C architectures, and networks configured for 22 bidirectional data communication using software, control of access is gravely 23 threatened, and is not an abstract consideration. In plant systems and 24 networks that control all plant operations are now susceptible to attacks from 25 external plant sources that connect to the internet if they are using 26
17 bidirectional communications.
1 This results in a
compromise of independence, 2
defense-in-depth, control of access, three of the fundamental digital I&C 3
design principles. I'd like to again note that our focus is on control of 4
access; it's not a cyber security issue in our estimation. Next slide please.
5 The problem is that cyber security, and other security controls are not 6
addressed, and applied until the later phases of the life cycle that occur at a 7
licensee's site, be it site installation, operation, or maintenance. By then, 8
the digital I&C system architecture is potentially already designed, and ready 9
for manufacture, or in the installation phase. Incorporation of unidirectional, 10 not implemented in software, hardware-based data communication devices 11 into the architecture, what that means is actually into the hardware at this 12 late juncture in the process, would possibly require a license amendment, 13 since it would be a licensing basis change with whatever delay and cost 14 implications it brings with it. Next slide please.
15 Our next point was that Reg Guide 5.71 should be used 16 during the design, and design review phase to ensure a strong defensive 17 architecture is part of the design licensing basis. Reg Guide 5.71 describes 18 a defensive architecture that is strong, and to the point, noting that all digital 19 safety systems should be in the highest defensive level. It only permits one 20 way data flow from higher level digital safety systems to lower level digital 21 systems; prohibits communication from digital assets in lower security levels 22 to digital assets in higher security levels; and notes that one-way 23 communications should be enforced using hardware mechanisms. The 24 point of our recommendation is to use the guidance of 5.71, and methods in 25 that regulatory guide in the system design to ensure control of access to 26
18 reactor protection systems, and safety systems is maintained to the same 1
level that reactor protection systems, and safety systems are for existing 2
analog systems.
3 None of this guidance, and methods are in the SRP, Reg 4
Guide 1.152, which is for computer applications to digital I&C. Branch 5
Technical Position 7-19, which is diversity in Defense-in-depth, or ISG-06, 6
which is a preliminary licensing operation to help explain to the applicants 7
what is expected when they submit their application. Next slide please.
8 The alternative of incorporating cyber security software into any operating 9
system software for in plant systems and networks involved in protection, 10 control, and monitoring is problematic on two counts.
11 First, cyber security software is primarily reactive. It 12 mostly protects against attacks that have already been observed. Second, 13 it would disrupt all critical operational functions of the protection system, and 14 safeguards, and networks by imperiling those system's timely completion of 15 programmed cycle operations. It would require constant software upgrades 16 to maintain currency, similar to what we experience with laptops, and other 17 systems that we deal with in our normal day-to-day operations, increasing 18 the possibility then of introducing malware during the upgrades that allow 19 cyber compromise, or I should probably say allow access where it was not 20 intended. Next slide please.
21 Summary of the main points. Allowing the use of 22 computer based digital I&C systems, and architectures, and networks 23 configured for bidirectional data communication, or software configured 24 unidirectional data communications threatens control of access, and 25 compromises independence and defense-in-depth.
26
19 They compromise plant safety by leaving high and low 1
safety significance systems open to the kind of attacks that have seriously 2
impacted other industries and government agencies. We provided several 3
of those in our letter to the Commission as examples of very severe 4
applications of hackers gaining access. Next slide please.
5 Summary continued, we recommended that the 6
Commission direction is needed for the staff to assure during design 7
reviews, that only unidirectional hardware-based data communication 8
mechanisms not implemented in software are used between high safety 9
significance systems, and those of lower safety significance.
10 Consistent with the Be riskSMART, guidance to the staff 11 would help cases where regulations provide flexibility, they are guidance 12 after all, but overly rigid interpretation can be detrimental. This ensures at 13 the design review stage, there are not any software deficiencies, or back 14 doors within the in-plant networks, and systems that can be exploited by 15 internet connected sources to access in plant systems and networks. Thus, 16 independence, and redundancy, defense-in-depth are not compromised.
17 Next slide please.
18 Activities following the ACRS letter. We have not yet 19 received a formal response from the staff. We have observed in public 20 documents, and a memorandum to the EDO dated April 14, the Chairman 21 directed the staff to undertake a review, and within 90 days provide the 22 commission information on how the issues raised by the committee have 23 been addressed. The EDO established an independent team of experts to 24 respond to these matters raised in the ACRS letter.
25 In a memorandum to the Commissioners that was dated 26
20 July 14, the EDO reported the results of the team evaluation as follows.
1 The concerns identified by the ACRS letter do not identify a safety issue not 2
currently covered by NRC regulations. Second, mandating hardware for 3
unidirectional communication would not increase the level of cyber security 4
protection. Again, their focus is on cyber security, not control of access.
5 Mandating hardware -- next slide please, I'm sorry.
6 Mandating hardware unidirectional devices would add a regulatory burden, 7
reduce flexibility, and make the NRC's regulations more prescriptive in an 8
area where performance-based regulations have proved effective.
9 However, the team concluded that specific guidance documents could be 10 revised to encourage design certification applicants to consider the cyber 11 security requirements during the design phase for future operating license, 12 or COLs.
13 The team recommendation was then to revise Reg Guide 14 5.71 and 1.152, Criteria for Use of Computers in Safety Systems of Nuclear 15 Power Plants, to make applicants for design certifications aware, that's a 16 very key word there, of cyber security requirements, and cyber security 17 controls to be considered during the design phase of nuclear power reactor 18 design. Next slide please.
19 Revise BTP 7-19 to clarify how the inclusion of 20 unidirectional digital communications could reduce the scope of the review of 21 defense-in-depth and diversity. We weren't really concerned with reducing 22 the scope, but more ensuring that we had control of access covered. The 23 EDO evaluation, they accepted the team's recommendations and 24 conclusions, and said the staff will be directed to revise these regulatory 25 documents as soon as possible. Therefore, while we have not seen a 26
21 formal response addressed to the ACRS, as stated, the point of our 1
recommendation is to ensure the designs meet the 10 CFR 50.55a(h) control 2
of access requirements for control of access.
3 As a result, we stand by our letters of November 23, 2020, 4
and March 31, 2021. We cannot evaluate specific proposed staff actions at 5
this point, until we have seen the changes, or the proposed changes to the 6
regulatory guides and branch technical positions. Next slide. I've 7
completed my presentation, and I will pass it onto Matt for his section.
8 MR. SUNSERI: Thank you, Charlie. Good morning 9
Chairman Hanson, and Commissioners Baran and Wright. Thank you for 10 the opportunity to present the committee's view on the NuScale control room 11 staffing topical report, we look forward to your interactions. Next slide.
12 This slide depicts the features of the NuScale design that 13 differentiate it from the current fleet. Attributes such as the nuclear power 14 module being immersed in a large reactor building pool that serves as a 15 passive heat sink highlights one of the differences.
16 We considered several of these features as we evaluated 17 the proposed staffing plans. Next slide please. The passive safety 18 characteristics, and the enhanced safety margins of design combined with 19 the simplicity of tripping a module, and placing in passive cooling mode help 20 reduce the reliance on personnel action to maintain the safety of the plant.
21 Once in passive cooling, much more time is available before operator action 22 is necessary, thus giving back resources to the operating crew to devote to 23 higher priority tasks.
24 Design demonstrates that minimal operator intervention is 25 required within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> for a wide spectrum of design basis events, and the 26
22 improved human system interface in the main control room design 1
functionality displays are a real advantage for the operators. The at a 2
glance displays, the tiered alarms, the multi module trending, and the direct 3
links to procedures takes much of the burden off of monitoring and 4
assessing off the operators, thus giving them more individual capacity to 5
devote to oversight and control of the plant.
6 We took these features into account as we completed our 7
review. Next slide please. We had two opportunities to consider the 8
control room staffing needs. The first was during our review of the design 9
certification application that we completed in July 2020. NuScale proposed 10 at that time a minimum shift crew of six operators. Next, in its revised 11 control room staffing plan, NuScale proposed operating up to 12 modules, 12 with a minimum shift crew of three licensed operators, two of those being 13 senior reactor operators and one reactor operator.
14 NuScale also proposed eliminating the shift technical 15 advisor as a crew member, combining the functions with the shift manager 16 SRO, and the crew. And before we go into the details of the evaluation, a 17 little background might be instructive here. Next slide. The current staffing 18 requirements are specified in 10 CFR 50.54. The regulation did not 19 anticipate that there might be some day a design with as many as 12 20 reactors being operated from a common control room.
21 As Member Petti mentioned during his remarks, the role of 22 the operator is different for these new reactor designs. The staff recognized 23 that there would be issues for the multi module small modular reactors, and 24 designed a two-part approach for addressing these issues. For the initial 25 applicants that would be challenged with the requirements of 10 CFR 50.54, 26
23 the path forward was to proceed with exemption requests using the general 1
framework of the standard review plan, in particular chapter 18, the human 2
factors engineering section and the comprehensive human factors 3
engineering review covered by NUREG-0711. Staff also has sound 4
guidance for assessing exemption requests as referenced in NUREG-1791.
5 For the second part of the approach, the staff plans to pursue rulemaking for 6
the longer term as experience is gained from these early applications. Next 7
slide please.
8 All right, so now let's get into some of the technical details.
9 The technical basis for the staffing plan provided by NuScale is built on a 10 series of staffing plan validation exercises. NuScale conducted two staffing 11 plan validation exercises. The first was with two crews of six persons as 12 specified in the DCA. The persons assigned to these crews were trained on 13 the operating and emergency procedures. Scenarios for these validation 14 exercises including a spectrum of challenging high workload operating 15 conditions, including design basis events, beyond design basis events, multi 16 module transient and upset events, and a large scale loss of main control 17 room displays.
18 Acceptance criteria include performance within the 19 specified batch completion times, establishing a performance indicator, and 20 situational awareness questionnaires. We found the situational awareness 21 questionnaires particularly interesting, because they provided good insights 22 into what the operators knew about the scenario, and that they were making 23 decisions for the right reason. Next slide please.
24 In the revised staffing plan validation exercises, a three 25 person crew consisting of an SRO, senior reactor operator as the shift 26
24 supervisor, another senior reactor operator, and a reactor operator. The 1
testing was repeated for a similar spectrum of events with different 2
scenarios. This was done to ensure that the operators were not 3
compromised or preconditioned with knowledge of the scenarios.
4 The two operating crews were able to successfully operate 5
the plant with up to 12 modules, meeting all the task performance and 6
evaluation criteria as demonstrated by the larger crews. And there were no 7
high priority human engineering discrepancies, retesting, or corrective 8
actions identified. Committee had in-depth discussion with NuScale on 9
these exercises, and with staff on their safety evaluation. Next slide please.
10 The staff determined that the NuScale simulator test bed 11 was adequately representative of an as-designed main control room. The 12 test scenarios were audited, evaluated, and found sufficiently representative 13 of plant operations and challenges. Successful performance of the task 14 assignments in the spectrum of test scenarios for two different crews of 15 three was determined to be a satisfactory demonstration of minimal crew 16 requirements. So, the staff concluded that a 12 module plant can be 17 operated safely and reliably by a shift that's three licensed operators from a 18 single control room under high work load conditions. Next slide please.
19 This slide is mainly a summary of items that I've covered in 20 a previous slide. The first four items deal with the design features. The 21 fifth item is on the validation exercises. In addition to these points, and prior 22 to COVID, we had the opportunity as part of our design certification 23 application review to visit the simulated control room, and see firsthand the 24 control room layout, configuration of displays, and how information is 25 presented to the operators.
26
25 We also had an operator walk us through a couple of 1
plant transients to give us a sense for in real-time, how the operators interact 2
with the plant. This experience was helpful in our discussions with 3
NuScale, and staff as we went through the validation exercises, and design 4
features. And finally on this slide, for a NuScale plant with 12 modules, 5
refueling activities will be occurring frequently. A provision for an additional 6
senior reactor operator on the plant floor during refueling operations is 7
intended to further remove burden from control room staff, and this is 8
consistent with 10 CFR 50.54. Next slide please.
9 And as a final note on our review of the staffing plans, 10 staffing validation activities were highly dependent on the simulated control 11 room design attributes, such as the critical safety functions, and 12 defense-in-depth monitoring and displays, the tiered alarm scenario scheme, 13 and 12 module trend monitoring.
14 In our letter report, we recommended that the as-built main 15 control room will need to be thoroughly tested to ensure that the same 16 features used to validate the staffing requirements exist and function as 17 intended. The last area to cover is the proposal to eliminate the shift 18 technical advisor position. Next slide please.
19 Following the Three Mile Island accident, NRC required 20 establishment of an STA position at all plants to provide independent 21 engineering expertise and advice to the shift supervisor. It was recognized 22 that when qualifications of operators were upgraded and human system 23 interfaces were upgraded, the shift technical advisor could be eliminated.
24 The Commission has encouraged licensees to move towards a dual senior 25 reactor operator/shift technical advisor position for some time now.
26
26 NuScale has taken the function of the shift technical advisor and distributed 1
them into the three person crews. These functions were largely tested 2
during the validation exercises in conjunction with the enhanced control 3
room design. It's for these reasons that we agree that for the NuScale 4
design, sufficient justification exists to eliminate the STA position. And next 5
slide.
6 So, in summary, NuScale's design, the simplicity with 7
which modules can be placed in passive cooling, and the successful staffing 8
plan validation exercises provide confidence that up to 12 modules can be 9
operated safely with the proposed minimum three license operator crew.
10 We recommended that the staff's safety evaluation report be issued. We 11 also suggested that the minimum operating crews be supplemented with 12 additional independent engineering expertise until sufficient experience is 13 gained with multi module operation. This suggestion is aimed at addressing 14 the unknown unknowns that sometimes are discovered during initial startup 15 activities at first oft a kind plants. We look forward to reviewing applicant 16 submittals tha reference the Nuscale control room staffing topical report, and 17 this concludes my presentation, and I return it back to Vice Chair Rempe for 18 closing comments.
19 DR. REMPE: Thank you, Matt. This completes our 20 prepared remarks, and we'd now like to welcome questions from the 21 commission.
22 CHAIRMAN HANSON: Thank you Dr. Rempe, and thank 23 you to all of our presenters this morning. We're going to start the questions 24 with Commissioner Wright.
25 COMMISSIONER WRIGHT: Good morning and thank 26
27 each of you for your presentations this morning. This committee's 1
independent voice and advice on technical issues provides the NRC with 2
critical insights to what we do, and I'd like to acknowledge all that you do, 3
and have accomplished especially during the past 18 months as we've gone 4
through this pandemic. And like the rest of us at the NRC, y'all, and the 5
committee has adapted to that change and changing environment, and you 6
continue to effectively meet your mission, which we're very grateful for. So, 7
thank you for what you've done during these challenging times.
8 Dr. Petti, I'm going to start with you, thank you again for 9
your presentation, and I'm very interested in the -- I guess the progress of 10 part 53, as well as the committee's engagement with staff on the matter.
11 So, if I understand correctly, the ACRS recommended that a graded 12 approach, or PRA should be used, and I believe that's similar to the 13 feedback that we received from other stakeholders as well.
14 As you pointed out in your remarks, the staff should be 15 commended for its engagement for accepting comments from all sources, 16 and I believe the same goes for comments on how to approach a graded 17 PRA. So, has the ACRS engaged with the staff on how to best accomplish a 18 graded approach to PRA, and if not, do you have any thoughts on how this 19 could be best accomplished?
20 DR. PETTI: Good question, and very timely. In fact, we 21 anticipate in subcommittee meetings, either in next month, or the month 22 after, that this is one of the main topics. We've not talked in any detail with 23 the staff on this, except to note that it would be interesting to see what they 24 come up with. And so we haven't really heard anything else from the staff, 25 they're working on it at this point. I think there are options out there. If you 26
28 look at just what's done in other industries, there's other ways to look at 1
these, and it's hard to adapt them, not just adopt them, but adapt them for 2
the situation here.
3 COMMISSIONER WRIGHT: All right, thank you. So, I'm 4
going to stay with you. Another area I'm aware the staff has received 5
feedback on is the use of ALARA, the as low as reasonably achievable 6
principle. So, some stakeholders have indicated that while ALARA is a 7
tenet of good safety practice, its application to advanced reactors may be 8
too subjective, or ambiguous to include in part 53. Do you have any 9
thoughts on this?
10 DR. PETTI: Yeah, I don't fully appreciate I guess the 11 stakeholder response. Its requirement in the law already that ALARA be 12 implemented. Reechoing it in part 53 is just a matter of completeness, if 13 you will. It doesn't absolve them from ALARA, because that's already 14 required under the radiation protection standards, whose number I can't 15 remember right now, but maybe one of my colleagues remembers.
16 COMMISSIONER WRIGHT: Okay, thank you. So, I'm 17 going to go to Joy Rempe and Matt Sunseri here, so thank you both again 18 for your leadership on the committee. And I wanted to ask you about the 19 agency's transformation and risk informing initiatives. I think that many of 20 the staff's efforts, including the development of part 53 showed that the NRC 21 staff is being intentional about developing new regulatory frameworks and 22 licensing approaches that focus on the most risk and safety significant 23 aspects of the designs.
24 And I see these efforts as our principles of good regulation 25 at work. Staff is looking to leverage experience, and data to achieve our 26
29 mission in an effective, and efficient manner. Can you talk to me a bit about 1
how, if at all, the ACRS is adapting its review approach to complement the 2
staff's activities, and focusing on the most risk and safety significant 3
aspects?
4 DR. REMPE: Do you want to go first Matt, or you want 5
me to?
6 MR. SUNSERI: Well, it doesn't matter, you can go ahead.
7 DR. REMPE: Well, as I mentioned in my presentation, we 8
are trying to focus on what aspects will have the most safety impact in our 9
reviews. As you may recall, when we performed the NuScale review, we 10 changed our process a bit when we went through -- after we did the 11 individual chapters, we actually took a more integrated approach, and we 12 tried to focus on risk important aspects of the design.
13 And although we're not in the main impact of future 14 reviews, several applicants or design developers have come in with some 15 submittals, not only for non-LWR designs, but also the small modular 16 designs, and some of the medical isotope designs, and we are going forward 17 with that process in our subsequent reviews. I believe we had some fairly 18 positive feedback from the staff on that approach. Your turn, Matt.
19 MR. SUNSERI: Thanks. I think, Commissioner Wright, 20 thank you for the question, I would only add to Chair Rempe, is that the Be 21 riskSMART initiative that the agency is undertaking we see as a very 22 valuable approach, and framework. We've even adopted it in some of our 23 own letter reports that we've used to strike that balance. And we see the 24 staff really working more to use that kind of thinking if you will, in their 25 regulatory decision and process development. So, that's the only thing I 26
30 would add.
1 COMMISSIONER WRIGHT: All right, thank you. So, I'm 2
going to stay with you again, another little follow up here. So, I'm also 3
interested in your perspective of your committee's role with respect to 4
advanced reactor design reviews. So, how does the committee see its role 5
with respect to these reviews? For example, does the ACRS see its role as 6
conducting an independent safety review of a design, or more as conducting 7
a review of the staff's work for reasonableness?
8 MR. SUNSERI: Well, I can go first on that one. Our 9
charter at the ACRS is to review matters of safety. So, we're always looking 10 at these designs from the safety aspect. And our role in that is, depending 11 on where an applicant comes in with their particular design, some of them 12 are formal applications that are going through the process, and we 13 collaborate with staff. Collaborate is not the right word, but we follow the 14 staff. The staff conducts a safety evaluation, and then we weigh the 15 applicant's information, and we weigh the staff's information, and we make 16 our independent safety recommendations back to the Commission. And 17 that's on the formal application, but a lot of the advance work is coming 18 through in topical reports. So, it's coming through in pieces, and then we 19 essentially do the same thing though, we interact with the applicant, we 20 interact with staff, whether it's through their safety evaluation, or topical 21 report, whatever document, if you will, is being presented for approval. But 22 our focus is always on the safety aspects.
23 DR. REMPE: So, if I could add to this, I'd like to 24 reemphasize a point that Dr. Petti made that has appeared in several of our 25 letters. One of the more challenging aspects of these advanced reactor 26
31 designs is that they may present a different challenge. We have 1
encouraged the staff, as well as applicants to start with a clean sheet of 2
paper as they try and look at what the challenges are that might prevent 3
them from achieving critical safety function.
4 And I think that it's important that ACRS have that 5
independent review, and not only look at what the staff has reviewed, but 6
also step out of the box if you will, and think about is there something about 7
this design that might present a different challenge? And so that's why I 8
think it's very important to have that independent review at this time.
9 COMMISSIONER WRIGHT: So, thank you, I'm going to 10 follow up right there on what you just said. I want to see if I can get you and 11 Matt to comment on this. So, as you know there's considerable interest in 12 the time limits of NRC reviews of advanced reactor technologies. So, in 13 order to make our important safety findings, we need to have the right 14 resources in place so that we're not a barrier. So, can you talk to me a bit 15 about how the ACRS plans to handle the reviews of the multiple advanced 16 design concepts that we are expecting. Do you have the resources needed, 17 and the processes in place to accommodate timely reviews of these multiple 18 applications, and if not what is the committee doing to address these needs?
19 And is there anything that we at the commission can do to assist?
20 MR. SUNSERI: Well, I'll start again, and Joy, give you 21 some time to think about it. We do extensive planning for our reviews. We 22 stay, we follow staff on the applicants, and how they're coming in, and 23 regulatory action plans that are associated with that. In actuality, there are 24 quite a few applicants in play right now. There must be, I would guess 25 about a half a dozen or so things with various vendors that we are currently 26
32 reviewing, and we factor that into our schedule, our workload.
1 And right now, we always -- well, we periodically I would 2
say, step back, and assess our capacity, and our workload, and our 3
membership. We're allowed to have up to 15 members by regulation, by 4
statute, and we treat that as -- not a guideline, but that's an upper limit. But 5
we don't consider that to be, maintain that staffing level all the time.
6 Currently we're at 11, and that is the staffing level that supports the work 7
we've got coming in. We have some leaders leaving, and we've requested 8
new. So, we're continuously evaluating our resource capacity against our 9
workload that we currently have, and that we project to have, and we make 10 recommendations to the commission when we believe we need extra help 11 on that. We've made process improvements to help us get through these 12 staffing reviews. Vice Chair Rempe gave a perfect example with NuScale, 13 how we shortened that review, we got it done within the compressed time 14 frame that it was specified in.
15 In addition, as you recall, that application had some 16 challenges towards the end, some significant reviews had to be repeated, 17 and we were able to adjust our workload and our schedule to accommodate 18 that, and we got it done on time. So, I think we're open minded, and we're 19 flexible, and we want to work with staff, and we certainly don't want to be an 20 impediment to the completions. But you've got to keep in mind that we also 21 aren't designing these reactors and we're doing the independent review.
22 So, we are at the tail end of the process. We are between 23 the rock and the proverbial hard spot as they say, and so we're mindful of 24 that, and we work hard to make sure that we stay as far ahead as we 25 possibly can. Joy, anything you would like to add?
26
33 DR. REMPE: No, I think you've covered it very well.
1 Again, I would like to remind you that we do appreciate your willingness to 2
approve another member. It does take awhile to select a member and bring 3
them on board, and have them come up to speed, so I think that that's 4
important. And also our staff has been very good about keeping us aware 5
of what's going on, because there are a lot of activities in this area. Thank 6
you.
7 COMMISSIONER WRIGHT: Thank you very much, and 8
Mr. Chairman, I don't have a countdown clock, but I'm pretty sure ten 9
minutes is gone, so I'll pass it back.
10 CHAIRMAN HANSON: No worries at all Commissioner 11 Wright, I think we have plenty of time this morning, so no worries there.
12 Thank you all again for being here this morning. It's really a great pleasure 13 for me to get these updates. Dr. Petti, I'd like to start with you. Regarding 14 fuel qualification activities, what do you see are the key challenges with 15 licensing fuel technologies for near term advanced reactors?
16 DR. PETTI: I think the major issues are related to having 17 enough data, and the right type of data that supports safety analysis, 18 basically. And so those data take a long time, that's just sort of the nature 19 of the beast. You've got to irradiate fuel, you've got to irradiate enough fuel, 20 you've got to put it through its paces from a safety perspective, there are 21 special facilities that do that, and those just all take time.
22 There are pushes to accelerate that in the DOE, and I think 23 that can help what I would call low technology readiness fuels, get them up 24 the ladder faster so that you don't make a mistake, and have to go 25 backwards. That's one of the big issues in fuel qualification, is somewhere 26
34 along the line, it uncovers itself in your testing that you didn't think of, and 1
you've got to go back, and repeat something. And that's what takes it from a 2
10 year activity to a 20 year activity. So, that's really the biggest issue in my 3
mind.
4 CHAIRMAN HANSON: Thanks. I'd like to follow up on 5
just a couple of points you made on that. What's your kind of assessment, 6
or perspective on the current availability of testing facilities to support the 7
advanced reactors, and do you think that testing facility availability is posing 8
challenges for the deployment of new fuel technologies?
9 DR. PETTI: Yes. I mean I think we have been briefed by 10 the staff about the Halden facility being closed, and that really impacts for 11 instance accident tolerant fuel. For the advanced reactor fuels, most of 12 them are done at the advanced test reactor in Idaho. It is highly subscribed, 13 and saying that, if we have another test reactor, if today we said we needed 14 another test reactor, by the time that would be built, and ready, it's too late.
15 We kind of are where we are, we've got to hope that the 16 French facility, the Jules Horowitz reactor can come online soon, it's faced 17 delays. But we really are paced by the existing infrastructure. And if we 18 were smart enough, and looked 10, 15 years ago, we might have been able 19 to see this coming, and made different decisions, but that's not where we 20 are.
21 CHAIRMAN HANSON: Yeah, thank you for that, and I 22 think that it's an interesting problem that you know. One of the other things 23 you touched on, it made me think of the accelerated fuel qualification 24 initiative, which I know is something primarily at the Department of Energy, 25 but there's been some interactions here with the staff at NRC as well, and I 26
35 just wanted to see if you had some thoughts about that effort.
1 DR. PETTI: So, as I said, I think it can be very valuable 2
early when you've got a fuel that really hasn't really been tested, and you've 3
got ideas, and thoughts, and the models can help you think through 4
problems, whether that be performance, or even fabrication. I've made 5
something, and it looks weird, we don't understand it, it's not in the spec, is it 6
going to be good, or is it going to be bad, what do the models tell us?
7 So that you don't have to irradiate it, and then see what 8
happens. You can try to do it in advance. So, I think early on in the 9
process, when you've got a very low maturity fuel, it helps. But in the end, 10 even the people in the DOE complex, I've had lots of discussions with them, 11 they agree that there has to be testing of, let's call it fuel off of a true 12 production line, that's a fair representative of what would be put in the 13 reactor, and to do a final proof test to show that everything that's been done 14 to date works. That's the key lynchpin. You can accelerate getting there, 15 but still doing that, and standing up a fuel vendor to make these new fuels at 16 production quantities is not a simple task. It's overlooked by many. I spent 17 a lot of my career doing this for the TRISO fuel program, so I lived it. It's 18 very difficult, it's time-consuming. So, there's still big hurdles even with the 19 acceleration that just have to do with the engineering of getting a fuel vendor 20 ready to make this stuff, and do a final proof testing of it.
21 CHAIRMAN HANSON: Thank you, yeah, very interesting 22 stuff. I really appreciate that, of course that's my hobby horse, as many 23 people know, is the data, data, data on this stuff being really important for 24 validation and regulatory decisions. But kind of speaking, teeing off of that 25 data, I want to go in a little bit different direction on, and ask you a question 26
36 Dr. Petti, on probabilistic risk assessment.
1 And I'm curious about this, you talked about a graded 2
approach I think to PRA with Commissioner Wright, and what is -- we have 3
some really novel designs for advanced reactors out there, where we might 4
not necessarily have the kind of data that you might want, or might need to 5
populate a PRA, and I'm interested in your thoughts about kind of what is 6
your confidence level, and the ability of non-light water reactor PRAs to 7
support regulatory decisions that maybe rely heavily on the PRA, like the 8
licensing modernization project. And how do you see the challenges of 9
quantifying the reliability of new and novel passive systems, and the 10 uncertainties associated with the potential performance of those systems?
11 DR. PETTI: Right. I think it is an issue in one sense of, 12 let's call it a traditional or historic sense of how it's been applied to the 13 existing fleet. But there's a number of other tools in the risk analyst toolbox 14 that come from other industries. There's new chemical plants being 15 developed with new processes, how do they deal with this? And there are 16 techniques that one can use to estimate the frequency of events where you 17 don't have a lot of operations data.
18 The other thing that I think people forget is that we 19 anticipate that these reactors are going to be significantly -- have significant 20 margins to the regulatory limits. So, you can allow more uncertainty 21 because you're further away from, whether it be 25 REM, 1 REM, whatever 22 the number is that you're looking at. And so you don't need the precision 23 that you do necessarily for a light water reactor.
24 And so that's where some of these other techniques can 25 be helpful, and that's why we keep pushing on making sure you understand 26
37 what the potential events could be at the beginning. That's really the most 1
critical thing I think, in these designs, is what are going to be your safety 2
functions, what are going to be the systems to implement them? What are 3
those events that will be most important, and where do you think they're 4
going to fall in the consequence and frequency space?
5 A lot of that can be done in a very qualitative sense, 6
because, for instance some of these micro reactors, their hazards are so 7
much lower that one doesn't need all the precision that one uses for the 8
current fleet.
9 CHAIRMAN HANSON: Thank you.
10 DR. PETTI: I would call on any of my other colleagues 11 that have expertise, like Dennis, if he feels there's something he can add.
12 CHAIRMAN HANSON: Yeah, happy to hear it.
13 DR. BLEY: I don't have very much to add to that, I think 14 you covered it pretty well. We have had experience in both abbreviated 15 forms of PRA, and the thing we've learned from that, the thing I've learned 16 anyway, is there are places you can make conservative simplifications, but 17 the place you can't make simplifications is in the very beginning, identifying 18 the initiating events, and the scenarios that could lead to damage. You 19 have to do that very thoroughly.
20 In some of the other areas, you could do better. Now, in a 21 few of our earlier letters, we mentioned on some of these designs, especially 22 where you're going to have fairly small source terms compared to LWRs, the 23 right place to start is at the end, is what could be the source term, and then 24 work backwards, and see what you need to protect against that. So, that's 25 one of the things. We look forward to hearing where the staff's been going 26
38 on this, I know they've been working on it.
1 CHAIRMAN HANSON: Yeah, thank you. I look forward 2
to more of your insights, it just has big implications for how we look at these 3
designs, and I look forward to more of the ACRS's advice on this. As long 4
as I have you both, now that I've engaged both of you, I do have one kind of 5
last question, I'll beg Commissioner Baran's forbearance here just for a 6
second.
7 The current preliminary part 53 language includes, or 8
proposes to include quantitative health objectives, and can you share the 9
committee's thinking on this, and whether there could be some unintended 10 consequences in making quantitative health objectives regulatory criteria?
11 DR. PETTI: My sense is we need good metrics for the 12 advanced reactors, and that's what we've told the staff. We know that it's 13 not easy, but that we need something beyond the qualitative health 14 objectives that are there. We're hoping, we gave them a couple of ideas as 15 I recall, some NUREGs that were done, where this was looked at. But we 16 have not heard anything back from them. I'm thinking is it something fairly 17 simple that can be done based on the large margin that exists, for instance, 18 to the regulatory limits and from that try to make some estimates. Dennis, 19 do you have any thoughts?
20 DR. BLEY: Well, back when we were talking about this 21 with the staff, we had really two concerns. One was in some cases it could 22 be difficult to apply the quantitative health objectives. The staff has assured 23 us that at least in many of the places they've looked, that can be done 24 reasonably well. The other thing we were concerned about was the original 25 layout with the two-tiered approach with the quantitative goals being in the 26
39 second one. And we had trouble seeing the benefit of having things 1
separated in that way, and as far as I know, most of the committee still sits in 2
that spot.
3 DR. PETTI: Yes, and the staff has moved away from that 4
two-tier structure, you weren't at our last meeting Dennis, but they've not 5
removed any requirements, it's just sort of the way it's been presented in the 6
language.
7 DR. BLEY: Okay, that makes sense to me, I'm glad. I 8
look forward to seeing the transcript.
9 CHAIRMAN HANSON: Well, thanks to you both, and with 10 that, I'll hand it over to Commissioner Baran.
11 COMMISSIONER BARAN: Thanks. Well, thank you for 12 your presentations, and all your work on the committee. It's incredibly 13 valuable to the agency. I'd like to start by asking about the staff's new 14 guidance on assessing volcanic hazards. This guidance is relevant to 15 advanced reactors, because some vendors are considering sites in the 16 Pacific Northwest or Alaska, where there are active volcanic regions.
17 Based on my read of the letter, it sounds like ACRS thought the guidance 18 was a good start, but noted that research is needed to establish the impact 19 of volcanic hazards on the performance of equipment and personnel inside, 20 and outside the facility. Can someone tell us a bit more about what 21 research would be needed for volcanic hazard analyses to be effectively 22 performed for new reactor siting?
23 DR. REMPE: So, I'll start, but then I'd like to let Dennis 24 follow up, since he was the lead on that letter. But I believe our concern 25 was primarily associated with how the releases associated with a volcanic 26
40 hazard, ash, for example, might affect other facilities nearby, as well as the 1
reactor. And actually the staff response, actually concurred with that 2
recommendation, and said they were aware of IAEA research on that topic, 3
and they intended to follow that research. And if I could, I'd like to invite 4
Dennis to weigh in, if he has any additional insights he'd like to share.
5 DR. BLEY: I think we laid it out in a letter, but it's been 6
awhile, I don't remember exactly what we said there. But the ash problem is 7
especially troublesome, because that ash can be extraordinarily fine, and a 8
number of the members have had experience, or are aware of anecdotal 9
evidence where very, very fine sand fines, or ash finds its way into places 10 you can't imagine, into systems that appear to be sealed.
11 And there's very little good information documenting that 12 issue, and that's the place we thought needed a fair amount of work, 13 because the ash can cover a fairly wide area. It's not like the lava isn't 14 going to go all that far, as long as you're not right close, you're probably okay 15 with that one. But the ash issue is pretty important.
16 COMMISSIONER BARAN: Thanks, that's helpful. Can 17 you give us a sense, what's the current state of knowledge of equipment 18 failure rates caused by volcanic hazards, for example the very fine ash that 19 you refer to. Is there good data on that, or that really is the research gap?
20 And I guess more broadly, maybe just tie it a little bit to how far along is the 21 probabilistic risk assessment in this area?
22 DR. BLEY: As far as I know, there's very little recorded 23 data or research in the area. The place I first encountered it was working 24 with some folks from Dubai early on when they were starting to look at 25 nuclear, and they were telling us about the sandstorms that roll in there, and 26
41 they find those very, very small fines in those kind of storms getting inside 1
systems that they had thought were sealed and it wouldn't get in.
2 So, they had that high on their list, and so far I haven't 3
seen any data that links that to failure rates, and I think that's the place 4
we've got the hole.
5 COMMISSIONER BARAN: Okay. And what's the 6
committee's view of the level of detail in the staff's guidance? Would it be 7
helpful for the guidance to include more detail about how the hazard analysis 8
should be conducted, or what's your sense of that? My sense reading the 9
letter was that it sounds like the guidance is largely a compilation of 10 information that's out there. And less in terms of how do you go through 11 each step of an analysis. Can you talk a little bit about that? Do you think 12 it's hit the right spot? Do you think with more time, you'd want to see a 13 greater level of detail in the guidance?
14 DR. BLEY: Well, a key point for where we are at this time, 15 I think it's probably at an appropriate level. It narrows down who has to 16 look, and how hard they have to look, and refers to some other guidance, 17 especially from the IAEA, that's more thorough and detailed. So, I think it's 18 setup right. When this truly becomes an issue, I think they have the 19 resources and the sources to draw on, to ferret out in a little more detail.
20 But I think they've got it at maybe an appropriate level for now, and save that 21 one gap on what do we do about the ash problem.
22 COMMISSIONER BARAN: Okay, thanks.
23 MR. SUNSERI: Dennis, this is Matt, remind me, I think 24 this is one of the guides that was going to be table-topped with a vendor, 25 was that right, am I remembering that right?
26
42 DR. REMPE: That's true Matt, I'll step in here, but staff in 1
the response that they had posted that request out, and they had not had 2
anyone willing to step up to the table yet.
3 MR. SUNSERI: Oh, I thought there was one, okay, that's 4
my fault, sorry.
5 COMMISSIONER BARAN: Okay, great, well thanks. I 6
look forward to seeing that down the road if someone ends up wanting to 7
tabletop it. Let me turn to the issue of operating staffing for a 12 module 8
NuScale facility. The NRC staff and ACRS were satisfied that three 9
licensed operators, without a shift technical advisor, would be sufficient to 10 operate 12 of these reactors. That's obviously far fewer operators than we 11 have in existing plants.
12 Dennis prepared a white paper on the question of the shift 13 technical advisor in particular, and that's a position of course that's been 14 required since the Three Mile Island accident. Dennis, your white paper 15 discussed the risk of group think, and the value of having an independent 16 assessment capability during an event. Can you talk a bit about that? And 17 then share your thoughts about whether the shift technical advisor role is 18 needed for this particular NuScale design.
19 DR. BLEY: Sure, I'd be delighted to. And I agreed with 20 the rest of the committee, so these weren't, that little paper wasn't submitted 21 as additional comments, but it's an area I've been interested in since this first 22 began. And I watched the development of the STA position for the first two 23 to five years, they got fairly young people with degrees and put them in the 24 plant, and nobody paid too much attention to them. It took awhile for them 25 to come up to speed, and I think be useful.
26
43 From my own background, I've seen places where having 1
an independent set of eyes who is not engaged in the operations has saved 2
many an odd situation. I've seen places where, that apparently 3
independent set of eyes jumped in, and took over, and once they were 4
enmeshed in the problem, they didn't have the clarity they had before. So, I 5
really liked having that independence.
6 A few years back, Halden did some work that kind of 7
surprised them, and I mentioned that in the letter. They did experiments 8
where they put the STA in the control room with using the same displays as 9
everybody else, with their own displays in a separate place. And they found 10 that this role, the independent oversight worked very much better when they 11 were separated from the operating crew. The crews really like having a 12 qualified person available to help, but it made a difference not having that 13 set of eyes.
14 Now, there's a few things about NuScale that set it apart, 15 and for me, the one that allows me to be more comfortable with this is the 16 ability, if something starts acting up in one of the modules, they can very 17 easily shut it down, and put it into its long-term cooling mode, and don't 18 really have to look at it again. The two visits I was with out to visit NuScale, 19 I saw a number of exercises on the simulator, and it appears that their 20 training really emphasizes that. The computer systems, and alarm 21 screening tools are very good to let them know when something starts 22 happening in a module. They'll try to work on it with one person, and if they 23 get to the point, either it's getting complicated, or some other problems start 24 to develop, they can quickly eliminate that unit from their further 25 consideration. That kind of simplicity makes me more comfortable there 26
44 than I would be in any other facility I know of. So, the independent 1
oversight isn't, to me, as essential given their ability to pick things out of the 2
picture quite easily. So, that's where I came down on this.
3 COMMISSIONER BARAN: Well, and that's very helpful.
4 Thinking back to the presentation today, it sounded like part of the 5
committee's recommendation or preference would be maybe in that early 6
period, when everyone's still learning how to operate these reactors, or in 7
the early period of operation of the reactors, they maybe do have something 8
like that position present for a period of time. I don't know if anyone wants 9
to comment on that. Whether that kind of aspect of the ACRS view is really 10 reflective of the issues you're raising now.
11 DR. BLEY: Well, Matt might want to talk to this more than 12 me, but we're saying it for the reasons you suggested Commissioner Baran, 13 but on the other hand, every startup I've seen, everybody, from the vendors, 14 to the operating plant bring extra people in to keep a close eye on it, and 15 make sure everything's going well. So, it's almost gratuitous. It's going to 16 be there anyway, but for the reasons we were talking about, it's especially 17 useful.
18 COMMISSIONER BARAN: Okay. Matt, did you have 19 anything to add on that?
20 MR. SUNSERI: No, Dennis covered it exactly right, so 21 nothing to add.
22 COMMISSIONER BARAN: Okay, great, well I'll stop 23 there. And again Dennis, just you're going to be so missed, and just these 24 kinds of perspectives that you bring, and your thoughtful way of approaching 25 these issues based on all the experience that you have, it's really hard to 26
45 replace. You've got some great colleagues still, and obviously we're going 1
to keep relying on them, but we're going to miss having you there. Thank 2
you.
3 DR. BLEY: Thanks very much.
4 CHAIRMAN HANSON: Thank you Commissioner Baran.
5 And thanks to the ACRS today, thanks to Chair Sunseri, and Vice Chair 6
Rempe for kind of moderating. I want to once again extend a warm 7
welcome to Dr. Bier and Mr. Halnon, and also a sincere thanks to Dr.
8 Riccardella and to Dr. Bley, who once again kind of showed his insight, and 9
his helpfulness in our discussion today. So, best wishes to you Dr. Bley.
10 And with that, thanks again to my colleagues.
11 I think we had a really good discussion today, these are 12 complex issues, and we sincerely value the contributions of the ACRS. And 13 with that, we're adjourned.
14 (Whereupon, the above-entitled matter went off the record 15 at 11:29 a.m.)
16