|
|
| Line 16: |
Line 16: |
|
| |
|
| =Text= | | =Text= |
| {{#Wiki_filter:( | | {{#Wiki_filter:}} |
| __ __ _ - - - - - - - - ~ ~ ~ ~ ~ ^ ~
| |
| l m ,
| |
| . , a \ __
| |
| O "UiiHTED STATES NUCLEAR REGULATORY CORGESSION
| |
| . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . = . . . . . . . . . . . . . . . . . . . . .l i
| |
| l l
| |
| In the Matter of:
| |
| SUBCOW4ITTEE OM INSTRUMENTATION AND CONTROL SYSTEMS l
| |
| O l
| |
| $ -- r [ ',
| |
| a .
| |
| e ,
| |
| y p Pages: 1 throuch 271 L c -. - ? . ; ., ue .:a U s,- ; M ;
| |
| Place: Washington DC Q \ %
| |
| gj'j]Q) 'Qj}} {Q n.2._
| |
| Date: March 24, 1988 HERITAGE REPORTING CORPORATION O omaw=
| |
| 1228 L Street, N.W., Suke 646 Washington, D.C. 20405 (202) 628-4888 8804010196 880324 PDR ACRS PDR T-1654 R- 1
| |
| | |
| l 1 PUBLIC NOTICE BY THE 2 UNITED STATES NUCLEAR-REGULATORY COMMISSION'S 3 ADVISORY COMMITTEE ON REACTOR SAFEGUARDS 4
| |
| 5 6
| |
| 7 The contents of this stenographic transcript of the 8 proceedings of the United States Nuclear Regulatory 9 Commission's Advisory Committee on Reactor Safeguards (ACRS),
| |
| 10 as reported herein, is an uncorrected record of the discussions 11 recorded at the meeting held on the above date.
| |
| 12 No member of the ACRS Staff and no participant at 13 this meeting accepts any responsibility for errors or
| |
| (]) 14 inaccuracies of statement or data contained in-this transcript.
| |
| 15 16 17 18 19 l
| |
| 20 21 22 23 24 25 Heritage Reporting Corporation (202) 628-4888 m
| |
| | |
| I 1
| |
| om U 1 UNITED STATES NUCLEAR REGULATORY COMMISSION 2 ADVISORY COMMITTEE ON REACTOR SAFEGUARDS 3
| |
| )
| |
| 4 In the Matter of: )
| |
| )
| |
| 5 )
| |
| SUBCOMMITTEE ON INSTRUMENTATION )
| |
| 6 AND CONTROL SYSTEMS ) ,
| |
| )
| |
| 7 Thursday, 8 March 24, 1988 9 Room 1046 1717 H Street, N.W.
| |
| 10 Washington, D.C. 20555 ;
| |
| 11 The above-entitled matter came on for hearing, j 12 pursuant to notice, at 8:30 a.m. ,
| |
| l 13 BEFORE: MR. JESSE C. EBERSOLE f}'
| |
| Retired Head Nuclear Engineer i 14 Division of Engineering Design Tennessee Valley Authority 15 Knoxville, Tennessee 16 ACRS MEMBERS PRESENT:
| |
| 17 DR. HAROLD W. LEWIS Professor of Physics 18 Department of Physics University of California 19 Santa Barbara, California 20 MR. CARLYLE MICHELSON Retired Principal Nuclear Engineer 21 Tennessee Valley Authority Knoxville, Tennessee 22 and Retired Director, Office for Analysis and Evaluation of Operational Data 23 U.S. Nuclear Regulatory Commission Washington, D.C.
| |
| 24 25 O
| |
| HERITAGE REPORTING CORPORATION -- (202)628-4888
| |
| | |
| 2 0 1 MR. CHARLES J. WYLIE Retired Chief Engineer 2 Electrical Division Duke Power Company 3' Charlotte, North Carolina 4 ACRS COGilIZANT STAFF MEMBER:
| |
| 5 Medhat El-Zeftawy 6 NRC STAFF PRESENTERS:
| |
| 7 Robert Baer Newton Anderson 8 Andy Szukiewicz Dale Thatcher 9
| |
| Consultants:
| |
| 10 Paul Davis 11 i 12
| |
| ( 13 l e.
| |
| 15 16 17 18 19 2.)
| |
| 21 22 l 23 ,
| |
| l 24
| |
| )
| |
| 25 l O
| |
| HERITAGE' REPORTING CORPORATION -- (2021628-4888
| |
| | |
| i 3 i 1 -INDE - -. -. X-2 Item Discussed Page 3 NRC Staff Introduction 6 l
| |
| l 4 Scope of Generic Issues 24 l l
| |
| 5 f)SI A-47 57 f
| |
| 6 USI A-17 174 7
| |
| 8 9
| |
| 10 11 12 h 13 14 15 16 17 1
| |
| 18 l
| |
| 1 19 20 21 22 23 h 24 25 HERITAGE REPORTING CORPORATION -- (202)*28-4888
| |
| . . . . - . . . . - _ . . - _ , . . . . - . . . - . _ - - . _ . . . . . . . . . . . - , . . . . . . . . . _ , . . - . . ~ . . , . . - . , .
| |
| | |
| -i 4
| |
| l 1 ,P. R O 9 E E D I, [{ G S. ;
| |
| (')s
| |
| (_ 2 CHAIRMAN EBERSOLE: The meeting now will come'to 3 order. This is the meeting of the Advisory Committee on 4 Reactor Safeguards, Subcommittee on Instrumentation and 5 Control Systems. I am Jesse'Ebersole, the Subcommmittee 6 Chairman. The other ACRS members in attendance are H. Lewis, 7 Carlyle Michelson, and Chuck Wylie. We have in attendance P.
| |
| 8 Davis Ilso, and the purpcse of this meeting is to review the 9 NRC staff analysis and to study the, to limit the scope of USI 10 A-47, safety implications of control systems, and I might add 11 to that to examine the validity of that limiting process, 12 Medhet El-Zeftawy is the cognizant ACRS member for
| |
| () 13 this meeting. The rules for participation in today's meeting 14 have been announced as part of the notice of the meeting 15 previously published in the Federal Register on March 7, 1988.
| |
| 16 A transcript of the meeting is being kept and will 17 be made available as stated in the Federal Register notice.
| |
| 18 It is requested that each speaker first identify himself or 13 herself and speak with sufficient clarity and volume so that 20 he or she can be readily heard.
| |
| 21 I have just a few comments to start this meeting, 22 anc I will ask the subcommittee members to also make any 23 comments they wish.
| |
| 24 I have tried to as best I can in the time that I
| |
| [}
| |
| 25 have to look at the various documents on this subject, and I r
| |
| HERITAGE REPORTING CORPORATION -- (202)628-4888
| |
| | |
| 5 1 find a sort of a disturbing implication or feeling that we 2 have gone about this matter in the way that I recall 3 instructor Clinton Walker about 35 years ago described a man 4 who had looked, was looking for something that he lost. He 5 had noticed the man walking around and around in the circle of 6 light furnished by a streetlight, and he became curious and 7 inquired what he was looking for, and he explained he had lost 8 a valuable jewel or whatever. And he said I see that you are 9 just walking around and around here in the circle of light.
| |
| 10 Did you lose it here? Whereupon the gentleman said no. He 11 says I don't know where I lost it. I am looking for it here 12 on the street because this is the only place there is some
| |
| () 13 light for me to see.
| |
| 14 And I get bothered by the approach, the development 15 of the logic to look at this problem as it is represented by 15 going to Chapter 15 and looking at the various disturbances 17 that occur to the critical parameters of the plant, and simply 18 looking outward to see how far you can reach the sources of 19 those disturbances.
| |
| 20 Just as in the streetlight case, the vision is 21 limited, and I don't think by that process we will pick up a 22 multitude of things in the Twilight Zone beyond the clear 23 illumination of the light on the court. Those parameters--and l 0
| |
| {} 24 I think we are forced to have a clear example to present to 1
| |
| 25 show you. We are forced to look at processes quite distant j HERITAGE REPORTING CORPORATION -- (202)628-4888
| |
| | |
| 6 1 from the ultimate effect on the core and anticipating we may
| |
| () 2 uncover some critical cascades, of course one of which was 3 TMI. It came from weird points of origin you-wouldn't 4 believe, and progressively built up to a disaster.
| |
| 5 So with that, I would like to ask the other 6 Committee members if they have any comments to make, if they 7 have any examples to show or any comments to start? Anybody?
| |
| 8 DR. LEWIS: No.
| |
| 9 MR. WYLIE: No, t
| |
| 10 MR. MICHELSON: Not yet.
| |
| 11 CHAIRMAN EBERSOLE: It seems that we have Mr.. Bob 12 Baer I believe to start this.
| |
| (} 13 MR. BAER: I would just like.to make a few 14 introductory remarks before we get to the major portion of the 15 presentation.
| |
| 16 During the past ACRS subcommittee and Full Committee 17 meetings, a number of concerns have been raised about USIs and 18 GSIs and how the staff approaches them. Some of the concerns 19 have dealt with the scope of'the issue, whether the scope was 20 narrowed during the resolution process, what specifically 21 types of events and equipment failures the staff considered 22 for each issue, and how we are handling or attempting to 23 handle any residual concerns.
| |
| 24
| |
| (-)
| |
| (>
| |
| I believe that some of the confusion or we feel 25 confusion or lack of understanding resulted from two major HERITAGE REPORTING CORPORATION -- (202)628-4888
| |
| | |
| 7 1 factors.
| |
| \/ 2 One factor was that we come down and we present the 3 information on one issue at a time, and then some other, at 4 some later date, we discuss a different issue, and that we 5 don't and we did not, we are not discussing in that kind of 6 format how we tie and treat the interrelationship between 7 these issues because there is a fair amount of overlap or 8 potential interrelationship.
| |
| 9 The other factor is that we come down here, we tend 10 to emphasize those areas where we believe new requirements are 11 justified and that we can justify them with a cost / ben > fit 12 process. We tend not to emphasize those areas that we study
| |
| () 13 and found a low residual risk or a risk so low that we could 14 not justify additional requirements.
| |
| 15 Today we are going to try a somewhat different 16 format. We are going to discuss three different GSIs, and 17 USIs and two USIs really, and an overall program, but before 18 that, we are going to talk a little bit about the scope.
| |
| 19 Our objective is to demonstrate to the subcommittee 20 that we did follow the agreed-upon scope for each issue, that 21 our resolution process did not focus in on just one or two 22 events, and that the staff has a program in place to try and 23 handle the residuals for each issue.
| |
| {} 24 The specific toples we are going to talk about this 25 morning are pretty much on the agenda that we had prepared and HERITAGE REPORTING CORPORATION -- (202)628-4888
| |
| | |
| f 8
| |
| 1 it is in your official agenda.
| |
| 2 (Slide)
| |
| ~
| |
| 3 MR. BAER: First we are going to talk.in general, 4 and that will be Newt-Anderson,'how the scope for each issue
| |
| ~
| |
| S is defined.and how we go about developing task action plans.
| |
| 6 Then we are going to talk specifically'about USI 7 A-47, safety implications of control'' systems. We are going to 8 talk about the scope and then we are going to talk about the 9 overview, an overview--I'm sorry--yes, overvieu of the 10 methodology. And one concern expressed at previous meetings 11 was that we directed our efforts toward just overfill-events,_
| |
| 12 which was not the case.
| |
| () 13 Our goal this morning in discussing this methodology 14 is to try and show that we try to systematically look at a 15 variety of events and to both' demonstrate the methodology, and 16 to give an example, we are going to t'ake one event and tri and 17 walk through it where we came to the conclusion that we could 18 not justify any additional requirements, even based on using-19 what we felt were very conservative assumptions.
| |
| 20 Next we are going to talk about USI A-17, system I 21 interactions, and again we will talk about the scope and' sort 22 of an overview of the proposed resolution. We have this 23 topic has been discussed with us, this subcommittee and Full-(} 24 Committee, in the past several times. We have now-a package 25 that we have been discussing with NRR as part of our peer HERITAGE REPORTING CORPORATION -- (202)628-4888
| |
| | |
| 9 i
| |
| 1 review or staff' peer review process, and we have what we
| |
| () 2 believe is a final package coming out of.our, editor today we 3 hope, and so we expect to be down again on that one as a, 4 present a full resolution, but we are going to show1today 5 where we think we are coming out on that.
| |
| 6 CHAIRMAN EBERSOLE: .Can I ask you a question? ,
| |
| 7 MR. BAER: Yes.
| |
| 8 CFAIRMAN EBERSOLE: I'got the impression:looking'at' ,
| |
| l 9 the various' papers here'.that what you did in general was the-1 10 classic approach.. You looked at a consequence to the core .
| |
| l 1
| |
| 11 from Chapter 15, high level, too little' water, whatever, and j l
| |
| 12 then you reached out and tried to find a source of' disturbance l I 13 which would produce that consequence, and you looked only so
| |
| (]}
| |
| 14 far, and stopped. And I am reminded--
| |
| 15 MR. BAER: We will go through them, go through A-47, 16 but I think a fairer characterization is we said what are the 17 sort of parameters that could influence things?~ And now what 18 are all the control s.vstems that could give.you a' reactivity-19 transient?
| |
| 20 CHAIRMAN EBERSOLE: What, the question is what is 21 all the instances of it?
| |
| 22 MR. BAER: I-think we try to look at all, but we 23 tried to do some bounding analyses.
| |
| 24 CHAIRMAN.EBERSOLE: What we are going to try to do, 25 I have a few examples of ones evidently you didn't look at.
| |
| HERITAGE REPORTING CORPORATION - .(202)628-4888
| |
| _. . , - - , . . , , . , - . . _ . _ , . . . _ . _ . _ . _ . _ . - . . . ~ _ . . - - _ _ - _ . _ , . . , , . - _ - . , . _ . .
| |
| | |
| 10 1 We will just use them as a model of not covering that, but I 2~ am eminded of the recent. case--
| |
| 3 MR. BAER: Let me address that because I think, I' 4 realize that the methodology we used, and this is something
| |
| .5 that was developed back, overall plan back in'something like 6 '82, and a lot of contractor' work went into it, that we.are 7 not all of us able right on'the spot to say' yea or nay, our 8 analyses bound that particular' event',-but--and I think maybe 9 the only way we are ever going to-be able to try and 10 demonstrate that is if you will give us some events in enough 11 detail that we can understand them, and many cases we may have 12 to go back to the national labs that did the work, and say i
| |
| () 13 hey, was this bounded by some analysis? If so, show us. If 14 not, we will go into'this third program,:the multiple system 15 response program, as an individual. event or attempt to define 16 it, that which, and prioritize it as an individual event.
| |
| 17 CHAIRMAN EBERSOLE: We have some of the lab 18 representatives here that may be able to cast light into this.
| |
| 19 Let me give you an example. There has been a recent case,-
| |
| 20 trouble with airplanes. DC-9 I believe it was. You could say 21 I am going to look at all the events which will upset or harm 22 the turbine blades on the turbines and begin to look at a 23 field of events. I don't think you would have ever picked up 24 the present case which recently occurred where due to leaky
| |
| (
| |
| 25 valve, they form an icicle underneath the fuselage which went HERITAGE REPORTING CORPORATION --~(202)628-4888
| |
| | |
| 11
| |
| : 1. into the blades-and torefthem up. And'if you looked'just from 2 the point of view of what can hurt the turbine, the field of' ,
| |
| 3 view is narrowed' or:if you look just what can happen to the 4 reactor field,=the field 11s narrowed. I believe you have got 5 to go the other way, say this system, that une and the other 6 one either does or does'not have'some perhaps distant 7 potential to light a fire that will turn into'a' forest fire.
| |
| 8 I don't think'that--
| |
| 9 MR. BAER: Okay. Remember in A-47, this is control 10 systems.
| |
| 11 CHAIRMAN EBERSOLE: Yes.
| |
| ~
| |
| 12 MR. BAER: And I do think some of your concerns, the
| |
| () 13 Committee's. concerns as a whole, really do'deat with 14 protection systems.
| |
| 15 CHAIRMAN EBERSOLE: Let me comment on that. Control 16 systems are all over the place because you.have a process:that 5 17 you have a driver of some sort. I don't care what it is--a 18 pump, a generator, an adverter or whatever, that-has an excess 19 capacity to do what it has to do,-and is modulated by some 20 control system to hold-it within a band width and rate of 21 change.
| |
| 22 MR. BAER: But nuclear plants we say since we 23 historically, and long before I was involved, at least in the
| |
| {} 24 HRC, came up with some requirements and said we don't have a 25 lot of requirements on control. systems,-because we have many l l
| |
| l l
| |
| l HERITAGEnREPORTING CORPORATION -- (202)628-4888 1
| |
| )
| |
| | |
| 12 1 requirements on protection systems, and that is what we are
| |
| /~T k-) 2 counting on. And within the scope of what we did with A-47, 3 we felt very much constrained to follow that same ground rule.
| |
| 4 CHAIRMAN EBERSOLE: I think we will have some 5 examples that show it hasn't been followed, but we will see.
| |
| 6 MR. MICHELSON: Could I follow up on one of your 7 earlier discussions which I think was a good point? And that 8 is that you have to keep watching your experience to begin to 9 wonder as you see each piece of experience as to whether it 10 was bounded by your analysis and so forth. I'm not really 11 sure that's being done presently.
| |
| 12 MR. BAER: Oh, yes.
| |
| (~1 13
| |
| () MR. MICHELSON: If it is, could you at some time 14 today tell us where and how you are assured that that possess 15 is always underway?
| |
| 16 MR. BAER: Let me describe the process because with 17 my new job I am not heavily involved, but in my previous job 18 was fairly heavily involved. Every morning there is a 19 conference call.
| |
| 20 MR. MICHELSON: I am acquainted with that process.
| |
| 21 That process isn't going to do what we are talking about here.
| |
| 22 At least my acquaintance with that process in the past has not 23 been that you start looking at each and every one of these
| |
| {} 24 experiences in terms of whether or not it was bounded when the 25 analysis was done for A-47 or A-17 or whatever. I think HERITAGE REPORTING CORPORATION -- (202)628-4888
| |
| | |
| 13 1 that's what you were talking about a little bit earlier. I 7
| |
| j 2 thought that's what you had in mind. Ac you, as you resolve 3 an issue, you must. continue to monitor experience to see that 4 the experience was bounded by the resolution of the issue. If 5 it was not, then you need to decide what to do about it, and 6 that's the process I am interested in.
| |
| 7 MR. BAER: Well, I think it isn't, it isn't looked 8 at in quite that way, but I think it is a subset of what is 9 done. I mean each event that is called in and you and the 10 other subcommittee members is called in to the, our 11 operational center under 5072, is written up on a little word 12 processor, and every morning each one of those events plus
| |
| () 13 anything--the regional daily reports are reviewed by several 14 different groups and then there is a conference call among 15 them to decide whether any of them look significant enough, 16 and that's a broad statement, to, that is worth some further '
| |
| 17 follow-up, and the significance could be either in terms of 18 the event was more, well, I think the threshold is well below 19 Chapter 15 in those morning calls. Here was an event that is 20 kind of unusual even if it was bounded by a Chapter 15. Those 21 are looked at.
| |
| 22 There is a lot of things that come up that are 23 really implementation or failure to implement something rather em 24 than a new requirement. Probably the majority of events fall
| |
| ')
| |
| \
| |
| 25 in that category, and anyhow, those are all reviewed. Those HERITAGE REPORTING CORPORATION -- (202)628-4888
| |
| | |
| 14 1 that are deemed to be significant in any manner is assigned to i
| |
| k/ 2 an individual or to a group to follow up, and then once a 3 week, there is a management meeting where the more significant 4 events and follow-up is presented to management and further 5 assignments are made if indeed necessary, so there is a 6 conscious attempt to review operating data.
| |
| 7 Now it is not, I agree not in terms of hey, this 8 falls in A-47 and this falls into A-17 and this is the decay 9 heat removal, although frankly in the morning phone calls, 10 when there is a water hammer event, someone says well, call Al 1
| |
| 11 Cyrus, tell him another one happened, so there is, you know, 12 an awareness of who has worked on the issues in the past.
| |
| () 13 MR. MICHELSON: There is a whole sets of events that 14 escape that system and those events which are reported to the l
| |
| 15 agency as design deficiencies, these don't go through your 16 morning report process I don't believe. If they do, then I am 17 going to ask about the three or four we had today and tell me 18 what happened in your morning report process that allowed them 19 to--
| |
| 20 MR. BAER: I am not involved in it anymore.
| |
| 21 MR. MICHELSON: I assume the design def: ciencies l i
| |
| l 22 don't get called in every morning. l 23 MR. BAER: Those will crop up mostly through the 24 daily reports from the region.
| |
| (")%
| |
| u 25 MR. SZUKIEWICZ: I have some information on that HERITAGE REPORTING CORPORATION -- (202)628-4888
| |
| | |
| 15'
| |
| : 1. that I can share'with you.
| |
| () 2 MR. MICHELSON: .We will do it at the appropriate 3 time, but I think it is important that, that we recognize that i
| |
| 4 perhaps not all events come through that process. LERs do not 5 necessarily prompt morning calls, particularly an LER that is 6 written two or three' months after-the fact when they decide l
| |
| 7 :yes, I guess I should have given you an LERL so now I write j l
| |
| 8 you.one. I don't think they call in the desk and say there is-
| |
| : 9. one coming.
| |
| 10 MR. BAER: From a--
| |
| 11 MR. MICHELSON: We gave you examples.
| |
| 12 MR. BAER: From an enforcement point of view, the >
| |
| () 13 region tends to get pretty upset if there is an LER on some 14 event that never, that should have been called in also as a 15 5072 and we they do tend to look for that; just a matter of ;
| |
| 16 enforcement.
| |
| 17 MR. MICHELSON: Maybe I got.the wrong impression, 18 but earlier discussions that we have had about the immediate l
| |
| 19 actions that the agency takes on events led me to believe that l l
| |
| 20 NRR was looking at the, at the immediate effects of a )
| |
| l 21 particular event when it, certain immediate actions need to be i i
| |
| 22 taken, but do not necessarily do a longer range view of the l I'
| |
| 23 problem and how it might fit into another problem area-or-24 whatever.
| |
| 25 That was picked up later on by AEOD in terms of.long l
| |
| I HERITAGE REPORTING CORPORATION -- (202)628-4888
| |
| | |
| 16 l l
| |
| l 1 range, so I'm not convinced that the short-range view l (h
| |
| () 2 necessarily thinks about generic problems or applications, nor 3 should it necessarily at all. In fact, I was surprised that 4 you would even claim that that's where you took care of the 5 problem. I thought this was taken care of by AEOD in the long 6 range.
| |
| 7 MR. BAER: But short-term events that affect generic 8 issues that are being worked on, I think people are generally 9 aware of the generic issues, and the task managers get calls 10 on events like that.
| |
| 11 MR. MICHELSON: If there is sufficient medie 12 visibility, I'm sure they do.
| |
| () 13 MR. BAER: Now I have to concede that a lot of the, 14 to a large extent it does depend on some individual. My 15 people aren't involved in the day-to-day basis on these 16 short-term reviews of these daily report and event reviews, 17 that we do depend on people trying to remember that we are 18 working on certain issues and giving us a call if we didn't 19 happen to see it, but also I do get all LERs and I scan all of 20 them and pass them on to the branch members if in any remote 21 way in my opinion, they affect any of the generic issues that 22 we are working on.
| |
| 23 DR. LEWIS: Since everyone has already interrupted 24 you, I guess I could do it.
| |
| }
| |
| 25 Several times while you have been talking you have HERITAGE REPORTING CORPORATION -- (202)628-4888
| |
| | |
| 17 1 spoken in terms of justifying new requirements, and I wonder 2 whether there is a little more general than A-47, whether the 3 approach--it is hard, sometimes hard to tell whether the )
| |
| 4- approach is one in terms of looking for justification for new 5 requirements, or in terms of looking for understanding of the !
| |
| l 6 system because the new requirements issue is really the last 7 step in the regulatory process, and I thought unresolved :
| |
| 8 safety issues meant unresolved in the sense that we don't 1 9 quite know what is going on, not'necessary uhether there is a 10 new requirement as the end result of the study.
| |
| -11 I don't know how to ask this question, but you know 12 what I am asking.
| |
| () 13 MR. BAEP: We try-and do it in a two-step process, 14 although I have to admit I can't help but think ahead in the 15 process. The question, the people in my branch are thinking 16 ahead.
| |
| 17 We look first at the technical proble.ms and try and 18 put together a report called technical findings where we say -
| |
| 19 here are the problems, and here are what we have uncovered or 20 seen in investigating this, a particular issue, and here are i
| |
| 21 three or four or five alternatives of possible regulatory 22 action and everywhere from hardly more than no action or in 23 some cases no action is an alternative to new regulations
| |
| (} 24 which will require extensive backfitting, and a couple of I 25 steps in between. I I
| |
| HERITAGE REPORTING CORPORATION -- (202)628-4888
| |
| | |
| 18 1 And then we try to do a cost / benefit or a value
| |
| (')
| |
| \_/ 2 impact on each of those alternatives now and then recommend to 3 our, to CRGR or first to the other offices those alternatives 4 where we think the value impact--and we are allowed to 5 consider averted shutdown cost for a particular plant anyhow, 6 not industry-wide, and replacement power cost which quite 7 oft 3n dominates, and for those that we think we can make a 8 reasonable case, and we can include certain qualitative 9 factors, those are the ones we propose.
| |
| 10 Now for the--but we do have to make, we have really 11 three, three groups we have to convince, and unfortunately 12 they come at us three different ways. One is the ACRS, which
| |
| () 13 for lack of a better word let's say tends to lean toward the 14 side of safety in terms of if in doubt, require the licensees 15 to do more.
| |
| 16 We have CRGC which I think is very concerned about 17 safety, but if anything has a bias slightly in the other 18 direction--don't make the licensee do something unless you can 19 really demonstrate that it is, one, it is cost effective, and ,
| |
| 20 two, that you have considered other interactions that may make 21 the plant less safe. Make sure you have thought about all ths 22 ranifications Of what you are proposing, and then lately we 23 have had a third constituent which is it is a resource
| |
| {} 24 limitation by both NRR and the regions that say hey, we Mind 25 of agree with your requirement, but you have got to help HERITAGE REPORTING CORPORATION -- (202)628-4888
| |
| | |
| 19 1 figure out a way to structure this requirement so that NRR and O
| |
| (_) 2 the, NRR can review whatever licensee submittals are required 3 and maybe somehow try and minimize that and the regions can go 4 out and do a verification inspection, and that third one is a 5 relatively new aspect. I think with the new reorganization 6 people have added up all the tasks that have to be done, and 7 said okay, and we are not getting more people, we are not 8 getting bigger budgets for technical assistance. This is all 9 we have to work with. You have got to somehow prioritize this 10 work, so we are doing the most important areas and most l l
| |
| 11 important from the safety point of view first, and so I think 12 we find ourselves somewhat, or feel we are somewhat in the 13 middle trying to balance those three, three different
| |
| ( })
| |
| 14 pressures on us. I l
| |
| 15 DR. LEWIS: Everybody you have described in this !
| |
| 16 discourse has been in terms of finding justifications for new l
| |
| 17 requirements in terms of the constituents that you have l l
| |
| 18 described. Some were for it and others opposed to it, but you !
| |
| l 19 seem to set, as I interpret this long speech, set no value on j l
| |
| 20 understanding of a safety issue except as it feeds the need 21 for a new requirement. I find that--
| |
| 22 MR. BAER: I think we have to understand it even to 23 get far enough to talk about alternatives.
| |
| ()
| |
| %)
| |
| 24 DR. LEWIS: But your purpose is to think of 25 alternatives in terms of regulatory requirements and--
| |
| HERITAGE REPORTING CORPORATION -- (202)628-4888
| |
| | |
| 20 1 MR. BAER: That's, yes, that's, you know, the people
| |
| ,~
| |
| k_)s 2 up one flight have spoken very unambiguously about this issue.
| |
| 3 You know, after TMI, a huge number of requirements were 4 imposed on industry, and the later concerns with that is that 5 so much was laid on industry so fast that they were presented l 6 with an impossible situation.
| |
| 7 DR. LEWIS: I not going to try to change your I 8 psychology obviously, but I must say I set great value on 9 understanding even if it doesn't lead to new regulatory 10 requirements.
| |
| 11 MR. BAER: We try to understand what we are doing.
| |
| 12 MR. ANDERSON: I have been involved in working with
| |
| () 13 these issues for the last eight years, and I think I can say 14 unequivocally that our first, first and foremost in the 15 resolution of these issues we do try to understand it
| |
| .6 technically. We don't even start thinking about what any 17 regularly requirement would be or how to implement it until we 18 have got a good technical answer, and I think we consciously 19 attempt to do that. We don't want to be colored initially in 20 the process by whether we are going to be able to impose it. !
| |
| l 21 We want to understand it technically. l 22 DR. LEWIS: But not for its own sake. Even you have 23 said you regard that as a tool for determination of new 24 regulatory--
| |
| 25 MR. ANDERSON: For determining whether or not we can HERITAGE REPORTING CORPORATION -- (202)628-4888
| |
| | |
| 21 l
| |
| 1 impose it; I don't think that affects us in studying it. i
| |
| (~\
| |
| \_) 2 DR. LEWIS: You said it with a slightly different i 3 emphasis, but you say the same thing. That'a okay. I just 4 needed to understand your, what is driving you.
| |
| 5 MR. BAER: Yes. Well, we are driven by given 6 assignments. I mean I will be frank about that, that I can't 7 go to my boss and say I have got 12 people working for me and 8 my goal is to make them more knowledgeable. He is not going 9 to accept that.
| |
| 10 DR. LEWIS: Th( analogy I am using is the analogy of 11 a highway patrolman. A highway patrolman looks for speeders 12 so he can issue citations. He has a quota. They deny it, but 13
| |
| (~) they often do have a quota of citations or whatever you want 14 to call them that they issue. Their job is not a job of 15 understanding the distribution of speeds on the highways. ,
| |
| 1 16 Their job is to find out how many people are breaking the law, 17 and to do something about it, and I see that here, too. I 18 MR. BAER: But I will give a different analogy. We 19 would be the people that would go out on the highway and say 20 here are areas where there is potential for accidents, and 21 maybe we subdivide it too carefully or into too small pieces, 22 but so maybe we are looking for places where the shoulder 23 isn't wide enough. It is someone has other than us who
| |
| {} 24 prioritized an issue and then we are assigned it so we are 25 limited in that scopa, but if our issue is to go look at the HERITAGE REPORTING CORPORATION -- (202)628-4888
| |
| | |
| 22 1 hight,ny to see whether the shoulders are in such poor shape 2 that they may be causing accidents, we are not in the 3 enforcement business, then that's what we would look at, and 4 yes, we might point out hey, there is, some of these are tied 5 up with bridge abutments and raise that as a separate issue, 6 but we unfortunately are reasonably constrained to the 7 assigned task, but--and we are going to be discussing today 8 two, two tasks and a third program that are interrelated 9 because yes, they don't fall in the neat categories, 10 unfortunately.
| |
| l 11 CHAIRMAN EBERSOLE: One of the things that bothers 12 me under the pressures of these three constituencies that you l
| |
| ()' 13 have to deal with in your approach to get something done is i
| |
| 14 almost invariably something happens that leads to problems and !
| |
| l 15 that is you retain a broad general title of your 16 accomplishment, implying you have great broad and indefinite i 17 coverage of a topic when in fact you have delineated it so 18 sharply in such a limited way that it only covers a fraction j 19 of the issue which you identify as an issue. l 1
| |
| l 20 MR. BAER: I think that only happens where the two 21 issues coincide, and I guess maybe at the Full Committee i
| |
| 22 meeting, the thing Chet Siess and others said that there is )
| |
| 23 the, there is a question if you define the issue so broadly
| |
| [} 24 that you have difficulty getting your arms around it, and 25 that's the problem with two of these issues, and if you, but HERITAGE REPORTING CORPORATION -- (202)628-4888
| |
| | |
| 23 1 if you define them too narrowly, how do you go look for the (s
| |
| (.) 2 gaps? And the third program we are going to talk about today 3 is the one that tries to .'.cok for those gaps.
| |
| 4 CHAIRMAN EBERSOLE: I suspected this would evolve 5 from the last few months.
| |
| 6 MR. BAER: And the one, the other comment that or 7 plea that I want to make is each segmen,t. we tried to allow on 8 the agenda a fair amount of time and would appreciate it to 9 the extent that you can restrain yourself, let us go through 10 each segment and then open it up for questions because I think 11 sometimes we, we leave here saying we never got a chance to 12 make what we thought were the major points, so I am asking for
| |
| (') 13 that opportunity.
| |
| 14 CHAIRMAN EBERSOLE: That might bring up, this 15 meeting I see is supposed to adjourn at 3:15. Anybody got any 16 time crunch on that?
| |
| 17 DR. LEWIS: Well, I do, but I am not important.
| |
| 18 CHAIRMAN EBERSOLE: I don't know why you say that.
| |
| 19 Anybody else? Well anyway, I am saying as far as I am 20 concerned, it is flexible, but carry on.
| |
| 21 MR. BAER: I will move here next. Newt Anderson is 22 going to discuss--I should probably leave this up--discuss the 23 scope part of this in general terms. We will talk about the l 24 scope on each issue individually in addition.
| |
| [}
| |
| 25 MR. ANDERSON: Okay. You did say, Andy, that the HERITAGE REPORTING CORPORATION -- (202)628-4888
| |
| | |
| . . . . ~ . _ . =. .. . . - .. . . . _ -
| |
| l 24 1 these slides were up here?
| |
| 2 MR. SZUKIEWICZ: 'The~ slides.are right'there.
| |
| 3 MR. ANDERSON: Okay.
| |
| 1 4 MR. MICHELSON: Before'you sit down, Bob, could you 5 tell me how you-fit into the, this whole. business?. The new 6 organizational range leaves me a little' fuzzy now as to just 7 what your job is in this generic issue-resolution business.
| |
| 8 HR. BAER: Okay. With the new organization, generic 9 issues are distributed I guess really three or four-divisions 10 within Research. There is one group that does all the 11 prioritization and then there are prioritization in draft form 12 that is widely circulated for peer review and' staff comments,
| |
| () 13 and their complaint is that the review process takes.much too 14 long, and probably does, but people don't focus on it.
| |
| 15 Once an issue is determined to be'either high 16 priority or medium priority, it is then assionedsto a specific 17 branch to work, and I think there is.probably three branches ,
| |
| 18 involved. Frank Kaufman handles all the human factor-type 19 things, and then the other two branches, mine is. quote, 1
| |
| 20 engineering issues branch, and Carl Neal heads.up one, and I '
| |
| l 21 don't know if I know the exact title, but it is supposed to be ;
| |
| l 22 systems type issues.
| |
| 23 The ultimate goal is my branch will handle quote, i l
| |
| [} 24 engineering issues, and his branch will handle systems issues, 25 but we are nowhere near there, and frankly, each issue is i l
| |
| HERITAGE-REPORTING CORPORATION -- (202)628-4888
| |
| | |
| a 'Q 25 t
| |
| i looked at in terms of not only the branch title, but what task
| |
| /~'T
| |
| (_/ sl 2 managers might be available and what the background is.
| |
| 3 MR. MICHELSON: So A-17 and A-47, are they thought 4 to be systems issues or engineering issues?
| |
| 5 MR. BAER: I would think that they were systems 6 issues, but there was no attempt with this reorganization to 7 take existing issues away from the task manager.
| |
| 8 MR. MICHELSON: Maybe Carl Neal should have been the i
| |
| 9 person here, but you are the one that was assigned.
| |
| 10 MR. BAER: Yes. The issues stayed with the task l
| |
| 11 manager, and the task managers were assigned to these two l l
| |
| 12 branches.
| |
| () 13 MR. MICHELSON: The longer term, basically if it is 14 an engineering kind of a problen, it is one branch, if it is 15 an global system problem or something, I guess it is a 16 different branch?
| |
| 17 MR. BAER: And frankly, since we do get into value 18 impact as I mentioned, I think they all to some degree become 19 system issues, but things like valves and pumps--
| |
| 20 MR. MICHELSON: They are engineering issue.
| |
| 21 MR. BAER: And snummbers are my branch.
| |
| 22 MR. MICHELSON: I picked up three organizations.
| |
| 23 Did I miss one or did you say there were four?
| |
| 24 MR. BAER: There is--
| |
| 25 MR. MICHELSON: Human factors--there is four--the HERITAGE REPORTING CORPORATION -- (202)628-4888
| |
| | |
| 26 1 human factors is a separate one, prioritization, and 2 engineering and systems.
| |
| 3 MR. BAER: Yes. Each of the four divisions in 4 Pesearch has some role in this process. ,
| |
| 5 MR. MICHELSON: Could you clarify for me what part, 6 if any, NRR plays in this process?
| |
| 7 MR. BAER: There are a few residual issues that they 8 were handling in the past, and they are still assigned to NRR.
| |
| 9 MR. MICHELSON: Normally I would not expect them to 10 see new issues.
| |
| 11 MR. BAER: Except as a peer review aspect.
| |
| 12 MR. MICHELSON: So they do, they are in the review
| |
| () 13 cycle but not in the generation cycles so to speak?
| |
| 14 MR. BAER: Not--in the resolution; anyone can 15 generate an issue.
| |
| 16 MR. MICHELSON: I'm sorry. I used the wrong 17 words--resolution cycle.
| |
| 18 MR. BAER: Or they won't be in the future; at coast 19 that is my understanding.
| |
| 20 MR. MICHELSON: I think that's a help. Thank you.
| |
| 21 . ANCr.RSON: NRR gets involved when we have, you 22 are r 'Inq a. . ion. Then they are, they become 23 invc' e g how it is to be inplemented and what (N 24 kind c -
| |
| - t 4 trification that the staff needs because
| |
| : 1) {
| |
| 25 . resources :e involved, so we always jet them involved
| |
| ) l HERITAGE REPORTING CORPORATION -- (2021628-4888 !
| |
| | |
| 27 l 1 or they get themselves involved at that point.
| |
| /'%
| |
| (.) 2 MR. MICHELSON: AEOD doesn't get involved either 3 except in the review process, is that it?
| |
| 4 MR. BAER: Yes; r..ot directly.
| |
| 5 MR. ANDERSON: I think we just covered my first 5 slide, partially anyway, but the intent of this'is to try to 7 give you a better understanding of how generic issues are born 8 and live their life and how they get resolved. They start 9 right from ground zero when we start identifying safety 10 concerns as potential generic issues, the, that the issues can 11 be derived from many sources. A lot of the individual safety 12 concerns, there is a, a procedure within the staff where any
| |
| (') 13 individual, any staff member, can initiate a safety concern, a 14 potential generic issue.
| |
| 15 There is, a number of it gets into system in a 16 number of other ways, concerns of ACRS, for instance, or 17 concarns, so they may even come from industry or from anyone, 18 AEOD records, because they have got their own tracking system :
| |
| I 19 on what consider to be the issues, so AEOD concerns are also
| |
| )
| |
| 20 potential generic issue. And also from operating reactor 1
| |
| ' 1 21 events; a lot of operating reactor events get in the system j 22 via the AEOD reviews and record, but the, it is the l
| |
| 1 23 responsibility of the initiator to provide enough of a O ~/
| |
| 24 definition of the issue so that it is amenable to l 1
| |
| 25 prioritization.
| |
| I HERITAuE REPORTING CORPORATION -- (202)628-4888
| |
| | |
| 1
| |
| -28 1 The procedures that we have.in-house'specify that,
| |
| ~T .
| |
| 2 that the initiator,. he can't just have some vague uneasiness 3 that he wants people to work. He has got to be able to
| |
| ~
| |
| 4 articulate what the issue is for, and this is, it is assigned 5 to a, to the prioritization branch and assigned to one of the 6 prioritizers there, and the prioritizer does more definition 7 on the issue and expands the issue. He talks to other people, 8 He.looks to see if there are any other activities going on in 9 this area, who is working in the: area, what resource on the
| |
| : 1. 0 staff that he can find where he can get better definition, 11 better enderstanding of the problem, and then he does his .
| |
| 12 prioritizstion.
| |
| i
| |
| () 13 Now the prioritization is based on a, also on a 14 cost / benefit basis, This means that the person who is 15 prioritizing or trying this issue has to assume some kind of a 16 potential fix or nome times three or four types of fixes, and
| |
| ) 17 then he evalue'wr. these on a cost / benefit' basis, and initially '
| |
| t 18 assigns a priority.
| |
| 19 Now the priorities that vould be assigned are a j
| |
| ' I 20 number of high or medium priorities or there is a, whether it i 21 is a high or low priority, there is a category called drop, 22 may conclude that it is a, what they call a regulatory impact 23 isaus which means it doesn' t r eally have much saf ety 24 significance. Maybe it is a new procese or'new analytical l 25 procedure that would be helpful to use as opposed to something p
| |
| HERITAGE REPORTING' CORPORATION -- (202)628-4888
| |
| | |
| 29 1 that would be a real, would be a real safety problem. l O
| |
| g_/ 2 DR. LEWIS: That means that even in the original 3 assessment of priority because there is no such word as, 4 prioritization but that's at least a losing battle, but in the
| |
| -5 original, but in the original assignment of priority, there is 6 already in mind an estimate of the cost it would take to fix 7 whatever~it is. That's in the original priority. So that, 8 for example, something could be given a low priority even if 9 it were of high safety importance, if the cost of fixing'it 10 would be a billion dollars, would then end up-low on the list?
| |
| 11 MR. ANDERSON: Well, in general, that's true. Thers 12 are issues-- ,
| |
| () 13 DR. LEWIS: That's all I needed to know. That is 14 interesting.
| |
| 15 MR. BAER: There is a something that I know has been 16 presented to the Committee that that goes through a little 17 matrix, and if the safety significance is high enough, it is, 18 cost is not considered. That's one category now. There 19 aren't many events or many issues that are identified that 20 fall into that, so yes, cost is usually almost always 21 considered in the prioritization process.
| |
| 22 Let me just make one other point. The proce.es is 23 intentionally, though, biased toward overestimating the saf ety l
| |
| , 24 significance and underestimating the cost. Some of the issues
| |
| : 25 that are--that's the intent. It may not actuallJ w>rk out HERITAGE REPORTING CORPORATION -- (202)628-4888 -l
| |
| | |
| q 30 l 1- that way, but there are.an awful lot of issues.that have been 2 worked on fer long periods of time, and when the issues are 3 ' refined, it goes from a medium to a low, or one finds that -
| |
| 4 there is really no' additional r 2quirements that can be-5- justified.
| |
| 6 CHAIRMAN EBERSOLE: Bob, I think you made an l 7 overstatement. You'said if the safety significance is severe t 8 enough, cost doesn't become a problem.- That's not really so.
| |
| 9 MR. BAER: In'the prioritization process; that's one 10 of the criteria, though.
| |
| 11 CHAIRMAN EBERSOLE: I can cite you a 20-year old 12 case which has Chernobyl type potential of the spike failure
| |
| () 13 on the HPCI lines and the valve inability to close and-so ;
| |
| 14 forth. It simply stands, and it stood for 20 years, and in !
| |
| P 15 the core melt is right there and the cost is modest. The 16 problem comes in establishing the probability of the ;
| |
| 17 occurrence, and that involves the-- >
| |
| 18 MR. BAER: That is a current issue being worked on. i
| |
| , 19 CHAIRMAN EBERSOLE: For the last 20 years, if you .:
| |
| i 20 call that current. We have got to run. ;
| |
| ) 21 MR. WYLIE: Newt, I guess you are going to tell us 22 how the decisions of the prioritization, .the guy that does the !
| |
| 23 prioritization in his review next?
| |
| 24 MR. ANDERSON: Yes.
| |
| [
| |
| 25 MR. WYLIE: As to whether or not he did the right
| |
| {
| |
| . HERITAGE REPORTING CORPORATION -- (2021628-4888'
| |
| . _ . _ . _ . . . _ . . . _ . . . _ . . _ . , . _ . . ~ _ _ _ _ . . , . _ _ . _ . _ . _ . . . . . _ _ - _ ~ - , _ _ , . -
| |
| | |
| 31 1 thing in dropping something?
| |
| () 2 HR. ANDERSON: Yes. That's right, after the 3 prioritizer completes--
| |
| 4 MR. MICHELSON: Before you get to that' step, there 5 is one other step that I'm quite interested in, and that is 6 when you see a particular issue, I would think one of the 7 first questions you would ask is whether this is, issue is 8 already covered by regulatory requirements. If it is already 9 a requirement, you fix it, you dott' t go through cost / benefit 10 prioritization or anything else. I thought you had to fix it.
| |
| 11 At least that's what our lawyers tell us you have to do.
| |
| i 12 MR. BAER: Yes.
| |
| () 13 MR. MICHELSON: Where does that stand? Where is the ;
| |
| 14 step that decides whether or not this particular problem is 15 already covered by regulatory concerns and here is what the I
| |
| 16 resolution is?
| |
| l l
| |
| 17 HR. ANDERSON: That's a step that didn't get put on I 18 there.
| |
| i 1
| |
| 19 HR. MICHELSON: It clearly comes before you even j l
| |
| 20 prioritize. You don't prioritize it if it didn't meet
| |
| {
| |
| 21 regulatory req 2irements to begin with. I l
| |
| 22 MR. BAER: If there is a clear regulatory 23 requirement--I think it is the gray area that is troublesome.
| |
| r'% 24 If there is a clear requirement, that's enforcement action.
| |
| (j 25 If somebody else goes out and identifies a plant, here is a HERITAGE REPORTING CORPORATION -- (202)628-4888
| |
| | |
| 32
| |
| ~
| |
| 1 single :f ailure I'didn't include in~ my analysis, he fixes it.
| |
| () 2 There is no question about'that. That isn't.a generic issue.
| |
| '^
| |
| 3 MR. MICHELSON: I am trying to establish for the 4 record the fact that as a part of the process here there is a 5 distinct step that says we will.look at it from the viewpoint 6 is there a regulatory requirement already existing? And if 7 there is, then we don't go any further in our process. We 4
| |
| 8 turn it back over to the regulators, and there is a distinct s
| |
| i 9 step where you do that?
| |
| -10 MR. ANDERSON: Yes. Wo do that on at least two 11 occasions--one, during the prioritization, and another'during 12 the resolution process.
| |
| () 13 MR. MICHELSON: It must occur before you even decide 14 the priority because it has nothing to do with cost / benefit or i 15 has to do with only regulatory requirements. l 16 MR. BAER: Not since--these people generate these i
| |
| 17 issues, you know, to get some additional work done and they, i 18 the proposer usually feels that there is a safety >
| |
| 1 19 significance--let me just get two sentences'out. If the ;
| |
| i,.
| |
| * 20 proposer says there is an existing requirement and it isn't :
| |
| 21 being implemented properly, he would be pretty foolish to try I
| |
| : 1. 22 and throw it into a generic issue process when he can go claim l 23 it is an immediate enforcement process. I don't think it, the i
| |
| 24 black and white ones come up very often.
| |
| 25 MR. MICHEiSON: The reason that I am raising it, I i i
| |
| i HERITAGE REPORTING'CORIORATION'-- (202)628-4886 I
| |
| | |
| '33 1 think it is, a very black and white white one is Jesse's
| |
| /~)
| |
| (,_/ 2 question on HPCI steam lines. There is no doubt in my mind l
| |
| 3 that there is a regulatory requirement that those valves close j 4 to isolate a break, and they must close under those 5 conditions. It has nothing to do with a generic issue. There 6 is no issue there. It is a regulatory requirement, and it has 7 to be approached from that viewpoint.
| |
| 8 If they can't do it for some reason, then you 9 proceed with the program to get it fixed, but it has nothing 10 to do with generic issues. It isn't a generic issue. It is a 11 regulatory requirement that isolation valves close under the 12 conditions for which they were put in, and unless they are
| |
| () 13 clearly sensitive for a pipe breakdown steam--
| |
| 14 MR. BAER: I may have misspoken.
| |
| 15 MR. MICHELSON: There is a part of that, it is a-~
| |
| 16 MR. BAER: There is also a Research function that I 17 know was discussed with you recently.
| |
| 18 MR. MICHELSON: It doesn't belong in the generic 19 issues, and I think there ought to have been a step very 20 clearly understood by everybody that you stop prioritizing and 21 you don't even prioritize it if there is a regulatory 22 requirement.
| |
| 23 HR. BAER: But the requirement is to tell tbi r's 24 licensees to ao oat and test some valves, and that is, that's U
| |
| 25 an issue that involves money, and the Commission has said on HERITAGE REPORTING CORPOR ATION -- (202)628-4888
| |
| | |
| l 34 1 those sort of things that now the new interpretation, you must
| |
| /')s (m 2 go through this process.
| |
| 3 MR. MICHELSON: There is nothing new about the 4 interpretation. It has always been very clear what the valves 5 are put in for and what the requirement is, that they do 6 perform under that circumstance, and now if it turns out we 7 haven't done a good job of regulation, that's a different 8 probler, but it is not a generic issue. You always throw 9 these things into the generic issue pot. Then we put 10 cost / benefit on it and whatever.
| |
| 11 MR. BAER: Carl, see, your--
| |
| 12 MR. MICHELSON: THI--
| |
| () 13 DR. LEWIS: This is cwfully hard on the reporter if 14 you all talk at once.
| |
| 15 MR. BAER* You're questioning us on the 16 prioritization process which we are really not involved in, 17 and maybe the subcommittee or different subcommittee ought to i
| |
| 18 bring these issues up, but you do have to recognize that we 19 are in a somewhat different regulatory arena now, atmosphere I 20 guess. After THI--I will give you a very analogous example.
| |
| 21 After THI, there was, a couple years after THI, 22 people found out for the first time that pressurizer safety 23 valves had never been tested at full flow capacity. Lots of
| |
| {} 24 tests to see that they pop open at the right pressure, and 25 close at the right pressure, but never any tests of capacity.
| |
| HERITAGE REPORTING CORPORATION -- (202)62C-4888 s
| |
| | |
| 35 1 Some small models had been tested by manufacturers earlier
| |
| ( 2 years before and they just extrapolated results. In the i
| |
| 3 regulatory climate that existed a couple of years after TMI, ;
| |
| 1 1
| |
| 4 and I--very rapidly a raquirement was generated and all 5 licensees were told they had to check the capacities and EPRI !
| |
| l 6 put together an owners group and they went ahead and did that. )
| |
| 7 But today, we wouldn't be authorized to do that.
| |
| 8 There is no one as far as I know, short of a director of NRR 9 or that sort of level, issuing an order that can tell someone l
| |
| 10 to do it without going through the steps of trying to estimate l 11 the risk to the public that would be reduced by taking some 12 action and the cost of the action, and weigh those before
| |
| () 13 putting a requirement on.
| |
| 14 MR. MICHELSON: What you are saying is that you have l
| |
| 15 to do a cost / benefit to decide whether or not to meet a 16 regulatory requirement. Our lawyers I thought made it very I
| |
| 17 clear that you do not use cost / benefit to decide whether or '
| |
| 18 not to meet regulatory requirement.
| |
| 19 MR. BAER: The requirement is there, but now if you 20 are telling a licensee he must do additional testing to 21 demonstrate that, that I think gets grayer.
| |
| 22 MR. MICHELSON: That is a little grayer than the 23 HPCI steam line valves.
| |
| 24 MR. BAER: I think the licensees will say here is 25 our purchase spec, these salves are supposed to close in the HERITAGE REPORTING CORPORATION -- (202)628-4888
| |
| | |
| .i 36 1 event of a HPCI steam line break.
| |
| 4
| |
| ( 2 MR. MICHELSON: Some of them can't'even.say that.
| |
| 3 It turns out it isn't even'in the purchase spec.
| |
| 4 MR. BAER: I think it should be enforced.
| |
| 5 MR. MICHELSON: Those should not be under the 6 generic issue. l 7 CHAIRMAN EBERSOLE: I am supposed to limit this ,
| |
| 8 conversation, but I am not much of a limiter in any case and I.
| |
| 9 think something comes out of this, but I can't help but hear ;
| |
| 10 all the talk about this and the escape word used by the i
| |
| 11 lawyers and everything is the word "adequate." You know, if 12 you get beyond adequacy, and then it becomes a controversial i
| |
| l
| |
| (]) 13 matter, but who the hell knows what is adequate? I think the j i
| |
| 14 evidence on the valve case is, it is, certainly is'now known !
| |
| 15 not to be adequate since it has been found the classical 16 equation used to estimate closing thrust about 30, 20 percent j i
| |
| 17 too low. ]
| |
| l
| |
| ; 18 HR. ANDERSON: You are right, and the generic issue j i
| |
| 19 questions that, the capability of the valve to perform, and )
| |
| i 20 now that's a valid issue. i I t 21 MR. MICHELSON: It is not a valid generic issue. It j l
| |
| 1 22 is a valid issue. You just said it. I claim that that sort l i
| |
| 23 of issue doesn't belong in the generic issue classification. )
| |
| l l 24 It belongs in a regulatory arena where you have not met the 25 requirements of the, that you claim that the device can j i
| |
| HERITAGE REPORTING CORPORATION -- (202)628-4888 i 1
| |
| | |
| 37 1 perform, and ycu have to decide in a different arena how to
| |
| ( 2 solve that problem and you don't use cost / benefit necessarily.
| |
| 3 CHAIRMAN EBEPSOLE: When Chernobyl came up you were 4 asked to look s' Chernobyl type protections. Immediately I 5 could focus on that as e protection as it stands right square 6 in front of our face clear as anythitg, where you proceed even 7 to multiple core melts because of destruction of machinery 8 necessary to keep the core cool as a result of an open primary 9 loop. Anyway, let's leave that and carry on or we will never 10 get through.
| |
| 11 MR. ANDERSON: Good idea. Okay. Well, the point 12 that I was going to make is that during the prioritization
| |
| () 13 process, the, they always look at what other issues are being 14 worked, what other activities are going on within the 15 Commission, who is doing what, in all the offices, just not 16 other generic issues, to ensure that this issue isn't being 17 worked on some place else, isn't part of another issue. They 18 define what the interfaces are.
| |
| 19 Once the prioritization is complete, and there is an
| |
| \
| |
| 20 initial prioritization assigned, then it is subjected to the 21 staff peer review. It goes to the various offices, and it is 22 reviewed fairly extensively. Following the review, then the 23 prioritization is looked at again in light of what the other, 24 what the other offices and what the NRC management says about
| |
| }
| |
| 25 it, and a final prioritization is assigned.
| |
| HERITAGE REPORTING CORPORATION -- (202)628-4888
| |
| | |
| i 38 1 The ACRS does redo these prioritization O)
| |
| \_ 2 periodically, so now we have an issue. It has been 3 prioritized as high or medium, and the issue then assigned to ,
| |
| 4 one of the branches. The tasx manager is assigned to it, and 5 then the resolution process starts.
| |
| 6 HR. WYLIE: Let me ask a question. Is this true of 7 those that during the process that they said dropped?
| |
| 8 MR. ANDERSON: No. The issue is, if an issue is 9 assigned the drop category--
| |
| 10 HR. BAER: Or low category.
| |
| 11 MR. ANDERSON: Or low, and the review indicates that 12 that's an appropriate category.
| |
| () 13 MR. WYLIE: That's my question. If you, if it 14 during the prioritization is assigned a drop, of no concern or 15 something, does it get peer review?
| |
| 16 MR. ANDERSON: Yes.
| |
| 17 MR. WYLIE: And it is identified why it was dropped? l I
| |
| i 18 MR. ANDERSON: Yes. .
| |
| 19 MR. MICHELSON: Along the same line, what I wanted !
| |
| 20 to ask is having decided at that particular point in time to 21 drop the issue, wnat kind of a structure is in place to 22 re-review these lower drops as new evidence comes in over 23 future time? Perhaps there wasn't the evidence for anything 24 higher than a low or drop at the time, but since that time a
| |
| )
| |
| 25 lot has happened.
| |
| HERITAGE REFORTING CORPORATION -- (202)628-4888 m
| |
| | |
| 39 1 MR. ANDERSON: It isn't pulled out of'the book'and O 2 thrown into the waste can.- It maintains its identity almost
| |
| \a/
| |
| ~
| |
| 3 forever. There is a. record of all the issues that'have been 4 prioritized, all the ones that have been assigned'that J
| |
| 5 . category.
| |
| 6 MR. MICHELSON: Who has those in mind, though? I'm 1 -
| |
| 7 sure there is a record,-but who keeps them in mind as new
| |
| : 8. experience unfolds?
| |
| 9 MR. ANDERSON: The way that that.would get into the 10 system, I don't think there is any periodic look at-tha ones 11 that have been assigned low priorities. It some incident 12 occurs or another issue similar to that or the same one
| |
| () 13 surfaces in the future, then in the looking at what ether, l
| |
| 14 looking at what other issues exist or what concerns exist, the i
| |
| j 15 guy who is doing the prioritization would--
| |
| 16 MR. MICHELSON: There is, if no experience comes up, 17 there isn't somebody doing prioritization on that not new 18 experience necessarily? It-is just a piece of information.
| |
| 19 That's all. It is an LER or deficiencies record of some sort.
| |
| 20 And irho reviews them from the viewpoint of whether or not they 21 now create a sufficient elevation of a lower drop to bring it u
| |
| 22 up to, as a formal issue again? How is that done?
| |
| 23 MR. BAER: I don't know that there is a systematic 24 way.
| |
| "}
| |
| 25 HR. MICHCLSON: This happens by happenstance? If HERITAGE REPORTING CORPORATION -- (202)628-4888
| |
| | |
| 1' 40 1 somebody thinks oh, gee, we worried aboutLthat years ago.and [
| |
| 2 he pulls it.out of the file.
| |
| 3 MR. BAER: Quite'often it is the guy lthat originally' 6
| |
| 4 : identified the issue and is still- disappointed that it was _ low i
| |
| 5 or drop. He carefully is looking for.further evidence.
| |
| 6 MR. MICHELSON: He may be long gone from the agency, !
| |
| 7 though, and I wondering how the agency assures.that the new 8 experience is related to the old issues to see whether or not 9 the correct decision might have been made?. ;
| |
| 10 MR. ANDERSON: Only if this issue comes up as a new ,
| |
| 11 proposed issue.
| |
| l 12 MR. MICHELSON: Then I can understand how it works.
| |
| () 13 MR. ANDERSON: Then this systematic look at other i 14 activities in the agency would uncover it, but if itidoesn't, 15 then more than likely, it wouldn't. i 16 MR. MICHELSON: Now to come up as a new issue, i
| |
| 17 somebody has to get sufficiently excited abeut it to declare
| |
| , 18 it a potential generic issue, somebody or some organization.
| |
| 19 MR. BAER: Yes.
| |
| 20 MR. WYLIE: Is there a single point in the 4
| |
| 21 management organization that is charged with the management of '
| |
| 22 this?
| |
| i 23 MR. ANDERSON: Yes.
| |
| 24 MR. WYLIE: Who is that?
| |
| (
| |
| 4 25 MR. ANDERSON: There is a prioritization group.
| |
| 4 HERITAGE REPORTING CORPORATION -- (202)628-4888
| |
| | |
| 41 1 MR. WYLIE: No. Is there a single manager?
| |
| 's_ji 2 MR. ANDERSON: There is know--Tom King.
| |
| 3 MR. BAER: They all filter to him to be prioritized.
| |
| 4 It would be, if it is identified, it goes to that single 5 branch.
| |
| 6 MR. WYLIE: He is charged with overseeing this whole 7 process?
| |
| 8 MR. BAER: Yes.
| |
| 9 DR. LEWIS: The closeness of priorities or the 10 process of, sort of shepherding the resolution of the--
| |
| 11 MR. BAER: No. Let me try and say it again. We in 12 my branch, Carl Neal's branch, and Frank Kaufman's branch, are
| |
| /~T 13 not involved in the prioritization except in the peer review V
| |
| 14 process. We like everybody else have a crack at it in peer 15 review, and to be very frank, if we think it is coming to our 16 branch, we get very actively involved in the peer review, but 17 only after it comes out of that process, is assigned to 18 somebody, and we, we don't do the prioritization, and we are i 19 not really assigned any efforts there until it comes out of l 20 the process and then it is assigned to a branch, and the 21 branch assigns it.
| |
| 22 DR. LEWIS: Who makes the assignments?
| |
| 23 MR. BAER: Beckjord within Research.
| |
| 24 DR. LEWIS: That is in Research?
| |
| 25 MR. BAER: Yes. I mean--
| |
| HERITAGE REPORTING CORPORATION -- (202)628-4888
| |
| | |
| 42 1 DR. LEWIS: And who is responsible for making sure 2 that these things move along at a reasonable manner?
| |
| 3 MR. BAER: Then Henry Spiess is the associate 4 director that worries about generic issues primarily, other 5 research activity.
| |
| 6 MR. ANDERSON: Okay. The first step then after a 7 task manager has been assigned to the issue is to develop a 8 task action plan, and that outlines how the task manager 9 intends to approach this issue and where he defines what the 10 scope of it should be.
| |
| 11 (Slide) 12 CHAIRMAN EBERSOLE: On the particular issue we are
| |
| () 13 calking about, I think that's where the trouble starts, the 14 task action plan and the approach.
| |
| 15 Anyway, carry on.
| |
| 16 MR. ANDERSON: I may not agree with that, but--all 17 right. The task action plan goes through the procedure that 18 we use here. There is a number of, number of items, number of 19 sections in the task action plan that the task manager has to 20 put in it.
| |
| 21 First of all, he needs a clear statement of the 22 issue and also an outline of what his approach will be. The 23 objective of the study, any assumptions and limite,tions which
| |
| [} 24 for one reason or another that he has got to put some kind of 25 bounds on it, and this is where tnat task manager describes HERITAGE REPORTING CORPORATION -- (202)628-4888
| |
| | |
| 43 1 what these bounds should be.
| |
| /^)
| |
| \v 2 Then a definition of the task, task 1, 2, 3, however 3 many separate tasks that he thinks need to be worked on this 4 issue, and then one of the, one of the items is, then is 5 justification for continued operation.
| |
| 6 Now in all of these issues, all the task action 7 plans. one of the things that we want to do is to make a 8 determination if we can that this isn't a sufficiently 9 important issue such that we need to go out and take some 10 action immediately, that it is okay to let plants continue to 11 operate while we are working on the resolution of this issue.
| |
| 12 DR. LEWIS: And that determination is made within
| |
| () 13 Research? It is a regulatory decision within Research?
| |
| 14 MR. ANDERSON: Initially; this first task action 15 plan developed by the task manager is subjected to the same 16 type of review that the prioritization is.
| |
| 17 DR. LEWIS: That review includes the regulatory 18 people?
| |
| 19 MR. ANDERSON: Includes NRR.
| |
| 20 DR. LEWIS: But 1 thought that Carl Neal was in 21 charge of the whole process?
| |
| ; 22 MR. ANDERSON: You still need peer review especially 23 from NRR and the other officas, even from OGC.
| |
| (} 24 DR. LEWIS: I am having trouble finding out who is 25 in charge.
| |
| HERITAGE REPORTING CORPORATION -- (20.l)628-4888
| |
| | |
| 44 1 MR. ANDERSON: Okay. You have to wait just a minute
| |
| ( 2 here. The first thing that the task manager does is develop 3 the task action plan. Originally it is a draft task action 4 plan. Once it is drafted, and he has proposed what task could 5 be, what the assumptions, limitations are, he puts the thing 6 together. Then it, it is submitted for management review, 7 peer review, management review, and approval.
| |
| B DR. LEWIS: Management review means the cabal, the 9 office director--
| |
| 10 HR. ANDERSON: Goes to the offices who are affected 11 by it. It may go to NHSS, certainly NRR. It will go to AEOD.
| |
| 12 DR. LEWIS: That is for coordination?
| |
| () 13 MR. ANDERSON: No. This is for review and comment, 14 and--
| |
| 15 DR. LEWIS: Comment back to Research? Research 16 remains in charge.
| |
| 17 MR. ANDERSON: Research remains in charge.
| |
| 18 DR. LEWIS: It could ignore the comments from the 19 other officea?
| |
| 20 HR. ANDERSON: At their own risk I suspect.
| |
| 21 DR. LEWIS: I am not talking about that. I am 22 talking about the way it is structured so-- 1 l
| |
| 23 MR. ANDERSON: The comments have to be resolved.
| |
| ll 24 HR. MICHELSON: I assume it is peer review and not 25 concurrence review. c l
| |
| t HERITAGE REPORTING CORPORATION -- (202)628-4888 l a
| |
| | |
| 45 1 MR. BAER: Yes: '
| |
| ( 2 MR. WY1.IE: I don't know--the second bullet there?
| |
| 3 MR. ANDERSON: For review and approval.
| |
| 4 MR. WYLIE: That's what you are talking 9. bout?
| |
| 5 MR. ANDERSON: Well, the approval, approval process 6 here, you know, certainly it requires Research management 7 approval. I would, I guess I have to, I would have to retract a 8 that as far as NRR is concerned. I think that in NRR we get s
| |
| 9 review and we get comments which we have an obligation to 10 resolve with NRR. If NRR says we don't like this and we think 11 you are off base on it, then we have to, have to sit down with 12 NRR and work out the problems. We have to resolve their I'T 13 comments.
| |
| U 14 HR. WYLIE: Does that occur?
| |
| 15 MR. ANDERSON: Yes, it does.
| |
| 16 DR. LEWIS: But I'm--okay. I think I understand the ,
| |
| l 17 process, but this very important regulatory decision, whether 18 to let the plants operate in the face of whatever this j 19 unresolved issue, is made within Research, after consultation 20 with the other affected offices, including NRR, but it is made l i
| |
| 21 within Research? i 22 HR. BAER: That decision initially was made also i 23 during the prioritization, when the issue was identified, even !
| |
| 24 before the prioritization. That was a consideration at that 25 time. I think this is more a formal statement of the basis '
| |
| HERITAGE REPORTING CORPORATION -- (202)628-4888
| |
| | |
| l 46 1 for saying that it is a generic issue and not immediate action O).
| |
| (_ 2 item.
| |
| 3 MR. MICHELSON: If you had decided, though, it 4 should not continue to operate, all you would do is recommend 5 to NRR that it ought not to continue to operate?
| |
| 6 MR. BAER: That's right.
| |
| 7 MR. MICHELSON: They don't decide. They only 8 recommend.
| |
| 9 DR. LEWIS: But they decide whether to raise the 10 issue?
| |
| 11 MR. MICHELSON: Sure.
| |
| 12 MR. ANDERSON: That's right.
| |
| () 13 MR. BAER: But it really, in actuality it gets 14 raised when the issue is first proposed, too, before it is 15 prioritized.
| |
| 16 DR. LEWIS: You can see that I am a little concerned 17 that in the resolution process for these things, Research 18 whose function is to generate knowledge and approve 19 understandings and so forth, is deeply involved in the 20 regulatory implications of these things and they may be 21 biasing the whole process.
| |
| 22 HR. BAER: Well, the people--
| |
| 23 DR. LEWIS: That is what I am coming away with.
| |
| 24 HR. BAER: The people involved were, the branches 25 involved were pretty mucit moved in tact from NRR to Research.
| |
| HERITAGE REPORTING CORPORATION -- (2021628-4888
| |
| | |
| 47 1 You know, the people haven't really changed.
| |
| ('i
| |
| \/ 2 CHAIRMAN EBERSOLE: Out of all this is coming a 3 little picture to me that is, I guess it is almost a policy 4 matter.
| |
| 5 I would like to find out, you know, the focal point 6 of indecision over this little matter of HPCI thing. This has 7 beer persisting for 25 years. Because of its immense 8 potential and the comparative ease with which a fix can be 9 accomplished, I don't understand the absence of a decision 10 when the decision process and the elements of correcting the 11 situation are so simple. Somewhere there is a stagnation 12 process and I don't know what the hell drives it.
| |
| () 13 HR. ANDERSON: Well, I think that although the 14 system can be slow and burdensome at times, I think that if 15 that issue, and I don't know that it hasn't, but got into this 16 system, I think it would receive that kind of attention. I 17 don't know, don't know whether it has been proposed as an--
| |
| 18 CHAIRMAN EBERSOLE: It was brought up in '68.
| |
| 19 MR. ANDERSON: I can't answer that. I don't know 20 why it u .dn't get into the process.
| |
| I 21 CHAIRMAN EBERSOLE: Okay. ,
| |
| l 22 MR. MICHELSON: Would you clarify for me, does a 23 task action plan, is it developed as a medium level?
| |
| 24 MR. BAER: Yes.
| |
| {"}
| |
| 25 MR. MICHELSON: But not low or drop?
| |
| HERITAGE REPORTING CORFORATION -- (202)628-4888
| |
| | |
| 48 1 MR. BAER: Right. If it is assigned--the highest
| |
| ) 2 and mediums are to a particular branch.
| |
| 3 HR. MICHELSON: This same process goes through for 4 medium as well as high?
| |
| 5 MR. ANDERSON: Yes. Once we start working on an 6 issue or it is assigned, we don't treat medium any different 7 than we do high priority.
| |
| 8 MR. BAER: Really the only distinction is if there 9 is any sort of budget crunch on technical assistance money, 10 obviously the mediums get hit harder than the highest, but 11 that is really the only distinction.
| |
| 12 CHAIRMAN EBERSOLE: We are laying an awful lot of
| |
| () 13 ground work but we are not getting very close to the problem 14 at hand.
| |
| 15 MR. WYLIE: Is this process written down any place?
| |
| 16 Who is responsible for what?
| |
| 17 MR. ANDERSON: Let's see--
| |
| 18 MR. BAER: There is a series of office letters being 19 prepared. The first one out, the first one on the 20 prioritization process has been issued in the lust month or 21 so. There is several more in preparation, but I don't think 22 they have been issued. They were old office letters on this.
| |
| 23 MR. ANDERSON: Old NRR office letters that describe 24 this process; but now it has been, research is being redone.
| |
| 25 MR. MICHELSON: No manual chapter?
| |
| HERITAGE REPORTING CORPORATION -- (202)628-4888
| |
| | |
| 49 1 HR. ANDERSON: If there is, I have never been able O
| |
| \/ 2 to find it. I don't believe it is covered by manual chapter.
| |
| 3 MR. MICHELSON: I would think if it is important and 4 expensive and elaborate enough, there would be a manual 5 chapter on the process instead of just some office memos.
| |
| 6 MR. BAER: Office letter, I guess I am not sure.
| |
| 7 MR. MICHELSON: Manual Chapter Is available to 8 everybody at any time. It is in front of you. It is the 9 policy of the agency that you abide by it, but the memos from 10 offices get old, and lost or whatever. I just was surprised.
| |
| 11 I thought it was a manual enapter.
| |
| 12 MR. ANDERSON: Okay. The other two items that are
| |
| () 13 included in the task action plan is a proposed schedule for 14 the resolution, and an identification of what resources are 15 required, both technical assistance resource, and staff 16 resources.
| |
| 17 Okay. After the review process, and then we get 18 management approval before the work is initiated here. This 19 would be after resolution of comments from the other offices, 20 this would be approval of Research management in this case.
| |
| 21 Okay. And the task action plan, okay, has to be kind of a 22 living document. As a situation changes, or we get smarter, 23 there is a process for revolutionizing the task action plan.
| |
| 24 If the scope of the task changes for some reason or something 25 is added, something is deleted from it, then we would make a HERITAGE REPORTING CORPORATION -- (202)628-4888
| |
| | |
| 50 1 change in task action plan, formal change.
| |
| ( 2 The change in resource requirements which often 3 happens, we also would update the task action plan.
| |
| 4 Md. WYLIE: Have you changed the scope or change, if 5 you change scope such as that, is that then reviewed again by 6 the peer review?
| |
| 7 HR. ANDERSON: Yes. Now when we--in controlling the 8 scope, okay, it is, the scope is defined in the task action 9 plan, and sometimes the scope has a tendency to be kind of 10 fuzzy at the edges. The reason is that not all of the 11 activities are that easy to draw a fine line of what is in and 12 what is out, but we do the best job we can to try to get a
| |
| () 13 good definition of what the scope is, what problems that we 14 are attemp*ing to work, and what the limits on it are.
| |
| 15 The task definitions and the assumptions and 16 limitations are important. Much of--the task manager 17 initially and throughout the process has to look at what, 18 certain assumptions that have to be made in order to achieve a 19 resolution of this issue, and what limitations he is going to 20 have to place on it, and one of the things that he is 21 obligated to do is make sure that other people understand the, 22 what these limitations and assumptions are and why it was 23 necessary to make them.
| |
| 24 Then throughout the life of the project, at least 25 through the technical resolution phase of it, when the actual HERITAGE REPORTING CORPORATION -- (202)628-4888
| |
| | |
| -, . . = . -- - - . . , , ..
| |
| ~51 1 work is being done, .the scope is changed as'necessary, but
| |
| ( 2 only with the management review and' approval.
| |
| 3 On the USIs, we used to review, we used to change 4 them, go through a, review them for a change, and provide any.
| |
| 5 changes annually. We haven't done that on an annual basis 6 anymore. We do it as needed. a91 on the issues, but-- .
| |
| 7 MR. MICHELSON: Does.this mean when you put that 8 GIMCS book with its descriptions that you read, went through-a ,
| |
| 9 whole review process then because tha deceriptions of scope in 10 many cases wers significantly different than in the aqua book?
| |
| 11 MR. BAER: The GIMCS is updated every three months.
| |
| 12 MR. MICHELSON: Doesn't it go through review process
| |
| () 13 when it is updated?
| |
| 14 MR. ANDERSON: We haven't put out an aqua book for 15 sometime.
| |
| 16 MR. MICHELSON: I thought the suggestion was if you ;
| |
| i 17 change the scope, it goes out for review. )
| |
| 18 MR. ANDERSON: It is.
| |
| 19 MR. BAER: The scope--I can't talk about other 20 branches, but when we update the seventeen or so issues in my 21 branch, yes, I review the changes, but most of the changes, 22 the GIMCS--
| |
| l j 23 MR. MICHELSON: I thought review meant beyond your l 24 branch?
| |
| O i l 25 MR. BAER: Let me--most of the changes are schedule- l l
| |
| l l
| |
| i HERITAGE REPORTING CORPORATION -- (202)628-4888 !
| |
| 1
| |
| | |
| 52 1 changes, and if they are'significant, then the depending on
| |
| () 2 how badly they slip, they have to_be reviewed by the division 3 director, and if they are bad enough, by the office director. !
| |
| 4 MR. MICHELSON: How about the scope changes?
| |
| I 5 MR. BAER: Well, we update the status, but we don't
| |
| ]
| |
| l 6 change the scope. l l
| |
| l 7 MR. MICHELSON: The wording changed significantly l
| |
| 8 between the aqua book and the GIMCS book?
| |
| 9 MR. ANDERSON: The aqua book is several years old.
| |
| 10 HR. MICHELSON: I understand why it could have 11 changed, but the question w.T is the GIMCS book out for, you 12 know, the peer review to see if the scope changes were okay?
| |
| () 13 MR. BAER: The GIMCS is just a summary of the 14 status.
| |
| 15 MR. MICHELSON: I realize that, but the summary, now 16 they are using the GIMCS book, not even using the aqua book 17 for descriptions of scope, and somebody changed the scope.
| |
| 18 MR. BAER: The scope is defined in the task action i
| |
| 19 plan, not GIMCS.
| |
| 20 MR. ANDERSON: It has never been the intent in agua 21 or GIMCS to control the scope with those documents. The task 22 action--
| |
| 23 MR. MICHELSON: How do you control the scope?
| |
| 24 MR. ANDERSON: Task action plan.
| |
| 25 MR. MICHELSON: The scope is changed in there, it HERITAGE REPORTING CORPORATION -- (202)628-4888
| |
| | |
| h 53 1 'goes out for peer review?
| |
| 2 MR. AUDERSON: Yes.
| |
| 3 MR. BAER: At least management review through 4 Research management.
| |
| 5 CHAIRMAN EBERSOLE: On this subject of--
| |
| 6 MR. BAER: If it changes, really because of 7 resources and schedule, I don't think we normally would send 8 that out.
| |
| 9 MR. MICHELSON: You can change the scope- ,
| |
| 10 significantly because you don't have the money anymore and 11 nobody else has an input'to that change.
| |
| * 12 MR. BAER: No. That isn't what I. meant. If you
| |
| () 13 stretch out the schedule because of lack of resources, that 14 wouldn't go through a peer review. >
| |
| 15 MR. MICHELSON: You would go beyond Research,-in l 16 other words, to NRR or AEOD or whenever?
| |
| 17 CHAIRMAN EBERSOLE: I want to stick in a word about 18 the nature of the project we have here. It says the influence 19 of control systems on safety systems.- Now that has a whole 20 wide world of interpretation.
| |
| 21 MR. ANDERSON: That's right.
| |
| 22 CHAIRMAN EBERSOLE: And it is really the 23 implications of control system on nuclear safety I think. I
| |
| [} 24 don't care whether it affects safety systems or not. We are 25 trying to find out what we can do--I am going to pull an HERITAGE REPORTING CORPORATION -- (202)628-4888
| |
| | |
| 54 i
| |
| 1 ancient example 20 years old again. I can go back'in history. I
| |
| () 2 MR. BAER: Wait until we get to USI A-47.
| |
| 3 CHAIRMAN EBERSOLE: I want to talk about scope. The 4 scope of this problem, as you undertook it, has been vastly 5 truncated.
| |
| 6 MR. BAER: That is not the case. People make that 7 statement.
| |
| 8 CHAIRMAN EBERSOLE: I am going to give you an 9 example and to show--
| |
| 10 MR. BAER: It may have been you can argue that it 11 was misdefined, it wasn't changed.
| |
| 12 CHAIRMAN EBERSOLE: But I want to tell you there was
| |
| (} 13 a case where an 800 ton cask was lifted over a pool, it was 14 held up by a crane. The crane had a driver. It had control 15 systems to control rates and distances, and torque switches, 16 and it had a control system and there was some potential this 17 800 ton bullet would fall through the floor of the pool and I
| |
| 18 expose a whole reactor load of fuel. That's a problem. When 1
| |
| 1 19 one looked at the control system, and I am sure you didn't j 20 look at these in your scope, it was found out that-- )
| |
| 21 HR. ANDERSON: I don't know.
| |
| 22 CHAIRMAN EBERSOLE: Found out very easily that if 23 the control system torque limit switches failed, the driving 24 motor had a pinion shaft that drove the gears. When there is 25 a break on the outboard end of the drive pinion, it would HERITAGE REPORTING CORPORATION -- (202)628-4888
| |
| | |
| 55 1 never stop. What happened was you would overrun the motor, 2 the pill box come through, teeth come out, brakes go and the 3 bullet would go through.
| |
| 4 MR. BAER: Generic issue. ;
| |
| I 5 CHAIRMAN EBERSOLE: It was handled under a lift, j i
| |
| l 6 heavy load later, but nevertheless, these things existed and i 7 had to be fixed, and it was done by going back and forth l 8 vastly changing the design of the whole damn crane and putting 9 massive brakes on it that would override any motor torque at 10 all with control systems to override it, and it was a safety 11 problem.
| |
| 12 I don't think these things are within your scope at 13 all.
| |
| 14 MR. ANDERSON: It was identified as a safety 15 problem. It was--
| |
| 16 CHAIRMAN EBERSOLE: It was generic class, says I 17 have got a driver, got excessive capabilities, I must control 18 its band of influence on the process,or else determine what, 19 if the driver goes out of control, what the hell happens to 20 the system? And that bounds the control systems to me.
| |
| 21 MR. ANDERSON: I don't remember the scope of that 22 issue when it was worked, but I remember the--
| |
| 23 MR. EBERSOLE: That was 20 years ago. It was '68.
| |
| 24 We took it up with GE and they said don't tell.
| |
| 25 HR. ANDERSON: Our generic issue of control on heavy HERITAGE REPORTING CORPORATION -- (202)628-4888
| |
| | |
| 56 1 loads.
| |
| O sf 2 CHAIRMAN EBERSOLE: That was ten years later.
| |
| 3 MR. ANDERSON: Okay. At any rate, it is not a 4 perfect system, but we do the best we can to try to get a good 5 definition.
| |
| 6 CHAIRMAN EBERSOLE: Angels can do no more.
| |
| 7 MR. ANDERSON: Not even us! Okay. We do change the 8 scope as necessary. Okay. And--all right. And this is 9 updated, resubmitted. If the scope changes outside of the !
| |
| l 10 change in the requirement for resources or schedule, we are 1 l
| |
| 11 not so concerned about the safety issue or actual scope of 12 technical work in that case, but you know, just make appeal to
| |
| (} 13 you, you know, we think that it isn't a bad system. We try to 14 work it the best that we can, but you know, there are things 15 that may slip by us, but you know, I think that we make an 16 honest effort to try to define what this scope is and try to 17 get our peer review and get our approval and we try to work it I 18 according to that. Some of these issues are very difficult to 19 define, and I hope, I think you appreciate that, but when Andy 20 comes up, one of the things that he is going to do is to walk 21 you through that task action plan and how it was changed and 22 when, and what was added to it, and how we came out on it.
| |
| 23 CHAIRMAN EBERSOLE: What was taken away trom it is )
| |
| 24 what I am interested in.
| |
| 25 MR. ANDERSON: Okay. That's, he is going to tell i HERITAGE REPORTING CORPORATION -- (202)628-4888
| |
| | |
| 57 1 you that, but it may be a null set, which might surprise you.
| |
| () 2 CHAIRMAN EBERSOLE: I notice the unidirectional 3 character of your observation, what we added to it.
| |
| 4 MR. ANDERSON: That is correct.
| |
| 5 CHAIRMAN EBERSOLE: Madison Avenue technique.
| |
| 6 MR. SZUKIEWICZ: My name is Andy Szukieweiz. I am 7 the task manager of USI A-47. We have met a couple of times 8 already. We have met in October in a subcommittee meeting, 9 and in Noverher of last year in a Full Committee meeting 10 where I made some presentations on the issue itself.
| |
| 11 As Newt pointed out, initially what we try to do is 12 give you a quick overview of what the activities were and we
| |
| () 13 concentrated primarily on the proposed resolutions.
| |
| 14 Because there was a big discussion in unclarity of 15 scope, today I will try to emphasize more what we agreed to 16 do, what we did, and if there are any clarifications or 17 changes in scope, I tried to identify the major ones.
| |
| 18 MR. EBERSOLE: Are you going to say what you agreed 19 not to do?
| |
| 20 MR. SZUKIEWICZ: Yes, sir. So I will just briefly 21 go over the introduction and background, and definition, and 22 then focus primarily on the scope and the task action plan 23 activities, unat our assumptions and limitations were with the 24 overall program and the program overview, and the last two 25 items primarily are just reiteration of what we discussed HERITAGE REPORTING CORPORATION -- (202)628-4888
| |
| | |
| 58 1 before in the previous meetings.
| |
| () 2 (Slide) 3 HR. SZUKIEWICZ: USI A-47 is a program to evaluate 4 the effect of non-safety grade control system plants on plant 5 safety. That was the very broad, general charter.
| |
| 6 CHAIRMAN EBERSOLE: Can I stop right here at the 7 moment and say how are you going to identify a failure?
| |
| 8 MR. SZUKIEWICZ: I think I can cover that in our, 9 what we looked at and where we scoped.
| |
| 10 CHAIRMAN EBERSOLE: You are going to take the ,
| |
| j 11 control parameter up and down and have it oscilate and go to :
| |
| 12 the right and left?
| |
| i
| |
| (} 13 HR. BAER: Give him a chance.
| |
| 14 CHAIRMAN EBERSOLE: All right. Carry on.
| |
| 15 MR. BAER: We never get a chance to describe what we 16 did do.
| |
| 17 CHAIRMAN EBERSOLE: Carry on.
| |
| 18 MR. SZUKIEWICZ: The purpose of this presentation is 19 to define the scope of review, present the review methodology, 20 and summarize ~the ..roposed resolutions, and also to seek a 21 recommendation from the ACRS to issue the proposed resolution 22 for public comment.
| |
| 23 At this stage, we have gone through and have '
| |
| 24 concurrences by Research, by the office of NRR, AEOD, and ,
| |
| 25 Office of the General Counsel. !
| |
| HERITAGE REPORTING CORPORATION -- (202)628-4888
| |
| | |
| 59 1 We also received recently a go ahead from CRGR to go
| |
| ( 2 out for public comment. What we intend to go out for public 3 comment is to receive comments on the technical findings 4 report which we provided to you in last year, and the 5 regulatory analysis which we also provided, and the guidelines 6 for implementing the proposed resolution which will be 7 basically the information that will eventually be contained in 8 the generic letter, and all this you have received previous in )
| |
| 1 9 October and in our November meetings. !
| |
| l 10 (Slide) 11 MR. SZUKIEWICZ: As I think Mr. Baer identified, 12 that when we went out to, when out and discussed our proposed
| |
| (') 13 resolution with CRGR, there were certain conditional approvals 14 and conditional activities that we had to resolve before we 15 can go out for public comment.
| |
| 16 We have completed these activities, and we are 17 planning on issuing, we are going out for public comment soon.
| |
| 18 A quick background--the USI A-47 and its very broad 19 nature was approved by the Commission December 1980.
| |
| 20 Technical assistance contracts were started in '82, and the 21 task action plan, the initial one, was also approved in 1982. I 22 The werk in, the work primarily was conducted in oak .
| |
| 1 23 Ridge National Laboratory, the Idaho Falls INEL labs, the p) 24 Idaho Falls and Battelle Northwest PNL laboratories, v
| |
| 25 The worst was, basically most of the technical work i 1
| |
| 1 HERITAGE REPORTING CORPORATION -- (202)628-4888
| |
| | |
| 60 1 was completed and the contractor reports were issued in
| |
| () 2 January of '86. The proposed package for staff and office 3 concurrences was completed in '86, and as I said, the approved 4 package by CRGR was in December of this past year, a couple of 5 months ago, and we are anticipating to issue the documents 6 that I mentioned next month, and with the projected final 7 resolution a year from now.
| |
| 8 DR. LEWIS: I am still groping for who is in charge.
| |
| 9 In the end--since the Commission approved the establishment of 10 A-47 USI, in the end the Commission will have to sign off on 11 the final resolution, or is that wrong?
| |
| 12 MR. ANDERSON: That's wrong. That would be the-() 13 office director will issue it. When they do issue the final 14 resolution, a Commission paper will be sent informing the 15 Commission that it has been resolved and how and made an 16 issue. !
| |
| l 17 DR. LEWIS: Who in the end signs off? The office l l
| |
| 1 18 directors? l I
| |
| 19 MR. ANDERSON: That will be Beckjord. l 20 DR. LEWIS: I see; even for the regulatory 21 implications? j l
| |
| 22 MR. ANDERSON: That's right. We have recently--
| |
| 23 MR. BAER: The specific actions the licensees are l
| |
| 1
| |
| (~g 24 asked to do will be a letter sent from NRR signed off by AEOD s/ I 25 or perhaps-- l l
| |
| l 1
| |
| f HERITAGE REPORTING CORPORATION -- (202)628-4888 l
| |
| | |
| 61 1 DR. LEWIS: I see. So the implementation will be in
| |
| (-
| |
| /^)% 2 the hands of NRR?
| |
| 3 MR. BAER: Yes, sir.
| |
| 4 MR. ANDERSON: That's right. Just the resolution 5 package and final issuance will be Beckjord, 6 DR. LEWIS: The resolution package will contain 7 regulatory recommendation?
| |
| 8 MR. ANDERSON: Yes, or requirements.
| |
| 9 DR. LEWIS: And NRR then has the option to reject 10 them?
| |
| 11 MR. ANDERSON: No.
| |
| 12 DR. LEWIS: It does not?
| |
| (') 13 MR. BAER: That is why they are part of the--
| |
| 14 MR. ANDERSON: They have already approved the 15 issuance of the resolution, whatever it is, and it is their 16 responsibility to see that it is implemented.
| |
| 17 MR. BAER: Part of the resolution package, proposed 18 resolution package, will be essentially the requirements to be 19 imposed on licensees. It is all the attachments to the draft 20 generic letter.
| |
| 21 DR. LEWIS: That will be signed by Beckjord, but 22 with concurrence presumably in the form of a formal letter 23 from NRR to Beckjord, and then NRR will implement the research 24 package because it has already approved it?
| |
| {
| |
| 25 MR. ANDERSON: Yes.
| |
| HERITAGE REPORTING CORPORATION -- (202)628-4888 .
| |
| i
| |
| | |
| 62 1 DR. LEWIS: Funny way to do business.
| |
| (.
| |
| O) 2 MR. BAER: That may well be, but the research, the 3 bottom line in this particular case, as we envision it now, is 4 the generic letter to licensees requiring them to do certain 5 things if they haven't been done, for those plants that 6 haven't already done them, and that would be an NRR generic 7 letter, and the enclosure to that generic letter will be 8 published as part of this package for proposed resolution, and 9 then the generic letter itself.
| |
| 10 MR. MICHELSON: I have a question of little broader 11 scope than just A-47, and that is that some of the generic 12 issues that come up involve I think things that the regional
| |
| () 13 directors instead of NRR will be obligated to do.
| |
| 14 Are the regional directors in this concurrence 15 process at all?
| |
| 16 MR. ANDERSON: Not unless they are brought in by 17 NRR.
| |
| 18 MR. MICHELSON: But the regional offices end up with 19 some of the resolution work, don't they?
| |
| 20 MR. BAER: With the verification part of it.
| |
| 21 MR. MICHELSON: For instance, but they are never in 22 the peer review? Are they in the peer review process?
| |
| 23 MR. ANDERSON: They are in some issues. Recently we 24 have reviewers in regional offices on Generic Issue 51, which 25 is--
| |
| HERITAGE REPORTING CORPORATION -- (202)628-4888
| |
| | |
| 63 1 MR. MICHELSON: You decide whether or not they
| |
| (-
| |
| O) 2 should be involved, is that it?
| |
| 3 MR. BAER: Not only--there is a division in NRR 4 under Jim Hartlow that, who has as one of, that division has 5 as one of its, has as one of its functions coordination of 6 regional activities, and that third constituency that I was 7 describing before is in part trying to package the resolution i
| |
| 8 to adjust the resources between NRR and the regions, and that 9 gets involved very heavily in that.
| |
| 10 MR. MICHELSON: I understand the process. Basically 11 it is a headquarters process?
| |
| 12 MR. BAER: Yes, but they have a division that is
| |
| () 13 sort of the regional advocate. They coordinate and really 14 advocate.
| |
| 15 MR. MICHELSON: I just wondered how this worked now.
| |
| l 16 Thank you.
| |
| 17 MR, SZUKIEWICZ: Okay. Because of the broad l
| |
| 18 statement I think as Mr. Ebersole mentioned, that we call this ;
| |
| I 19 issue safety implications of control systems which aould !
| |
| 20 reall? go off and almost address every single part of the j 21 plant.
| |
| 22 We attempted to identify clearer what we meant by j l
| |
| 23 safety implications of control systems. !
| |
| r 24 Basically the instrumentation systems comprised two 25 basic groups--a safety grade protection system which includes l
| |
| HERITAGE REPORTING CORPORATION -- (202)628-4888 i
| |
| | |
| 64 1 the reactor protection systems, engineered safety features O
| |
| s_/ 2 actuation systems, and ether safety grade systems, and then we 3 have the non-safety grade control systems which are, which 4 include the normal control systems that control pressure and 5 temperatures and flows, and the normal every-day operation of 6 the plant.
| |
| s 7 CHAIRMAN EBERSOLE: Let me comment a little bit on 8 the evolution of this. Again, if I go back to the laboratory, 9 Oak Ridge 25, 20 years ago, protection system was only those 10 circuits and apparatus and devices that opened the circuit so 11 the magnet would drop rods in the core. IEEE-279 was .
| |
| 1 12 originally written just to get that electrical function done.
| |
| () 13 It skillfully avoided the mechanical aspects of that problem.
| |
| 14 Shortly afterward, people realized it didn't matter 15 where the decay heat was. You get into actuation systems.
| |
| 16 All the ultinate evolving history the neglected areas have 17 been in service systems which can impose an excess of whatever 18 service they apply as well as a deficiency thereof or the 19 wiggly motion of random supplies that completely confuse the 20 limiting devices that are supposed te stand in there and limit 21 the aberration of the control functions.
| |
| 22 We still are in a wilderness of whether we are 23 controlling those parametes within safe bounds in these 24 service systems. That's all I want to say.
| |
| 25 MR. MICHELSON: I have got a question on the l
| |
| 1 l
| |
| HERITAGE REPORTING CORPORATION -- (202)628-4888
| |
| | |
| . . _ - __. _ _. -. . . . _ _ m . _ . .,
| |
| t 65 1 . definitions here. One case you talk about. safety grade I 2 protection systems. I assume that'that, there is nomething i
| |
| 3 beyond that class. For instance; like Jesse pointed out,-the 4 voltage regulators on essential' power supply, I guess what you 3 5 call protection system, although they are really what I call a j 6 control system, but a safety grade versus non-safety grade 7 control system,-but I don't know how, I am confused as to how l 8 you, whether it is a clever use of words or whether you really 9 meant protection system includes all safety grade control i i
| |
| 10 systems. ,
| |
| 11 MR. SZUKIEWICZ: It has-- i 12 MR. MICHELSON: Versus not safety grade.
| |
| 4
| |
| () 13 MR. SZUKIEWICZ: It is not intended to have any i
| |
| 14 clever words in it. What we are, when we identify safety 15 grade systems, there is a whole list of these systems, and '
| |
| 16 these systems not only include the systems per se, but the ;
| |
| ) .
| |
| ( 17 support systems as well like power supplies. And they have-- !
| |
| 18 MR. MICHELSON: Support system, did you call that ,
| |
| 19 protection control arrangement or a just a control :
| |
| i 20 arrangement? It is a control system really.
| |
| ] 21 MR. SZUKIEWICZ: Part of that is the prorection
| |
| }
| |
| 22 system arrangement, and that's why we wanted to identify--
| |
| t ,
| |
| l !
| |
| 23 MR. MICHELSON: Part of it is not? Is that what you !
| |
| I l
| |
| 24 are saying?
| |
| 25 MR, SZUKIEWICZ: In some cases, it is strictly power j i
| |
| i HERITAGE REPORTING CORPORATION -- (202)628-4888 I
| |
| | |
| 66 1 supplies, for example, to the normal what you call ICS system.
| |
| ( 2 That is not a safety grade system. And these--
| |
| 3 MR. MICHELSON: When it is controlling power supply 4 for a safety grade power supply, what do you call that?
| |
| 5 MR. SZUKIEWICZ: If it is controlling a safety grade 6 power supply, that is a safety grade system, and the 7 requirements--
| |
| 8 MR. MICHELSON: You use the word protection. Now 9 you are changing the words already. It safety grade 10 protection system.
| |
| 11 MR. SZUKIEWICZ: It is part of the safety grade 12 protection system, and it has to meet the requirements
| |
| () 13 thereof.
| |
| 34 MR. MICHELSON: Second question is can a control 15 system be just a control device or does it, a system infer 16 that there is a whole arrangement of something? l 17 MR. ANDERSON: It is all of the above. It is the 18 whole--
| |
| l 19 MR. MICHELSON: An air regulator as a device is also l
| |
| {
| |
| 20 a control system. There is a man and a machine there that l
| |
| 21 interact. He sets it and so forth, but it is a device that j i
| |
| 22 controls the air pressure, the regulator, i
| |
| 23 Is that considered then to be a part of the, what j i
| |
| 24 you are looking at here when you look at control systems? Are 25 you looking at air regulators, for instance?
| |
| 1 i
| |
| i' HERITAGE REPORTING CORPORATION -- (202)628-4888
| |
| --. _I
| |
| | |
| 67 1 MR. ANDERSON: It is everything that is required to
| |
| ( 2 make that system function or can defeat its function.
| |
| 3 MR. MICHELSON: Can be just a single device?
| |
| 4 MR. ANDERSON: Yes.
| |
| 5 MR. SZUKIEWICZ: There are specific items that are 6 identified and certain ones, for example, in the air system, l
| |
| 7 that are classified as safety grade. There is other parts of ;
| |
| 8 it taat are not. I 9 MR. MICHELSON: There are certain of them like the I
| |
| 10 air regulators depending on who you talk to out there in the 1
| |
| 11 world, even though the air is performing an essential i
| |
| 12 function, they haven't included the regulator as a part of
| |
| () 13 that safety grade categorization, but it is now a control 14 system instead of a protection system, but it is still--
| |
| 15 MR. SZUKIEWICZ: Part of the safety grade protects i 16 the system.
| |
| 17 MR. EBER3 OLE: Let me try to just cover it. There l 18 are lots of things I will call drivers out in the plant. They l 19 drive functions. They furnish services. They are parameters 20 as maybe water, air, electricity, whatever, but they are l I
| |
| 21 drivers, invariably have excess capacity, or at least they j 22 hope they have, and they must be modulated, and that's done by 23 control system, so the outputs come from them aave to be
| |
| {} 24 within a band amplitude and ranges of change. That gadget is 25 fragile. The consequences when it fails either have to be HERITAGE REPORTING CORPORATION -- (202)628-4888
| |
| | |
| 68 1 accepted by the system being served or you have got to put in
| |
| () 2 limit devices. I could use the domestic water heater as an 3 example. The safety devices are safety valve limit.
| |
| 4 MR. SZUKIEWICZ: Part of the safety system had to 5 meet certain redundancy independence. 1 6 CHAIRMAN EBERSOLE: I can use service water as a j l'
| |
| 7 safety system or air pressure or the charging voltage of 8 batteries or the AC output of the main turbine generator and I 9 can do devastating things with these things if they go off in 10 the wrong directions.
| |
| 11 MR. SZUKIEWICZ: That's true. There are certain 12 part of those systems that are classified as safety grade
| |
| (} 13 where single failures can, have to be tolerated.
| |
| 14 CHAIRMAN EBERSOLE: We must learn--
| |
| 15 MR. SZUKIEWICZ: But that part of it is the safety 16 grade protection system. The other part--
| |
| 17 MR. MICHELSON: I think you are wrong. The air 18 system, for instance, although there may be devices that 19 perform safety functions and therefore are required to have 20 accumulators or whatever on them, the pressure of the air 21 generated by the non-safety air system is not in that loop 22 that you look at as safety-related. It isn't. I know it 23 isn't. And so when you overpressurize the air system from a 24 failure of the control on the compressor, you have not 25 included that kind of a single failure in your thought HERITAGE REPORTING CORPORATION -- (202)628-4888
| |
| | |
| 69 1 process.
| |
| () 2 MR. BAER: That is one of the issues that has now 3 been identified as generic--
| |
| 4 MR. MICHELSON: It it is just indicative of what 5 Jesse is talking about--overvoltages, overwater pressures.
| |
| 6 HR. BAER: I think Andy isn't grasping the nature of 7 your question, and it is, it will become evidence in his 8 presentation. What we did on what we call the control-9 systems is where we could, we tried to bound the worst 10 consequences of their failure, and he will get into that.
| |
| 11 Okay. ,
| |
| 12 AR. MICHELSON: You considered over, oversupply of l
| |
| (} 13 the particular source as one of the bounding things you look
| |
| ; 14 at as to whether the air goes too high in pressure or water 15 goes too high in pressure or voltage goes too high?
| |
| 16 MR. BAER: We tended to look at the device that was I
| |
| 17 being controlled and said let it go to its maximum speed, go 18 to minimum speed.
| |
| 19 HR. MICHELSON: That's good. If you have done it, 20 that's great.
| |
| 21 HR. SZUKIEWICZ: That is exactly what wo do. ,
| |
| 22 DR. LEWIS: You do, for example, a worst case 23 analysis?
| |
| 24 HR. BACR: No. Let him get to that part of the O I 25 presentation. If we could withstand the worst case, we didn't l
| |
| HERITAGE REPORTING CORPORATION -- (202)628-4888
| |
| | |
| 70 1 look further I think is a better way of saying it.
| |
| O)
| |
| N- 2 CHAIRMAN EBERSOLE: Did you account for vascilating 3 supplies as well as steady state?
| |
| 4 MR. ANDERSON: This is a very complicated process.
| |
| 5 MR. BAER: Let him talk about the scope. One of the 6 issues was how the scope changed. He is about to get into the 7 scope part. Why don't we try and tackle that?
| |
| 8 DR. LEWIS: It is not a general theorem that if you 9 can survive the worst case, you can surely survive a less 10 worst case. That is not true.
| |
| 11 MR. BAER: I agree.
| |
| 12 MR. MICHELSON: Depends on how you define the worst
| |
| () 13 case with that definition. The worst may be low voltage or it 14 may be high voltage.
| |
| 15 DR. LEWIS: Or it may be something in between.
| |
| 16 MR. SZUKIEWICZ: That is correct.
| |
| 17 MR. MICHELSON: You have, once you define the worst 18 case, then I think you have the bounding.
| |
| 19 DR. LEWIS: If you make the defintion that, but that 20 isn't what they are talking about.
| |
| 21 MR. SZUKIEWICZ: That is exactly in our failure--
| |
| 22 MR. BAER: Reactivity transient where they 23 parametrically tried to vary all the things that could
| |
| {' 24 increase reactivity and looked at the worst reactivity 25 increase and said that's, if a protection system can handle HERITAGE REPORTING CORPORATION -- (202)628-4889
| |
| | |
| 71 1 that, then we don't have to look at all the subsets if we
| |
| () 2 truly reached our goal of looking.at the worst reactivity.
| |
| 3 MR. MICHELSON: I think by definition that would 4 always be the case.
| |
| 5 CHAIRMAN EBERSOLE: P.ight. I agree.
| |
| 6 MR. MICHELSON: If you correctly selected the worst 7 case. If you incorrectly selected it, that is trouble again.
| |
| 8 DR. LEWIS: Let's not be too easy on making this.
| |
| 9 Of course, it is true if you follow a thing all the way 10 through to the end and find the worst case, you have found the i
| |
| 11 worst case. No question about that; the question is whether i 12 in the intermediate steps if you choose a worst case, whether
| |
| (} 13 you have then found the track that leads you to the worst 14 final case, and that's where the error is always made.
| |
| 15 MR. SZUKIEWICZ: We attempted to analyze the 16 different states at different power operations as well to 17 determine quote and unquote, what the worst case condition is 18 because sometimes certain valves that are opening in a certain 19 direction at low levels may be more sensitive and give you 20 worst conditions than at high power conditions, and what we ;
| |
| 21 have-- l l
| |
| 22 DR. LEWIS: It is not always that obvious.
| |
| I 23 MR. SZUKIEWICZ: That is correct, so we used a l
| |
| 24 number of tools which I will discuss. One of them was failure ;
| |
| i l
| |
| 25 modes and effects analysis. j HERITAGE REPORTING CORPORATION -- (202)628-4888
| |
| | |
| 72 ,
| |
| 1 Another one was really looking at plant simulation
| |
| /~) 2 studies where we actually perturbated at different load
| |
| (_/
| |
| 3 conditions failures to determine where the worst case 4 conditions could occur, and at what operating conditions.
| |
| 5 DR. LEWIS: But the main flaw in failure modes and 6 effects analysis is precisely that, that what worst case is 7 the failures? That failure modes and effects analysis is done 8 as a means of avoiding just the issues we have just been 9 talking about, but go on.
| |
| 10 MR. BAER: Why don't you try, let's try and get 11 through the scope changes, not confuse him further with how we 12 did the methodology. 4
| |
| () 13 DR. LEWIS: I am talking the risk analysis.
| |
| 14 MR. SZUKIEWICZ: The task action plan was initially 15 approved in September 1982. We discussed this with the ACRS 16 in December of that year. Subsequently, in a major revision 17 in the task action plan, as Newt points out, most of the 1
| |
| 18 revisione and the changes were schedule or manpower l 19 requirements, but this was revised and approved and then 20 subsequently issued in a NUREG 0649 which was made available I
| |
| 21 to ACRS as well. And then we made another revision where we 22 needed to provide more clarification. That revision was also l
| |
| 23 issued for peer review and concurrence, and it was approved by 24 the staff, but not officially published.
| |
| 25 MR. MICHELSON: 0649 was a book of all issues. !
| |
| l I
| |
| HERITAGE REPORTING CORPORATION -- (202)628-4888
| |
| | |
| L
| |
| '73 I 1 MR. ANDERSON: All USIs. 7 2 MR. MICHELSON: Indeed it was. It represented 3 revisions. Unless you flipped through the book and picked ;
| |
| s
| |
| }. #.
| |
| 4 those particular ones that this is a whole lot different, it I 5 wasn't highlighted as an item but rather a whole book of these-6 things came through at once. i 7 MR. ANDERSON: Yes. That is correct. ,
| |
| I
| |
| . 8 MR. MICHELSON: It is easy to not realize-- ;
| |
| 9 MR. ANDERSON: Easy to miss it. !
| |
| 10 MR. SZUKIEWICZ: And because it wasn't highlighted, l 11 in the next couple of slides I attempt to point out where some- ,
| |
| i 12 of the major changes that you might be interested in occurred, l .
| |
| () 13 and what actually, and how and where we functioned according l 14 to the task action plan requirements, and where we might have l
| |
| ^
| |
| i 15 changed. !
| |
| . 1 f 16 CHAIRMAN EBERSOLE: Does that first statement, i, 17 should it maybe have the word in it can eventually lead? I am l i
| |
| 18 talking about the cascade.
| |
| l 1
| |
| 0 19 LMR . SZUKIEWICZ: I think it, when you see the t b '
| |
| ] 20 further continuation of our logic, you can interpret it as can s ,
| |
| ) 21 eventually lead, that's true. ,
| |
| +
| |
| i j 22 CHAIRMAN EBERSOLE: I think maybe that's the {
| |
| - I 23 problem. It is now what is the complexity of the trail?
| |
| l
| |
| ! l 1 24 HR. SZUKIEWICZ: Also we have to make decisions on 25 the timeframe to have failures and then everything straightens !
| |
| , i f
| |
| 4 l 4
| |
| HERITAGE REPORTING CORPORATION -- (202)628-4888 l
| |
| | |
| 74 1 out, levels off,- and then have another subsequent failure, and
| |
| ( 2 then cascade that on that, that became a very untenable--
| |
| 3 -CHAIRMAN EBERSOLE: If we have these failures, maybe 4 the escape route in the system, we pt:t it in'or Appendix R, if 5 we.have retained the support functions in the Appendix R
| |
| . 6 additions, maybe they will, _could cover aberrations in 7 controls. I don't know.
| |
| 8 HR. SZUKIEWICZ: The way we ran the program, we 9 really couldn't justify those kind of proposed findings.
| |
| l 10 CHAIRMAN EBERSOLE: I am saying maybe it is_there.
| |
| 11 MR. MICHELSON: Appendix R fixes were in just for l 12 fire.
| |
| () 13 CHAIRMAN EBERSOLE: I know, but I am saying as a 14 by-product of their being there, we might escape some of the 15 problems.
| |
| 16 MR. MICHELSON: You might.or might not.
| |
| i 17 MR. BAER: Andy, to clarify this, the efforts, the 18 column effort described in task action plan, that's the '82 19 task action plan? '
| |
| i 20 HR. SZUKIEWICZ: That's the '82 task action plan.
| |
| 21 MR. BAER: We are comparing what was originally 22 described in the last column. Far right column says what we ,
| |
| t 23 actually did in terms of what we think we said we were going l 24 to do.
| |
| 25 MR. SZUKIEWICZ: Where we made changea, we tried to HERITAGE REPORTING CORPORATION -- (202)628-4f98
| |
| | |
| i 75 1 indicate what we did tnd it is, a few of these are identified.
| |
| 2 HR. MICHELSON: I guess we can correctly interpret 3 the item to mean that you went through systematically as in 4 the process of resolution, looked at every system, non-safety 5 system, whose malfuncton could cause a significant primary 6 system transient, so I am sure you looked at the compressed 7 air system, for instance. We know for a fact that it causes 8 quite a good transient to get started, and you looked at all 9 the effects of the either elevated pressure or reduced 10 pressure or whatever.
| |
| 11 MR. BAER: No. As I said before, we have a whole 12 bunch of slides on the methodology.
| |
| () 13 MR. MICHELSON: That was the idea.
| |
| 14 MR. ANDERSON: That was the idea.
| |
| 15 MR. MICHELSON: You went through the power supplies ;
| |
| 16 which are non-safety. l l
| |
| 17 HR. BAER: We worked it the other way back '
| |
| 18 primarily.
| |
| l i
| |
| 19 HR. ANDERSON: Let's go through the methodology 1 20 here.
| |
| 21 MR. MICHELSON: I was reading the first bullet. I 22 want to make sure I understood what it meant. It says you )
| |
| I 23 looked, you go through systematically and look at all these !
| |
| l 24 systems. {
| |
| 25 HR. SZUKIEWICZ: We identified all the control l
| |
| l HERITAGE REPORTING CORPORATION -- (202)628-4888 l
| |
| | |
| 76 1 systems, the major control systems, and we also, to answer (O
| |
| .) 2 your question, looked at the support system such as power 3 supplies, and air supplies to those particular systems.
| |
| 4 CHAIRMAN EBERSOLE: Where is the list of discards 5 where you said I looked at control system and I determine that 6 thi<, has no potential for damage? I want to find that bucket, 7 that waste basket where you put the discards.
| |
| 8 MR. BAER: Maybe we ought to jump to the 9 methodology. We are not making any progress going through the 10 scope, 11 MR. MICHELSON: Well refrain from being unduly 12 obnoxious!
| |
| () 13 DR. LEWIS: You have ten minutes before the break to 14 finish the whole presentation.
| |
| 15 CHAIRMAN EBERSOLE: Right!
| |
| 16 MR. SZUKIEWICZ: Under task one which has not 17 changed, we identify that we would look at, use failure modes 18 and effects analysis as one of the tools to identify control 19 system failures that could lead to the transients.
| |
| 2 20 We also used non-mechanistic worst case analysis 21 initially alse to say that, for example, independent of how a ;
| |
| 22 control, how a feedwater system can fail, to produce maximum 23 flow, we concentrated on what would happen if you have maximum ,
| |
| q 24 flows independent of everything at a first cut, of how, what '
| |
| (> '
| |
| 25 kind of failures in the control logic could lead you to this ,
| |
| 5 HERITAGE REPORTING CORPORATION -- (202)628-4888
| |
| | |
| I 77 l
| |
| l 1 kind of a condition, so we identified conditions where, for 2 example, in feedwater control, we identified a lot of t l
| |
| l 3 different kinds of transients that can occur if you have
| |
| ! 4 different flow conditions, so we, so that was part of the 5 initial identification of candidate systems. ;
| |
| l 6 We also stated that we will evaluate independent i
| |
| l 7 failures and failures concurrent with accidents or transients
| |
| ( 8 to see what would happen if you had concurrent.' to these )'
| |
| I 9 events that were identified in Chapter 15 concurrent failures 10 of control systems.
| |
| 11 We also stated in the task action plan that we would
| |
| ]
| |
| 12 look at not only single failures, but two at a time 13 independent failures. We aise stated that--
| |
| 14 HR. MICHELSON: Why do you do that? Why do you look i l
| |
| 15 for double failures? Because our on safety systems, we only 16 look for single failures.
| |
| l l
| |
| 17 Is there some kind of reason on non-safety you look l
| |
| l l 18 for double failures?
| |
| l 19 HR. SZUKIEWICZ: No. We tried to assess what, if 20 there could be a common mode failure--
| |
| 21 HR. MICHELSON: For your own verification?
| |
| l 1 22 MR. SZUKIEWICZ: To get a better idea what kind of, 23 what these kind of events could cause in the form of 24 transients. It was an iterative process, trying to better 25 understand what could happen to control systems when certain i
| |
| HERITAGE REPORTING CORPORATION -- (2021628-4888 l
| |
| - - ._ - . - ~ __ _ _ _ _ - . - _ _ _ . _ _ . _ - _ . . _ , _ _ . - _ __ .~ . - - _ _ _ _ _ _ , .
| |
| | |
| l 78 1 failures occur.
| |
| () 2 MR. MICHELSON: These were non-related, truly f 3 independent of each other?
| |
| 4 MR. SZUKIEWICZ: That's true.
| |
| t 5 MR. ANDERSON: They were functionally--
| |
| 6 MR. SZUKIEWICZ: We felt that--
| |
| 7 MR. MICHELSON: No common cause to depict either?
| |
| 8 MR. SZUKIEWICZ '
| |
| 4ctly. But we also looked at 9 events. We tried to ide; events that were coupled, like 10 off of a common power supply or a bus where you had certain ,
| |
| 11 control systems that could fail at the same time.
| |
| 12 HR. MICHOLSON: This is kind of interest *ng. I (
| |
| () 13 didn't realize you went beyond looking at single failure. It 14 is nice that you did go beyond.
| |
| . 15 M?. SZUKIEWICZ: When you-- i 1
| |
| l 16 MR. MICHELSON: I will go beyond when I start to l i
| |
| l 17 think about these things, j I 18 MR. SZUKIEWICZ: If you allow me to finish today, I I l
| |
| 19 will try to show you that we have also gone way beyond just 20 two at a time failures in certain conditions, but there we, we 21 looked at control systems and failures in a more selective !
| |
| I 1
| |
| 1 22 fashion. J l
| |
| l 23 CHAIRMAN EBERSOLE: Did you maintain the position l l 1
| |
| 24 which eventually came out of 2679 that if you have some
| |
| ) 25 transient or accident which you must intercept, you retain the
| |
| ! HERITAGE REPORTING CORPORATION -- (202)628-4888
| |
| | |
| _- . . ._ _ . ___ ___ _ .~ ,_ _ _ _ . . .. .. . _. . . . . . .
| |
| l 79 1 privilege of a random failure in the protective setup as that?
| |
| l
| |
| ( 2 Do you follow me?- I'am saying if I have an accident, I1must 3 have two gadgets which are redundant to give me the' privilege-4 of a random failure in one of them, not to respond.
| |
| 5 MR. SZUKIEWCIZ: 'That.is correct, yes. i 6 MR. BAER: The answer to'your question, Jesse, is 7 no. There are certain power supply failures that would wipe 8 out, would cause a control system malfuncton and wipe out one 9 of the protection s.ystems. i 10 MR. EBERSOLE: That's a root deviation'from a l 11 long-standing--
| |
| 12 MR. SZUKIEWICZ: We did look at simultaneous control 13 system failures and also certain safety grade control system
| |
| {)
| |
| 14 failures.
| |
| 15 CHAIRMAN-EBERSOLE: But there is a Biblical-16 requirement in our afety structure that says that if I have a 17 severe emergancy con up, I want the privilege of random 18 failure in the response system, and if you violated that,-you 19 are really not complying with regulations.
| |
| 20 MR. ANDERSON: The way the assumption was~ stated, 21 that there is always a minimum set of protective systems to 22 protect you.
| |
| 23 CHAIRMAN EBERSOLE: Set--that means more than_one?
| |
| ~
| |
| 24' MR. SZUKIEWICZ: A-train of safety. systems; if.you 25 had two high pressure injection systems, one would be HERITAGE REPORTING CORPORATION -- (202)628-4888
| |
| | |
| 80 1 available.
| |
| - 2 CHAIRMAN EBERSOLE: Free of the influence from the 3 original event that caused the transient?
| |
| 4 MR. SZUKIEWICC: We had to assume that.
| |
| 5 MR. BAER: You couldn't--I want to clarify this.
| |
| 6 This has come up before, and I think we may not ha.e given--I 7 thought we gave a clear answer, but I am not sure.
| |
| 8 We did not in addition postulate a single failure in 9 the remaining train. We didn't also consider that the case 10 where you have a train out occurring, a limiting condition of 11 operation, so--
| |
| 12 CHAIRMAN EBERSOLE: That is a window in time that
| |
| () 13 you didn't have. I understand that.
| |
| 14 MR. MICHELSON: In taking two at a time independent 15 failures, were those, both of those in the control system, or 16 was one of them in the safety and one in the control or could 17 it be either?
| |
| 18 MR. SZUKIEWICZ: We, the thrust of the program was 19 to look at them in the non-safety grade systems. We did, we 20 did show you later--
| |
| 21 MR. MICHELSON: I am trying to understand, though.
| |
| 22 What yo" said later then was you also took a single failure in 23 the safety end?
| |
| 24 MR. ANDERSON: The answer to your question'is yes.
| |
| }
| |
| 25 We did take the--
| |
| HERITAGE REPORTING CORPORATION --'(202)628-4888
| |
| | |
| , 81
| |
| +
| |
| 1 MR. MICHELSON: 'You took the.three plants, in some
| |
| '2 cases two, in the non-safety and one in safety?
| |
| 3 MR.-SZUKIEWICZ: In some cases, but what we tried to 4 do there was a bounding analysis. We don't:want to say that 5 we have done this across the board.-
| |
| 6 MR. BAER: Andy, I don't think you are--maybe I am 7 not understanding the question, but if you had-a power supply 8 failure, that could affect the control system, causing a 9 transient, and also that power supply fed one. train of a 10 protection system, I don't th?.nk you then postulated--
| |
| 11 MR. SZUKIEWICZ: An additional one.
| |
| 12 MR. BAER: Random single failure in the other j
| |
| () 13 protection system.
| |
| l 14 MR. SZUKIEWICZ: We did not. I 1
| |
| 'I 15 MR. BAER: We did not. I just want to make that i 1
| |
| 16 clear. I 17 MR. SZUKIEWICZ: Okay. In order to assess a little i i
| |
| i 18 better the effects and understand the effects of multiple i 19 control system failures to determine what the effect of those 20 common mode failures would be, we expanded the task in the '84 I
| |
| 21 revision to include a number of selected multiple failures 22 beyond two at a time, but that was only limited to the' l
| |
| 23 non-safety grade systems.
| |
| l 24 In the original task, we stated that we would look
| |
| )
| |
| 25 at-- l l
| |
| HERITAGE REPORTING CORPORATION'-- (202)628-48881
| |
| | |
| 82 1 MR. MICHELSON: Excuse me. Your multiple, you meant
| |
| \ 2 multiple independent?
| |
| 3 MR. SZUKIEWICZ: Yes, and I will show you an example 4 of what we meant.
| |
| 5 MR. MICHELSON: It only takes one failure of a 6 control system to in some cases affect both safety grade 7 systems to some extent, like for instance, the compressed air, 8 if it is a single train non-safety system and you 9 overpressurized it, you are going to overpressurize both l
| |
| 10 trains of safety grade functions that are being served by it. I 11 MR. SZUKIEWICZ: It was, a difference that we want 12 to mention is there may be some situations like that because
| |
| (') 13 of design deficiencies.
| |
| 14 MR. MICHELSON: That is not design aericiency.
| |
| 15 MR. SZUKIEWICZ: We didn't look for that. We 16 assumed at least one channel of protection system will be 17 available.
| |
| 18 CHAIRMAN EBERSOLE: Wait a minute. I just, as a 19 matter of fact, I just--you have got a bullet coming up which 20 is a devastating bullet as far as I am concerned--minimum 21 number of safety grade protection systems are available.
| |
| 22 What we are telling you is they may not be. Your 23 very root assumption let's you escape from what we are trying
| |
| (~) 24 to not let you escape.
| |
| I U
| |
| 25 MR. SZUKIEWICZ: There may be cases and we see LERs )
| |
| HERITAGE REPORTING CORPORATION -- (202)628-4888
| |
| | |
| 83 1 that that's the case. They are design deficiencies in the
| |
| ( -) 2 protection system.
| |
| 3 CHAIRMAN EBERSOLE: It is just that they are there.
| |
| 4 It doesn't matter why they are there.
| |
| 5 MR. SZUKIEWICZ: If there are criteria and 6 requirements for those systems and they violate those systems, 7 then it is not in the scope of A-47 to come out with another 8 requirement saying you didn't do this one, do it again, and 9 that is one of the reasons that we have opted for taking one 10 protection channel to be available. We, traditionally in the 11 past we have--
| |
| 12 CHAIRMAN EBERSOLE: You can't do that.
| |
| () 13 MR. SZUKIEWICZ: In the past we have done--
| |
| 14 MR. BAER: Andy, let me interject two points. One, 15 I think on electrical systems, you did look to see if control 1
| |
| 16 system failures could wipe out both protection systems in l
| |
| 17 terms of electrical and instrumentation failures. I believe 18 you did that.
| |
| 19 Now on air systems, there has been a couple of 20 events recently, and this is one of the reasons why air 21 systems is now a separate generic issue with a high priority, 22 where there were failure modes that weren't previously 23 recognized, at least not widely recognized. One was the extra 24 excess pressure. I don't think we were smart enough--the 25 studies were done before I was involved--to recognize that HERITAGE REPORTING CORPORATION -- (202)628-4888
| |
| | |
| .- . . . - -. . .~. . . . . - . . -. .. .- -
| |
| 84 1 excess air pressure could be causing some of the problems, so 2 that wasn't explicitly looked at.
| |
| 3 CHAIRMAN EBERSOLE: .You can have excess. air in
| |
| : 4. anything.
| |
| 5 t!R . MICHELSON: Have you looked at overvoltage?
| |
| 6 CHAIRMAN EBERSOLE: ~ Excess flow, whatever, 7 vascilating supplies, these are modes of' failure that you have-8 ignored.
| |
| 9 MR. SZUKIEWICZ: We did not look at those 10 specifically, that's right, but the design criteria was that 11 no single failure in the protection system should be, should 12 compromise both protection systems.
| |
| () 13 Now this has been in existence for 20, 30 years.
| |
| 14 There is always--in some cases, we do a very precise audit and 15 go out in the field and there are periodic design reviews out 16 in the field to catch those kind of glitches, and recently 17 there was a number of them that have occurred where, for 18 example, the routing of a, of four redundant switches were 19 routed to a safety grade system, and its plant can knock.out 20 all four. From the A-47 perspective, the requirements are 21 very clear on the protection system that that was not allowed, 22 and when the person identified it, he reported it as a 5073 f
| |
| 23 item.
| |
| E
| |
| [} 24 CHAIRMAN EBERSOLE: You didn't have isolators that 25 worked? You are telling me you didn't have isolators?
| |
| HERITAGE REPORTING CORPORATION -- (202)628-4688
| |
| | |
| 85 1 MR. SZUKIEWICZ: In this case it wasn't even an Was just a blatant--
| |
| 2 isolator.
| |
| 3 CHAIRMAN EBERSOLE: Cross-wire?
| |
| 4 MR. SZUKIEWICZ: Just four common wires.
| |
| 5 CHAIRMAN EBERSOLE: We will get to that.
| |
| i 6 MR. SZUKIEWICZ: Routed in the same conduit; but the 7 requirements were there, and it was in our opinion bad j 8 implementation, and we are not saying here that just because 1
| |
| 9 we haven't found major problems in the control systems by l 10 themselves, that they are not going to have transients out l
| |
| 11 there because of bad implementation in specific areas, 12 plant-specific areas, but we are not--
| |
| () 13 CHAIRMAN EBERSOLE: If they have transients, though, 14 you are supposed to have devices in place to intercept the 15 transient.
| |
| 16 MR. S'3UKIEWICZ : That is correct, yes.
| |
| 17 MR. BAER: I think the distinction--and Carl, 18 certainly most of these people in AEOD and others, including 19 myself, have been concerned about air systems for a long time.
| |
| 20 There have been a bunch of studies. When they were looked at 21 merely as control systems, and getting dirt and grease, no one 22 could ever make the compelling argument that there was a, 23 encugh safety significance that to get a, to get a very high
| |
| [} 24 priority issue moving.
| |
| 25 Now recently, there has been a couple of events, HERITAGE REPORTING CORPORATION -- (202)628-4888
| |
| ~ . - ,
| |
| | |
| 86 -i 1 really design reviews, that have uncovered situations where 2 protection systems have been influenced by air systems and 3 this was enough to raise this now to a high priority issue, 4 and maybe that was the part--electrical systems, I.think'this 5 has been looked at much more thoroughly in general in-the 6 staff review and air systems--
| |
| 7 MR. MICHELSON: Very serious problem at one boiling 8 water reactor when the air system was overpressured by'some 9 nitrogen bottles hanging on'it, and stuck the SCRAM valve so 10 the some of the rods wouldn't go in, and that was the 11 precursor of an overpressure problem.
| |
| 12 Now we have got, of course, another overpressure
| |
| () 13 event, and I am sure it has gotten.your attention, but it just 5 14 takes an accumulation of these sometimes before the' action ;
| |
| 15 occurs, and I don't disagree with perhaps it should require i 16 some--
| |
| 17 MR. BAER: I will make another statement, and my 18 branch is not handling the air system generic issue, but in 19 general, I think it is going to be much easier to get a 20 concrete resolution of that as an individual issue than it is T
| |
| 21 to handle it under A-47 or A-17.
| |
| 22 MR. MICHELSON: It isn't even required under generic 23 issue. It is already a regulatory requirement. They violated 24 their regulatory requirements. Maybe you can clarify this. .
| |
| 25 It appears to me--correct me if I am wrong--that it is already i i
| |
| HERITAGE REPORTING CORPORATION -- (202)628-4888
| |
| | |
| - . . - . = . - . . - . - . - - . . - ~.- - . - . . . - .-
| |
| 87 1 .a regulatory requirement that a safety system shall not, when
| |
| ( 2 it interfaces with a non-safety system, it has to be ;
| |
| 3 appropriately protected from the-adverse effects of that 4 non-safety system.
| |
| 5 MR. SZUKIEWICZ: That is true.
| |
| 6 'MR. MICHELSON: From overpressure coming from it or-7 overvoltage coming from it, or loss of voltage or loss of 8 pressure; any change in the quality of that non-safety system, 9 there must be an isolator of some sort. It may be inherent in 10 the design of safety system or whatever, but it must be 11 isolated from the failure effects of that non-safety system.
| |
| 12 Tn1:'s a reJ21atory requirement. If you find it isn't being -
| |
| () 13 carried out in some instances, then you approach it from the 14 regu?.atory vj ewpoint a not from the generic. It isn't a !
| |
| 15 ger.aric issue at all. ,
| |
| 1 l
| |
| 16 MR. BAER: I think the goal of generic issue on air )
| |
| i 17 systems is that to get specific instructions to go out to I 18 licensees, to have them look for--
| |
| l 19 MR. MICHELSON: That ought to be the goal-of the j l
| |
| , 20 regulatory process, to clean up the, get out a regulatory i l
| |
| 21 guide. It isn't a generic, I feel that it isn't a generic !
| |
| -l 22 issue, and I don't know why we are trying to make it a generic l 23 issue. Generic in a sense that all the air, people use air, l
| |
| 24 that nearly all the plants are affected by it, it is generic
| |
| [
| |
| 25 in that sense, but it is not a generic issue. It has always !
| |
| l HERITAGE REPORTING CORPORATION -- (202)628-4888
| |
| | |
| .. . . =. .- . .. .. - . . . . . . . . . . _ . ..
| |
| 88 R
| |
| - :L been a regulatory requirement to protect systems, safety
| |
| ! 2 systems, from the effect of failure also1of non-safety 3 systems. It is a regulatory requirement.
| |
| 4 MR. BAER: I guess--
| |
| 5 MR. MICHELSON: I can' point you'out th'e GDCs and-6 LERs.
| |
| 7 MR. BAER: In order for NRR to send out a letter 1 8 that says to licensees you shall go out now and do X, Y, Z, j l
| |
| 9 someone selected this process. See, I think in my mind-- q 10 MR. MICHELSON: I am surprised you even think.it is 11 the generic issue process that should be controlling .that .
| |
| 12 particular problem.
| |
| () 13 MR. BAER: .Well, I am not saying that it is-- _
| |
| 14 MR. MICHELSON: I think this is a regulatory 15 problem.
| |
| 16 MR. SZUKIEWICZ: We don't think it is a generic 17 problem.
| |
| 18 MR. BAER: I think the distinction really is, on the 19 electrical systems, to handle this potential interaction we 20 said we want two separate trains. Service water systems, we 21 said we want two separate trains. Air systems, we let them do 22 anything they want, just put in a seismic category one 23 accumulator in front of the device, and so although in theory i
| |
| [} 24 the requirements were there, the way we let them implement it 25 didn't have anywhere near the scrutiny.
| |
| 1 HERITAGE REPORTING CORPORATION -- (202)628-4888 j
| |
| - _ _ - . _ _ _ _ . _ . _ . _ _ _ . . ~ . _ _ .. _ .._ _ - . . . _ _ . _ , . . . . _ . . ~ . _ , - _,a
| |
| | |
| - . . .. . . - . . . . - . . _ . . - . - . - - .. -- . - . . . = . . . - ._ - -
| |
| '89 1 MR. MICHELSON: That doesn't mean it is now a 2 generic issue. .Now means you have-got to straighten out'the 3 ' regulatory acts.
| |
| 4 MR. SZUKIEWICZ: It could be generic implementation.-
| |
| 5 MR. MICHELSON: It is a falldown of our regulatory-6 process.
| |
| 7 CHAIRMAN EBERSOLE: Let me' call a ten-minute break 8 because you are not going to get through in time, and while we >
| |
| 9 are breaking, I want you to think about this. I am going to l l
| |
| 10 take you up on the electrical matters on the output of the I 11 main turbine generator frequency when it becomes uncontrolled )
| |
| 12 from the grid and becomes a, really a wild machine if it gets
| |
| () 13 out of control.
| |
| 14 Okay. Let's come back at a quarter to. All right.
| |
| 15 (A brief recess was taken.)
| |
| 16 CHAIRMAN EBERSOLE: Let's reconvene and have a 17 speaker.
| |
| 18 MR. SZUKIEWICZ: Continue on with the tasks, item 5, 19 we identified that we would also use the_LERs, INE bulletins, 20 AEOD report, any other record that we could get our hands-on 21 to also identify control systems whose failing could-22 potentially lead to primary valve transients.
| |
| 23 MR. MICHELSON: In that record do you include the 24 deficiency record that comes under what 5055E or whoever.
| |
| [
| |
| 25 MR. SZUKIEWICZ: 5072.
| |
| HERITAGE REPORTING CORPORATION -- (202)628-4888
| |
| | |
| 90 1 MR. MICHELSON: The-deficiencies.
| |
| 2 MR BAER: Plants under construction.
| |
| 3 MR. MICHELSON: 'Do you include them when you look?
| |
| 4 Because that is where a lot of interesting--I guess a few 5 examples, they have interesting things show up'that are then 6 corrected on that particular plant.
| |
| 7 MR. SZUKIEWICZ: I really don't know if they were 8 included or not.
| |
| 9 HR. ANDERSON: They use the data base that Oak Ridge 10 has.
| |
| 11 HR. MICHELSON: I don't recollect that they do. I 12 don't think they every analyzed and' tracked the deficiencies
| |
| () 13 reports, just LERs. But I don't wouldn't want to say that for 14 sure because I don't know, but I'm disturbed occasionally to 15 find out about things I read in the deficiency reports because 16 I don't read very many of then, and it is a strange way to--I 17 wonder how it gets into the regulatory process.
| |
| 18 MR. SZUKIEWICZ: The only'other bulletin or 19 information document that we used that I know-of is the 20 nuclear power operating experience information which really ,
| |
| 21 discussed the LERs in a lot more detail.
| |
| 22 Also in 1984, we clarified the scope that sabotage 23 would not be included. We did not clearly state that it would 24 be or would not be, and then we felt that we needed to
| |
| [}
| |
| 25 identify that.
| |
| HERITAGE REPORTING CORPORATION --'(202)628-4888 L _
| |
| a
| |
| | |
| 91 1 Also in 1984, clarification, we said that a 2 systematic investigation of all seismically, environmentally 3 induced failures was not included in the scope. However, we 4 also added a task to address more multiple independent control 5 system failures, to address and better assess the effect of 6 common mode failures, but we do not want to--
| |
| 7 MR. MICHELSON: Which task is that in?
| |
| 8 MR. SZUKIEWICZ: This is item 7. The task is one.
| |
| 9 MR. MICHELSON: What task did you assign it to?
| |
| 10 MR. SZUKIEWICZ: I'm sorry?
| |
| 11 MR. MICHELSON: What task did you assign it to or 12 what other generic issue or something. I assume you are
| |
| () 13 implying there is another generic issue that does this? Where 14 did you move it to if you decided not to do it as part of 15 A-47?
| |
| 16 MR. SZUKIEWICZ: Part of some of the activities and i 17 some of the control systems that are, that are utilized in 18 plant control systems, the equipment is currently being 19 evaluated in USI A-46. We are also investigating the, to 20 expand this under the multi-system, multi-system study that we 21 are going to be talking about later.
| |
| 22 MR. MICHELSON: Let me phrase the question quite 23 differently. The regulatory analysis says that you did not 24 include external events in the resolution of A-47. Okay. Now
| |
| (
| |
| 25 where did you or how are you handling that exclusion? . think HERITAGE REPORTING CORPORATION -- (202)628-4888
| |
| | |
| - .- - . .. -. .- . . __ ~ _ - . . - . ..- --
| |
| 92 1 it is under 7 here, but I am not-sure.
| |
| 2 MR. ANDERSON: I think that what Andy is saying is 3 that we didn't include specifically common mode type event-4 where everything would be wiped out.
| |
| 5 MR. MICHELSON: They said there you just didn't 6 include external events in the resolution. l l
| |
| 7 MR. SZUKIEWICZ: We said we consider them, but to I l
| |
| 1 8 very limited extent. We do not want to be saying we conducted '
| |
| 9 a very syatematic investigation of this.
| |
| 10 HR. MICHELSON: Haybe I read-it wrong, but I 'hought t 11 it was a flat out exclusion.
| |
| 12 MR. ANDERSON: If you look at 4 up above, thatithe
| |
| () 13 decision was made to attempt to look at what the impact of 14 multiple failures would be from a common mode event. They 15 took selected--
| |
| 16 MR. MICHELSON: Common mode event other than'a 17 so-called external event; didn't look at common flood or 18 common fire.
| |
| 19 HR. ANDERSON: We didn't look at what the mechanism 20 would be, but what the effect would be of having multiple 21 equipment failures. That could be from any cause, from a, I
| |
| 22 common mode from an earthquake, from a flood. We were looking i
| |
| 23 at a, trore from a system point of view. R 24 MR. MICHELSON: What you failed, in doing that
| |
| {
| |
| 25 analysis, what you failed to recognize or failed to include l
| |
| HERITAGE REPORTING CORPORATION -- (202)628-4888
| |
| | |
| 93 l
| |
| 1 was the fact that the same flood that'was' flooding out the l
| |
| 2 non-safety equipment might also be affecting the, directly the.
| |
| 3 safety-related equipment, and then you are_ finding that you 4 get both trains because the flood goes to one train.of-safety 5' plus non-safety, but the non-safety fed ~back'over into the-6 other safety train.
| |
| 7 MR. ANDERSON: That's right.
| |
| 8 MR. MICHELSCN: Those kind of things I don't think 9 you really included. What I am claiming is I don't think you 10 included flood, and you, I think you specifically exclude, 11 included it in the statement.
| |
| 12 CHAIRMAN EBERSOLE: That way of expressing 7 is a
| |
| () 13 terrible way to say something because it leaves you floating 14 into nowhere.
| |
| 15 MR. MICHELSON: Specifically excluded.
| |
| 16 CHAIRMAN EBERSOLE: Doe.an't tell you what you 17 excluded, and I could argue that you looked at one of them but !
| |
| 18 not any of the rest.
| |
| 19 MR. SZUKIEWICZ: Well, for clarification, the only 20 thing that we wanted to point out was that we extended the 21 scope to look at, look at potential common mode failures that 22 could also occur as a result of environmentally seismically I 23 induced conditions, but we only looked at'them from a 24 non-safety grade control system perspective. We don't want to
| |
| {
| |
| 25 be coming out and say we analyzed the plant from a seismic HERITAGE REPORTING CORPORATION -- (202)628-4888- i
| |
| | |
| 94 1 point of view, and the interrelationships, how control systems ll
| |
| \/ 2 were affected, and we don't want to come out there and say 3 that.
| |
| l 4 MR. MICHELSON: Where are you doing external events ;
| |
| 5 as they may affect control systems and their interaction with 6 safety-related?
| |
| 7 MR. SZUKIEWICZ: Again, we looked at multiple 8 failures from the control.
| |
| 9 MR. MICHELSON: Not only looking at the--your own 10 report says, I will read the one sentence for the record.
| |
| 11 "External events such as earthquake events, flooding, fire, 12 and sabotage, have not been considered in this study."
| |
| 13
| |
| ( ') MR. ANDERSON: That is correct not surprisingly, but 14 what Andy is saying is that we looked at the effect of 15 multiple failures such as those multiple failures that would 16 occur as the result of these external events. That's not an 17 exact answer, but that, but that doos it.
| |
| 18 MR. MICHELSON: That doesn't do it. That is a 19 partial answer.
| |
| 20 MR. ANDERSON: That is correct. With regard to the 21 seismic capability mentioned in A-46, there is--I can't tell 22 you there is a one-to-one correspondence between all of the 23 instrumentation that associated, all the control systems i
| |
| 24 associated with A-47 and what you are looking at in A-46,
| |
| }
| |
| 25 although most of the systems components are included in the I l
| |
| HERITAGE REPORTING CORPORATION -- (202)628-4888
| |
| | |
| 95 1 seismic data base, at least by type, and some of them will be
| |
| -/(l
| |
| _/ 2 explicitly reviewed as we go to that.
| |
| 3 MR. MICHELSON: I would have expected from your 4 statement then that you wou.1d have thought to include the fire 5 protection system such as the CARDOK system on diesel engine.
| |
| 6 You would have, that would have been what I would have thought 7 the scope of your study was to make sure that there was no 8 interactive effects.
| |
| 9 MR. ANDERSON: That specific incident, when I saw 10 that LER, I didn't check tch A-47.
| |
| 11 MR. MICHELSON: I am thinking of your process. Once-12 we see the event, obviously everybody focusing on it, was that l
| |
| () 13 kind of a situation within a scope of what you were even 14 looking for.
| |
| 15 MR. ANDERSON: That, I did not check that scope 16 against the A-47. I did check it against the relay review, l 17 A-46, and I was convinced that it would catch that. We would 18 have caught that set of contacts.
| |
| 19 MR. MICHELSON: For seismic case, but see this, what 20 I find disturbing, of course, is that I can have a non-seismic 21 actuation of a fire protection system that will trip all four 22 diesel engines. Didn't have to be seismically induced. I 23 have to go back now to look at the fire protection control 24 arrangement to see what kind of--I have to do failure modes
| |
| [}
| |
| 25 effects analysis on it to see how I might generate a CO 2 HERITAGE REPORTING CORPORATION -- (202)628-4888
| |
| | |
| 96 1 release, and then I have to realize that once generating the g
| |
| \ 2 release, it trips the engines because that was built--and I 3 doubt seriously you have ever even looked at a CARDOK system.
| |
| 4 MR. ANDERSON: I would be very surprised if we had 5 identified that specific problem as part of this review. That 6 would surprise me.
| |
| 7 MR. MICHELSON: Well, you should have identified it 8 long ago because Jesse has been repeatedly talking about 9 mercury switches and we thought we got rid of then all. TVA 10 assures us they did, but obviously other utilities didn't 11 necessarily.
| |
| 12 MR. EBERSOLE: This gets back to the quality of our
| |
| () 13 information.
| |
| 14 MR. MICHELSON: I am wondering does the agency look 15 at in a global sense when somebody loses an issuo of that sert 16 and that issue is as old as, not as old as Jesse, but it is 17 right along there.
| |
| 18 CHAIRMAN EBERSOLE: Well, it is 20 years. Mercury 19 switches are taboo. ,
| |
| 20 MR. MICHELSON: I really wonder.
| |
| 21 MR. BAER: I know there is an old, I am not sure if i 22 it was a notice or circular or bulletin, dealing with that, f
| |
| f 23 with mercury switches, and it is many years ago. [
| |
| 24 CHAIRMAN EBERSOLE: It gets you worried about the
| |
| [
| |
| 25 quality of the information really. You really wonder about HERITAGE REPORTING CORPORATION -- (202)628-4888
| |
| | |
| 97 1 the quality of the information that we hand around to each C)
| |
| (s 2 other. Just by the depressurization capability on the MARK I 3 containment, whether we have it; we talk about it as though it 4 was there, but I hear we don't have it. We may be riding 5 along on this misinformation.
| |
| l 6 HR. SZUKIEWICZ: This is a design deficiency that 7 was identified by the utility that used it. They recognized I
| |
| 8 that they were using non-qualified equipment that would not l l
| |
| 9 satisfy their single failure criteria as far as protection !
| |
| l 10 system goes.
| |
| 11 CHAIRMAN EBERSOLE: It is fascinating to me that 12 Peace Bottom was supposed to be a follow-on to Browns Ferry r
| |
| (j) 13 and that was explicitly dragged out, be here 20 years later.
| |
| 14 MR. MICHELSON: Also is disconcerting that they 15 really discovered the problem on Limerick when they were doing 16 some fire reviews and they realized that the four cables 17 tripping all four engines were bundled together somewhere in 18 the fire area, and that's when they first fell on the idea 19 that they had a problem, and then I guess they must have gone 20 back to Peach Bottom, see how it was handled, but there again 21 they were tripping the engines on their fire actuations, and 22 you got to ask the more fundamental question what happens if I 23 inadvertently experience the spurious actuation of this
| |
| , 24 non-safety system? Why does it cause the loss of all of the 25 on-site power, all of the diesel-generated on-site power? Why l
| |
| HERITAGE REPORTING CORPORATION -- (202)628-4888
| |
| | |
| 98 1 should that be allowed? It is:a-regulation I am sure that you
| |
| : 2. can't do that. You don't fixHit with generic issue._ ~ You fix 3 it with--
| |
| 4 MR. ANDERSON: Don't'know why that happened. I 5 don't think anyone else does.
| |
| . 6 HR. BAER: There is1really no way--in the working 7 generic issues, you know., we will discuss later, we try to 8 take four typical pl'nts a and look at them, but that's a far ;
| |
| 9 way, far short of looking at a hundred plants individually.
| |
| I 10 MR. MICHELSON: When you took the four typical j l
| |
| 11 plants I never sensed you even looked at the fire protection 12 system and its means of actuation and so forth to see what '
| |
| i
| |
| () 13 kind ofspurious generation you could get that could interact 14 adversely with safety systems. I didn't get that out of
| |
| - l l
| |
| 15 looking at that. .I didn't look at it as deeply as you did, i 0
| |
| 16 CHAIRMAN EBERSOLE: The typicality as described by l
| |
| 17 venders only covers a small part of plant design and some 18 features. The AEs produce the balance of plant and you don't 19 mention the fact that just because it is?GE or B&W or whatever
| |
| , 20 that doesn't cover--funny things that go on-out in balance of 21 plant which are where really most of our problems are.
| |
| l l
| |
| 22 MR. SZUKIEWICZ: Again, one of the objectives of the 23 A-47 program was to verify the adequacy.of the current.
| |
| l
| |
| {} 24 licensing design requirements. In your case that you
| |
| ; 25 identified as far as the problems with the fire protection HERITAGE REPORTING CORPORATION -- (202)628-4888
| |
| . ,,_ . _ -_ .- _ .. _ _ _ _ _ _ - . _ , _ _ . ~ . _ . . _ _ _ _ _ _ . _ . _ .
| |
| | |
| 99 1 interactions, these, the requirements are stated and they are
| |
| ,r-(_/ 2 rather clear, so we looked at them as it is an implementation 3 problem and not a control system problem even though it is, as 4 you say, non-safety grade control systems were used. It is 5 not a normal design that has been used in the past and there 6 are requirements to prohibit that.
| |
| 7 MR. MICHELSON: What I thought the A-47 process 8 would do is to go look at all the control systems to see 9 whether or not there are really serious adverse interaction 10 effects. I thought that is what A-47 was going to do, and 11 come up with the final findings and say yes, we looked at them 12 all, here are the ones that gave us trouble. And I never
| |
| () 13 sensed that you looked at them all. Like you said originally, 14 you said all control systems will be looked at in the aqua 15 book.
| |
| 16 MR. ANDERSON: They were all looked at in the sense 17 that when they initiated the program, we had to, the logic 18 that we used to look at the events of concern he is going to 19 cover pretty soon and then itemized all the control systems in 20 the plant.
| |
| 21 Now I think all--I am not sure what that those 22 boundings are, but I think make a judgment as to which ones of 23 those control systems would affect the events we were 24 concerned with. We went from there.
| |
| [
| |
| 25 HR, MICHELSON: Learned judgment based on doing some HERITAGE REPORTING CORPORATION -- (202)628-4888
| |
| | |
| n
| |
| .100 L l' preliminary looking or flipping a coin or looking at how much 2 .you got in the pot or what?
| |
| 3 MR. ANDERSON: Possibly all of the above, to be 4 truthful about it. We took as large a scope as we could of 5 the, all the control systems that had any remote possibility' 6 of affecting the events we were concerned-about, and then only 7 tale those that had some potential for-- ,
| |
| 8 MR. MICHELSON: Did fire protection end up initially l l
| |
| 1 9 in that set?
| |
| 10 MR. ANDERSON: I am not sure. Was fire protection 11 system one of the systems in the master list? I don't know.
| |
| i 12 MR. SZUKIEWICZ: We only looked at fire protection
| |
| ()
| |
| 13 systems if they could affect failures in the control systems.
| |
| 14 We did not look at them in terms of failures in the protection .
| |
| 15 systems.
| |
| 16 MR. MICHELSON: So you did look at fire protection i
| |
| 17 to see whether--I am not sure what you told me. Fire p 18 protection systems when they inadvertently actuate and do two l
| |
| 19 things--one is disturbing the environment around the, ,
| |
| 20 potentially impact assuredly the environment around safety 21 systems. That's what they are protecting. It is sure that .
| |
| 22 you will influence the environment, so that's one aspect you ;
| |
| l 23- have to look at. !
| |
| {) 24 The other aspect is whether.or not in the~ process of 25 addressing the fire in that particular area either ,
| |
| HERITAGE REPORTING CORPORATION -- (202)628-4888
| |
| | |
| 101 1 inadvertently or directly, you might also have some kind of
| |
| ( 2 difficulty which we did discover between safety systems 3 operation and than the actuation and hopefully none of those 4 matters existed, but the probablity is, you know' you are 5 going to influence the environment and you know, the equipment 6 is not designed to be sprinkled. We know that, although one 7 can argue that the regulations require that it not be 8 affected, safety-related components shall not be affected by 9 the fire protection systems inadvertent actuation. That's the 10 words. Structure, systems and components are all covered, and 11 it says inadvertent actuation shall not affect those 12 components. Didn't say safety function. It said those
| |
| () 13 components.
| |
| 14 MR. ANDERSON: Andy, do you know whether in the 15 initial master list of systems, when they built the big matrix 16 with all of the events of conce'en, whether either as a primary 17 system or some support system, that fire protection was on 18 there? I don't know whether it was or not.
| |
| 19 MR. SZUKIEWICZ: Only to the extent if it could 20 affect the main control systems.
| |
| 21 MR. ANDERSON: But--
| |
| 22 MR. MICHELSON: The protection systems?
| |
| 23 MR. SZUKIEWICZ: No, not protection systems; again, 24 we assumed that at least one channel of protection system was 25 available. That's the only way we could look at it. We did HERITAGE REPORTING CORPORATION -- (202)628-4888
| |
| | |
| 102 1 not look at adequacy, for example, of, the design adequacy of 2 the protection systems. I mean that has been looked at by a 3 lot more people for a very long time. We did not look at 4 that.
| |
| 5 MR. MICHELSON: It has not been looked at from the 6 point of spraying water on them. It was early on recognized 7 that it wasn't designed for water spray. They tried to put 8 some capsule or something and they even gave up finally doing 9 that. You walk around the plant, you don't even find the 10 capsule or the safety-related equipment anymore, and it is 11 drip proof motors and they just aren't going to stand the 12 water.
| |
| () 13 MR. ANDERSON: I guess I can't answer your question 14 right now. I guess we don't have whether or not that fire I
| |
| 15 protection system showed up on that master systers list.
| |
| 16 MR. MICHELSON: The reason I never pressed it real l
| |
| 17 hard is your report said you are not going to consider fire.
| |
| .i 18 That's what your--and then I am asking where are you going to 19 consider fire? The answer was we have already considered it i
| |
| 20 under Appendix R, and the answer there was no, you didn't )
| |
| 21 consider these kind of effects on control and protection l
| |
| 22 systems when you did it under fire. It was entirely different j i
| |
| 23 approach.
| |
| 1 24 MR. SZUKIEWICZ: When I talked to some of the people 25 that actually did the review, they assure me that they have. l l
| |
| HERITAGE REPORTING CORPORATION -- (202)628-4888
| |
| . . . , --_ ~. . . - _ _. .-
| |
| | |
| 103 1 Now to what extent, that I can't say.
| |
| /')
| |
| (~/ 2 MR. MICHELSON: We will have to get a different 3 arena. This is not going to be the one--
| |
| 4 MR. SZUKIEWCIZ: You have to talk to the fire 5 protection people that did the work. l l
| |
| 6 MR. MICHELSON: I have been acquainted with them for i 7 sometime. That's why I am concrrned e about it.
| |
| 8 MR. SZUKIEWICZ: Okay. Operator errors that could 9 contribute to additional control system failures over and 1 i
| |
| 10 above the multiple failures that we assumed and we analyzed, !
| |
| I 11 we did not look at, we--again we felt that we looked at l l
| |
| 12 independent failures and selected multiple failures to address
| |
| () 13 some of the concerns, but in no way do we want to imply that 14 we did a human factors study on this to address all possible 15 operator errors that could occur.
| |
| 16 MR. MICHELSON: Now again the operator errors were 17 looked at in a different arena. For instance, we know that if 18 the operator inadvertently actuates his fire protection on the 19 second train of equipment when he has got a fire, the first 20 one, because the hose got out of hand or he got panicky and 21 pushed the actuation button, whatever reason, we know we will 1
| |
| 22 wipe out both trains of equipment. That's not even a, that's '
| |
| 23 not even considered in Appendix R. There aren't, operator l 24 errors are not considered, but you are considering them here
| |
| {
| |
| 25 which then gives people a false feeling of security that HERITAGE REPORTING CORPORATION -- (202)628-4888
| |
| | |
| 104 l
| |
| 1 1 operator errors have already been thought of.
| |
| r
| |
| (/ 2 They haven't been thought about in the case of fire, 3 for instance, and fire is wishy-washy. I think you really, 4 you ought to really admit you just aren't considering fire, 5 you aren't considering earthquake, and you aren't considering 6 the other external events. You ought to admit to that and 7 move it over somewhere else because you really aren't.
| |
| 8 MR. ANDERSON: I don't think we have ever portrayed 9 that we are doing that in a rigorous manner, but the 10 statements we have may have had, we have ettempted to look at 11 what the effects of the multiple failures would be, i
| |
| 12 MR. MICHELSON: In some cases, and that should
| |
| () 13 always be stated very carefully. Well, a few cases, and you 14 haven't begun to do a comprehensive look at these effects.
| |
| 15 MR. ANDERSON: In the selection of the cases we 16 looked at that was, that was the consideration.
| |
| 17 MR. MICHELSON: If you picked the right cases, it 18 won't be a problem.
| |
| 19 MR. ANDERSON: There was an attempt made to do that.
| |
| 20 CHAIRMAN EBERSOLE: On item 8 now?
| |
| 21 MR. SZUKIEWICZ: Yes.
| |
| 22 CHAIRMAN EBERSOLE: Particular class of operator 23 response, I would call a one-shot irreversible that I think
| |
| ''s 24 you ought to look at. The ones that you can correct by b
| |
| 25 looking at the display of your action, consequences, is HERITAGE REPORTING CORPORATION -- (202)628-4888
| |
| | |
| 105 1 something else.
| |
| ( 2 Are there any cases where the operator can make a 3 singular mistake and be locked out to correct it?
| |
| 4 MR. SZUKIEWICZ: A singular mistake on control 5 systems?
| |
| 6 CHAIRMAN EBERSOLE: Yes, on him becoming the control 7 system; I am looking at him as a control system.
| |
| 8 MR. SZUKIEWICZ: Well, again in the context of 9 non-safety grade control systems, we didn't identify any.
| |
| 10 MR. BAER: Again, let me state there is the problem 11 of multiple events, but for the most part, if I understand it 12 correctly, correct me if I am wrong, Andy, we looked at the
| |
| () 13 item that is being controlled, and tried to look at worst case 14 operation.
| |
| 15 A pump can go faster, slower. It can stop, and to 16 look at it in that sense, and now whether that control, 17 whether that pump went to maximum speed, if we are worried 18 about ccid water entering the steam generator, if it is 19 feedwater, whether that occurred because of a control system 20 error, I mean operator error, or control system failure, or 21 whether the failure was induced through a seismic event or 22 just a random equipment failure, or water spraying on it, we 23 didn't mechanistically try to determine that. We tried to say 24 what is the consequence of the feedwater pump in terms of
| |
| (~)
| |
| 25 overcooling, giving you maximum blow? '
| |
| HERITAGE REPORTING CORPORATION -- (202)628-4888
| |
| | |
| 106 1 CHAIRMAN EBERSOLE: Did you look at the operator?
| |
| f)/
| |
| su 2 MR. SZUKIEWICZ: We did any non-mechanistic. We 3 didn't care how it happened. It failed, and this is what we 4 try to assess, and is this failure significant?
| |
| 5 CHAIRMAN EBERSOLE: Surely you--
| |
| 6 MR. BAER: The point I am trying to make is the 7 question in my mind is hey, the multiple failures, that 8 particular failure in conjunction with a whole series of other 9 failuras, and as Andy said, selectively they tried to look at 10 that in a non-mechanistic way.
| |
| 11 CHAIRMAN EBERSOLE: What I am hearing is you didn't 12 recognize the operator as a control device in his own right
| |
| () 13 who has the capacity to reverse what he did wit'a some 14 intelligence, and the capacity to make terrible mistakes and 15 multiple mistakes. You didn't set him aside as a control 16 element, but that is what he is.
| |
| i 17 MR. ANDERSON: That is what this says.
| |
| 18 MR. SZUKIEWICZ: That is true. We did not.
| |
| 19 CHAIRMAN EBERSOLE: Where are--are ye,u ~,ing to do 20 that? When are you going to decide?
| |
| 21 HR. SZUKIEWICZ: We are not, not in A-47.
| |
| 22 MR. BAER: Why worry about it for control systems?
| |
| 23 Worry about it for protection systems. You have got an 24 example, THI, where the operator shut off all the protection 25 rystems. Now that to me is a much more fundamental problem if HER1fAGE REPORTING CORPORATION -- (202)628-4888
| |
| | |
| 107 1 you are going to worry about it than he somehow can manage a O
| |
| (_/ 2 control system worse than the random feed.
| |
| 3 MR. SZUKIEWICZ: We have a human factors division 4 that is looking into these kind of things. To, to now say to 5 us well, forget about what they are doing or in addition to 6 what they are doing, stick it into your program, I don't think 7 this is the right place to do it.
| |
| 8 CHAIRMAN EBERSOLE: it is a much, it is a program, 9 very broad issue.
| |
| 10 MR. SZUKIEWIC4: It has to be addressed in those 11 arenas. What we are, what we do, what we did was we said we 12 will fail one independent system. Then we said we will fail
| |
| () 13 two independent systems, and then three independent systems.
| |
| 14 Somehow we could say--
| |
| 15 MR. BAER: In some cases.
| |
| 16 MR. SZUKIEWICZ: In some cases; what we considered 17 were the more important systems, and there you can comfortably 18 say if they are independent, well, one of those systems that 19 failed could be really as a result of an operator error, and i
| |
| 20 we tried to look at and understand as you pointed out in the 21 pre-discussions how the control systems interact, but no;r to 22 stick into the safety implications of control systems the 23 other requirements that there are some non-conformance to 24 design requirements on protection systems, I really feel that 25 this is, and se did our management when we approved this, that HERITAGE REPORTING CORPORATION -- (202)628-4888
| |
| | |
| 108 1 this was a completely broad scope which is outside of the task f%
| |
| 's_) 2 that we did, what we wanted to do, and the objective of it in 3 1979 when the issue was raised was that there are a lot of 4 control systems that although they are separate and 5 independent from protection systems, they are, they have a 6 commonality through the thermal hydraulic or through the 7 hydraulic system, and we never really looked at the effect of 8 what could happen in control systems.
| |
| 9 We did some certain audits and of course, the 10 utilities looked at these things when they did their analysis 11 and FSAR analysis, but we as a Commission never focused in 12 toto on the control systems. And what we did in order to, you
| |
| () 13 know, do as many I failures as possible, is we had to assume 14 that there were certain given things.
| |
| 15 Now in every FSAR construction permit and final 16 operating license stage, there is an intensive review by the, 17 by our people, to assess the adequacy and, of the protection l 18 systems, that indeed they satisfy the single failure and they 19 are designed correctly.
| |
| 20 CHAIRMAN EBERSOLE: You even check though whether 21 they are exist?
| |
| 22 MR. SZUKIEWICZ: I'm sorry?
| |
| 23 CHAIRMAN EBERSOLE: You say you checked on the 24 adequacy of them. That's based on their presence. I'm 25 confident you are going to find a lot of them don't exist l
| |
| HERITAGE REPORTING CORPORATION -- (202)628-4888 l
| |
| | |
| 109 1 especially in the service areas where ycu have parameters out l'
| |
| (.s) - 2 of bound.
| |
| 3 MR. SZUKIEWICZ: Then I think this should be a 4 separate study looking at the adequacy of the protection ,
| |
| 5 systems the way they are designed now.
| |
| 6 CHAIRMAN EBERSOLE: At least in the absence of your 7 telling me otherwise, I am going to claim they are not 8 existent protective system that ought to be in place. l i
| |
| 9 MR. SZUKIEWICZ: We looked at, when we did the 10 simulation study, we looked at the, when wa perturbated it, we 11 utilized in our simulation the protection systems that were 12 required to function.
| |
| () 13 CHAIRMAN EBERSOLE: I am going to take a simple 14 model, the big machine, the main turbine generator, and ask a 15 few questions later on.
| |
| 16 MR. SZUKIEWICZ: Okay. Should I continue or--
| |
| 17 CHAIRMAN EBERSOLE: Go ahead, but on item 9, you are 18 going to be hung up because it ought to be rubbed out. That 19 is an escape route up there that leaves you clear and above 20 everything. Your assumption you will always have a working 21 safety train, that is invalid.
| |
| 22 MR. BAER: Except where we found--and it was looked 23 at regularly--of where a control system failure would wipe out ,
| |
| I 24 both trains of protection system, you were unable to identity 25 it. i 1
| |
| HERITAGE REPORTING CORPORATION -- (202)628-4888
| |
| | |
| 110
| |
| . CHAIRMAN EBERSOLE: It doesn't say.
| |
| G k/ 2 MR. MICHELSON: You know of at least one now, 3 though, at Peach Bottom.
| |
| 4 MR. SZUKIEWICZ: The only way we did this was 5 through the literature search, and there were no repeatable 6 identified failures. Now some of them occurred, but they also 7 cccur because of a derign deficiency.
| |
| 8 CHAIRMAN EBERSOLE: That statement up there, you 9 could make that statement. We could throw everything else 10 away.
| |
| 11 MR. BAER: That's very--maybe we ought to spend a 12 few minutes on this because that is very fundamental. Again,
| |
| () 13 what Andy has been saying--in no way is this study giving you 14 plant-specific assurance that systems or that, that the design 15 requirements were implemented on plants correctly.
| |
| 16 MR. SZUKIEWICZ: On protection systems.
| |
| 17 MR. BAER: No way were we studying that as a generic 18 issue. That was a goal, or even if it was a goal, I don't 19 know how you would do it beyond getting more audit inspections 20 by different group than ours.
| |
| 21 CHAIRMAN EBERSOLE: I don't know what the purpose of 22 all the work is unless it ensures--
| |
| 23 MR. BAER: I can remember this issue back when Steve !
| |
| 24 Hanour was concerned, and I thought that the two parts, the v'
| |
| 25 genesis as I understood it then, and this is long before I HERITAGE REPORTING CORPORATION -- (202)628-4888
| |
| | |
| 111 1 think even '82, he had I think two concerns, that the 2 electrical isolation between control systems and protection 3 systems either didn't exist or wouldn't be effective, and the 4 other one was the thing that has been being dealt with heavily 5 here, is that there is interactions through the thermal 6 hydraulics where control system failures can give you 7 transients that are beyond those that the protection system 8 were to handle.
| |
| . 9 CHAIRMAN EBERSOLE: You don't need to get near 10 thermal hydraulics to fail equipment which is critical to 11 post-trip heat removal. You just lose the equipment.
| |
| 12 MR. BAER: Lose the control system?
| |
| () 13 CHAIRMAN EBERSOLE: Lose the power operated 14 equipment. I don't care what the control system can do. If 15 it doesn't have power to run it with you--
| |
| 16 MR. SZUKIEWICZ: You are saying you lose the 17 protection systems?
| |
| 18 CHAIRMAN EBERSOLE: To me, I am talking about the 19 fundamental requirements. You have got to pump water. I 20 don't care how it got pumped, but if you lose the capacity to 21 pump water, no amount of control system help is going to do it 22 any good.
| |
| 23 MR. SZUKIEWICZ: That is correct, but you do have 24 separate independent systems.
| |
| 25 CHAIRMAN EBERSOLE: Control system failures can 1
| |
| 1 HERITAGE REPORTING CORPORATION -- (202)628-4888
| |
| | |
| 112 1 cause you to lose your pumping systems, and I don't care about
| |
| ( 2 the safety system.
| |
| 3 HR. SZUKIEWICZ: Well, in line with that, as a 4 result of the THI action plan we looked at some of the l
| |
| 5 independence of the water systems and found, for example, on 6 B&W plants, that they were part of the control non-safety 7 grade protection system. They have been since then all 8 reclassified and separated.
| |
| 9 Now the requirements have been established, and the 10 people have committed to do that. We in the Rancho Seco 11 situation a couple of years ago, in December of '86 I think, 12 we found that although they were going to separate the
| |
| () 13 protection system away from the safety system, away from the 14 control system, they didn't complete the job and we had a 15 transient, but that transient also had a lot of margin before 16 you get into safety.
| |
| 17 They have committed to it. They haven't done a 18 complete work on it, but it was there in the works. For us to 19 re-evaluate the adequacy of that design, that's what is being 20 done now in their licensing stage, so I agree that this topic 21 doesn't address your specific concerns of well, what happens 22 if you have control systems that could impede protection 23 systems? But we did not identify any that were in accord with i
| |
| ( 24 the design basis, the design basis of the systems, except for 25 the auxiliary air system, i l
| |
| HERITAGE REPORTING CORPORATION -- (202)628-4888 I
| |
| | |
| 113 1 MR. DAVIS: Mr. Chairman, can I ask a related 4 G
| |
| km/ 2 question? Excuse me for interpreting.
| |
| i 3 As I understand it, a major element of this activity 4 is to do a risk assessment of control system failures to l 5 determine whether or not they are significant, and I am a 6 little bit confused how you can assume a train of existing l 7 protection is available and still do a valid risk assessment.
| |
| 8 Normally to do a risk assessment you assume however many 9 trains are available and you account for outages due to 10 maintenance and so forth and it all turns up in the failure 11 data for the train itself it seems like.
| |
| 12 MR. SZUKIEWICZ: When we finally did the risk
| |
| () 13 contribution of control systems, when we did the PRA study, we 14 did factor in the probability of certain protection system 15 failures.
| |
| 16 MR. DAVIS: So that assumption was not made when you 17 did the actual risk assessment?
| |
| 18 MR. SZUKIEWICZ: That is correct.
| |
| 19 MR. DAVIS: Did you in fact assume consequential 20 failures of a train due to the control system failure? You 21 said you never did find any of those.
| |
| 22 MR. SZUKIEWICZ: That's right. And the unswer, 23 therefore, is no, we did not.
| |
| 24 MR. DAVIS: But you did look for them as part of 25 risk assessment?
| |
| HERITAGE REPORTING CORPORATION -- (202)628-4888
| |
| | |
| 114 1 MR. SZUKIEWICZ: Exactly.
| |
| f')
| |
| \_/ 2 MR. MICHELSON: Depends how good your models are 3 and so forth.
| |
| 4 MR. SZUKIEWICZ: To go a little deeper in your 5 question, we identified, for example, the frequency of events 6 of overfill, for example, that could contribute to a main 7 steam line break. The main steam line break scenario to core 8 melt would include the probability estimates that you are 9 talking about, certain protection systems not functioning at 10 that point. That part of the risk we did not change much.
| |
| 11 What we did change was the frequency of events leading to the 12 main contributor.
| |
| () 13 MR. MICHELSON: I think the key problem that has 14 bothered me for a long time now and is becoming more and more I
| |
| 15 apparent even in the case like this, and that is that one must J l
| |
| 16 be very careful whenever you do any analysis to make sure that 17 you identify the initiating event for which your conclusions I 1
| |
| l 18 are being considered.
| |
| 19 For instance, I can have an initiating event like a )
| |
| 20 pipe break and I can even lose both trains of a given safety ;
| |
| 21 function, but I might still be able to safely shut down even i
| |
| 22 with the loss of those two particular trains for that 23 particular event only. l 24 That doesn't mean now that losing those two trains 25 is okay for any other event. It means for a break in a given l l
| |
| l l
| |
| HERITAGE REPORTING CORPORATION -- (202)628-4888 )
| |
| \ !
| |
| | |
| 115 1 location, even though it takes out'two trains of a given 2 function, I can still safely shut down because it turns out I 3 need that for that given event. I may not need those two 4 trains for some other event. I may need one of those two 5 trains, so we have to always be very careful to name the 6 initiating event for which your conclusion was valid and we 7 don't do that and that's a problem with pipe break, for 8 instance. People say we have been through all the pipe break 9 analysis. We are okay.
| |
| 10 That have's not true. The pipe break analysis broke 11 the pipe at given location and determined whether or not you j 12 could safely shut down with what was left for that particular
| |
| (') 13 event only. Now that same way with a fire. Appendix R went 14 through, said okay, I have fire in this area, I can still 15 safely shut down with my remote shutdown location, and I can 16 lose two trains of equipment in the process, but I can't use 17 that remote shutdown location for some other initiating event !
| |
| 18 other than the fire in that area with that same remote j 19 shutdown center because it won't work anymore. I am going to 20 name an event like a pipe break that is going to get these 21 remote shutdown center at the same time, cets the two trains.
| |
| 22 You have got to name your initiating event for which 4
| |
| 23 your conclusions are valid, and you have got to keep moving 24 that initiating event around until you have done all the 25 credible events in the plant, and we don't do it that way. We HERITAGE REPORTING CORPORATION -- (202)628-4888 ;
| |
| | |
| 116 1 just start drawing generalized r:onclusions ~and we say oh, this 2 is-not a problem, that's not a problem. We have already done 3 the pipe break analysis. Wo have already done the fire 4 analysia and se forth, and you can't draw conclusions that 5 way. Simply doesn't work.
| |
| 6 MR. SZUKIEWICZ: That is exactly why we are very 7 careful about identifying exactly what the limitations of the 8 study are.
| |
| (
| |
| 9 MR. MICHELSON: And may be perfectly all right to 10 lose two trains of a certain train of equipment for a given 11 initiating event.
| |
| 12 MR. SZUKIEWICZ: For instance, pipe breaks on
| |
| () 13 protection systems has been addressed for a long, long time.
| |
| 14 Now there is a different question whether you think that's 15 adequate or not.
| |
| 16 MR. MICHELSON: Whether they have done it right or 17 not.
| |
| 18 MR. SZUKIEWICZ: That's a different story, but 19 because it was done, we assumed that we are not going to 20 include it in our scope.
| |
| 21 MR. MICHELSON: But that, the trouble was, and this 22 is the deficiency at the time that was done, they did not look 23 at, they did not look at control system effects at all. They 24 only looked at the effects of the pipe break on safety-related 25 systems. They didn't search to see whether control systems HERITAGE REPORTING CORPORATION -- (202)628-4888
| |
| | |
| 117 1 feed back into safety systems by the results of that D)
| |
| (- 2 particular pipe break. Go back and look at your response. It 3 wasn't required by regulation, and most of the people didn't 4 do it. Some did, to some extent, on a sort of as it became 5 obvious basis. It was not a comprehensive examination.
| |
| 6 CHAIRMAN EBERSOLE: Let me take item 9 up there, 7 just give a shot in the dark. I-will go back to air systems.
| |
| 8 I always hat 2d the General Electric SCRAM system that was 9 dependent on air and single dump volumes, et cetera. This 10 comes out now with the experience that excess air pressure 11 will cause certain valves to stack up from excess 12 differential.
| |
| () 13 I can arbitrarily assume that we have modulation 14 systems on air pressure output that feed in common all the 15 SCRAM solenoid valves, all air dependent.
| |
| 16 And some day I get a diaphragm failure or something, 17 and I find to my consternation that the pressure safety valve 18 lifts in excess of a lock-up pressure of the solenoid valvo on 19 the SCRAM system, and in the course of developing this 20 pressure, I develop a need to SCRAM for a good reason, i
| |
| 21 whatever it may be, and I can't.
| |
| 22 Has that beeri examined?
| |
| 23 MR. BAER: It is not a control system.
| |
| 24 CHAIRMAN EBERSOLE: What is it?
| |
| 25 MR. MICHELSON: It has happened--
| |
| HERITAGE REPORTING CORPORATION -- (202)628-4888 -
| |
| \
| |
| | |
| 118 1 CHAIRMAN EBERSOLE: It was controlling air pressure 2 with the diaphragm operating control.
| |
| 3 MR. BAER: You are saying it is affecting the other 4 protection systems? I 5 CHAIRMAN EBERSOLE: Exactly.
| |
| 6 MR. MICHELSON: Rod drives.
| |
| 7 MR. SZUKIEWICZ: It is affecting the protection 8 systems, then-- )
| |
| I 9 CHAIRMAN EBERSOLE: All the SCRAM solenoids. I have 10 lock-up.
| |
| 11 MR. SZUKIEWICZ: Loss of coolant accident, j
| |
| ! 12 CHAIRMAN EBERSOLE: No, no. I just can't SCRAM.
| |
| () 13 MR. MICHELSON: It is going to cause a transient at 14 the same time I am sure.
| |
| 15 CHAIRMAN EBERSOLE: Have turbine trip, I have got 16 to, I have no exit steam other than safeties, and I can't 17 SCRAM and we run ATWS.
| |
| 18 MR. SZUKIEWICZ: Again, what we did was when we i 1
| |
| 1 19 looked at the system, control systems, we looked at the active !
| |
| l 20 components, and we did not go back all the way into the air 21 supply systems and look at the compressors and all. We 22 recognize this, but we are now looking at--
| |
| 23 MR. BAER: I said earlier and I will say it again,
| |
| ]
| |
| 24 that we, like the rest of the agency and the ACRS, were not
| |
| )
| |
| 25 smart enough to identify that failure mode and so it wasn't HERITAGE REPORTING CORPORATION -- (202)628-4888
| |
| | |
| 119 1 looked at.
| |
| () 2 CHAIRMAN EBERSOLE: -This is only one of a large 3 family of failure modes.
| |
| 4 MR. MICHELSON: Several years by AEOD.
| |
| 5 CHAIRMAN EBERSOLE: Just part of a large family; 6 getting back to the base, I have got parameters in the plant 7 with drivers that have excess of function or they can fail 8 totally or they can vascilate between the extremes. I have 9 got to control them and examine the output with modulator out 10 of function and--
| |
| 11 MR. BAER: Do you want to let us describe what we 12 did do? Why don't you jump ahead to the--
| |
| r
| |
| () 13 CHAIRMAN EBERSOLE: Go ahead.
| |
| 14 MR. BAER: I think they can read--
| |
| 15 MR. SZUKIEWICZ: If there is any question in scope, 16 you folks can read this I am sure at your leisure.
| |
| 17 MR. BAER: The bottom line is that we really think 18 we did, we and our contractors, did what we set out to do.
| |
| 19 Now there may be arguments that the scope wasn't, didn't 20 include everything that it should have included, and that may 21 be a fair comment, but we did not go--the statement was made ;
| |
| 22 on a couple of the previous Committee meetings that we honed !
| |
| l 23 in on just one or two issues very quickly, and that was not j 24 our intent.
| |
| 25 MR. MICHELSON: What we didn't find, what we didn't I l
| |
| i l
| |
| HERITAGE REPORTING CORPORATION -- (202)628-4888 l
| |
| | |
| 120 1 find in the reports were the evidence as to what you looked at
| |
| ( 2 that turned out to be a non-problem. In other words, the 3 original scope, and I guess you don't disagree, you were going 4 to look at all control systems. That's what the scope said.
| |
| 5 We read it to you at the time of the meeting. I can read it 6 to you again. It was in the agua book that you said you were 7 going to look at all control systems,' evaluate all other 8 control system failures that have safety implication also, and 9 that means I look at all other control systems.
| |
| 10 MR. ANDERSON: We made a judgment very early in the 11 program of what those control systems were that had safety.
| |
| 12 MR. MICHELSON: What we didn't find is the l l
| |
| () 13 documentation, the judgment as to what things you did that you 14 didn't think were important. Rather it seemed like they were, I l
| |
| 15 the report honed in without much discussion. ;
| |
| 16 MR. SZUKIEWICZ: Carl, that is exactly the reason l 17 why we had to go back and make clarifications, because with a 18 general statement, people will say you are going to under a l l
| |
| 19 generic issue find all the ills in implementation, all the 20 problems that people have looked at in the past on protection l l
| |
| 21 systems, and what we wanted to come out and clearly say,,what j 22 we did was we only looked at failures of the control systems 23 that are used during normal plant operation, and we did not )
| |
| 1 24 look at any kind of interaction, system interaction between !
| |
| 25 the designs to see if some of the implementation was faulty.
| |
| i HERITAGE REPORTING CORPORATION -- (202)628-4888 I
| |
| | |
| 121 1 MR. MICHELSON: Then you did look at the air systems
| |
| } 2 and you did look at the, how you control the air pressure on 3 the air systems so that if you get failure of the control on 4 the air system, you now know what the consequerice would be.
| |
| 5 That was a part your scope then? Didn't find a discussion of 6 your having really looked at air systems, so I assume you 7 found no problems. It isn't clear what you did.
| |
| 8 MR. SZUKIEWICZ: Again, but only as it affected the 9 control systems.
| |
| 10 MR. MICHELSON: clearly it affects the control 11 systems.
| |
| 12 MR. SZUKIEWICZ: We looked at that, and we looked at
| |
| () 13 the combinations of them. ,
| |
| 14 MR. BAER: I will try again. We really looked at it 15 from the other way back. We have said here are some of the 16 types of events that we are concerned about, broadly 17 reactivity insertion, overcooling, overpressurization, and 18 overfill I think were the four major ones, and said okay, what 19 can cause those events? Then what control systems could cause r
| |
| 20 that equipment to malfuncton? And so we looked at it that way 21 rather than starting from each control system, working the i
| |
| 22 other way.
| |
| 23 CHAIRMAN EBERSOLE: That's why we are where we are, i l
| |
| 24 MR. BAER: I can understand the thought that it 25 ought to be done the other way, but again I want to emphasize l HERITAGE REPORTING CORPORATION -- (202)628-4888 i
| |
| | |
| l 122 1 we did try and systematically look at these, and-- j A
| |
| (-) 2 CHAIRMAN EBERSOLE: I knew it was an outward view 3 like the old large LOCA which didn't disclose the real 4 problems of reactors. You looked at from the large LOCA, 5 begin to fix it up. That is not the lion that is going to 6 kill us. It is the ants that is going to kill us.
| |
| 7 MR. MICHELSON: The other scope issue which I think 8 you clarified but I am not sure, and that is we were concerned 9 that you did not consider external events as being a challenge 10 to control systems that could then affect the plant. That was 11 explicitly excluded in your document. I read you the sentence 12 that excluded it, and that is still an issue with me at least
| |
| () 13 as to whether you finished the job or not. Might not even be 14 including external events much.
| |
| 15 CHAIRMAN EBERSOLE: It is fascinating to look at how 16 you looked at it and it has the classic characteristic of the 17 old academic process. I don't know what the hell is going to 18 happen in detail, but let's pick the biggest thing there is 19 and you look outwardly from consequence, try to find points of 20 development. You can't make it, friend, because you are 21 outside the shadow, in the shadow. You have got to go out 22 there and look at the sources.
| |
| 23 MR. SZUKIEWICZ: Like everything that we do, we i 24 identify a very broad problem. We have certain limitations, 25 and then what we identify after we work this a little bit, !
| |
| HERITAGE REPORTING CORPORATION -- (202)628-4888
| |
| | |
| 123 1 that this is the only part that is right now workable, but
| |
| ( 2 again, and I caution you gentlemen that you cannot stick this 3 in. When you say safety implications of control system, what 4 you are really concerned about is the adequacy of the existing 5 protection systems.
| |
| 6 CHAIRMAN EBERSOLE: You are talking about adequacy 7 of safety per se.
| |
| 8 MR. SZUKIEWICZ: It was an extre::.ely broad system.
| |
| 9 CHAIRMAN EBERSOLE: I know, but the protection 10 systems are gadgets to do something. If you take that first 11 bullet up there and say I am going to always have protection 12 systems, and they will keep me tripped and with heat going to
| |
| () 15 some place, you can stop. You have got it made. That 14 assumption closes everything. What I am really saying is--
| |
| 15 MR. BAER: Strangely, we did find some inadequacies; 16 not many, but we did find some.
| |
| 17 CHAIRMAN EBERSOLE: You made an assumption. I don't 18 know where you looked for them if you made the assumption.
| |
| 19 MR. BAER: We found there was no protection system 20 required on overfill.
| |
| 21 CHAIRMAN EBERSOLE: That bullet ought to be craced.
| |
| 22 MR. SZUKIEWICZ: I think we also found out that we 23 feel that if you perturbate control systems, as long as you 24 have a protection system, the existing--
| |
| 25 CHAIRMAN EBERSOLE: Which you may not.
| |
| HERITAGE REPORTING CORPORATION -- (202)628-4888
| |
| | |
| 124 1 MR. SZUKIEHICZ: That's the next step. And you 2 know, what we did was we worked the problem. Now if you 3 gentleman find that there is a specific problem that still 4 needs to be worked or an ares that needs to be Worked, that's 5 a different issue.
| |
| 6 CHAIRMAN EBERSOLE: There is a generic problem. It 7 is a list of quote, .:ontrol systems, and they go back even to 8 that damn crane that I told you with the 800 pound blow-down, 9 800 ton big one. It goes into valve controls. It goes 10 to--there is lots of control systems.
| |
| 11 MR. BAER: Jesse, if we approached it that way, you 12 get down in that kind of detail, I don't know.
| |
| () 13 CHAIRMAN EBERSOLE: It is not that big a deal.
| |
| 14 MR. MICHELSON: It is the question of--
| |
| 15 CHAIRMAN EBERSOLE: You tabulate the control systems 16 and look at their ramifications and you fix it. That's all.
| |
| 17 All it takes is a pile of schematics, elementaries, and a--
| |
| 18 MR. BAER: On a hundred plants or a 127?
| |
| 19 CHAIRMAN EBERSOLE: I don't know at what point in 20 time you can say I have found a generic problem.
| |
| 21 MR. SZUKIEWICZ: Again, I would like to point out 22 sort of a fallacy of the concern that you raised. You have 4
| |
| 23 identified in an LER, actually self-identified a problem with
| |
| / 24 a problem in redundancy or satisfying single failure of both 25 dedicated generators where you had four, four contacts being 1 HERITAGE REPORTING CORPORATION -- (202)628-4888
| |
| | |
| 125
| |
| -)
| |
| 1 run in a single conduit where potentially you could fail them j 2 or crimp the raceway, and actuate or trip the dedicated 3 generators. Now right away that looks like oh, boy, it is a 4 big violation.
| |
| 5 CHAIRMAN EBERSOLE: It is a separation problem.
| |
| 6 HR. SZUKIEWICZ: And it is a violation, but when you 7 look at the consequences, the only thing that, from what I 8 understand because I looked into it a little bit, if you had a 9 problem like this, yes, indeed, indeed you could trip the 10 dedicated generators, but if you had an accident, then there ,
| |
| 11 is an automatic override which is safety-related and safety 12 grade which would separate that particular trip from the
| |
| () 13 system.
| |
| 14 HR. MICHELSON: Which one comes in first; yes, it 15 does. As I understood it, once you have locked in on the fire 16 protection, then it doesn't go back and start the engine 17 anyway, but if you have an accident and then you get the fire 18 protection signal, then it ignores it. That was the way I l 19 understood it, but maybe I misunderstood. You will tell us 20 this afternoon the details enough to understand which way it 21 is. If you are, if your ECCS always override, that helps 22 some. However, it doesn't take the case where there is no 23 ECCS signal anyway. There is a fire in the plant, or there is 24 a seismic event or whatever, that has actuated the fire 25 protection system.
| |
| J !
| |
| , HERITAGE REPORTING CORPORATION -- (202)628-4888 !
| |
| | |
| 126 i l
| |
| 1 CHAIRMAN EBERSOLE: Where I have had a total loss of
| |
| () 2 power, is that an accident?
| |
| 3 MR. SZUKIEWICZ: No. If you have a total loss of 4 power on some designs, you would trip the dedicated 5 generators, but then the operator would have time to reinstate 6 manually.
| |
| 7 CHAIRMAN EBERSOLE: If he has a course to safety, i
| |
| 8 MR. SZUKIEWICZ: If you had that, you would have to 9 bypass it.
| |
| 10 CHAIRMAN EBERSOLE: When you use accident, I use 11 accident in the broader context.
| |
| 12 MR. MICHELSON: He doesn't have a course to safety
| |
| {} 13 if you don't have an accident signal. He is locked out.
| |
| 14 CHAIRMAN EBERSOLE: An accident generally is thought 15 to be something like a LOCA, but an accident to me is loss of 16 the batteries. It is a whole much far broader scope, will 17 eventually lead to what you call an accident.
| |
| 18 MR. SZUKIEWICZ: Could choose it, but I think we in 19 the Commission look at it in specific events, and yes, during ,
| |
| 20 a loss of power, some of the older plants would not 21 automatically bypass that system, but in a loss of power, and 22 no other situation, apparently these things were analyzed to 23 show that you do have some time.
| |
| 24 CHAIRMAN EBERSOLE: Fine. You have got time.
| |
| 25 MR. MICHELSON: I suspect water deluge in dedicated HERITAGE REPORTING CORPORATION -- (202)628-4888
| |
| | |
| 127 1 compartment will kill the dedicated engine anyway, but that is i ( 2 another issue. If you have a common mode actuation of all 3 four compartments that is, depends on the design of the 4 control system for this deluge business, and which I thought 5 you were going to look at which I don't think you have, you
| |
| > 6 have got to assure yourself there are four separate control 7 systems such as no matter what goes wrong, you will not 8 actuate all four compartments. That means including a seismic 9 event, doesn't cause them to come on in al) four compartments, 10 and I just don't think you all--you explicitly exclude the 11 seismic, and I don't think you really look at the fire 12 protection.
| |
| I
| |
| () 13 If you have, I would sure like to read about it ;
| |
| 14 somewhere.
| |
| 15 MR. SZUKIEWICZ: We have excluded it from the A-47 16 program, and the reason that we gave we excluded it was 17 because it was done elsewhere. 1 18 MR. MICHELSON: You say it was done in Appendix R 19 and no, it was not done under Appendix R.
| |
| 20 MR. ANDERSON: Whether a requirement or 21 implemented--if it wasn't a requirement, then we are in error, j 22 MR. MICHELSON: It was a requirement to look at the j
| |
| j 23 effective--that is how they got it at Limerick. They didn't 24 get it at Peach Bottom except by looking at it at Limerick, 25 and really we did the same thing with the CO 2 at Peach HERITAGE REPORTING CORPORATION -- (202)628-4888
| |
| | |
| . 128 1 Bottom.
| |
| ) 2 MR. ANDERSON: Yes.
| |
| 3 CHAIRMAN EBERSOLE: We better move on.
| |
| 4 MR. BAER: Could I suggert go ahead on to the 5 example case, and let's try and show you what we did do rather 6 than argue about what we didn't do, and then maybe we can 4 7 reach some agreement on if we get to the multiple system
| |
| ; 8 response program and we could discuss where maybe some of 9 these things could be put in.
| |
| 10 DR. LEWIS: We are just giving us the benefit of our 11 constructive judgments.
| |
| 12 MR. SZUKIEWICZ: Let me just, I want to take an
| |
| () 13 example of how we addressed reactivity increases in 14 transients, and the particular example I am using is for the i
| |
| ; 15 BWR design, and it is provided in, the information is provided 16 in the contractor reports which we also provided to you.
| |
| 17 For this particular design, what we wanted to do was l 18 to identify all systems that could contribute to positive t 19 reactivity, identify the failure modes of each which leads to i 20 reactivity.
| |
| 21 MR. EBERSOLE: Where does that put a boiler in an a 22 ATWS, undergoing a turbine trip in an ATWS7 If I have a il i 23 boiler that is going through turbine trip failure of the rods 24 to insert, is that covered by the first bullet?
| |
| i j 25 HR. BAER: ATWS is not covered.
| |
| HERITAGE REPORTING CORPORATION -- (202)628-4888
| |
| | |
| l 129 1 MR. SZUKIEWICZ: ATWS is not' covered, but here were
| |
| () 2 the, all the systems that were identified for that could 3 provide positive reactivity, and it is, and I have that in the 4 slides so you can see it. There are basically eight systems I 5 believe, eight systems. Some of them were safety grade 6 systems. Some of them were not safety grade systems. Again, 7 the primary purpose is to evaluate what could happen if these 8 systems failed in combinations that could excced the FSAR 9 analysis.
| |
| 10 (Slide) 11 CHAIRMAN EBERSOLE: In fact, the turbine trip is the 12 reactor core positive reactivity increase.
| |
| (} 13 MR. BAER: Turbine generator system.
| |
| )
| |
| 14 CHAIRMAN EBERSOLE: We don't need to put 15 inadvertent, any trip.
| |
| 16 MR. BAER: That's where I guess we just, where we ]
| |
| 2 1 17 say yes, if we looked at them mechanistically, you complain, i 18 CHAIRMAN EBERSOLE: It collapses the void.
| |
| l 19 MR. BAER: We just said yes, it tripped, right.
| |
| 20 CHAIRMAN EBERSOLE: It is the, a failure of it is a 21 routine practice.
| |
| 22 MR, SZUKIEWICZ: Then what we did was evaluated the 23 FSAR analysis and identified what the FSAR analysis assumed as I
| |
| l 24 far as plants go.
| |
| O 25' l,
| |
| We--and this was an iterative process that we have I
| |
| l HERITAGE REPORTING CORPORATION -- (202)628-4888
| |
| | |
| 130 1 failed because some of these systems have different effect on t
| |
| () 2 other parameters. We have evaluated these systems, how they, 3 what effects they have on different power operations. Then we ,
| |
| 4 evaluated the individual contributions or selective multiple l i
| |
| 5 failures of these systems on the reactivity transient. In ;
| |
| )
| |
| 2 6 some cases, this was a plant computer siranlation. In others, l
| |
| 7 it was engineering judgment based on the-key parameters such l l
| |
| 8 as flow, that could induce this kind of a transient. I l
| |
| 9 MR. MICHELSON: Did you not use any external events 10 in that evaluation or (ld you? For instance, seismic? l 11 MR. SZUKIEWICZ: No, we did not.
| |
| 12 CHAIRMAN EBERSOLE: It is interesting you call a ,
| |
| 13 failure what you do up there and not simply come out and i
| |
| [}
| |
| 14 recognize all BWRa have in-built positive reactivity 15 transient. It is a part of their normal every-day operation. i 16 HR. BAER: If you will give us a chance, we will try b l 17 and show you how we tried to bound all of this. !
| |
| 18 CHAIRMAN EB3RSOLE: Go ahead.
| |
| l i
| |
| I 19 MR. SZUKIEWICZ: Exactly. So we identified all the 20 control systems that if they could fail in certain manners, 21 this could potentially add some reactivity, so the systems, we 1
| |
| 1 4 22 took non-mechanistic system failure combinations or excessive 23 flow conditions to determine the, what kind of conditions J
| |
| l 24 could be more severe than used in the FSAR analysis.
| |
| (
| |
| 25 MR. BAER: Things like increase in flow; it is i,
| |
| j HERITAGE REPORTING CORPORATION -- (202)628-4888.
| |
| | |
| 131 )
| |
| 1 really your void coefficient.
| |
| () 2 MR. MICHELSON: Did you include the case whettein for 3 whatever reason, the rods didn't go in and you used the !
| |
| 4 injection to handle it underwater? !
| |
| 5 MR. SZUKIEWICZ: The failure modes that we use 6 especially specifically were here. [
| |
| 7 MR. MICHELSON: That wasn't necessarily ATWS case? !
| |
| 8 You didn't include any of that? >
| |
| 9 MR. SZUKIEWICZ: No.
| |
| 10 CHAIRMAN EBERSOLE: You didn't look atATWS initiated 11 by control system failure, for instance, on air pressure 12 control?
| |
| () 13 MR. SZUKIEWICZ: We did not look at ATWS events.
| |
| 14 That was one of the exclusions.
| |
| 15 CHAIRMAN EBERSOLE: You don't look at it in the 16 context of already having occurred. I am talking about, I i 17 mean look at it in the cvatext of a control system failure i 18 initiating, and I will pick arbitrarily, I will pick excess .
| |
| 19 pressure from the air system which lock up the SCRAM in the l 20 system which is certainly going to produce condition for me to l
| |
| l 21 SCRAM, and every SCRAM brings a positive reactivity increase, l
| |
| 22 as you well know, and I just have a sequence. All I started :
| |
| t 23 out with, I put 200 pounds of pressure, arbitrarily picked 24 that, SCRAM locked up, then some, some peripheral effects trip
| |
| }
| |
| 25 the turbine. That guarantees a positive reactivity trend. I ;
| |
| I f
| |
| HERITAGE REPORTING CORPORATION -- (202)628-4888 L
| |
| | |
| 132 ;
| |
| 1 can't intercept it. The rods don't move.
| |
| 2 MR.'BAER: Say again? ATWS was not included?
| |
| 3 MR. EBERSOLE: I didn't conclude--look, I walked in, 4 I walked in into ATWS. I walked into ATWS which is probably ;
| |
| 5 the best example I can even think of because of a failure of a 6 stupid control' system on an air system. If-you don't look at ,
| |
| 7 that, you might as well not look at anything. Do you follow 8 me? I have got the worst end result from the simplest 9 beginning.
| |
| 10 MR. SZUKIEWICZ: We actually took the analysis of ,
| |
| 11 the FSAR which according to the FSAR was an increase in flow, 12 the recirculation.
| |
| l
| |
| () 13 CHAIRMAN EBERSOLE: I am umimpressed by FSAR 14 procedural approach to this.
| |
| l 15 MR. SZUKIEWICZ: If you bear with us to let us know I
| |
| 16 what or let us tell you what our procedural values were, we, I l
| |
| 17 we actually simulated the FSAR analysis of the failure mode, 18 and the worst case flow conditions to give you an overpower 19 condition, and then what we did was we started failing l 20 combined control systems to see if we could exceed with 1
| |
| 21 increase in flow. For example, could we exceed the analysis?
| |
| 22 Could we exceed the maximum power spikes that occurred. And l 23 for all the combinations that we have looked at, and we have 24 looked at quite a lot, and we have actually invested a much l
| |
| )
| |
| 25 more conservative maximum flow, we could not exceed the peak HERITAGE REPORTING CORPORATION -- (202)628-4888
| |
| | |
| 133 ,
| |
| i 1 power conditions that were identified in the FSAR, and by that
| |
| () 2 definition, we said that these combinations were really l 3 bounded by the FSAR analysis. So whether, whatever reason--
| |
| 4 MR. BAER: We did assume--
| |
| t 5 MR. SZUKIEWICZ: We didn't care. !
| |
| 6 MR. BAER: The control rods that SCRAM, if that is 7 your point.
| |
| 8 CHAIRMAN EBERSOLE: You always save yourself in the 9 beginning by making an assumption.
| |
| 10 MR. BAER: No, but keep in mind we are trying to say 11 was there some control system failures, singularly or in 12 combination, or--
| |
| () 13 MR. EBERSOLE: I just picked one.
| |
| 14 MR. BAER: Reactivity transient, that wasn't !
| |
| 15 protected by the protection system. You keep wanting to I 16 expand the scope of the protection system.
| |
| 17 MR. MICHELSON: You picked a good system to look at 18 because the reactivity system is one of the better designed.
| |
| 19 CHAIRMAN EBERSOLE: But not in the boiler, not in a 20 boiler, not in a boiler. I am coing to think of a simple 21 evolution. You can tell me it is impossible if you wish.
| |
| 22 I have an excess of air pressure that locks the 23 SCRAM solenoids up. I can't SCRAM the rod. I can't put the I 24 rods in. The very action that caused that lock-up, I could 25 probably find half a doren reasons, caused the turbine trip. l HERITAGE REPORTINC CORPORATION -- (202)628-4888
| |
| | |
| 134 1 MR. SZUKIEWICZ: Can't trip the rods.
| |
| 2 CHAIRMAN EBERSOLE: I can't trip the, record turbine l
| |
| 3 trip; guarantees stop valve closure because it is a hydraulic I 4 system, independent. ;
| |
| , 5 MR. SZUKIEWICZ: We have dealt wirk this over and :
| |
| 6 over. We assumed that the protection system at least, the one 7 channel of protection system will work, and that meant that we 8 had to--
| |
| 9 CHAIRMAN EBERSOLE: I don't care.
| |
| 10 MR. SZUKIEWICZ: Already redundant channel to make 11 sure that that protection system trips. ,
| |
| 12 MR. EBERSOLE: I go back to the old protection .
| |
| () 13 system definition which was loss of voltage to some damn thing 14 because they wanted, the original concept on SCRAM was to
| |
| ] 15 de-energize. Here I have a, rather a kind of thing like that.
| |
| 16 I have locked mechanical function up and the mechanical I 17 function may in fact not even be within the protection j I i 18 concept? I have locked up the rods just as though I put nails (
| |
| )
| |
| 2' 19 in it.
| |
| } i
| |
| . 20 MR. SZUKIEWICZ: We do not identify any failures. '
| |
| l 21 CHAIRMAN EBERSOLE: We just did.
| |
| i 22 MR. BAER: K3 didn't look at that while you say you 4 ;
| |
| . 23 did, but the--
| |
| {} 24 CHAIRMAN EBERSOLE: He has got tl v cases.
| |
| 25 MR. BAER: Does the compressor put out enough i I
| |
| I l HERITAGE REPORTING CORPORATION -- (202)628-4888
| |
| | |
| 135 1- pressure'to lock up the SCRAM? I realize.if it. fails, 2 solenoid valve--
| |
| 3 MR. MICHELSON: What happened several years ago at 4 Pilgrim they were having troubl with' the air system, so they 5 put the, isolated the air system and put. nitrogen' bottles on 6 to,.in that function, and--
| |
| 7 MR. BAER: So the air--
| |
| 8 MR. MICHELSON: Regulators again weren't quite 9 adjusted right and air pressure was higher than they thought '
| |
| 10 and they kind of pushed the valves-pretty tightly closed, and-11 so packed tightly the seats and so.forth and behold some of 12 them stuck. Not enough of them stuck to create national O 13 incident, but enough of them stuck to create a concern, and 14 that's the kind of thing you get into. . How whether.they were 15 at 150 pounds, which is the limit of most air systems, I don't i 16 know.
| |
| 17 MR. BAER: I will tell you, I would'have to' concede l l
| |
| 18 that I, I think that you could almost have infinite resources l
| |
| l 19 without knowing about that event ~. We in national labs--I will '
| |
| 20 ask Sam. I know he didn't work that particular system--would 21 have looked for a long time without coming up with'that l l
| |
| 22 sequence.
| |
| 1 23 MR. EBERSOLE: You don't look. You,aon't look out.
| |
| l 24 in the shadow beyond the puddle of light under the lamp, and l 25 it worries me.
| |
| .l 4
| |
| 'HERI'fAGE REPORTING CORPORATION -~--(202)628-4888 l
| |
| - . . . . - - - . - - . - , . . - . . . ~ . . - . . , - . . - . , - - , . - . . . , .
| |
| | |
| -136 1 MR. ANDERSON: We are trying to turn the light up.
| |
| 'O
| |
| (_/ 2 CHAIRMAN EBERSOLE: Do you know as a case in point 3 there is a strict compatibility between the output of air 4 compressor and relief systems, et cetera, and the capacity to 5 withstand, just like they withstand voltage in an electrical l
| |
| 6 system, to withstand excess pressure like you withstand 7 voltage on the soft seats on these SCRAM systems; I don't know I i
| |
| 8 that do you know that. .
| |
| 1 l
| |
| 9 MR. SZUKIEWICZ: No.
| |
| 10 CHAIRMAN EBERSOLE: It may be a beautiful form of 11 that horrible thing. The worst of all, we got the BWR ATWS.
| |
| 12 I don't know that. And where it does come from a failure of a
| |
| () 13 control system.
| |
| 14 MR. MICHELSON: You want to be a little careful 15 about that.
| |
| 16 MR. SZUKIEWICZ: In broad definition, but you can 17 also define it as a, you know, as a failure in the design of 18 the protection system.
| |
| )
| |
| 19 MR. EBERSOLE: I don't dare care at what point of l i
| |
| 20 origin.
| |
| {
| |
| 21 MR. SZUKIEWICZ: But that's the reason you have 22 periodic checking and maintenance and testing of protection 23 systems.
| |
| 24 CHAIRMAN EBERSOLE: Whoever checks? You can't tell 25 me.
| |
| HERITAGE REPORTING CORPORATION -- (202)628-4888
| |
| | |
| 137 1 MR. SZUKIEWICZ: What you are suggesting is we also
| |
| ( 2 look into that area as well.
| |
| 3 CHAIRMAN EBERSOLE: I am saying you must look at l
| |
| 4 compatibility between the driving capacity when it is exerted, !
| |
| l 5 when the modulator fails.
| |
| 6 MR. BAER: Jesse, I think that is valid point, 7 and--in terms of what the air compressor could put out. Now 8 in terms of top, if it hadn't happened, thinking about someone 9 hooking up nitrogen bottles, I will have to admit I don't 10 think anyone ever thought of that.
| |
| 11 CHAIRMAN EBERSOLE: That's a Never NeverLand, but 12 nevertheless it did happen.
| |
| () 13 MR. MICHELSON: They have regulated it, just didn't 14 set the regulator.
| |
| 15 MR. BAER: A fellow I worked with said you can 16 design something to be foolproof, but the damn fool will get 17 you every time.
| |
| 18 CHAIRMAN EBERSOLE: You don't even know, what you 19 are telling me is you don't even know the driving capacity of 20 the air compressor nor its relief functions nor limiting 21 device over and above the modulator that will control it 22 within the bounds of acceptability of the SCRAM solenoids.
| |
| 23 MR. SZUKIEWICZ: As I said, when we looked at the 24 LERs, we didn't identify those pr^blems. They have occurred 25 within the last two years, that the staff recognized and they HERITAGE REPORTING CORPORATION -- (202)628-4888
| |
| | |
| 138 1
| |
| 1 1 are right now having task to look at that specific area. )
| |
| (-) 2 CHAIRMAN EBERSOLE: I am saying you know, that in )
| |
| l 3 the work we are trying to do here, scope it. Be sure you look l 1
| |
| l 4 at all these things. '
| |
| 5 MR. MICHELSON: Overvoltage does the same thing it 6 did in fact.
| |
| l 7 CHAIRMAN EBERSOLE: Overfrequency.
| |
| 8 MR. MICHELSON: We have overvoltage conditions on 9 these same SCRAM valves and they have caused the coils to bake 10 out of the little varnish and stick the solenoids--again, the 11 same kind of problem; now overvoltage instead of overpressure. J l
| |
| 12 CHAIRMAN EBERSOLE: It is fascinating to me in
| |
| () 13 recent years, like ten years, we are going to the modern 14 practice of carrying house load on the turbines. We think we 15 can modulate steam flow and feedwater, but in doing so, we 16 incur interesting potential. Whereas we used to be concerned 17 with the big pieces of turbine flying all over the place, 180 18 percent, Westinghouse argued you all out of that ever 19 occurring, with well, I won't comment on the argument, but the s
| |
| j 20 finding when you connect house load to a run-away generator or ;
| |
| 1 21 potential one which is it lost its grid load, and you must !
| |
| 22 absolutely jerk it straight up and apply alterations to 23 excitation current and speed control. If you carry the
| |
| (} 24 connecting parallel house load, all trains into destruction 25 from overvoltage or frequency, it don't matter what the HERITAGE REPORTING CORPORATION -- (202)628-4888
| |
| | |
| 139 1 diesels can do. They don't have anything to run.
| |
| () 2 MR. BAER: We did look into that one somewhat.
| |
| l 3 MR. MICHELSON: Was that written up? )
| |
| 4 MR. BAER: No.
| |
| 5 CHAIRMAN EBERSOLE: It is only part of a family.
| |
| 6 MR. BAER: Yes, sir. You brought it up. To get 7 back on some of the details, you brought it up at the Full 8 Committee meeting and if I had brought the transcript, I could 9 quote Mr. Wylie on all the protection devices and that's, and 10 that's what the staff told me, that there is, there were four 11 or five or six different failures that would be required.
| |
| 12 First of all is I have loss of off-site power. Then you have
| |
| () 13 to have one of those rare plants that can.try to maintain 14 house load with loss of off-site power and there are not many 15 that even would, that even would claim that capability. There 16 is a few that claim that capability. I don't know that they 17 have enough turbine bypass to do it, but there is a few that 18 do. And then there were all sorts of generator and voltage 19 trips that would have to all fail to get into that situation.
| |
| 20 CHAIRMAN EBERSOLE: Unless you put that down in 21 authentic legal statement--you know that to be the case.
| |
| 22 MR. SZUKIEWICZ: Also some--
| |
| 23 CHAIRMAN EBERSOLE: Carl I hear mentioned--
| |
| 24 MR. WYLIE: The governor, if the governor safety is 25 working properly, you will catch it within, if it is carrying HERITAGE REPORTING CORPORATION -- (202)628-4888
| |
| | |
| -= _ - .
| |
| 140 1 house load, catch it 2 to 3 percent. Now if that fails, 2 something wrong with the governor, that fails, then it is 110 3 percent. There is a diverse trip and we--of a mechanical 4 overspeed trip, so mechanical hydraulic trip. Then at 111 5 percent there is an electrical trip of the governor that has 6 the shutdown regulator. That shuts you down, trips you, shuts 7 you down.
| |
| 8 CHAIRMAN EBERSOLE: That all stops here.
| |
| 9 MR. WYLIE: That's three of them.
| |
| 10 CHAIRMAN EBERSOLE: They are all just like the BWR 11 SCRAM system. They converge to the stop.
| |
| 12 MR. WYLIE: No. The governor acts on intercept.
| |
| () 13 Then the diverse, the electrical trip hits the stop valves.
| |
| 14 CHAIRMAN EBERSOLE: In the face of this, history 15 says that these things are runaway and they have done so 16 because it was softer sand in mechanic, 17 MR. WYLIE: Not recently.
| |
| 18 MR. EBERSOLE: I agree. l 19 MR. WYLIE: That's the reason they put all these l 20 trips in, because they did have over runaways.
| |
| 21 CHAIRMAN EBERSOLE: We have displayed, we have 22 decided that 180 percent failure is not enough to worry about 23 anymore because of all the features you are talking about, and 24 we have conceded that carrying away the connected load is a
| |
| [}
| |
| 25 permissible adjunct to just blowing up the turbine. )
| |
| ]
| |
| i HERITAGE REPORTING CORPORATION -- (202)628-4888
| |
| | |
| Is 141 1 MR. WYLIE: I will put my plug in for generator 0
| |
| \# You take a normal trip on turbine 2 circuit breakers.
| |
| 3 generator, you don't carry house load, it stays connected to 4 the system.
| |
| 5 MR. EBERSOLE: Of course; they are not all that--
| |
| 6 MR. MICHELSON: We generally concede that the 7 protective devices on a generator are probably as well or 8 better designed than on the reactor.
| |
| 9 MR. EBERSOLE: They should be because there is more 10 money at stake.
| |
| 11 MR. WYLIE: Some utilities take one additional step 12 and they put on the frequency relay 110 percent, get the
| |
| () 13 shutdown relay.
| |
| 14 CHAIRMAN EBERSOLE: All I am hearing is hearsay.
| |
| 15 MR. MICHELSON: If there is one common--
| |
| 16 CHAIRMAN EBERSOLE: Most of the time.
| |
| 17 MR. MICHELSON: That is not one I would wish too 18 hard.
| |
| 19 CHAIRMAN EBERSOLE: You have got to put it on the 20 record.
| |
| l i
| |
| 21 (A discussion was held off the record.)
| |
| 22 MR. WYLIE: From an electrical standpoint, though, 23 it would never get there because the rotor of the generator
| |
| () 24 will come apart first, and the windings will wedge into the 25 stata and stop you somewhere around 120 percent or something HERITAGE REPORTING CORPORATION -- (202)628-4888
| |
| | |
| 143 1 like that.
| |
| 2 CHAIRMAN EBERSOLE: We have been looking for years 3 at the bigcer pieces of the turbine b2.ade.
| |
| 4 MR. WYLIE: I know.
| |
| 5 CHAIRMAN EBERSOuE: You think that's--
| |
| 6 MR. WYLIE: It was on the basis that you broke the 7 shaft between the turbine and the generator.
| |
| 8 MR. MICHELSON: You can't guarantee the generator 9 will be the brake. -
| |
| 10 MR. WYLIE: From an electrical standpoint, it 11 wouldn't exceed 180 because of the rotor will come apart.
| |
| 12 CHAIRMAN EBERSOLE: It really is, a. simple issue is
| |
| () 13 that can we let the case rest on the agreement that if that 14 runaway does occur, it will carry away all of our motor power 15 for pumping water because of excess speed or voltage. See, up 16 to now it has been looked at in the context of fragments 17 flying around.
| |
| 18 MR. SZUKIEWICZ: We looked at it when you raised it.
| |
| 19 We talked to our contractors, and they basically said they 20 can't really identify any failure modes that are really 21 probable. How I am not, this was--
| |
| 22 CHAIRMAN EBERSOLE: Do we have voltage limitors and l
| |
| 23 excess frequency trips? I
| |
| {} 24 MR. SZUKIEWICZ: They have voltage limitors on the 25 generator side to trip the turbine. They have overvoltage HERITAGE REPORTING CORPORATION -- (202)628-4888
| |
| | |
| 143 1 trip, but they do not have any overvoltage on the buses. They O 2 have overcurrent I believe on the-buses. But in fact, I 3 talked to some of the power experts, and they indicate no, 4 they don't have it, and these questions have been raised with 5 IEEE and IEEE has never suggested or requested that 6 overvoltage--
| |
| 7 CHAIRMAN EBERSOLE: In the context--
| |
| 8 MR. SZUKIEWICZ: Exactly; to protect their-- - 1 9 CHAIRMAN EBERSOLE: Nuclear rather than generator.
| |
| 10 MR. WYLIE: Overspeed and the voltage going up, is 11 that what you are talking about?
| |
| 12 CHAIRMAN EBERSOLE: Right.
| |
| (~)%
| |
| : s. 13 MR. MICHELSON: Frequency goes up.
| |
| 14 MR. WYLIE: The regulator would hold it. Then you 15 have got the limitors that--
| |
| 16 CHAIRMAN EBERSOLE: If you have limitors, that's the 17 safety trip.
| |
| 18 MR. WYLIE: But here is one other thing, too. The 19 motors themselves are frequency sensitive. They are 20 inductors, and they are not going to--
| |
| 21 CHAIRMAN EBERSOLE: They will resist attempt to 22 overspeed. Sure. Fellows, my function is to raise these 23 until you tell me, your function is to tell me it is okay.
| |
| () 24 MR. MICHELSON: I would have expected some 25 discussion of this.
| |
| HERITAGE REPORTING CORPORATION -- (202)628-4888
| |
| | |
| 144 q 1 CHAIRMAN EBERSOLE: It is one of these voids in your
| |
| (-- 2 report along with the air problems. l l
| |
| 3 MR. MICHELSON: Then I would know you looked at it, 4 along with the air problem, along with the other voltage 5 regulators that tie into safety systems. l l
| |
| 6 MR. SZUKIEWICZ: We looked at control valves i
| |
| 7 opening. We did not specifically look at hat particular I I
| |
| 8 scenario, but after you raised it, and I think you raised it I i
| |
| 9 in the inicial subcommittee meetings and subsequent telephone l l
| |
| l 10 conversations, we chatted with a number of different people, l
| |
| 11 and our contractors, and-- i l
| |
| 12 MR. EBERSOLE: Put your findings on record and we l rx
| |
| (,)
| |
| i 13 are done, i l
| |
| 14 MR. BAER: We will send you a little something.
| |
| 15 MR. WYLIE: One that did happen some years ago that 16 is probably of more concern, and that is because the l
| |
| 17 conductivity instrumentation detect leakage of sea water into l i
| |
| 18 ocean-cooled plants, that's a non-safety instrumentation.
| |
| 19 Some years ago, this happened at one of VEPCO's plants. It 20 wasn't a nuclear plant. It was a fossil plant, and they had 21 taken the conductivity instruments, some of them out, and we 22 looked, and the one would went off scale. They said that 23 thing is acting up again. They actually had a bona fide leak,
| |
| {} 24 and it froze up the stop valves.
| |
| 25 CHAIRMAN EBERSOLE: The sand froze them up.
| |
| HERITAGE REPORTING CORPORATION -- (202)628-4888
| |
| | |
| l 145 1 MR. WYLIE: The heater tripped it. It would have
| |
| !D
| |
| \/ 2 gone into infinity, and that's more concern. That kind of 3 instrumentation should be preserved, higher grade.
| |
| 4 CHAIRMAN EBERSOLE: I'think there are several cases 5 where sand or other materials went into the stop and turbine 6 control valve and we lost the wheels.
| |
| 7 MR. WYLIE: It was the reason they exercise them 8 periodically.
| |
| 9 CHAIRMAN EBERSOLE: We are not going to go and lose 10 the turbine or the generator or going up and seeing it 11 mechanically, but it is the core melt.
| |
| 12 MR. SZUKIEWICZ: From what I understand, Crystal p/
| |
| s_ 13 River just recently had an event where the operator was doing 14 something with the turbines, and they were down to.40 percent, 15 which was their relief capability, steam relief capabilities, 16 and from what I understand just through a conversation--I 17 don't have anything in writing yet, it hasn't apparently been '
| |
| 18 written up, but it is coming--was that they tried to trip the 19 turbine, but they couldn't for a while, but they finally 20 tripped the main steam isolation valves.
| |
| l 21 CHAIRMAN EBERSOLE: If they had lost the grid load. )
| |
| l 22 MR. SZUKIEWICZ: I don't know the details. When we l 23 get them--that that's the closest thing that could come to the i l
| |
| (} 24 kind of event that you are concerned about.
| |
| l l
| |
| 25 CHAIRMAN EBERSOLE: Typically we don't go into the <
| |
| i HERITAGE REPORTING CORPORATION -- (202)628-4888
| |
| | |
| 1 146 1 turbine stop and control valve design, and I think they have 2 some of the characteristics of the BWR hydraulic mechanism.
| |
| 3 They dump oil from high pressure cylinder, which controls the 4 stop and the control valves, into some reservoir, so they 5 don't throw it out in the river. I can at least invent the 6 spector of that reservoir being pre-filled and I have never 7 searched that out. I doubt any of you have, but I am sure the 8 industry must have.
| |
| l 9 MR. S ZUK.' 3WICZ : From our perspective, from the way 10 we did A-47, we looked at failures of valves failing to close, 11 bypass valves, the governor valves, the stop valves, but we 12 did not look at nor did we consider it in our scope to look at
| |
| (') 13 missiles. You know, that was done by some other people.
| |
| 14 CHAIRMAN EBERSOLE: Used to be a big thing to look 15 at missiles and finally it got pumped to down where it is 16 missiles due to metallurgical failures at synchronous speed, 17 and the notion of 180 percent failure was pressed, and I think 18 in the course of that, big, thick walls that were originally 19 in the early design to protect against missiles have 20 disappeared in this country. I don't think they have in 21 Japan. I think that the Japanese design still anticipate the 22 turbine blowing away. I am not certain about that. What they 23 do about retaining connective load, I haven't the foggiest
| |
| /~)
| |
| (/
| |
| 24 notion.
| |
| 25 That is just one of a family of events in the HERITAGE REPORTING CORPORATION -- (202)628-4888
| |
| | |
| l 147 1 control arena, and one looks at it and puts it to bed with 2 some qualified consensus. That's all.
| |
| 3 MR. SZUKIEWICZ: We. looked at it, and I don't want 4 to imply that we spent & tremendous amount of time on it, but 1
| |
| 5 we looked at it.
| |
| 6 CHAIRMAN EBERSOLE: Necessary or not.
| |
| 7 MR. ANDERSON: Let's just go on.
| |
| 8 MR. SZUKIEWICZ: We did not consider it a problem.
| |
| 9 Okay.
| |
| 10 Just to summarize, again is what we did was 11 identified all the control systems, non-safety grade control 12 systems, and in fact, safety grade control systems that could
| |
| () 13 affect certain events--overpressure, overtemperature, 14 overheat, overfill, reactivity, and we did this in a matrix 15 fashion to identify all the systems that could interrelate and 16 cause you these kind of transients, and then what we did was 17 we took single failures, analyzed two at a time failures, and 18 in certain cases where we considered the transients could be 19 significant went to three or four more, and in some cases we 20 had about six or seven failures just to get an idea of what 21 the bounding condition would be; non-mechanistic lumping of a 22 lot of different transients, lot of different plants that 23 could aggravate certain parameters to see if, you know, they
| |
| () 24 could exceed the design basis of the tech specs or the FSAR 25 analysis.
| |
| HERITAGE REPORTING CORPORATION -- (202)628-4888
| |
| | |
| l 1
| |
| -148 l l
| |
| 1 MR. MICHELSON: What puzzled me about your matrix is 2 what you call the events. Those are not the initiating event 3 rather, and consequential effect of initiating event, 4 depending upon what the initiating event is that cause l
| |
| 5 overpressure, the matrix results become different. I don't 6 know how you can give that a consequential effect of one 7 coordinate and the systems as the other because it doesn't 8 work that way. It always starts out with what was the 9 initiating event and then what was the subsequent ei*ects, and 10 what systems were.
| |
| 11 MR. BAER: The what.is called systems, I think the 12 intent is failure of the control system, those control systems
| |
| () 13 could they cause these sort of events.
| |
| 14 MR. MICHELSON: Like closure of a TB turbine valve, 15 turbine valve, what will it cause? Is that the way you looked 16 at it?
| |
| 17 MR. BAER: Yes. It is not labeled too well I agree.
| |
| 18 MR. SZUKIEWICZ: Closure of turbine bypass. ,
| |
| 19 MR. MICHELSON: Really consequential effects. l l
| |
| 20 CHAIRMAN EBERSOLE: We don't have that matrix here, ,
| |
| l 21 do we?
| |
| i 22 MR. MICHELSON: Yes. Events are really ;
| |
| 23 consequential events of certain system failures which are 1
| |
| (} 24 found.
| |
| 25 MR. SZUKIEWICZ: Exactly.
| |
| l l
| |
| HERITAGE REPORTING CORPORATION -- (202)628-4888 ;
| |
| | |
| l 149 1 MR. MICHELSON: I wasn't quite sure, and I hope 2 any--of course, you have included all the consequential 3 effects; there is generally more than one possible.
| |
| 4 HR. SZUKIEWICZ: That is correct.
| |
| 5 MR. MICHELSON: Might get reactivity and overfill 6 and overpressure all as a part of the same consequential 7 effects of some system component failure. I am not saying it 8 was the case. I am saying you might.
| |
| 9 MR. SZUKIEWICZ: Overfill and overpressure, I don't 10 think that would occur.
| |
| 11 MR. BAER: It is indicated that you would in fact, 12 the things that tend to give you overfill also tend to give
| |
| (') 13 you overcooling.
| |
| 14 MR. SZUKIEWICZ: Exactly. And it is there.
| |
| 15 MR. BAER: It is one of the others. You are right.
| |
| 16 MR. MICHELSON: What you didn't include are such 17 things then as degradation of the air pressure or degradation 18 of a control voltage source, things of that sort. I find only 19 some of these big main line things like RCIC.
| |
| 20 MR. ANDERSON: That was a different step after this.
| |
| 21 MR. MICHELSON: I thought that was a step before 22 because I thought that degradation of air might lead to 23 several things happening, including possibly-losing RCIC and 24 HPCI, depending on how you are controlling the valves on your
| |
| [
| |
| 25 particular project.
| |
| HERITAGE REPORTING CORPORATION -- (202)628-4888
| |
| | |
| 150 1 Mk. ANDERSON: The purpose of this was to identify 2 all of the control systems that could have any effect on, 3 initiate in any way or have any effect on overpressure event 4 in the plant, and then the next step is say what affect could 5 it have?
| |
| 6 MR. MICHELSON: Other category way out on down the 7 line, is this matrix developed somewhere with all of the 8 things you are looked at on it? Thac's what I was asking for 9 earlier.
| |
| 30 MR. SZUKIEWICZ: Yes. In the contractor reports, we 11 identified the--
| |
| 12 MR. MICHELSON: I didn't see it in the report.
| |
| ( 13 MR. EBERSOLE: Would it be possible to expand that?
| |
| 14 MR. BAER: On references, it turns out in the 15 original package we did give a brief summary review 16 references. We have since sent down a copy of the reference.
| |
| Identified the contents of'each 17 MR. SZUKIEWICZ:
| |
| 18 reference.
| |
| 19 MR. MICHELSON: Which reference will I find this in?
| |
| 20 MR. SZUKIEWCIZ: It was the BWR report which was'an i
| |
| 21 INEL report, and it is--I don't recall what the NUREG number j i
| |
| 22 is.
| |
| 23 CHAIRMAN EBERSOLE: Is there consolidated extension 24 of that list anywhere?
| |
| r()
| |
| 25 MR. MICHELSON: He said in BWR INEL report.
| |
| HERITAGE kEPORTING CORPORATION -- (202)628-4888
| |
| | |
| 151 1 CHAIRMAN EBERSOLE: Okay. It is there.
| |
| 2 MR. SZUKIEWICZ: In their report what you have is 3 you have four of the events. You have what parameters, what 4 control system contributed to these conditions. You don't 5 have a summary matrix.
| |
| 6 HR. MICHELSON: -Overpressure is not an event. It is 7 a consequence of something happening. You don't get 8 overpressure as the initiating event generally. You have got 9 to have something cause the overpressure. Is that cause-- -
| |
| 10 MR. SZUKIEWICZ: The cause is the failure. Now for 11 example, if you have a turbine control valve closure, you can 12 cause an overpressure event. If you have a turbine bypass
| |
| () 13 valve closure, you won't have an overfill event. If you have 14 an open, then you can. And so a lot of control systems are 15 in t e r twir.e d . That is correct.
| |
| 16 MR. MICHELSON: Down the line off the chart there I 17 will find somewhere the air, the building air and ao.forth 18 because that is the loss of building, of control air, for 19 instance, will in turn cause the valve to close which in turn 20 will cause--
| |
| 21 MR. SZUKIEWICZ: If we found that this particular 22 failure was a significant one, we then went back to see what 23 the, what the cause could be, and if it was one of those 24 significant ones that we could, for example, improve on, then
| |
| }
| |
| 25 we did look at mechanistic failure to make recommendations for HERITAGE REPORTING CORPORATION -- (202)628-4883
| |
| | |
| 152 1 alternatives.
| |
| O, 2- MR. MICHELSON: I think the thing.that concerned me 3 earlier and still concerns me is when you go back to see what 4 caused the valve to close, you find that maybe it was. loss of 5 air or maybe it was overpressure. I hope that when you found 6 that source, you chased it on out to what else it was causing, 7 and then coupled it with what you have on the chart here 8 because I don't think this chart does that.
| |
| 9 MR. SZUKIEWCIZ: Because we didn't do it; we took 10 non-mechanistic failures and decided to couple the major ones.
| |
| 11 We didn't care, in the transient, if we coupled'the number of 12 systems together and found out that the transient.was not a
| |
| () 13 significant transient, then you didn't really have to.go all 14 the way back to see what caused that particular failure.
| |
| 15 The only time we would have done that is if the 16 combination was significant. If the combination was not 17 significant, then if the reason for the failure was a flood or 18 the reason for a failure was a deluge system turning on, or 19 operator errors, we didn't care--only until we found that a 20 significant system, a significant transient and then we looked 21 at these combinations. In some cases we found that when we 22 took bounding combinations, we found that yes, indeed the 23 transient was very, very significant. Then we went back to 24 see if it was a probable transient and we found out that no, 25 it wasn't. For example--
| |
| HERITAGE REPORTING CORPORATION -- (202)628-4888
| |
| | |
| 153 1 MR. MICHELSOll: If you really did what you are 2 saying, you have done it right. !!ow we were just kind of 3 trying to read the reports where we were left with a very 4 distinct feeling that you indeed did it this way, and
| |
| [
| |
| 5 therefore it was done right.
| |
| 6 MR. SZUKIEWICZ: One of the main problems in doing 7 this generic issue is when you get the information, you get 8 the information that is available through the FSARs, and 9 sometimes through old design drawings, and we didn't go out to 10 the plant-specific designs and say we want to look at every 11 single drawing, and that is one of the reasons that we decided 12 to take this approach, and combine failures and see what would
| |
| () 13 happen because we, we can then conclude that it may not occur 14 on a plant-specific design that we were looking at but it 15 could occur at some other plant, and that's why we did take 16 certain selected combinations.
| |
| 17 MR. MICHELSOll: From what I understand, you did, for 18 instance, go back, if you had a bad combination, then you went 19 back to make sure no inadvertent actuation of fire protection, j 20 for instance, would result in that combination. Is that true?
| |
| 21 MR. AllDERSOll: lio . We did not go back and look at 22 inadvertent fire protection.
| |
| t l 23 MR. MICHELSOll: Then it is not quite true. It is 24 listed in the discussions just a minute ago. It is true you 25 went back and looked at pipe breaks around the plant to see if HERITAGE REPORTIllG CORPORATIOli -- (202)628-4888
| |
| | |
| 154 i l
| |
| 1 a pipe break could cause that combination to appear?
| |
| 2 MR. SZUKIEWICZ: Only if--
| |
| 3 MR. MICHELSON: You really--
| |
| 4 MR. SZUKIEWICZ: Wait a minute. Only if those 5 combinations were significant; then we went back.
| |
| 6 MR. MICHELSON: That was the preface I put with my 7 statement. When you found a significant combination off this 8 chart that you were worried about, did you chase back to see 9 what kind of initiating events could lead to that combination, 10 including an inadvertent actuation pipe breaks?
| |
| 11 MR. ANDERSON: Unless I don't understand the logic, 12 which may be true, is that what we are really looking at is
| |
| () 13 what does the effect of these failures, rather than look at 14 mechanistically what causes them, the system, if the system 15 fails, you know, I guess we don't really care whether it 16 failed due to fire protection or failed due to earthquake or 17 what it failed. We have lost that function.
| |
| 18 MR. MICHELSON: You are saying you didn't find any 19 significant combinations of this chart to worry about?
| |
| 1 20 MR. SZUKIEWICZ: That's what we said, except for the 21 ones that we identify.
| |
| 22 MR. ANDERSON: Other than just assuming the loss of l l
| |
| 23 function of the systems.
| |
| (} 24 CHAIRMAN EBERSOLE: Seems to me the resolution that 25 you have is missing about 50 percent of its volume, which is l l
| |
| l HERITAGE REPORTING CORPORATION -- (202)628-4888
| |
| | |
| 155 1 the defense arguments that you looked at certain systems to
| |
| (/
| |
| s-
| |
| )
| |
| 2 complete the picture and you found no potential in them, and 3 what disappears from history is the. fact that you did that 4 comprehensive extension of the list like this and verbiage to 5 go with it--we fix that.
| |
| 6 MR. SZUKIEWICZ: We made some modifications to 7 clearly define that the two topical, the two NUREG reports are 8 a combination and summary of specific reports and we made a 9 better attempt to clarify that.
| |
| 10 CHAIRMAN EBERSOLE: Your resolution, though, was a 11 statement you found problems you had to fix. You found a lot 12 you didn't have to fix. The latter part of them was just as
| |
| () 13 important as the former.
| |
| 14 MR. SZUKIEWICZ: We have that in our conclusions in 15 those reports, in the two main reports, the technical finding.
| |
| 16 MR. ANDERSON: Haven't itemized everything. We 17 didn't look at, we looked at, decided it wasn't a problem.
| |
| 18 CHAIRMAN EBERSOLE: You are supposed to have done a 19 blanket coverage of control systems or part of your defense 20 that you did, it is the ones you looked at in listed form.
| |
| 21 MR. BALL: The contractor reports do have all these 22 considerations of the systems that were thrown out because 23 they were found to be not important, and if you look at those
| |
| ('T 24 you will find all those things.
| |
| U 25 MR. MICHELSON: You did look at all the air system HERITAGE REPORTING CORPORATION -- (202)628-4888
| |
| | |
| i 156 l
| |
| 1 control ranges to see what effect both high and low pressure Os 2 would have?
| |
| 3 'MR . BALL: Yes. I think the reason they didn't make I
| |
| 4 in these--
| |
| 5 MR. MICHELSON: You say definitely, you say 6 definitely. That means you looked at the kind of-situation j i
| |
| 7 that appeared in that Peach Bottom LER, for instance. Not
| |
| )
| |
| 8 Peach Bottom, the--then you just didn't pick up on it, which !
| |
| l 9 is understandable, but you did look at it systematically, 10 recognize that overpressure on the air system is a possibility j 11 and you found a single failure maybe in the control ;
| |
| 12 arrangement that would cause you to do that sort of thing? In
| |
| () 13 other words, a failure modes and effects analysis on the air 14 pressure?
| |
| 15 Mk. BALL: Oak Ridge did that for their two plants. )
| |
| l 16 I can't speak for the other guys. l l
| |
| 17 MR. MICHELSON: So I can go to--which two do I look 18 at to find this analysis?
| |
| 19 MR. BALL: For Oak Ridge?
| |
| 20 MR. MICHELSON: Yes.
| |
| 21 MR. SZUKIEWICZ: Oconee report, do you have that 22 list?
| |
| 23 MR. BALL: I gave them to Jesse the other day.
| |
| (} 24 MR. MICHELSON: Which ones are they?
| |
| 25 MR. BALL: They are the Calvert Cliffs report which HERITAGE REPORTING CORPORATION -- (202)628-4888
| |
| | |
| 157 1 is N'JREG CR 4265, and then the Oconee, which is the NUREG CR
| |
| /Q 2 4047.
| |
| 3 CHAIRMAN EBERSOLE: You are saying buried down is 4 the fact that you did--
| |
| 5 MR. BALL: It is not buried.
| |
| 6 MR. MICHELSON: We will look and judge for 7 ourselves.
| |
| 8 CHAIRMAN EBERSOLE: This paper, there is the 9 evidence that you have looked at these things and discarded 10 them as being--
| |
| 11 MR. BALL: Definitely.
| |
| 12 CHAIRMAN EBERSOLE: Includes excess services, excess
| |
| () 13 voltage, excess pressure, excess whatever, as well as 14 oscilatory flow?
| |
| 15 MR. MICHELSON: Loss of flow has always been--
| |
| 16 MR. BALL: The people that looked at these were we 17 felt very well qualified. They were given the license to look
| |
| . 18 at all possible failure modes of both the pneumatic and 19 electrical systems, and they came out and made extensive lists 20 of what they looked at, both what they considered, both what 21 they considered to be important and what they considered to be 22 unimportant, and all that is documented.
| |
| 23 MR. MICHELSON: In order to save us a lot of time
| |
| () 24 and since you are well familiar with the reports, maybe 25 between now and the end of the day you can just flip through HERITAGE REPORTING CORPORATION -- (202)628-4888
| |
| | |
| 158 l 1 and pull out the salient sections that we could look at?
| |
| 2 MR. BALL: Okay. Jesse has them.
| |
| 3 CHAIRMAN EBERSOLE: I have got the reports.
| |
| 4 MR. MICHELSON: You can get them easily enough from l
| |
| 5 several people. :
| |
| 6 MR. EL-ZEFTAWY: I have got them.
| |
| l 7 MR. MICHELSON: Just look through them while you are l l
| |
| 8 listening to all this other experience stuff and make it for 9 those.
| |
| 10 MR. BALL: I could do that for the Oak Ridge 11 reports.
| |
| 12 MR. MICHELSON: Just for the Oak Ridge.
| |
| 13 CHAIRMAN EBERSOLE: You have given us examples of l 14 the boiler up here. Let me--the boiler has the interesting 15 undesirable in this case advantageous aspect if you overload 16 it, it will quit.
| |
| 17 MR. SZUKIEWICZ: If you what?
| |
| 18 CHAIRMAN EBERSOLE: Put excess load, it will die 19 i because of void formation. Is there comparable list where you '
| |
| 20 looked at PWR with very high bypass and you looked at the 21 spurious bypass when you carry full turbine load?
| |
| 22 MR. SZUKIEWICZ: Again, those were the specific 23 scenarios that would be identified in the reports.
| |
| 24 CHAIRMAN EBEPsSOLE: Somewhere you are supposed to 25 boil out the effect out of these enormously detailed reports i I
| |
| l l
| |
| 1 HERITAGE REPORTING CORPORATION -- (202)628-4888 j
| |
| | |
| 159
| |
| ; 1 that you cannot have an overpower event which is damaging due A
| |
| 2 to this simple mechanism.
| |
| 3 MR. BAER: What was the scenario is the bypass 4 valves open.
| |
| 5 CHAIRMAN EBERSOLE: PWR got this great moderator 6 coefficient, makes it take load. It is carrying load, and I 7 have a control system failure that swings the bypass valves 8 wide open. What catches it?
| |
| 9 MR. BAER: This is nothing else, the high power 10 SCRAM.
| |
| 11 CHAIRMAN EBERSOLE: The high power SCRAM will catch 12 it?
| |
| A
| |
| 's_) 13 MR. SZUKIEWICZ: It should.
| |
| 14 CHAIRMAN EBERSOLE: High flux will catch it. Okay.
| |
| 15 I won't quarrel with that.
| |
| 16 MR. MICHELSON: The thing you want to worry about is 17 whether or not the air to those bypass valves and the air to 18 the regulators or whatever could catch you like main steam 19 line, make sure they aren't the same air and overpressure, 20 that air supply didn't cause one to open and the other to 21 close, or vice-versa. That's the point. The event is the 22 change in the air pressure, not the opening of the, one of the 23 valves and what happens thereafter.
| |
| () 24 Generally we do we start out by postulating one time 25 this valve opens, that valve closes and so forth, and we chase '
| |
| HERITAGE REPORTING CORPORATION -- (202)628-4888
| |
| | |
| 160 i all the way through. We never stop to ask what caused this.
| |
| 2 initiating event, which is really the real initiating event 3 back there night have been air pressure change, or voltage 4 change or something of that sort. That's where the fallacies 5 I find in many of our failure modes and effecta analysis. We 6 pick a component at a time, and fail it and chase it without 7 realizing that it failed maybe because its conditions had 8 changed, its environment temperature was raised at the same 9 time a whole lot of other temperatures in the same cabin were 10 raised and analysis breaks down because we chased it through 11 as the one component was initiated when it wasn't.
| |
| 12 MR. SZUKIEWICZ: We only did this when the
| |
| () 13 transients were significant. Then we tried to say could these 14 failures really occu? And that's what we did.
| |
| 15 MR. MICHELSON: What I worry about is do we know 16 that the transients are significant from doing this component 17 failure on down as opposed to starting out with the change in l
| |
| 18 the basic parameter like temperature on down? Maybe a 19 temperature change would be significant even though that 20 component failure per se was not. That's what bothers me. I l
| |
| 21 am wondering if we really followed it through from the true l l
| |
| 22 initiating cause, and that's why we are worried.
| |
| l l
| |
| 23 MR. SZUKIEWICZ: We felt that one, that would really I 24 mean that you would have to have a tremendous amount of 25 detailed design information and you would have to make sure j l
| |
| l HERITAGE REPORTING CORPORATION -- (202)628-4888
| |
| | |
| 161 1 that it was current and represents the as-built design, and
| |
| (
| |
| (/ 2 because we didn't have all this information, that's one of the 3 reasons we took, we took this approach to first see do you 4 have a problem if you perturbate these systems? And in_a lot 5 of cases, we perturbated, the more systems we perturbated, the I
| |
| 6 transients in some cases actually wasn't as bad as with less j 7 systems perturbated, and so--and we had to, and we had to go 8 through that process to determine, you know, the limits.
| |
| 9 CHAIRMAN EBERSOLE: Let me ask you about another 10 related--let me ask you about DC system system. Some years 11 ago we found out that the stability of the voltage regulators 12 on many of the then existing plants was such that if you took
| |
| () 13 the load off, you get excessive high voltage, and we put in 14 specifications from requirements that says even on open 15 circuits you at low voltage stay and it will be within the l
| |
| 16 acceptable voltage with staying operating limits of the l
| |
| I 17 equipment, which was somewhat unusual requirement for those j 18 times. l 1
| |
| 19 Now I hear that other plants have to actually l 1
| |
| 20 disconnect the loads and raise the regulator voltage up just I I
| |
| 21 to get equalizing charge on the batteries. That being the )
| |
| 1 22 case, it tells me that if I have a partial load rejection on 23 DC bus, I may have a potential for excess voltage which will, i
| |
| {} 24 due to a variety of causes, lock up a lot of safety equipment 25 due to the DC.
| |
| HERITAGE REPORTING CORPORATION -- (202)628-4888
| |
| | |
| -l 162 1 Did you all look at this? l 2 MR. SZUKIEWICZ: Again, no, we did not look at the l I
| |
| 3 interaction between the safety systems. We assumed one ,
| |
| 1 l
| |
| 4 channel was available, the other was not. I l
| |
| 5 CHAIRMAN EBERSOLE: The safety systems are served by l
| |
| 6 the supply system, and in a common mode influence, I can 7 commonly affect at least everything connected to one pattern. j 8 MR. SZUKIEWICZ: You should have independence l l
| |
| 9 between the two. !
| |
| I 10 CHAIRMAN EBERSOLE: I should have,:but I have 11 adverted to a case where they actually disconnected or il cross-connected loads in order to simply get the batteries 1
| |
| () 13 equalized because they haven't designed the serve systems to 14 accept the equalizing voltage--example of horrible design.
| |
| 15 MR. SZUKIEWICZ: In the operating history that we i
| |
| 16 looked at, we didn't find trends in that nature that occurred '
| |
| 17 on one or two or three plants to determine that it was a l
| |
| 18 common mode failure. We did recognize and we did look at 19 failures of protection systems, but you know--
| |
| 20 HR. EBERSOLE: Due to excess voltage?
| |
| 21 MR. SZUKIEWICZ: I can't, I didn't do the work 22 myself. It was the contractors.
| |
| 23 CHAIRMAN EBERSOLE: Did you look at excess voltage
| |
| () 24 on DC circuits?
| |
| 25 MR. BALL: I don't, I don't know. I am not that HERITAGE REPORTING CORPORATION -- (202)628-4888
| |
| | |
| 163 1 familiar with that.
| |
| 2 CHAIRMAN EBERSOLE: Older regulators, all the older 3 DC equipmrnt, didn't take the equalization charge voltage.
| |
| 4 MR. MICHELSON: Also happened on a boiling water 5 reactor SCRAM system wherein the regulator was working and 6 full voltage, DC regulator failed, went up to full voltage, 7 and caused the coils and it stuck.
| |
| 8 CHAIRMAN EBERSOLE: Some cases also you lose 9 substantial part of the DC load but have a few critical items 10 after the voltage arrives. The battery is a stabilizer.
| |
| 11 MR. SZUKIEWICZ: I know that Oak Ridge had a very 12 intensive program on looking at the two reference plant -
| |
| () 13 designs on their off-site and on-site power systems, and they 14 had two or three people involved continuously for three, four !
| |
| 15 months, so I know that we are looking at excessive voltages on ,
| |
| 16 buses, so they did look at it to some extent. !
| |
| 17 CHAIRMAN EBERSOLE: This includes spikes due to 18 switching?
| |
| 19 MR. SZUKIEWICZ: Yes, but to what extent I can't 20 speak. l
| |
| {
| |
| 21 CHAIRMAN EBERSOLE: Like the one that got the !
| |
| 22 Hanford SCRAM system because it punctured two diodes. I 23 MR. SZUKIEWICZ: If they were aware of the Hanford :
| |
| t 24 spike, I don't know.
| |
| 25 CHAIRl!AN EBERSOLE: Let me ask, your presentation I HERITAGE REPORTING CORPORATION -- (202)628-4888
| |
| | |
| 164 1 take it is all of that before USI 17. Where are you in it 2 now?
| |
| 3 MR. SZUKIEWICZ: I am really finished. We tried to 4 provide-you with the scope and the limitations and the 5 methodology on how we approached the problem. You have 6 identified, and I think we all know what the limitations are, 7 and the last time I provided a proposal, what we are proposing 8 as a resolution. We discussed that in detail. I can go over 9 it in general if you would like, but it is a limited 10 resolution. It primarily deals with requiring overfill 11 protection on all the plants, the impact of this is not major 12 because a lot of plants have provided overfill protection
| |
| () 13 already, and another requirement is that we require technical -
| |
| 14 specifications to assure that these protection systems, the 15 trip systems overfill protection systems will be tech spec and T
| |
| 16 periodically verified operable. That's another requirement.
| |
| 17 We identified a problem really dealing with B&W 18 plants on three of them where we identified a potential 19 overheat transient because of the inadequacy of the auxiliary 20 feedwater system design so we are requiring that they provide 21 some additional diverse initiation of the auxiliary feedwater, 22 and we are also requiring that the Combustion Engineering 23 plant take a closer look at some of the operating procedures
| |
| (~} 24 of the small break LOCA because we found some problems there,
| |
| %.)
| |
| 25 and that's basically it as far as the resolution and the HERITAGE REPORTING CORPORATION -- (202)628-4888
| |
| | |
| 165 1 impact.
| |
| 2 And we have concluded that with multiple control l 3 system failures, in the context that we have identified, 4 assuming at least one channel of protection is still 5 available.
| |
| 6 CHAIRMAN EBERSOLE: That's the part that bothers me, 7 why you pick that as an assumption rather than having found it 8 a prudent case.
| |
| 9 MR. SZUKIEWICZ: It is because of established design 10 requirements on protection systems.
| |
| 11 MR. EBERSOLE: That is not reality. That is paper.
| |
| 12 MR. BAER: We are not in the business of doing
| |
| () 13 plant-specific implementation reviews. You know, I just don't 14 have that, the authority, the resources.
| |
| 15 CHAIRMAN EBERSOLE: We can't talk about paper. We P
| |
| 16 have got to talk about realities in the field, 17 MR. BAER: New requirements, and there is no way ;
| |
| 18 that we would be--there are ways that wo have discussed of i
| |
| 19 handling identified deficiencies in impleinentation, and [
| |
| 20 publishing new requirements is not the way. I mean--
| |
| {
| |
| 21 MR. MICHELSON: The old ones, j
| |
| 22 HR. EBERSOLE. This seems to be your loophole that 23 you are running through by making this assumption.
| |
| [} 24 MR. BAER: It is not a loophole. It is not the task 4 25 we were assigned. It is not the function of my branch. If we I
| |
| I HERITAGE REPORTING CORPORATION -- (202)628-4888 '
| |
| | |
| 166. ;
| |
| J 1 identify by looking at the one typical building, quote, 2 typical, the one plant of each NSSS supplier that we looked 3 at, if we happened to find some implementation deficiencies, 4 we certainly would bring those out and ask for some sort.of 5 enforcement action, but I have no way of, I have no other 6 source of data on whether other plants have implemented -
| |
| 7 properly, no other source than the same source that ACRS has 8 and other people in NRR have within the report, the 5073 9 report.
| |
| 10 CHAIRMAN EBERSOLE: Okay.
| |
| 11 MR. MICHELSON: Could I ask questions on the generic 12 letter at this point, or should we ask another time?
| |
| l
| |
| () 13 CHAIRMAN EBERSOLE: Why don't we do it now, Carl?
| |
| i 14 MR. MICHELSON: In the generic letter that you sent f
| |
| 1 15 out I was puzzled by--first of all, let me read you--you're ,
| |
| i 16 familiar, but for benefit of the committee, it points out in 17 the generic letter that the boiling water reactors isolate the 18 main feedwater flow by tripping the feed pumps, and then it 19 goes on to say that in the case of Westinghouse now, they 20 close at least one main feedwater valve as well as tripping 21 the main feedwater pumps. And it goes on to point out that in 22 the case of B&W, they close a feedwater isolation valve as 23 well as tripping the pumps. And then in the case of
| |
| () 24 Combustion, they just isolate the main feedwater flow on high 25 signal, and I believe it never did tell me whether they, how i
| |
| HERITAGE REPORTING CORPORATION -- (202)628-4888 L
| |
| | |
| i I
| |
| 167 1 they did that. I don't know for-sure.
| |
| 2 MR. BAER: In the CE plant, just have control 3 system. They don't have protection system.
| |
| 4 MR. SZUKIEWICZ: . They have trips to trip the 5 turbine. Basically you could use'those sensors, develop a 6 logic to trip the feedwater system.
| |
| 7 MR. MICHELSON: The resolution which it said boiling 8 water reactors are okay as long as you do make sure that your 9 one train--but you did not, you did not require that the 10 boilers do any more than trip the turbine, trip the feedwater 11 turbine? You did not require them to close their isolation 12 valves as well?
| |
| t
| |
| () 13 Now in the case of pressurized water, I don't know 14 if it was a requirement or not, but in the past, the practice 15 has been, for Westinghouse and for B&W was to both trip the 16 feedwater pump and close the isolation valve. Now if I had to 17 worry about reactors, and the effect of not getting this 18 feedwater shut off as well as I would like, I think I would i 19 worry a lot more about boilers than I would about pressurized 20 water reactors.
| |
| 21 Overfilling that and potentially large break LOCA is 22 what I worry about if I was, didn't cause a large break to 23 occur. A large break, a large break on the secondary side of
| |
| {} 24 the steam generator is a lot less concern than a large break 25 on the boiler on the primarily side, so why is the logic that l
| |
| HERITAGE REPORTING CORPORATION -- (202)628-4888
| |
| | |
| 168 !
| |
| 1 says that Westinghouse and CE are, or B&W for whatever reason I
| |
| /~T
| |
| %I 2 think that it is important and not alone trip the turbine but I
| |
| 3 also close the valve, why is, what logic was established there 4 that doesn't seem to pertain to boilers?
| |
| 5 CHAIRMAN EBERSOLE: Before you answer the question, 6 I want to tell you a week or two after we met with you last 7 time Nine Mile of. course you know filled the building, ran it 8 on over, and it didn't fall down. Maybe that's the answer.
| |
| ! 9 MR. MICHELSON: That is not the answer. That is-one 10 incident. They were lucky.
| |
| 11 CHAIRMAN EBERSOLE: But anyway, it did, and it could 12 have been expected to because of transient that lowered
| |
| () 13 pressure and let booster pumps pump the water.in.
| |
| 14 MR. MICHELSON: The same thing has been done on 15 pressurized water reactors. Westinghouse on the BWR think it 16 is important to do both. GE apparently didn't think it was 17 important to do it. My intuition says if I am ever going to 18 do it better--my question to the staff is why don't you 19 require them to do, close a feedwater valve as we trip the 20 feedwater turbine on the boiler?
| |
| 2 '. MR. SZUKIEWICZ: On the boiler you also need, on low 22 power operation, low pressure operation, you-need the 23 condensate booster pumps, and if you--
| |
| (~ 24 MR. MICHELSON: I think you are missing my point. I V) 25 am not worried. That's another next stage I am going to worry HERITAGE REPORTING CORPORATION -- (202)628-4888
| |
| | |
| 169 1 about. I was trying to get the high-level one first. When (G
| |
| l 2 you normally are full pressure and so forth and you start-3 going on an overfill, why don't you think it is important to 4 close the valve as well as trip?
| |
| 5 MR. BAER: Isn't the answer when you looked 6 at--didn't look at this question I don't recall specifically, 7 but when you looked at multiple channels, being a single 8 failure proof system, the reg analysis wouldn't support the 9 extra cost of a single failure.
| |
| 10 MR. MICHELSON: Westinghouse does more than they 11 need to do I think because Westinghouse is a better system on 12 the boilers as far as interruption and they interpreted it not D1
| |
| ( ,/ 13 alone the turbine, but to close the feedwater valve as well.
| |
| 14 MR, SZUKIEWICZ: Most of that system on Westinghouse 15 is also classified as safety grade.
| |
| 16 MR. MICHELSON: Not on Westinghouse necessarily, but 17 it is, yes, and that was just a further argument on why they 18 could have got by with just turbine trip.
| |
| 19 MR. SZUKIEWICZ: There was a number of 20 considerations. One was Bob mentioned the cost aspects.
| |
| 21 MR. MICHELSON: What is the cost aspect of sending a 22 signal to the feedwater control valve to close system as well 23 as to the turbine feedwater turbine to trip?
| |
| (} 24 MR. SZUKIEWICZ: Again, we felt that we didn't want 25 to be isolating the flow through the booster pumps of low--
| |
| HERITAGE REPORTING CORPORATION -- (202)628-4888
| |
| | |
| l 170 ,
| |
| l 1 MR. MICHELSON: I don't know that was ever--that l
| |
| I ('"dh 2 only pertains if you can get the reactor pressure down and now j
| |
| 3 I have got a further proulem when I get the reactor pressure 4 down I do that. I did it at Nine Mile. I kind of worry about 5 overfilling and whatever as being a more serious problem than 6 the lack of flow. We never did it on those pumps for flow to 7 begin with, and 1 think that they could be significant hazard, 8 and we can recover them. This is only, this is, we are only 9 talking about the initiating, initiating system to do it.
| |
| 10 Doesn't say you can't go back and retrieve the function. It 11 just says if you fall anleep on the job, it will be done for 12 you. That's all it says. ;
| |
| () 13 MR. SZUKIEWICZ: The other aspect of this 14 consideration was also operating experience. We found out :
| |
| 15 that with even a single channel, in just tripping the !
| |
| 16 feedwater systems, the. designs that had that was there was no 17 indication ever of overfill conditions, as a matter of fact.
| |
| i 18 MR. MICHELSON: We have overfilled with automatic 19 trip and it turns out it wasn't an operation at the moment 20 because it wasn't safety grade. It didn't have to be.
| |
| I 21 MR. SZUKIEWICZ: There were, from our LERs, there 22 are three events and these were in '72, '73, and one I think 23 was Nine Mile Point where--
| |
| (} 24 MR. MICHELSON: Nine Mile Point is very recent.
| |
| 1 25 MR. SZUKIEWICZ: There was an old one. Subsequent !
| |
| HERITAGE REPORTING CORPORATION -- (202)628-4888
| |
| | |
| 171 1 to that, they stuck in or they incorporated a, just a single 2 level trip, and they did not have ?.ny problems with overfill, i
| |
| 3 and just recently, they had an overfill-problem via the 4 condensate system. Now we have looked into that--
| |
| I 5 HR. MICHELSON: Because they did not have automatic 6 trip on high level.
| |
| 7 MR. SZUKIEWICZ: That's right, and we looked at it 8 initially, and we looked at it, we identified that that was ;
| |
| 9 one of the mechanisms of overfill, that we felt at the time 10 that because of new operating experience, we felt that and we il estimated it to be a low probability event. 2 12 Subsequently, in fact in the last year, there were i
| |
| () 13 two such events, one on WTPS and the other one was Nine Mile, 14 and as a result of that, although we did not provide any 15 requirements for it, because there are safety concerns about i
| |
| 16 tripping the condensate booster pumps, we have incorporated in )
| |
| 17 the generic letter a precaution that they should evaluate 18 their operating procedures in the event of an overfill at low );
| |
| 19 pressure via the condensate system. It is like a warning.
| |
| 20 MR. MICHELSON: I guess you are saying they r7 ally 21 don't need it but they have got it anyway?
| |
| 22 HR. ANDERSON: Yes, that's right.
| |
| 23 MR. BAER: I would say it a little different, tSat
| |
| () 24 if they didn't have it, we would have a lot of difficulty 25 justifying a requirement.
| |
| HERITAGE REPORTING CORPORATION -- (202)628-4888
| |
| | |
| 172 ;
| |
| 1 MR. MICHELSON: Yes. Let me get a clarification on l 2 one more thing. In the case of the boiling water reactor, 3 your requirement is they provide an automatic reactor vessel i 4 overfill protection. That was the wording.
| |
| 5 In the case of Combustion Engineering, you said 6 provided automatic main feedwater isolation system. Now why 7 the difference in wording? Combustion is the only one worded 8 that way.
| |
| 9 Did you mean there a true isolation system.like 10 closing the feedwater valve? And if so, why is it worded that
| |
| ~
| |
| 11 way for Combustion and not for boilers, which is far more 12 serious? !
| |
| () 13 MR. ANDERSON: I think it means the sameithing. t i 14 MR. BAER: I think that is a gotcha.
| |
| 15 MR. SZUKIEWICZ: It is a very good point.
| |
| 4 16 MR. MICHELSON: That is the way it is worded only in )
| |
| 17 that case. I was also trying to figure out whether it, the i 18 other cases you talk about automatic vessel overfill 19 protection and kept trying to say that you really mean l l
| |
| I 20 isolation. In the case of Combustion, you said it, only in I 1
| |
| 1 21 that case, and you didn't really mean that there are any 22 difference.
| |
| 23 MR. EBERSOLE: All this enthusiastic conversation l j l
| |
| () 24 has caused me to overrun the lunch hour. I apologize for l
| |
| 25 that, but let's cut it here since you are not going to get l l
| |
| HERITAGE REPORTING CORPORATION -- (202)628-4888 ;
| |
| I
| |
| | |
| 173 1 through immediately.
| |
| 2 MR. SZUKIEWICZ: I am all through.
| |
| 3 CHAIRMAN EBERSOLE: You are through? Great! We 4 will initiate even betteri Come back at ten to two then.
| |
| 5 (Whereupon, at 12:50 p.m. the meeting was recessed, 6 to reconvene at 1:50 p.m. the same day.)
| |
| 7 l
| |
| 8 l
| |
| l 9 l 10 l 11 l
| |
| 12 h 13 14 15 ll j 16 1 i 17 r
| |
| 18
| |
| , 19 '
| |
| l 20
| |
| , 21 1
| |
| 22 23 .
| |
| Ih i
| |
| 25 '
| |
| HERITAGE REPORTING CORPORATION -- (202)628-4888
| |
| | |
| 174 1 AFIERHOON SESS ION 1:50 p.m. <
| |
| 2 CHAIRMAN EBERSOLE: We will continue the meeting.
| |
| 3 Okay.
| |
| 4 HR. THATCHER: Okay. I am Dale Thatcher with the 5 Engineering and Issues Branch in Research. I am the~ task 6 manager for USI A-17, and I also have responsibility for 7 another program that is a follow-on to this and a number of 8 other issues which I will talk to after I finish with A-17. 1 9 I am really I guess just trying to give a parallel i
| |
| 10 on A-17. This isn't really the subcommittee that deals with 11 A-17, but I guess I am trying to give a parallel as far as 12 task action plan goes, and what we did on A-17, and you can
| |
| () 13 compare it to what they did on A-47, because I know in both of j 14 these issues, you have some scope problems with what we have 15 done versus what you think we should have done or whatever.
| |
| 16 A-17 is a little bit different in the sense that I 17 think we took, I think we took a lot of steps to try to l l
| |
| 18 explain the scope back in the 1983, '84 timeframe, and the )
| |
| 1 1
| |
| 19 reason for that was the previous work on A-17 we thought 20 suffered from a lack of definition, so when I got involved in 21 1983, we decided that we needed a major revision to the task j 22 action plan, and in that revision process, we set up a 23 definitions and scope, but we also--and in that process, we l /~T 24 met with the ACRS.
| |
| V 25 The original task action plan for A-17 was published HERITAGE REPORTING CORPORATION -- (202)628-4888
| |
| | |
| 175' 1 in NUREG 0649 along with a bunch of other USIs. That was 2 revision zero, and that was published I think in 1980. I am 3 not sure--1980, and this task action plan that I am talking 4 about here, that was the revised one, was published in 1984 in 5 NUREG 0649, Revision 1, again along with a number of other 6 task action plans.
| |
| 7 Now some of the definitions presented in that task 8 action plan were we tried to define what we thought a system 9 interaction was, and then we added a slight little twist to 10 what an adverse system interaction was, and we did that in 11 terms of undesirable results, and we also kept I guess 12 basically the same classification system of systems
| |
| ( 13 interaction that had been started before we got involved, that 14 is, functionally coupled interactions, spatially coupled 15 interactions, and induced human intervention coupled 16 interactions was the third one.
| |
| 17 Also in the task action plan, we took a step to try l l
| |
| 18 to explain or describe some of the things that we were not 19 covering, and again, it goes back to the previous work. I 20 don't say necessarily that task action plan because the 21 previous task action plan I don't think was clear on what was 22 in or what was out, and that was part of the problem, so we 1 23 thought we had to take some steps to der.cribe what was not in
| |
| () 24 the A-17 program, and in that task action plan, we discussed l
| |
| 25 soi.;ething we called common mode f ailure.
| |
| I HERITAGE REPORTING CORPORATION -- (202)628-4888 ;
| |
| | |
| 176 ,
| |
| 1 I don't know. We have since stopped using that term
| |
| . 2 because that causes quite a bit of confusion, but we described 3 sets of failures that occurred due to the common maintenance 4 problems or common testing errors or even manufacturing 5 problems, and in that group we also talked about external 6 events. Now I will go into a little bit more clarification, 7 but on the next slide, what I wanted to put out was in that 8 task action plan, we not only described in words what the 9 scope was, and also what the task was, but we also tried to 10 diagram that, and that is what my next two slides are on and I 11 think mostly you will recognize that diagram. It is Figure 1 12 in the task action plan.
| |
| O 13 <stiae) 14 MR. THATCHER: And basically what v' were trying to 15 do, trying to say is that there is, there is this concern with 16 let's just call it significant events, and some of those 17 significant events are due to something called, generally 18 called common cause failures, and I think there is somewhat of 19 a Webster's Dictionary type understanding of what we mean when
| |
| * 20 we say that, but then we felt that, as I said on the previous L
| |
| 21 slide, there were things under that general heading of common 22 cause failures or common cause failure events that were in our 23 opinion in the realm of systems interaction, and that things ;
| |
| 24 that were not, and as you can see on this diagram, we tried to
| |
| [}
| |
| 25 say on the right-hand side what adverse systems interactions HERITAGE REPORTING CORPORATION -- (202)628-4888
| |
| | |
| . - =.
| |
| t 177 1 types of things we were considering in the attempt in our 2 process of revolution, and some of the other things that we 3 didn't really think were part of systems interaction. ;
| |
| 4 I will point out that as far as external events go, 5 in the task action plan, we clearly indicate that we are !
| |
| 6 following one failure, and whereoit goes. We are mostly ;
| |
| 7 concerned with systems, how they interact and subtle I
| |
| 8 interaction between systems. We state pretty clearly that we 9 are not interested in when you lose dedicated or when you lose 10 DC power, system A, that you will probably lose dedicated 11 generator A, battery A, and all the other things along with 12 train A, and to us, that wasn't what we should be working on
| |
| () 13 in our opinion. That is a common understood propagation of 14 failures. We were looking at those things, we used the word 15 hidden. We used the word subtle--the kind of links, coupling, 16 whatever you want to call it, that kind of sneak in and get 17 you.
| |
| i 18 Now as I said, I was going to try to relate that to 19 external events. We were not mechanistic in how that failure I
| |
| ^
| |
| \
| |
| 20 started. So one could, one could say thet a pipe break 21 individually one at a time, could be initiated by some kind of 22 external event. That's the link-up with external events, but 23 the problem then becomes if you want to go beyond that and
| |
| {} 24 talk about multiple simultaneous failures and propagations 25 occurring during a, something like a seismic event, that was i
| |
| HERITAGE REPORTING CORPORATION -- (202)628-4888
| |
| | |
| 178 1 not within the scope of A-17.
| |
| 2 MR. MICHELSON: Let me be sure I understand. Your 3 left-hand other control cause, other common cause rather, was 4 not considered to be in the scope of A-17?
| |
| 5 MR. THATCHER: That is correct.
| |
| 6 MR. MICHELSON: Even though they might have been 7 induced by wind, earthquake, fire, whatever? The reason that 8 they weren't in A-17 is because?
| |
| 9 MR. THATCHER: Well-- ,
| |
| i 10 MR. MICHELSON: Are you going to get to that later?
| |
| 11 MR. THATCHER: I really wasn't going to talk about 12 that.
| |
| () 13 MR. MICHELSON: Why don't you?
| |
| 14 MR. THATCHER: It comes-in when we get talking about .
| |
| 15 the next program, but let me say that we, we did discuss not i i
| |
| 16 so much in the task action plan, but in our resolution )
| |
| i 17 package, in our technical NUREGs, our feeling that, for 18 example, identical errors, inadequate safety systems due to )
| |
| i 19 maintenance problems, we feel--
| |
| 20 MR. MICHELSON: Let's just talk about internal 21 events. That's my only concern here, and you know, why, why ;
| |
| )
| |
| 22 do we say that fire, you know, you have the argument I believe !
| |
| 23 that you are going to tell me, and I will just tell you l l
| |
| () 24 anyway, is that for instance, when you did all the enormous 25 efforts on Appendix R that took care of system interaction as l
| |
| HERITAGE REPORTING CORPORATION -- (202)628-4888
| |
| ]
| |
| | |
| 179 1 well as it was related to the fire, and we did all the werk on 2 pipe breaks that took care of system interactions as it 3 related to pipe break. I thought that was the argument that 4 has always been the traditional answer. There is a new one?
| |
| 5 MR. ANDERSON: In addition to that--
| |
| 6 MR. MICHELSON: That wasn't even a good answsr. I 7 am just saying I think that is your answer. ;
| |
| 8 MR. ANDERSON: I thought you were accepting that 9 answer!
| |
| 10 MR. MICHELSON: That's a poor position to begin 11 with. May have been there are other arguments as well, but 12 that's a totally fallacious argument because Appendix R did
| |
| () 13 not take care of system interaction effects due to fire in one 14 zone propagating to other zones. It wasn't even required to 15 be looked at, so because it wasn't required doesn't mean it 16 was taken care of. It just means it was ignored.
| |
| 17 MR. ANDERSON: But what Appendix R I think was 1
| |
| 18 supposed to do was to provide some checks so that fire 19 wouldn't propagate from one zone to the other.
| |
| j 20 MR. MICHELSON: They didn't provide checks to keep 21 heat and smoke from propagating. Yes, fire, I don't disagree 22 that the 20-foot zone sprinklers and so forth might keep the 23 fire from getting there, but the heat and smoke will get there
| |
| (} 24 anyway, and we are only talking 170 degree kind of heat, and [
| |
| ] 25 that sets off the fire protection on the other train and wets l
| |
| i HERITAGE REPORTING CORPORATION -- (202)628-4888
| |
| | |
| 180 1 it down and it quits and we know equipment wetted down quits
| |
| ( 2 because we have got plenty of LERs already showing how fire 3 protection makes things quit.
| |
| 4 MR. ANDERSON: If that's an oversight, it is an 5 oversight of the fire protection and not A-17.
| |
| 6 MR. MICHELSON: When I go to the fire protection !
| |
| 7 people, they say A-17 is going to take care of those kind of l 8 system interaction.
| |
| 9 MR. ANDERSON: They haven't told us that.
| |
| 10 MR. MICHELSON: We keep going in a circle.
| |
| 11 MR. BAER: When the scope was changed, then Mr.
| |
| 12 Spiess keeps telling me, Vic Stello himself, the reduced
| |
| () 13 scope--in fact, he was down here for a subcommittee meeting a 14 month ago or so and pointed out that before the task action 15 plan attempted to narrow this down, I think then the story is 16 that he went to ten different people who he thought were {
| |
| r 17 pretty knowledgeable and said read this scope and tell me what !
| |
| 1 18 it means, come back individually, and he said he got ten [
| |
| f' 19 different answers, and I think there was at least a pragmatic 20 decision that the scope would narrow to those things that we t 21 thought we could at least handle. ,
| |
| 22 MR. MICHELSON: Now we have some residual questions 23 left. My question is how are we proposing to handle the
| |
| (
| |
| 1 24 residual? Are you going to tell us today? Is it going to be 1 25 a new issue? l 1
| |
| HERITAGE REPORTING CORPORATION -- (202)628-4888
| |
| | |
| 181 1 MR. BAER: That's the last topic, w/ 2 MR. ANDERSON: There was another consideration in 3 the internal phenomena that is over on the left-hand block.
| |
| 4 We didn't, for instance, we weren't questioning the seismic 5 design. They have, we think that's somebody else's concern 6 that things are designed adequately to withstand seismic, and 7 so we didn't want to get into the problem in A-17 of~whether 8 or not equipment was going to fail due to seismic.
| |
| 9 Now if now there is a'little--
| |
| 10 MR. MICHELSON: Other people aren't looking at 11 non-safety equipment as it relates to seismic except from the 12 viewpoint of physically falling on a piece of safety-related
| |
| () 13 equipment. That's as far as their interaction went, but I am 14 saying electrically they are going to interact through l
| |
| 15 pneumatic systems like compressed air.
| |
| 16 MR. ANDERSON: If they do, and it fits the l
| |
| l 17 definition of adverse systems interaction, we look at the l
| |
| 18 subtle interaction and systems interaction that may result l 19 from failure, but we are not going to question whether it was l
| |
| \ l 20 the seismic ever.t that caused it.
| |
| 21 MR. MICHELSON: How are you prompted to look unless i 22 you start thinking about seismic effects on non-safety j 23 systems, for instance, as an example? How are you going to be 24 prompted to look?
| |
| {
| |
| 25 MR. ANDERSON: We are prompted to look by--
| |
| l l
| |
| HERITAGE REPORTING CORPORATION -- (202)628-4888
| |
| | |
| i 182 ,
| |
| 1 MR. MICHELSON: Your scope has to say I am going to 2 ''S k' / 2 look into this and if I find one and it is bad enough, I will 3 do something about it, but I don't find in your scope that you 4 are even going to look because you specifically are excluding 5 external events I believe.
| |
| 6 MR. ANDERSON: No, I don't think that is true. I 7 think we are including seismic events. We are including ;
| |
| 8 flooding.
| |
| 9 MR. MICHELSON: Maybe I misunderstood the chart up l
| |
| 10 there.
| |
| 11 MR. ANDERSON: Interaction induced by that--
| |
| r 12 HR. BAER: I think it is one of the ones at the
| |
| () 13 time; it isn't the multiple initiating events.
| |
| 14 MR. MICHELSON: The seismic event will cause 15 whatever it can cause, so it is about the same time, 30 16 seconds more or less. That has to be the event then that you 17 look at as that set of whatever caused it.
| |
| 18 MR. ANDERSON: What we are principally concerned 19 with in A-17 is whether or not we are able to protect the '
| |
| 20 equipment you need to get the plant into a safe condition from 21 these events, and to do that you don't have to go out and
| |
| * 22 postulate they are going to be gross seismic failures in the ;
| |
| 23 plant other than that would directly affect or indirectly rs 24 affect the function of the equipment that you need to keep the tj 25 plant safe, i
| |
| l I
| |
| 2 I
| |
| HERITAGE REPORTING CORPORATION -- (202)628-4888
| |
| (
| |
| | |
| 183 1 MR. MICHELSON: You need to worry about only that !
| |
| f !U
| |
| (/ 2 safe shutdown system and whatever the earthquake could cause 3 that might interfere with its operations, and I think that
| |
| ]
| |
| 4 includes everything on site. )
| |
| I 5 MR. MICHELSON: I think it has to. l 6 MR. ANDERSON: We don't think it--
| |
| 7 MR. MICHELSON: Logic can reduce the set down pretty 8 quickly. I am assuming you have done that, but I just kind of 9 think you have arbitrarily reduced some of the set.
| |
| 10 HR. ANDERSON: I don't think it has been that 11 arbitrary. I think we have done it in a pretty systematic 12 way.
| |
| () 13 HR. MICHELSON: Did you include the fire protection 14 systems looking at it whether they are actuated by 15 earthquakes? If you have, I would like to read about it 16 because I have been harping on it so long now it is a broken 17 record.
| |
| 18 MR. ANDERSON: I guess I can't speak for how well 19 the fire protection rule is implemented.
| |
| 20 HR. MICHELSON: Decause they tell me you are doing 21 it. They have said no, we are not doing it. That's, A-17 is 22 going to handle that. So we have been very patient and 23 waiting for A-17, but we are tired now, because you can't pass 24 the buck to anybody else. They have all passed it to you.
| |
| 25 You can't pass it back again because they have resolved their HERITAGE REPORTING CORPORATION -- (202)628-4888
| |
| | |
| 184 1 issues. They are done, and now you are sitting there. The ,
| |
| O' 2 final person holding the bag is you I believe. You have got 3 all the problems of the plant in this bag, all the ones that 4 you keep passing around, and all ending up in A-47. A-47 is a '
| |
| 5 subset of A-17. A-17 is where the buck stops.
| |
| 6 MR. EBERSOLE: It is where life is really. ;
| |
| 7 HR. MICHELSON: We are going to have to sit here on 8 it ad infinitum and argue, but you can't pass it back to say 9 this person looked and that person looked at it unless you can 10 show in the record that indeed they had.
| |
| i 11 MR. ANDERSON: Well, you know, we do have, we have a :
| |
| i 12 close tie with A-46, and I think we have a fairly close . r ;
| |
| () 13 we are developing a tie under A-17 with the reviews.
| |
| t 14 MR. MICHELSON: Let's stop at A-46. You know what ;
| |
| 15 happened when I raised the system interaction issue. I raised 16 the issue of okay. you are taking care of the tank that falls :
| |
| i 17 over as far as the hitting equipment, but you are not even 18 worrying about the water running across the floor to the
| |
| ]
| |
| 19 inverter, and you said no, we aren't going to worry about 20 that, so you haven't taken care of A-46.
| |
| l 21 MR. BAER: We heard you, and A-17 has been modified. l l
| |
| 22 MR. MICHELSON: We will take care of it--good.
| |
| 23 That's the kind of thing I want to see, and I am going to read l
| |
| l
| |
| ( 24 about it somewhere. !
| |
| 25 CHAIRMAN EBERSOLE: While we are talking about that l
| |
| l HERITAGE REPORTING CORPORATION -- (202)628-4888
| |
| | |
| 185 1 kind of thing, let me brine--historicelly we used to have such 2 reference, in the rate of AC power, we made the daily mistake, 3 and I did, too, we put the fire protection system operative by 4 electric pumps, great big pumps. We were always going to have 5 power. We didn't put dedicated plants in, which we should 6 have done.
| |
| 7 Now I am hearing system interactive stories now that 8 bother me because they put in marginal dedicated capacity, and 9 they have got these big electric pumps ready to stop fire.
| |
| 10 Well, NRC always said when you have LOCAs, you are not going
| |
| , 11 to have fires, and I think vice-versa.
| |
| 12 Unfortunately, the trigger systems for starting the
| |
| () 13 pumps is high temperature someplace to get them going. If you 14 are going to have a LOCA in a containment, you are going to 15 have high temperature so far as I know. Now there are going 16 to be trip systems in the containment that says for God's 17 sake, protect the cables that are on fire when really it is a 18 LOCA, so you are already overloading the diesels with 19 attempting to stagger the loads to get them going, and here 20 all the ones on a scheduled basis, the great big fire pump 21 starts up and is collapsing the diesels. I think this is a 22 real problem existing today.
| |
| 23 Do you know any more about this?
| |
| 24 MR. MICHELSON: Don't know. It is a problem, it is 25 a problem if the loads are big enough, and they are in the HERITAGE REPORTING CORPORATION -- (202)628-4888
| |
| | |
| 186 1 right part of the sequence. At least it is something we have 2 to--
| |
| 3 CHAIRMAN EBERSOLE: This causes me to jump instantly 4 to the thesis what a hell of a mistake that was, go back to 5 diesels for pumping fire water.
| |
| 6 MR. THATCHER: As far as I know, most plants have 7 dedicated driven pumps.
| |
| 8 CHAIRMAN EBERSOLE: Electric, i
| |
| 9 MR. THATCHER: Maybe there are a few plants that l
| |
| 10 have them. I agree. l 1
| |
| 1 11 MR. MICHELSON: Again, it is symptomatic of the kind '
| |
| 12 of problem that you get into if you aren't extremely careful
| |
| () 13 on a plant-specific basis and look, and I thought that 14 somebody was going to do the 1 Toking and maybe you, maybe you 15 know your resolution doesn't necessarily require this kind of 16 looking, and I--
| |
| 17 HR. BAER: That's right. As I say again, we are not 18 set up or budgeted for trying to look at implementation 19 problems across the board on plants. I would think-- !
| |
| t 20 MR. MICHELSON: What is wrong with the utility doing 21 it? i 22 MR. THATCHER: I am sure the utility would tell you 1
| |
| 23 they already did it. They may have goofed up, but I am sure l
| |
| 24 they would tell you they did it.
| |
| } .
| |
| 25 MR. SZUKIEWICZ: They actually have done and HERITAGE REPORTING CORPORATION -- (202)628-4888
| |
| | |
| N 187
| |
| [
| |
| 1 identified it during the review process for Appendix R review. ;
| |
| 2 That is where they identified it, so the. system of checking to {
| |
| 3 see if everything is okay is working.
| |
| 4 MR. MICHELSON: What you are saying is that [
| |
| ?
| |
| 5 everybody has looked at--Sequoyah ir another place they had >
| |
| 6 the problem.
| |
| 7 MR. SZUKIEWICZ: No.
| |
| 8 MR. MICHELSON: I haven't seen any other LERs. I
| |
| ; 9 read them. I admit that I read some of them more frequently.
| |
| J 10 MR. BAER: There was an information notice not on ,
| |
| i 11 the specific issue of fire protection pumps, but on just the 12 growing safety loads over the life of the plant and how that !
| |
| () 13 may be affecting diesels. !
| |
| 14 MR. MICHELSON: There is a, quite a few non-safety 15 loads on dedicated buses, ought to be desirable to bring in 16 much later after an accident, reliable power source, upon the i
| |
| 17 dedicated bus, and they are chiller systems in certain areas 18 of the building and a number of--and ventilation--a number of l
| |
| 19 these sorts of things which are, the way the board normally 20 works is when you get the signal, you shut everything on the j 21 board and the sequencer brings back on selectively the things 22 at once, but the sequencer does not prevent somebody else from J
| |
| ~
| |
| 23 bringing on other things or some spurious action. It doesn't
| |
| ! 24 prevent that. It only brings on what is needed in the right ;
| |
| 25 sequence and hopefully nobody is going to push buttons or 1
| |
| E 2 HERITAGE REPORTING CORPORATION -- (202)628-4888
| |
| | |
| 188 i i hopeful?.y whatever the plant disturbance isn't going to cause !
| |
| 2 other things to start.
| |
| 3 CHAIRMAN EBERSOLE: Not coincidentally, for heaven's 4 sake.
| |
| 5 MR. MICHELSON: That's the problem is coming in at j
| |
| 6 the wrong time.
| |
| 1 I 7 CHAIRMAN EBERSOLE: And I think there is another 8 system interactive aspect. You are getting a lot of your ;
| |
| 1 9 information from the operators and owners from the licensing 10 section. That's the Madison Avenue of the utilities.
| |
| 11 If you go down in the trenches, you are going to get 12 a different set of real information. I think you better go
| |
| () 13 walk the trenches and look in that once in a while.
| |
| 14 MR. THATCHER: I don't know. Boss, can I go walk l 15 the trenches? I don't know.
| |
| 16 MR. MICHELSON: You have to not just walk the q
| |
| 17 trenches. You are going to have to open up the black box.
| |
| 18 There are a lot more black boxes in plants than you realize.
| |
| 19 A lot of governor control systems and so forth are treated by 1
| |
| 1 20 the utility as black boxes. They have all their wiring 21 through them, but the internals and the understanding of the 22 internals and their vulnerability doesn't always exist even 23 with the licensee. It exists generally with the guy who
| |
| {} 24 builds it, but he may not even know the harsh environment that I 25 you might want to expose this thing to and how it might behave
| |
| 'l HERITAGE REPORTING CORPORATION -- (202)628-4888
| |
| | |
| 189 1 under those conditions.
| |
| ( 2 MR. BAER: I understand your concern, but as I said 3 bafore, I am not staffed nor budgeted to do plant-specific i
| |
| 4 implementation.
| |
| .5 MR. MICHELSON: We have residual that I feel must be 6 treated and maybe--
| |
| 7 MR. BAER: We will talk about the residual, but it 8 won't be plant-specific implementation, either. j i
| |
| 9 MR. MICHELSON: That residual has got to be tui ;
| |
| ; l 10 integral part of resolution of the issue. If it isn't, then I 11 wouldn't buy it.
| |
| l 12 CHAIRMAN EBERSOLE: The best you can do, if you I
| |
| () 13 can't do these things, I think it is incumbent upon you to say l 14 explicitly and forcefully I can't do them and make that a part 15 of the record rather than just implying that I have done a lot 16 more than I have.
| |
| 17 HR. BAER: There is no intent to imply that we are
| |
| ; 18 doing anything more than looking at adequacy of requirements, ,
| |
| 1- 19 not adequacy of implementation.
| |
| 20 CHAIRMAN EBERSOLE: When we boiled out the very
| |
| , 21 resolution of this control system business, the reader would !
| |
| l 22 gather from the surveys that you presented him that you had l
| |
| 23 really gotten into it. We only learned that you had a lot l I
| |
| 24 buried down deep somewhere and apparently have done it which I j 25 don't know about yet, but will, and I am quite certain the I HERITAGE REPORTING CORPORATION -- (202)628-4888
| |
| | |
| 190
| |
| - 1 technical reader will think well, you picked up everything in 2 the closed system there because'you closed out on the control 3 system interactive effects.
| |
| 4 Anywa', Let's go on.
| |
| * 5 MR. THATCHER: This is just an outline of the 6 proposed resolution of A-17. The, this was presented to the 2
| |
| 7 Committee about, it has been over a year ago now. Basically .
| |
| 8 we are provided a generic letter, basically two parts, one 9 which provides a certain amount of information on some of the 10 lessons learned from our studies on systems interaction.
| |
| I 11 The other is a request for verification of flooding ,
| |
| 12 evaluation. That's donc under, to be done under 5054F.
| |
| () 13 CHAIRMAN EBERSOLE: In that context, in flooding, I 14 wish you would sort out the kinds of flooding that occur.
| |
| 15 There is the kind that comes up so slow you can do lots of -
| |
| a 16 things before it gets there, then the other kind that gets i
| |
| 1 17 dumped on top of it so fact you haven't got a ghost of a 18 chance to do anything. The second kind may not get as high as 4
| |
| 19 the first kind, but it can be a, do a lot more. damage.
| |
| , l J
| |
| 20 Do you follow me? There is a rate-- l 21 MR. THATCHER: I thought we discussed that at the :
| |
| 22 Committee meeting and we have flooding, we have water j
| |
| i 23 intrusion, we have moisture-- !
| |
| 5 J 24 CHAIRMAN EBERSOLE: I am saying there is--
| |
| 4 25 MR. THATCHER: It is all in the letter. l i
| |
| l !
| |
| HERITAGE REPORTING CORPORATION -- (202)628-4888
| |
| | |
| . . _ ~ .
| |
| 191 1 MR. EBERSOLE: Two general kinds of floods.
| |
| 2 MR. THATCHER: I personally think there is more than 3 two.
| |
| 4 CHAIRMAN EBERSOLE: May be a dozen, but_I know of-5 two at least.
| |
| 6 MR. BAER: This is really, this is not what you are 7 breaking it down into. We are only dealing with internal 8 sources of water. We are not dealing with the rain and the i l
| |
| l 9 external flooding.
| |
| 10 CHAIRMAN EBERSOLE: That is what I understood, 11 understand that will probably be quite fast.
| |
| l 12 MR. THATCHER: Not necessarily.
| |
| () 13 CHAIRMAN EBERSOLE: Not necessarily, but it might i 14 be. The condenser neck breaks, lets a lot of water in, you ;
| |
| 15 don't turn off the motor.
| |
| 16 MR. THATCHER: Water back-up through drains can 17 happen very slowly. '
| |
| l 18 CHAIRMAN EBERSOLE: Seismic event will probably 1 i
| |
| 19 carry away.the condenser neck. Just before it went, the damn 20 DC batteries fail which serve the trip function of those 21 pumps, great big 3,000 horsepower circuit pumps. They are 22 terribly important--the ' thole housef ul.
| |
| l t
| |
| 23 MR. BAER: Off-site power still kept going, j 24 CHAIRMAN EBERSOLE: If you invoke the relative 25 vulnerability of the DC trip system, we call it the weakest HERITAGE REPORTING CORPORATION -- (202)628-4888
| |
| | |
| 192 1 system, what you have is a hot system you'can't control. Do C$ 2 you follow me? You can't trip it. You can't turn it off 3 because it requires a battery to clear it.
| |
| 4 MR. BAER: I understand what you are saying.
| |
| 5 CHAIRMAN EBERSOLE: That can well be the first thing 6 that fell on the floor. Okay.
| |
| 7 MR. THATCHER: We acknowledte the relationship that 8 was just discussed a little while ago with USI A-46. The 9 basic idea is that A-46 is looking at that set of safe 10 shutdown equipment and in that process, will look at some 11 seismic systems interactions.
| |
| 12 We are providing a certain amount of information to
| |
| () 13 GI 128. A-17 identified some power supply concerns which we 14 thought were best dealt with in an ongoing generic issue which 15 is called Generic Issue 128 which deals with the plant DC 16 battery system, and the vital 120 volts AC system.
| |
| 17 We are also providing information on systems 18 interaction for use in the review of probabalistic risk 19 assessments.
| |
| 20 We are also in the last bullet developing other 21 concerns for separate treatment under a separate program 22 called multiple system responses. I think in general you will 23 see that we want to get on with A-17, what it has found and 24 what it is trying to do, and the only way we can see doing 25 that and keeping any kind of agreement going is to develop HERITAGE REPORTING CORPORATIOli -- (202)628-4888
| |
| | |
| 193 1 another program to look at some of these' concerns that are in
| |
| /~'T
| |
| \/ 2 the guns if you want to call it that. I have some more slides 3 on that, but I did want you to know that we did eliminate the 4 commitment to develop a regulatory guide'for future plants on 5 systems interaction.
| |
| 6 Basically we got a lot of comments on our package 7 that the standard review plan covers kinds of systems 8 interactions.
| |
| 9 CHAIRMAN EBERSOLE: I have heard that, you know, and 10 it is just standard old story all the time. You read standard 11 review plan, you go to an AE, go to the old utility, and they 12 will tell you oh, in our individual functional channels of
| |
| () 13 work, we tell the boys to go out and be sure they won't run 14 pipes into other pipes or whatever, and they look at the 15 effect of their system on other systems and vice-versa.
| |
| 16 You better believe they have a diminished interest 1
| |
| 17 in doing that in the interest of getting the work out, and it l 18 is a very low-key NG type effort. There is no integral, and I j l
| |
| 19 spoke to TVA in particular. As far as I know, there is no l 20 integral system interactive efforts to consider a handful of l
| |
| 21 systems that are cracked. We asked them to put the equivalent 22 demonstration of having done that in PRAs and that was in our i l
| |
| 23 last letter because it is the only visible evidence that you l I
| |
| 24 have done it, but it remains to be Esen whether it will be
| |
| [
| |
| 25 done and how well. I HERITAGE REPORTING. CORPORATION -- (202)628-4888 )
| |
| | |
| 194 1 MR. THATCHER: Well, that was the other side to it,
| |
| (%
| |
| \~) 2 that the basic requirement that all future plants perform a 3 PRA type analysis, we thought this was the best mechanism to 4 get at these sorts of problems.
| |
| 5 MR. EBERSOLE: It would be the way to put it on 6 record.
| |
| 7 MR. BAER: And as indicated before, it is obviously 8 only as good at the model until there is some new plants, and 9 that's way off.
| |
| 10 MR. MICHELSON: We are designing them today and we 11 are certifying them before they are ever built, so we have got 12 to talk about new plants. We can't talk about new plants as
| |
| () 13 something in the far distant future. As far as the agency is 14 concerned, it is now deciding on the safety of the plants,
| |
| (
| |
| 15 very intimately involved in that, so we can't, don't tell me 16 that they are off in the future. As far as decision-making, 17 we are doing ABWR, APWRs.
| |
| 18 MR. BAER: I talked to the utility.
| |
| 19 MR. MICHELSON: How can we certify, in all due 20 conscience, how can we certify them if we don't believe they 21 are adequately safe, and how can we do that without some 22 regulatory guidance, review plans and whatever, that deal with 23 events?
| |
| (~) 24 CHAIRMAN EBERSOLE: If we don't do that, it will be
| |
| (/
| |
| 25 like abandoning the Center for Disease Control and have the HERITAGE REPORTING CORPORATION -- (202)628-4888
| |
| | |
| 195 1 Measle Center and Smallpox Center and other--there is no
| |
| (' ' 2 integrative push, and that doesn't make sense to me. I think 3 you ought to do system integration as an individual organized 4 subset of engineers in the design group. At one time you had 5 in NRC what you called system, what was it, Division of System 6 Integration, and that just was great until you look at what is 7 going on.
| |
| 8 MR. THATCHER: That certainly didn't have some of 9 the systems interaction.
| |
| 10 CHAIRMAN EBERSOLE: Put a name on something. It was 11 just another subterfuge.
| |
| 12 Anyway, carry on.
| |
| () 13 MR. THATCHER: I didn't want to dwell on A-17. In 14 fact, I took that slide down because we are not, I guess we 1
| |
| 15 are not really here to talk about the A-17 program as much as l i
| |
| 16 we are to talk about the follow-on, the last bullet I had on 17 the other slide, and I want to give you a brief description of 18 what we are doing in this program.
| |
| 19 I think we are wrestling with a lot of concerns on 20 this particular program, and I think we have got a number from 21 the ACRS in various letters on A-46, A-17. We have tried to 22 glean some of it from the transcripts which we haven't been 23 too successful at, but we are, we are trying to focus these
| |
| ("T 24 issues, and as I say, this is just basically the power things.
| |
| V 25 I am going to talk about the program plan, the general areas HERITAGE REPORTING CORPORATION -- (202)628-4888
| |
| | |
| 196 1 of concern involving multiple system responses, the source of
| |
| ('/)
| |
| \- 2 information, some of which I just described, and just as an 3 example, breakdown of one of'the general areas, that we have 4 picked seismic. Maybe that was a good choice. Maybe it.
| |
| 5 wasn't. We will see.
| |
| 6 (Slide) 7 MR. THATCHER: As far as the program plan goes, we 8 are trying to identify concerns from sources, sources of' 9 information. As I say, I will list some of those sources, but 10 once we have identified a concern, we are going to try to, we 11 try to classify the concern and we kind of have three ways to 12 go on that. It is a possibility that we will decide something
| |
| () 13 is really covered under some other program, and then we really 14 won't do anything more. We won't attempt to do anything more 15 about it.
| |
| 16 MR. MICHELSON: It has already looked at the 17 particular issue or resolved it?
| |
| 18 MR. THATCHER: Or it is in the. process of looking at 19 it.
| |
| 20 MR. MICHELSON: Or it is in the process of doing it; 21 if it is in the process of doing it, are you going to inform 22 them?
| |
| 23 MR. BAER: Yes. I was about to say unlike what 24 apparently happened on fire protection, we will make sure that 25 we will tell them if it is an ongoing generic issue.
| |
| HERITAGE REPORTING CORPORATION -- (202)628-4888
| |
| | |
| 197 1 MR. MICHELSON: Document all of this; you will also
| |
| ('h Nl 2 indicate that if'you think it is covered somewhere else 3 already, you will indicate where it is covered?
| |
| 4 MR. BAER: Yes.
| |
| 5 MR. MICHELSON: I was just looking at this air 6 system. After all, the whole discussion this whole morning, l
| |
| 7 on what we were concerned about, and that is not alone, l l
| |
| 8 did--you looked at air for reduced pressure, but did you look 1
| |
| 9 at air for elevated pressure? It is not in here. This is all l 10 reduced pressure. "hey are looking at all the ways you might 11 break the air lines, or lose the compressor or whatever. It 12 is not in here. It simply is not there. I thought it was
| |
| () 13 there.
| |
| 14 MR. BAER: I guess I said I didn't think it was 15 there.
| |
| 16 MR. MICHELSON: Only looked at Calvert Cliffs which 17 looked like the best candidate. I looked at the pages he said 18 look on. It is not there. Now I hope that when you do this 19 one, you are going to tell me at leact which page it looks 20 like and decide whether it is really there or not. Can't just 21 tell me look in the book. At least you did give me the page 22 numbers, and it was a very fine discussion, by the way. They 23 described in detail here the control system at Calvert Cliffs 24 for maintaining air pressure, but he never dealt with what (V~)
| |
| 25 happens if it goes screwy on the high side instead of losing.
| |
| HERITAGE REPORTING CORPORATION -- (202)628-4888 )
| |
| | |
| 198 1 CHAIRMAN EBERSOLE: It is classic. The only thing
| |
| ('')\
| |
| \- 2 they have done is look at the step change to zero.
| |
| 3 MR. MICHELSON: The whole mind set is loss of air, 4 loss of power, loss of water. That's the mind set. How can 5 we lose these things, not how can we get more than we want, 6 like more feedwater than we want into a generator or more air 1
| |
| 7 pressure than we want on the compressed air system, or more i l
| |
| 8 voltage, j l
| |
| 9 CHAIRMAN EBERSOLE: More hydraulic pressure in the 1 10 excess of relief capacity.
| |
| 11 MR. SZUKIEWCIZ: Your concern is mostly with the 12 protection eystem I believe.
| |
| () 13 MR. MICHELSON: Ultimately with them and how you get 14 to them.
| |
| 15 MR. SZUKIEWICZ: As we said, in that whole scope it 16 was excluded from this.
| |
| 17 MR. MICHELSON: Wait a minute. What scope was 18 excluded from this review?
| |
| 19 MR. SZUKIEWICZ: You are looking at protection 20 systems but--looking at protection systems.
| |
| 21 MR. MICHELSON: We are looking at control systems 22 here, safety implications of control systems at Calvert Cliffs 23 1. That's what I am looking at here. I will read the exact ;
| |
| 24 title--an assessment of the safety implications of control at 25 the Calvert Cliffs 1 nuclear plant. And this is a--
| |
| HERITAGE REPORTING CORPORATION -- (202)628-4888
| |
| | |
| I i
| |
| 199 I 1 CHAIRMAN EBERSOLE: It is typical over the years.
| |
| 2 MR. MICHELSON: Control systems by all definitions, 3 that a control system on those compressors, I want to know it 4 doesn't have any safety implications.
| |
| 5 CHAIRMAN EBERSOLE: You heard--
| |
| 6 MR. MICHELSON: High air as well as low air 7 pressure, and they didn't, they look at loss of air. Did a 8 good job at looking at loss of air.
| |
| 9 CHAIRMAN EBERSOLE: You have heard my story about 10 the B-9 that fell out of the air because it had 80 volts 11 instead of 28?
| |
| 12 MR. THATCHER: I think so.
| |
| () 13 CHAIRMAN EBERSOLE: It just lost a pigtail. That 14 was in 1944. This is '88. We ain't fixed it yet.
| |
| 15 MR. THATCHER: I have got to admit I am a little bit 4 1
| |
| 16 disturbed by that air system problem. You will recall that in l
| |
| 17 the air system example you gave was a boiling water reactor.
| |
| I 18 Was it, that was the problem? l l
| |
| 19 MR. MICHELSON: Talking about Oconee. We are 20 talking about specifically today the LER was for Oconee.
| |
| 21 CHAIRMAN EBERSOLE: Spoke about earlier on the 22 solenoid valves.
| |
| 23 MR. MICHELSON: This is, we are on boiling water 24 reactors on the control system, we had two different problems.
| |
| 25 One time was overvoltage, the other time it was excess HERITAGE REPORTING CORPORATION -- (202)628-4888
| |
| | |
| 200 l 1 pressure because of the nitrogen bottles that were hung on it.
| |
| t
| |
| (~%
| |
| (_) 2 MR. BAER: As I said earlier, there is a separate 3 high priority issue on air systems, and the reason this 4 priority was raised was the point Andy was trying to make, l
| |
| 5 that people now saw some event where it affected protection 6 systems and that was what, the portion of the issue that i
| |
| 7 tipped the scales and raised the priority. ;
| |
| 8 MR. MICHELSON: The issue was by AOED in nineteen--
| |
| 9 it was primarily focusing on the most obvious, but not the, I 10 mean you didn't intend to be all encompassing. We focused on 11 the overfill of the steam generator as a result of air system 12 problems, so it has been a problem ever since then. At'least
| |
| () 13 I suspect it was a problem before that with other people.
| |
| 14 CHAIRMAN EBERSOLE: Have we have looked at 15 overvoltage on the failed AC buses?
| |
| 16 MR. THATCHER: We specifically, if we are talking 17 about GE, General Electric boiling wnter reactor, AC reactor, 18 AC portion of the reactor protection system, the answer is 19 yes.
| |
| 20 MR. MICHELSON: AC, as a matter of fact, solenoids; 21 DC system, not AC system.
| |
| 22 MR. THATCHER: The main SCRAM solenoids are an AC 23 system. Back-up SCRAM solenoids may be DC.
| |
| 24 MR. MICHELSON: These are not on the feeding side.
| |
| 25 These are on the bleeddown side.
| |
| HERITAGE REPORTING CORPORATION -- (202)628-4888
| |
| | |
| 201 1 MR. THATCHER: The SCRAM solenoids, the SCRAM r
| |
| k-)/ 2 solenoids, the SCRAM solenoids.
| |
| 3 MR. MICHELSON: I am not talking about the ones that 4 are sitting on air packs, on the nitrogen packs.
| |
| 5 MR. EBERSOLE: Supposed to be transient free because 6 the fail free system, whien is the worst name it could have, 7 it is supplied by a rotary inverter or solid state inverter.
| |
| 8 I don't know what the potential for excess voltage on it is. )
| |
| 9 MR. THATCHER: I don't know if you looked at the !
| |
| 10 A-17 package, but we had a lot of problems with the GE SCRAM 11 system. We did not come after it from the problem that they 12 had high voltage here or something there. We came after it
| |
| () 13 from a system, systemic problem that it is not really 14 failsafe.
| |
| 15 CHAIRMAN EBERSOLE: No, it isn't.
| |
| 16 MR. THATCHER: That is, you know any time you don't 17 have a failsafe direction, you can have yourself a problem.
| |
| 18 You can postulate high this, low that, up and down this, 19 whatever you want to pick, but the inherent problem is that it '
| |
| 20 is not really failsafe for all cases that one could postulate, l 1
| |
| l 21 but you have got to be careful because I will go to my
| |
| )
| |
| i 22 favorite example--you can't get there completely because bhat l
| |
| 23 about the loss of gravity? See, I got it in! !
| |
| l 24 CHAIRMAN EBERSOLE: You don't have to get that far.
| |
| O i l
| |
| 25 MR. THATCHER: Well, on the seismic event, don't you I HERITAGE REPORTING CORPORATION -- (202)628-4888
| |
| | |
| 202 1 lose gravity momentarily?
| |
| q\ / 2 MR. ANDERSON: Intermittent loss of gravity.
| |
| 3 CHAIRMAN EBERSOLE: It is supplanted by excess of 4 same.
| |
| 5 MR. THATCHER: I was going to make the point that 6 on, at least on the elec.rical side, they took a hard look at 7 what kind of problems could come through that non-safety 8 related power that was coming in there, and they put a device 9 to trip it out on undervoltage, and overvoltage. They picked 10 both directions.
| |
| 11 CHAIRMAN EBERSOLE: I am thinking the Hanford 12 incident, they spiked the direct fires which caused the rod
| |
| (') 13 being tested to be locked into electrically all the other 14 rods, which caused main SCRAM system not to work.
| |
| 15 Md. THATCHER: I guess I am not familiar with that.
| |
| 16 CHAIRMAN EBERSOLE: They.had the classic redundant 17 protection, two inverters in a series, but a spike took them 18 out in the same instance, and I expect that was fed by-the l
| |
| 19 inverter and there was a voltage transient. I can't remember 20 that far, but there was a case where the ball saved the day.
| |
| 21 We don't have them. You know they fall in the core. j 1
| |
| 22 MR. THATCHER: Well, today we have anticipated l 23 transient without SCRAM mitigative features where we trip the
| |
| ''s 24 recire pumps so we have moved, we do move in those 6irections 25 when we identify a class of problems, and a lot of times, this l
| |
| HERITAGE REPORTING CORPORATION -- (202)628-4888
| |
| | |
| 203 1 solution is now to. analyze, see how:we fell in the trap. We
| |
| \ 2 analyzed the electrical system and we fixed that. Apparently 3 they missed the air system by this general discussion, at 4 least one direction of it. I know we fixed the degrading air 5 system.
| |
| 6 MR. MICHELSON: You better' correct the record on the 7 voltage. To my knowledge, we don't provide overvoltage l 8 protection, only undervoltage and I asked Charlie if he knew 9 of any overvoltage protection en AC systems. I didn't know of 10 any.
| |
| 11 MR. THATCHER: On the General Electric SCRAM,.on the 12 General Electric SCRAM colenoids, 120 volts AC power is
| |
| () 13 supplied to all the SCRAM solenoids. It is my understanding 14 that the electrical penetration,-electrical protection-15 assemblies do protect for overvoltage.
| |
| 16 MR. WYLIE: That may be. That is not a regulation.
| |
| 17 MR. THATCHER: It is a regulation. It is a 18 requirement, and it has to be a safety-related protection 19 device.
| |
| 20 MR. MICHELSON: Maybe it got fixed after overvoltage 21 event, and I forgot which plant that occurred at several years 22 ago.
| |
| 23 MR. THATCHER: That is exactly what it is. That is 24 what--I am trying to tell you that.
| |
| 25 MR. BAER: He said that was identified deficiencies l
| |
| l HERITAGE REPORTING CORPORATION -- (202)628-4888
| |
| | |
| 204 1 in that system, and there was a requirement.
| |
| 2 MR. MICHELSON: What we are getting into again is 3 the same mode that okay, you show me where something actually 4 happened and I will fix it.
| |
| 5 CHAIRMAN EBERSOLE: Put a match on it.
| |
| 6 MR. MICHELSON: You won't look generically across 7 the issue to see before it happens, instead of after it 8 happens, whether or not you can find these wonderful positions 9 that need to be fixed.
| |
| 10 MR. BAER: We sure do. We sure try to, but 11 when--and that's the various alternatives, but when you get 12 into trying to show a cost effective, a risk reduction to the
| |
| () 13 public that is cost effective, if there is no instances that 14 you can point to, and we are now up to 1500 or thousand 15 reactor years of operation, if you can't find an event, the 16 PRA people say, well, it looks to me like it is no higher than 17 ten to the minus three, and then if you need another failure, 18 it is ten to the minus five, and if you are down in ten to the 19 five, minus five, initiating event, it is not, it is not, you 20 will very seldom find it cost effective.
| |
| 21 MR. MICHELSON: Have the PRA people gone in and 22 looked at overvoltage condition to see where it would spread i 23 to, what it would cause, and determine it is a non-problem?
| |
| i
| |
| (~ 24 MR. BAER: I don't know.
| |
| 25 MR. WYLIE: What did you say about.the GE system as HERITAGE REPORTING CORPORATION -- (202)628-4888 i
| |
| | |
| 205 1 far as being a regulatory requireuent?
| |
| /~T
| |
| \-) 2 MR. THATCHER: As far as I know, it was done by 3 generic letter in about 1970--I know it is'not a GDC or 4 something like that. It is not part of 10'CFR 5055.
| |
| 5 MR. MICHELSON: The event didn't occur until the 6 '70s.
| |
| 7 MR. WYLIE: Well, how does that relate to the power 8 supplies for protection of a BWR?
| |
| 9 MR. THATCHER: It doesn't. I was going somewhere 10 with that argument. I have forgotten where I was. I was 11 going to say that maybe by attacking the electrical and maybe 12 solving, maybe looking at over and undervoltage, we solved it,
| |
| () 13 but we didn't then look at the air system. We looked for the 14 air. We didn't look, sounds like we didn't look at the 15 overpressurization from the air system, but we have looked at 16 the ATWS and that's even broader and that's a bigger way of 17 approaching it, and the answer is in diversity in that case.
| |
| 18 It isn't in putting another widget in to look at whether you 19 get overpressure and bleed it off or something. It is to take 20 a step back and do something like make a rule that they have '
| |
| l 21 got to SCRAM the, got to shut down the plant another way.
| |
| 22 HR. MICHELSON: We have to decide whether it is a 23 problem before we do anything, and I am looking for the
| |
| ( 24 mechanism by which we decide whether it is a problem or not, 25 and I thought that's what most of this business was about, .,
| |
| \
| |
| HERITAGE REPORTING CORPORATION -- (202)628-4888
| |
| | |
| 206 1 looking in to see where the problems are, if any, and I think
| |
| /~T kl 2 our whole argument all along has been tnat we just don't think 3 you have looked in all the corners that you ought to be 4 looking into, and you are coming back and saying--I am not 5 sure what you are saying, but I think you are telling me we 6 kind of glanced in those corners and don't think this is any 7 problem, we didn't do anything about it.
| |
| 8 MR. BAER: I am not sure whether you are talking 9 about A-47, A-17 or multiple system.
| |
| 10 MR. MICHELSON: Both.
| |
| 11 MR. ANDERSON: There are an awful lot of corners out 12 there. We haven't looked in all of them yet, and if there are
| |
| () 13 corners we haven't looked in, we would like for to you point 14 them out to us. We attempted to take all of the dark corners 15 and all of the cobwebs and all--
| |
| 16 MR. MICHELSON: I classify as a corner, for 17 instance, fire, pipe breaks, and other external events. I 18 consider those a corner on this problem.
| |
| 19 MR. ANDERSON: Yes.
| |
| 20 MR. MICHELSON: I think you just said essentially 21 you didn't look into those particular corners.
| |
| 22 MR. ANDERSON: No. We already know about those 23 corners.
| |
| 24 MR. MICHELSON: Who knows about them?
| |
| V('N 25 MR. ANDERSON: That gentleman up there.
| |
| HERITAGE REPORTING CORPORATION -- (202)628-4888
| |
| | |
| 207 1 MR. MICHELSON: Like okay, fire, do you know about
| |
| %) 2 the system interaction effects derived from fire?
| |
| 3 MR. ANDERSON: We have inadvertent fire, actuation 4 of fire protection.
| |
| 5 MR. MICHELSON: One at a time, that is no problem.
| |
| 6 I don't worry about those things happening when one goes off 7 by itself. I worry when I have a fire one day and some others 8 go off. Have you looked at that? That's a corner. Very 9 different, easily defined corner, been well defined for a long 10 time now, been harping on it again for several years and 11 nothing, you know, that still is, the fire protection people 12 passed it off to you, and you are not picking it up.
| |
| () 13 MR. ANDERSON: Well, I think--
| |
| 14 MR. MICHELSON: If you have--
| |
| 15 MR. ANDERSON: If we are not picking it up to the 16 extent that you think it should be, then we can modify our 17 approach to it, but I thought that we had understood what the 18 concern was, i
| |
| 19 MR. MICHELSON: You didn't pick it up.
| |
| 20 MR. ANDERSON: We are not working the whole room all 21 at once.
| |
| 22 MR. MICHELSON: Are you working that particular 23 aspect?
| |
| 24 MR. BAER: Why don't you let Dale go on? He is O(~N 25 going to give you examples in the seismic area, and we have HERITAGE REPORTING CORPORATION -- (202)628-4888
| |
| | |
| 208 1 some other that we have got tentatively listed.
| |
| \' 2 MR. MICHELSON: Okay.
| |
| 3 MR. THATCHER: Well, let's see. I guess the main 4 thrust here is to develop the concern into an issue for 5 prioritization, then we are going to try to publish a report 6 and then subsequent to the publishing of that report, 7 prioritize those issues that we have identified.
| |
| 8 MR. MICHELSON: The scope here are the residuals?
| |
| 9 This is, the whole program is designed to pick up the 10 residuals?
| |
| 11 MR. ANDERSON: Yes, sir.
| |
| 12 MR. THATCHER: Let me go on a little bit here.
| |
| () 13 MR. MICHELSON: This is going to be an interesting 14 one to read, I will tell you.
| |
| 15 MR. THATCHER: Well, it is an interesting one to try 16 to put together.
| |
| 17 The general areas of concern are outlined here. I 18 am working with Oak Ridge National Lab mostly, and we are 19 trying to make the report have some kind of a fabric in it 20 that holds it all together, and we have decided to work from 21 things like initiating events, and that's why you see things 22 like seismic plant transient upsets, not accidents, but they 23 are later on here, internal plant flooding, internal plant 24 fires, design basis events like LOCA steam line, those pipe 25 things, and also the simultaneous event.
| |
| HERITAGE RCPORTING CORPORATION -- (202)628-4888
| |
| | |
| 209 1 I think we have heard' people allude to the fact that s
| |
| \s 2 the Commission seems to somehow decide that fires don't happen 3 simultaneously with LOCA or something like-that, and that's 4 really what we are trying to catch in the last one.
| |
| ! 5 MR. MICHELSON: Fires generate LOCA signals that 6 cause equipment to respond as if there is a LOCA, and you have 7 got to consider that aspect. You don't have to consider the 8 fact that there is actually I busted pipe inside of 9 containment while there is a fire burning alongside unless you 10 can show the fires outside causes a pipe break, but make sure 11 you chase it the right way when you do it. They haven't in 12 the past.
| |
| () 13 CHAIRMAN EBERSOLE: The reverse--the pipe breaks 14 inside and provides you a temperature signal that makes the 15 fire system go off.
| |
| 16 MR. MICHELSON: That could be one of the things you 17 have got to think about.
| |
| 18 MR, THATCHER: The sources of information for this 19 program are, as we were saying, basically I mean it is there 20 No. 1, ACRS letters, meetings on--same kind of meetings we are 21 having, USI A-17, A-6 and A-47. But also--
| |
| 22 MR. MICHELSON: Let me caution you on one thing.
| |
| 23 When you break a pipe outside of containment, if it is even a
| |
| ~
| |
| 24 hot water pipe, there is enough steam and enough heat from it 25 to set'off the fire protection in probably more than one zone, HERITAGE REPORTING CORPORATION -- (202)628-4888
| |
| | |
| 210 1 depending on exactly where the break is, and I assume that you p-)g
| |
| \_ 2 are really doing it. Now the pipe break analyses were never, 3 they didn't even know about fire protection when they did 4 them.
| |
| 5 MR. BAER: When we are done, we are going to ask for 6 some help in defining these. We have gone through 7 transcripts.
| |
| 8 MR. MICHELSON: We have been helping you all day.
| |
| 9 MR. BAER: I think frankly some discipline is needed l l
| |
| 10 to write it down.
| |
| 11 MR. MICHELSON: It is all being written down.
| |
| 12 MR. BAER: Transcripts are pretty good, but we all
| |
| {; 13 talk at once, and there is a certain amount of jargon and you 14 go back there and did he really say that? He didn't really 15 say that.
| |
| 16 MR. MICHELSON: I think we would be glad to sit down 17 and you know, and in a working kind of session, to help you 18 out, but we have to be a little careful not to get so deeply 19 involved in helping you out that we can't judge it anymore. l 20 Pretty hard to judge--if I tell you to do something, I can't 21 judge you. Somebody else has to do it. There aren't enough 22 of us to form a committee after some of us help you.
| |
| 1 1
| |
| 23 MR. BAER: I think we are just looking for help in l l
| |
| 24 defining the concern, not necessarily working the problem.
| |
| 25 CHAIRMAN EBERSOLE: I think if you identify, you HERITAGE REPORTING CORPORATION -- (202)628-4888
| |
| | |
| 211 1 ought to pick it up and then move. Maybe I am an optimist.
| |
| 2 MR. ANDERSON: We haven't a defined obstacle course 3 to go through until we get to work on it, as you know.
| |
| 4 MR. THATCHER: The first step is prioritization, 5 right.
| |
| 6 Also listed some programs like-fire research and 7 environmental qualification. I think the Committee is pretty 8 well aware of those programs, and so we are trying'to work 9 along with what they are doing, too.
| |
| 10 We are also looking at gaps in requirements that may 11 pop up in standard review plan problems or operating 12 experience. That is probably our best feature. To give you fs
| |
| '( ,) 13 some example of the kinds of things we are doing, one of the 14 problems we are having is how to list these things or how to 15 group them or how to get our hands, arms, whatever, around I
| |
| 16 them.
| |
| 17 The basic area of seismic earthquake-related 18 concerns, this is one way we have it kind of broken down now ,
| |
| 19 but I am not even sure this is going to be the final way we !
| |
| l 20 are going to do it. The intent is to try to, as I said, break
| |
| \
| |
| l 21 this down into somewhat focused concerns and then decide l i
| |
| 22 whether they are really safety issues, and then whether they l
| |
| 23 have to be prioritized or whether they are covered from 24 somewhere else already, and we may identify that some of these 25 things are covered by existing regulations.
| |
| HERITAGE REPORTING CORPORATION -- (202)628-4888
| |
| | |
| 212 1 I am not sure yet how to deal with this problem that
| |
| / 2 we keep throwing around here of implementation because I see a 3 lot, we see a lot of problems with implementation of 4 requirements, but whether they are generic issues or not is, 5 is up for grabs in my opinion right now. I don't know what, I 6 ion't know how we should be dealing with them.
| |
| ~
| |
| 7 MR. MICHELSON: In terms of operating experience and 8 how it is going to feed into your system, let me ask at the 9 time the sequence coding surge system was devised and set up, 10 there were provisions within that system to insert what we 11 call watch lists which were simply words that--and one of the, 12 and I devised a small typical one initially just to think
| |
| () 13 about and hit a lot of interesting kind of problems which 14 presumably the reader of the LER and whoever it was being read 15 by at Oak Ridge and so forth, and one of the things he was to 16 do if this looked like a potential systems interaction without 17 real big definitions of what that meant, he would put that as 18 a watch list, on the watch list and words and so I could go 19 back and I could call up by that watch list word every LER 20 that Oak Ridge has ever looked at they thought might be a 21 potential systems interaction, and the question in my mind is 22 was that ever actually done? It was in the early plan, but I 23 wondered if it got carried out.
| |
| 24 MR. ANDERSON: In the A-17 program, I think it was 25 done pretty extensively. They were catalogued, and that--
| |
| HERITAGE REPORTING CORPORATION -- (202)628-4888
| |
| | |
| 213 1 MR. MICHELSON: Calling up by the-watch. list?
| |
| (~h k/ 2 MR. ANDERSON: No.
| |
| 3 MR, MICHELSON: There is a lot of potential systems 4 interactions that we recognized. You knew one when you saw 5 it, but it wasn't easy to define and it wasn't easy to code' J 6 other than that this looks like a systems interaction, and so 7 we said okay, we will use our watch li st for that purpose, so 8 that when the coder didn't know any other way to code it--I 9 guess this is something I would like to remember. This is an 10 interaction I would like to call back up some day without 11 remembering more than that. And then you were supposed to be 12 able to go in with the watch list and call up the system
| |
| () 13 interaction, and get fed back everything they ever thought was 14 a systems interaction. And I don't know that.
| |
| 15 MR. THATCHER: That sounds a lot like key wording.
| |
| 16 MR. MICHELSON: Sort of like key wording; we 17 recognize there are some things you can't do by sequence 18 coding. You have to do it by key wording, and then this was 19 what the watch list was for, and one of them was systems 20 interaction. How do you ever, how do you ever do other than 21 keyword that? You can't call it up by type of sequence, or. l 22 end product of the sequence or whatever. It has to be called i
| |
| 23 up by you know it when you see it. That reviewer thought he 24 saw one.
| |
| [
| |
| 25 MR. ANDERSON: Do you know, Dale, how they extracted !
| |
| HERITAGE REPORTING CORPORATION -- (202)628-4888
| |
| | |
| 214 1 that information from the LERs? They did use keywords, didn't (h
| |
| \/ 2 they?
| |
| 3 MR. THATCHER: They did use some keyword, yes.
| |
| 4 MR. ANDERSON: I think they read an awful lot of 5 LERs, too.
| |
| 6 MR. MICHELSON: Shouldn't have to reread them. You 7 have read them once and you coded them.
| |
| 8 MR. THATCHER: I disagree.
| |
| 9 MR. MICHELSON: You don't reread all of them. You 10 reread the ones you think you ought to be rereading. That's 11 the ones that were tagged.
| |
| 12 MR. ANDERFON: I don't know exactly how the, how
| |
| () 13 they selected which ones.
| |
| 14 MR. MICHELSON: What I was going to suggest, if it 15 hasn't been implemented, _you might think seriously of at least 16 getting it started now so that in a year or two you have got 17 at least a small set of what you think are potential 18 interactions. Whenever you want to say around some events, 19 you can always say--it is too late now I guess, but I would 20 like to think five years from now when we are still working on 21 this problem we have got a pretty good set and all I have to 22 do is call it up by system interaction, and all of them come 23 back to me in the order because initial judgment was made when
| |
| {} 24 it was read and I had several other.
| |
| 25 MR. BAERt Is that still under AEOD, that Oak Ridge HERITAGE REPORTING CORPORATION -- (202)628-4888
| |
| | |
| 215 1 contract? i 2 MR. MICHELSON: It is done at Oak Ridge, l 3 MR. BAER: AEOD?
| |
| 4 MR. MICHELSON: It is AEOD; call Genie Bill and she 5 will tell you whether that was ever implemented or not. It 6 was in, the original scheme of it was in the original coding 7 book, but I don't know if it was ever done.
| |
| 8 MR. BAER: I will give her a call.
| |
| 9 MR. THATCHER: I don't think it was.
| |
| 10 MR. MICHELSON: I am just not sure. If it had been 11 done, it would have been nice. We could go back, ?ook at 12 five, seven, eight years of experience, look at eight years of
| |
| () 13 LERs now.
| |
| 14 MR. THATCHER: That may be the problem we had with 15 Oak Ridge. They have may have called that one up and the 16 problem was we got every LER.
| |
| 17 MR. MICHELSON: You won't get every LER of systems 18 interaction, won't get all of those where the guy said 19 gee--this is a operator--I forgot to do my surveillance this 20 month. You don't get those kind.
| |
| 21 MR. ANDERSON: That is why we had so many. Called 22 up systems interaction and got every one, or nearly.
| |
| )
| |
| l l 23 MR. THATCHER: Something like that.
| |
| l
| |
| / 24 HR. MICHELSON: I will chat with Genie sometime and 25 find out what, but you might want to do it also.
| |
| HERITAGE REPORTING CORPORATION -- (202)628-4888
| |
| | |
| 216 1 MR. BAER: I will give her a call, f
| |
| ' 2 MR. MICHELSON: See what they are doing.
| |
| 3 MR. THATCHER: Was there a definition? I assume 4 there was a definition of what a systems interaction was.
| |
| 5 MR. MICHELSON: That was the difficulty. It is just 6 like today. There wasn't a good definition the reviewer. The 7 people we talked with at Oak Ridge, they understood the 8 problem. They understood what the sort of thing we were 9 interested in and we recognized that we would want to get back 10 more than the real ones, but not a lot more. We don't want to 11 get back every LER, but we wanted to get a good set from which 12 to start to work, so the reviewer thought it was a systems
| |
| () 13 interaction, and he put a flag on it, regular comment section.
| |
| 14 MR. SZUKIEWICZ: We tried to use that system to 15 identify control systems interactions and found out we would 16 have to go and start looking at all the LERs because of--
| |
| 17 MR. MICHELSON: Wouldn't be surprised. i 18 MR. SZUKIEWICZ: The way control systems were 19 defined.
| |
| 20 MR. MICHELSON: That was the purpose of the watch j 21 list was to try to identify certain problem areas as opposed 22 to sequences which they can identify rather well.
| |
| 23 HR. THATCHER: Well, that was just an example. I 24 don't know. We can talk about some of the things that are on 25 here, but I don't see any real purpose in that.
| |
| HERITAGE REPORTING CORPORATION -- (202)628-4888
| |
| | |
| 217 1 CHAIRMAN EBERSOLE: Tell me, the hydrogen supply i
| |
| (''l
| |
| \- 2 systems for boilers and BWRs come from high pressure torque 3 bottles, don't they, hydrogenated'the water?
| |
| 4 MR. ANDERSON: Yes.
| |
| 5 CHAIRMAN EBERSOLE: They have a regulator, step it 6 down to some useful pressure in the manifold, runs all over 7 the plant. I presume we are well cared for when the diaphragm 8 ruptures and they get cylinder pressure in the manifolds.
| |
| 9 MR. ANDERSON: I don't know that. That's an 10 identified issue. That's GI 106.
| |
| 11 MR. BAER: Is your concern fires from this or--
| |
| 12 CHAIRMAN EBERSOLE: Probably explosion.
| |
| () 13 MR. BAER: Okay. Well, there is actually two 14 different actions. One was going to my branch, we traded it 15 for another one. It was a question.
| |
| 16 CHAIRMAN EBERSOLE: Traded it off.
| |
| 17 MR. MICHELSON: You liked another one better.
| |
| 18 MR. BAER: It was, I said earlier, the goal was I 19 handle, quote, engineering issues, and Carl handles systems 20 issues. It was a manpower availability question. There is 21 one issue liraited to PWRs and I will tell you why.
| |
| 22 CHAIRMAN EBERSOLE: Liquid hydrogen boilers.
| |
| 23 MR. BAER: 106 on the questions of fires and 24 explosions in hydrogen systems; there was a similar issue of
| |
| }
| |
| 25 PWRs. It was being treated as a topical--the PWR's owners HERITAGE REPORTING CORPORATION -- (202)628-4888
| |
| | |
| 218 '
| |
| 1 group had already submitted a topical, and that was well under l O 2 svi- already. I know we have review in the peer review of 3 . s prioritization we had a lot of difficulties sorting that 4 out, but the decision was made since that topical report 5 review was well underway, that for the PWRs it would be 6 handled it as topical report. I don't know where that stands 7 offhand. That was one that was--
| |
| 8 CHAIRMAN EBERSOLE: It would be in your control 9 system?
| |
| 10 '
| |
| MR. BAER: Not if it is an identified issue and 11 someone is worrying about hydrogen fires.
| |
| 12 MR. EBERSOLE: I don't know how much are identified O 13 eea mot iae= tier voer e commo# eecxet eor 11 et taem.
| |
| 14 MR. MICHELSON: If it is a systems interaction.
| |
| 15 CHAIRMAN EBERSOLE: I am talking about control 16 system failures.
| |
| 17 MR. MICHELSON: This is a subset of A-17.
| |
| 18 CHAIRMAN EBERSOLE: It is' holding in a little
| |
| ~
| |
| 19 tighter.
| |
| 20 MR. ANDERSON: If there is a control .4ystem failure 21 problem, it is identified as a specific issue, however narrow, 22 and it is being handled or resolved in some way outside--you 23 know, I don't think that we need to go back and relook at it.
| |
| 24 CHAIRMAN EBERSOLE: You have had to put it in your 25 record as being handled.
| |
| l HERITAGE REPORTING CORPORATION -- (202)628-4888
| |
| | |
| 219 1 MR. ANDERSON: We haven't done that. We haven't b
| |
| N' 2 said these are the control system issues that are worked 3 outside of the A-47, 4 MR. EBERSOLE: Your system is.open-ended. You don't 5 know where the hell you are, whether you did 10 percent or 90 6 percent or 50 percent.
| |
| 7 MR. MICHELSON: The less informed reader at least is 8 not familiar with the fact that this or that--
| |
| 9 MR. ANDERSON: That may be a good point. We haven't 10 done that on any of our other issues, specifically addressed, 11 identified every other issue.
| |
| 12 CHAIRMAN EBERSOLE: You know they are scattered out
| |
| () 13 like chicken feed all over the yard. Yours is the summary.
| |
| 14 MR. ANDERSON: Well--
| |
| 15 CHAIRMAN EBERSOLE: If you know the others, just put 16 them in there.
| |
| 1 17 MR. ANDERSON: I can see the difficulty there. I 18 guess we really haven't, we haven't defined what it is we 19 haven't done. !
| |
| 20 MR. MICHELSON: There is a lot more going than what l
| |
| )
| |
| 21 we are aware of with less comfort. ,
| |
| 22 CHAIRMAN EBERSOLE: When you take a drawing, you 23 look at it and you say everything looks right here, but what I
| |
| /~T 24 the hell isn't here? And that's a major problem in the design
| |
| \-)
| |
| 25 effort. What has he left off because you can't see. ,
| |
| i l
| |
| HERITAGE REPORTING CORPORATION -- (202)628-4888
| |
| | |
| 220 ,
| |
| 1 MR. ANDERSON: You read what we wrote, not what we q
| |
| k/
| |
| - 2 were thinking.
| |
| 3 CHAIRMAN EBERSOLE: Yes.
| |
| 4 MR. AhDERSON: That's the problem.
| |
| ; 5 CHAIRMAN EBERSOLE: I think maybe that's the root of-6 it.
| |
| 7 MR. MICHELSON: I have a small question on a slide a 8 couple of slides before the last one. You don't need to show 9 it again.
| |
| 10 You talk about design basis events, and in the 11 multiple system response as being LOCAs and steam line breaks.
| |
| 12 Then you talk about internal plant flooding. Now how about
| |
| () 13 the case of a high energy pipe break that isn't--steam line 14 break here doesn't necessarily mean auxiliary feedwater steam, 15 does it, or does it? Does it mean all steam line breaks?
| |
| 16 Does it mean all high energy line breaks? .If it said high l I
| |
| 17 energy line break, I would have understood it. Do you mean 18 steam line or all steam lines? )
| |
| 19 MR. THATCHER: The design basis events are only high 20 energy line breaks, right? It has to be--HELB.
| |
| l 21 MR. MICHELSON: High energy line breaks actually as j l
| |
| 4 22 I recall never were, outside of containment, never were a 23 design basis requirement. ,
| |
| 1 24 What happened is they wrote those two funny little 25 letters back in '73, '72 and '73 actually was, and the O' Leary HERITAGE REPORTING CORPORATION -- (202)628-4888
| |
| | |
| 221 1 letter and the Jim Bruce letter which says go look at your 2 plants from the viewpoint of these lines breaking and tell us 3 what you find, and then it came back with what they found and 4 I think then you meditated and you didn't like it. It never 5 became what we call a design basis accident. It was just a 6 regulatory requirement that you look and fix as the regulatory.
| |
| 7 people felt it was necessary.
| |
| 8 MR. BAER: It is still in the standard review plan, 9 MR. MICHELSON: It isn't a design basis accident.
| |
| 10 So where do you cover the high energy line breaks that aren't 11 design basis events and which aren't related to internal plant 12 flooding because they are more than floodirig.
| |
| () 13 MR. ANDERSON: They are not related to internal 14 flooding.
| |
| 15 MR. MICHELSON: No. When you release high energy 16 line, you are going to get steel and water from both, you are 17 going to have flooding and steam environments.
| |
| 18 MR. ANDERSON: Well, Dale, we extended the 19 definition of flooding to include vapor, and sprays, and 20 communication.
| |
| 21 HR. MICHELSON: Make it high enery and moderate 22 energy line breaks, whatever they cost, be it both steel and 23 water, water vapor, whatever; it is all a part of high and 24 moderate energy line breaks outside of containment.
| |
| 25 CHAIRMAN EBERSOLE: I am not even sure the excess HERITAGE REPORTING CORPORATION -- (202)628-4888
| |
| | |
| 222 4 1 flow collection that GE uses because it runs static lines 2 outside of containment and runs it into a nest of control -
| |
| 3 devices,-if those tubes are broken by forklift er 4 something--they are pretty good tubes, but nevertheless you 5 can tear them down--I am not sure the excess flow checks would 6 really stop the flow through 3 quarter inch or 1 inch line.
| |
| 7 That's prodigious flow at a thousand pounds.
| |
| 8 MR. BAER: You are right back in--
| |
| 9 MR. EBERSOLE: Your hypothesis is it will snap shut ,
| |
| 10 and it is all over, which is probably not true.
| |
| 11 MR. BAER: Before I take up that one, could I talk a 12 bit about what Carl had because I hope you realize that right
| |
| () 13 now the Commission has been granting relief on the postulation i
| |
| 14 of high energy pipe breaks.
| |
| 15 HR. MICHELSON: Not from the viewpoint of 16 environmental qualification and effects on environment and so 17 forth; only from the viewpoint of whipping, jetting, and you 18 still got to account for the steam and the water that comes 19 out as if it were a rupture for now. If you don't, then we 20 can throw our ECCS equipment out. We won't need it anymore.
| |
| 21 CHAIRMAN EBERSOLE: Have the prerogative of assuming 22 valves will close when in fact you know they will not.
| |
| 23 MR. BAER: My point is that when someone, face up to 24 the fact that when someone starts looking at the probability
| |
| )
| |
| ; 25 of moderate and high energy pipe breaks, they are going to HERITAGE RZPORTING CORPORATION -- (202)628-4888
| |
| | |
| 223 1 look around to see how many occur, and there are not many, and 2 -so it is going to end up being a relatively low probability 3 event.
| |
| 4 CHAIRMAN EBERSOLE: That's right, but.it was 5 cancelled possibly by the severity of the consequences.
| |
| 6 MR. BAER: Right.
| |
| F 7 CHAIRMAN EBERSOLE: They make a matched pair in the 8 final analysis.
| |
| 9 MR. BAER: That's right.
| |
| 10 MR. MICHELSON: You are worried about the risk.
| |
| 11 MR. ANDERSON: And if you match that with what it 12 takes to do something about it--
| |
| () 13 MR. MICHELSON: Want to match that with just a wee l
| |
| 14 bit of worry. You start looking around at the volts that are l l
| |
| 15 corroding and so forth that we dodge in our design basis 16 requirement that you consider in the pump or a valve connet l 1
| |
| l 17 come off.
| |
| 18 CHAIRMAN EBERSOLE: At the same time we don't--
| |
| i 19 MR. MICHELSON: If you want to worry, I don't find 20 anyone giving me assurance that will never happen.
| |
| i 21 MR. EBERSOLE: That goes back to absence of control l
| |
| 22 system limitations on the torque, the thrust. You are caught 23 between two--
| |
| l 24 MR. BAER: Four-year information, there is another
| |
| [
| |
| 25 generic issue that we are working on, on bolting in general, HERITAGE REPORTING CORPORATION -- (202)628-4888
| |
| | |
| L' 224 1 and EPRI has put out some pretty good guidelines, and our, we 2 believe we have a reg analysis-that certainly supports 3 imposing, and this is what we plan to do, imposing 4 requirements of following those EPRI guidelines. We deal with 5 torquing and lubricants.
| |
| 6 MR. MICHELSON: They don't deal with the piping 7 outside of containment.
| |
| 8 MR. BAER: The reg analysis which was done sometime i
| |
| 9 ago only deals with class one pipe breaks. Right now, we are l 10 having the reg analysis expand to look at other piping systems ,
| |
| l i
| |
| 11 outside of containment. 1 l
| |
| 12 MR. MICHELSON: All less class 3? ;
| |
| () 13 MR. BAER: Class, class 3 plus support; I don't know 14 how it is going to come out. It may not come out to say that j l
| |
| 15 we can impose that, we have a justification for proposing i
| |
| 16 NUREG requirement.
| |
| 17 MR. MICHELSON: Can't put the problem to bed until l 18 we cover all the piping, for instance, the auxiliary boiler 19 piping and steam supplies. You know, if you are going to say 20 pipes don't break, you have got to be sure that you put all 21 those good requirements on every pipe.
| |
| 22 MR. BAER: Carl, you are not listening. I am not at 23 all sure that we are even going to be able to justify imposing 24 requirements. We certainly are going to say to the industry 25 EPRI came up with the good guidelines, you ought to use it, it HERITAGE REPORTING CORPORATION -- (202)628-4888
| |
| | |
| 225 l
| |
| 1 is an industry standard, but in terms of INPO situation,'if it 2 passes class 2 piping and class 3 piping, which I-frankly 3 doubt, then I will commit that we will look further, but I am 4 not sure that we are going to have a basis for class 2 and 3 5 piping.
| |
| 6 HR. MICHELSON: Until that-does occur, we have still 7 got to worry about pipe breaks, environmental effects.
| |
| 8 CHAIRMAN EBERSOLE: They committed to downgrading of 9 piece of pipe between two valves.
| |
| 10 MR. MICHELSON: That can be done locally yes. The 11 problem is that it is too expensive to do on small piping and 12 I mean after all, the 4 inch or 2 inch steam line can get you
| |
| () 13 in a lot of trouble depending on where it is located, and I 14 think we will never, we will never eliminate the environmental 15 problem. Keep it under control, and we will fix it.
| |
| 16 CHAIRMAN EBERSOLE: Carl's statement about-the 17 bonnet failure, I go back in ancient history to 3 and a half 18 inch pin sheared by valve rotor. I don't know how close that 19 came to pulling the bonnet bolts out and letting the system 20 discharge in the critical areas. All that happened was the 21 torque switch stuck. That's the other side of the coin. You I
| |
| 22 have got to make the valve shut to give it plenty of thrust.
| |
| 23 If you give it too much, it will offset. That is the other p
| |
| V 24 side.
| |
| 25 HR. BAER: That's happened more than once.
| |
| j j HERITAGE REPORTING CORPORATION -- (202)628-4888
| |
| | |
| 226 1- CHAIRMAN EBERSOLE: In the long run, you have got a O' 3 little problem. You are caught between two barriers.
| |
| I i
| |
| 3 MR. MICHELSON: I think your job is not going to_go 4 away even if we decide that more of the pipe is not subject to 5 failure. I think the problem of the environmental control is 6 going to be with us in much of the south side of containment.
| |
| 7 I just don't think it is going to go away.
| |
| 8 MR. B AL,: Well, let me bring up a couple of points-9 because as Dale mentioned, we are having difficulty in just 10 grouping these events because if you just look at this list 11 under seismic, you have got a bunch of things that_are 12 flooding and a bunch of things that are fire protection, and
| |
| () 13 you know, and if you start off with a list that says fire 14 protection, sa any smarts that you care to pass on now or .
| |
| 15 sometime in the future, formally or informally, we would 16 certainly like to get some feel for this because we have been 17 trying to work on a matrix, and every format we try has some 18 advantages and disadvantages.
| |
| 19 CHAIRMAN EBERSOLE: We can anticipate 20 years later 20 that something might happen like that old HPCI line.
| |
| 21 MR. BAER: No. Our intent really is to try, and the 22 other part which is maybe more important than the formating, 23 and there is some thought, and maybe it has to be informal,
| |
| {} 24 but sitting down and really trying to understand many of these 25 concerns which come right from this subcommittee and other i
| |
| HERITAGE REPORTING CORPORATION -- (202)628-4888
| |
| | |
| t 227-1 subcommittees in ACRS, really.try and understand the concerns 4
| |
| be 2 so we can get it down or we can get Oak Ridge to get it down ,
| |
| 3 in writing so that it truly can be prioritized, prioritized 4 and you know, describing it clearly so someone doesn't throw 5 in more what ifs than should be there is an important-aspect.
| |
| 6 HR. EBERSOLE: Do you' envision any extension of this 7 CO 2 discharge problem that blew up two rooms at the TVA 8 plants in the context of that being discharged in the battery 9 room and causing battery explosions? I am always nervous 10 about those systems. You understand what I mean, where they 11 discharge the tank in the space. ,
| |
| 12 MR. BAER: Event two-or three years ago.
| |
| () 13 CHAIRMAN EBERSOLE: It happened twice. What they 14 do, they misdesign maldesign the whole process by parceling a 15 portion of the large tank farm into a small space with a timer [
| |
| 16 which is not safety grade. The end result is standing .
| |
| 17 potential that you will discharge the whole tank farm into a 18 tight space which is well built. You will pull the hell out 19 of it. It becomes an internal structural bomb, and it might 20 be the battery rooms. I don't know.
| |
| 21 MR. BAER: Well, those are the ones where if someone 22 would set it down in writing it would help.
| |
| 23 CHAIRMAN EBERSOLE: It is on the record. They have 24 blown two rooms open.
| |
| 25 MR. MICHELSON: You know, it depends entirely on the 1
| |
| HERITAGE REPORTING CORPORATION -- (202)628-4888
| |
| | |
| 228 1 design of the plant, what design practices are, and how strong 2 the doors-are, and both cases, of course, they blew the doors 3 down is the first part.
| |
| 4 CHAIRMAN EBERSOLE: Natural relief valves, not 5 purposely.
| |
| 6 MR. MICHELSON: It is still a very interesting 7 problem.
| |
| 8 MR. BAER: Now--
| |
| 9 CHAIRMAN EBERSOLE: Canned equipment in inside; I 10 don't know.
| |
| 11 MR. BAER: The question, is that a separnte subset 12 or is that in the broad area?
| |
| () 13 CHAIRMAN EBERSOLE: This is a control system 14 failure.
| |
| 15 MR. BAER: Inadvertent actuation of fire protection.
| |
| 16 MR. EBERSOLE: I guess it could be either.
| |
| 17 MR. MICHELSON: That was purposely done. It didn't 18 work right.
| |
| 19 CHAIRMAN EBERSOLE: The parties were warned that was 20 a safety system, but they didn't upgrade it.
| |
| I 21 MR. BAER: See, for fire protection, I didn't know 22 what a safety system means because, because do I fail it safe 23 so it won't go off inadvertently, or is failsafe it fires off 24 with a single failure?
| |
| 25 MR. MICHELSON: It is not intended to be a safety 1 i
| |
| HERITAGE REPORTING CORPORATION -- (202)628-4888
| |
| | |
| .229 ,
| |
| 1 system as such by function, although they hang some'of the 2 pipes so it doesn't fall down and some of the wall monitor 3 components are--
| |
| MR. BAER:
| |
| 4 I realize the fire protection system 5 isn't safety system. When people say hey, the design of'this 6 part, you know, really the implication to withstand the single 7 failure, you have to two choices on how you withstand the 8 single failure.
| |
| 9 MR. MICHELSON: Compressed air which we have talked 10 about a number of times today let's say, for instance,-right 11 now we have, what we see in some plants that have compressed 12 air is a non-safety requirement because if we ever lose it,
| |
| () 13 everything_ works in the right direction. l 14 Now if it turns out that we have to worry about not 15 just a loss of air, but maybe excess air pressure as being 16 something that would jeopardize our safety systems, now we 17 have to make at least the protective circuitry and the '
| |
| 18 arrangement that prevent excess air pressure. We have to do 19 that with safety grade requirements and redundancy and 20 diversity or whatever, but we have to provide a safety loop.
| |
| 21 Now right now they do have the safety valve 150. If 22 you can show that 150 pounds doesn't better any of the 23 equipment, and if you put two safety valves, that will be all
| |
| ( 24 you have to do, but again we are beginning to find they are 25 more sensitive perhaps.
| |
| HERITAGE REPORTING CORPORATION -- (202)628-4888
| |
| | |
| + .
| |
| 230 1 The other~ thing that came up as a result of that LER -
| |
| 2 which again you better inquire around, how are people treating 3 the--where they have a safety-related valve they have to 4 reduce the air pressure to the air set, control valve set, ere 5 they treating the regulator as a safety-related comperont? .It 6 turns out in the case of the LER we read there la part of the 7 plant they didn't, part of the plant they did.- So again, hon 8 is that being treated? How do we, do we tech spec the 9 requirements concerning the setting of thu regulator?
| |
| 10 HR. BAER: I am just going to rGise the WL(le issue 4
| |
| 11 with the task manager and the--
| |
| 12 MR. MICHELSON: It is an extremely poo { sxampls. I ,
| |
| () 13 am not saying that air is necessarily a b(c pt(blem. I juat 14 don't know, but it is an example of the hiad ol thing thht we ,
| |
| 15 have been trying to convey, and that is that you have que to 16 look at all failure aspects particul-rly of these comJ2. mode 17 challenges which air is because it goes everywhere.
| |
| 18 Electricity to some extent is. I think it goes many plucas. j l
| |
| 19 Flooding is because it can go, any of these things caa go to a 20 lot of places at once. You have to kind of chase it dovr., an( ]
| |
| l 21 that's what I thought system interaction was supposeily abcut. l 22 CHAIRMAN EBERSOLE: The logo on your plants =houim 23 be the old it ought to look up and down as well as in P.11 four 24 directions and that will do it.
| |
| 25 MR. BAER: As I said earlier, I think air, I think HERITAGE REPORTING CORPORATION -- (202)628-4888
| |
| | |
| 231 1 in terms of control systems impacting' protection systems or 13
| |
| \/ 2 system interaction, I think the electrical systems because of 3 the much more stringent requirements and the way we have 4 forced licensees to implement them are less vulnerable than 5 air systems.
| |
| 6 MR. MICHELSON: Let me call you on that belief and 7 it was, we really haven't looked carefully at the non-safety 8 control system relay chatter problem. Generally we have said 9 we don't need to look at that. That's a non-safety system.
| |
| 10 We don't worry about how it behaves during the earthquake, but-11 we may have to worry about how it behaves during an earthquake 12 if it causes the air i3mpressor to increase its pressure or
| |
| () 13 causes bomething else to happen and feeds backs in an adverse 14 fashion. Then we do have to worry, but in general, I think 15 electric systems, at least all the safety grade ones, have 16 been worked over awfully hard from the viewpoint of the 17 seismic effects, but when we tried to work over the non-safety 18 systems, I couldn't even get them to chase the water across 19 the floor from the non-seismic tank. All they will do is see 20 where the tank falls and whether or not physically it--
| |
| 21 MR. b .ER : A-17, our plan is to chaso the water for 22 that at least more that equipment,
| |
| ?3 MR. HTCHELSON: Why didn't A-46 require they chase l 1
| |
| 24 tha watat? We prot.e a letter to the commissioners and so
| |
| {;
| |
| , 15 forth. Just want on through. I RERITAGE R3 PORTING CORPORATION -- (202)628-4888 I
| |
| | |
| 232 1 MR. ANDERSON: Well, the reason may have been a 2 procedural one. We recognize the point. I think we said 3 before it is going to be done. The people will treat it as 4 they go through there.
| |
| 5 MR. MICHELSON: They are better believers than the 6 staff.
| |
| 7 HR. ANDERSON: We believed that, but what I didn't 8 want to do, what the staff didn't want to do is to after we 9 have issued a final requirement, and we are down the road, to 10 go back and rework the problem. I was reluctant--
| |
| 11 MR. MICHELSON: Maybe we should have talked about it 12 earlier. Sometimes you don't bring things until you are done
| |
| () 13 like and A-17 14 CHAIRMAN EBERSOLE: That's the way the plants have 15 been built, isn't it?
| |
| i 16 MR. MICHELSON: A-47, you certainly brought it in in ,
| |
| l 17 a very late date to start, for us to start questioning it.
| |
| l 18 MR. ANDERSON: When we took the issue over, we had j l
| |
| 19 the change of management. What was that, 84? Eighty-four 20 MR. THATCHER: A-17.
| |
| 21 MR. MICHELSON: Forty-seven; A-17, I think we are l
| |
| 22 not too late. I don't believe there is any problem of your 23 casting it in concrete before you get our input, but A-47, we
| |
| /~ 24 were pretty well cast in concrete before we had an opportunity
| |
| (_}/ I 1
| |
| 25 to input into it.
| |
| I l
| |
| HERITAGE REPORTING CORFORATION -- (202)628-4888 {
| |
| .-- . . . . - . = - - - -
| |
| . -_ a
| |
| | |
| 3 233 1 MR. BAER: But people have said, including yourself,
| |
| +
| |
| {l 2 that although you have concerns that we hadn't treated the 3 whole problem, I think you did at least verbally support the 4 idea of going out with the requirements that we have 5 identified.
| |
| 6 HR. MICHELSON: My only reservation generated just J
| |
| 7 in that I really think we ought to close the feedwater valve .
| |
| 8 on the boiling water reactor as well as trip the turbine.
| |
| 9 That is a small perturbation. Basically your resolution is 10 right. I may have to put in a minor comment--the Full 11 Committee doesn't agree with me. I will add the minor 12 comment, I really think, I really think logically we are
| |
| () 13 missing the boat on that one, but other than that, I am in 14 agreement, just the residuals.
| |
| 15 MR. BAER: I understand that, and. and at least it 16 gets some, it gets moving toward imposing some requirements, 17 as I said earlierr. As I said at the previous meeting, as 18 long as we are ta] king, the licensees have no requirements.
| |
| 19 MR. MICHELSON: The reason I really am beginning to 20 get worried on that feedwater valve for boiler, I didn't 21 realize some people put in booster pumps over 600 pounds. I ,
| |
| 22 didn't realize anybody had that high booster pressure. When
| |
| , 23 you do, you have got to worry about cutting off the water in a
| |
| ()
| |
| 24 genuine fashion.
| |
| 25 MR. EBERSOLE: I wonder what the deadhead pressure l HERITAGE REPORTING CORPORATION -- (202)628-4888
| |
| | |
| 234 1
| |
| 1 on that thing is?
| |
| ()
| |
| ss 2 MR. MICHELSON: I haven't seen a pump head curve to 3 know what it will do.
| |
| 4 MR. SZUKIEWICZ: Something in the order about five, 5 600 pounds.
| |
| 6 CHAIRMAN EBERSOLE: Always look at deadhead 7 pressure.
| |
| 8 MR. MICHELSON: That is quite high.
| |
| 9 MR. SZUKIEWICZ: The Browns Ferry one was like 350.
| |
| 10 CHAIRMAN EBERSOLE: You look at deadhead pressure on 11 hydraulic systems?
| |
| 12 MR. SZUKIEWICZ: Yes.
| |
| (A) 13 MR. BAER: You are asking an electrical engineer.
| |
| 14 He said yes.
| |
| 15 MR. SZUKIEWICZ: I qualified it--reactor systems 16 people.
| |
| 17 CHAIRMAN EBERSOLE: More used to looking at network.
| |
| 18 MR. MICHELSON: Nine Mile was unique on the very 19 high booster pressure. I didn't know enough about it when I 20 suddenly realized that these were high. That is when I 21 started pushing. That's why I picked it up today instead of 22 last time. That event really worried me and how we could get 23 into that boat. I said that I thought A-47 solved this and I 24 went back and read it, and sure enough, it didn't.
| |
| [
| |
| 25 MR. SZUKIEWICZ: We actually identified it. We have l
| |
| HERITAGE REPORTING CORPORATION -- (202)628-4888
| |
| | |
| 235 l
| |
| 1 looked at it. We didn't think it was a major concern because !
| |
| () s- - 2 there were no precedents, and the last two years, basically 3 -when the project was through, we found that you can have a 4 problem.
| |
| 5 MR. BAER: Two events that he mentioned.
| |
| 6 MR. MICHELSON: Why didn't that cause you to go back 7 and revise A-47?
| |
| 8 MR. SZUKIEWICZ: We went back and we modified the )
| |
| 9 generic letter to indicate--and you haven't seen that--to 10 indicate that look, you can get it overfill protection, I mean .
| |
| 11 overfill via the condensate booster pumps at low pressure 12 conditions or lower pressure condition. You should, the
| |
| () 13 requirement is you should look at your procedures to see if 14 you know the operator can handle it. ,
| |
| 15 Now in both events, from what I understand, there 16 were people that really were not knowledgeable in this area, 17 and it is a very new design, new plant for operators, but when i
| |
| 18 we talked with our experts about saying well, maybe what we 19 really need to do is bottle the system up or trip the booster 20 pumps, and it turns out in fact in that in addition to where 1
| |
| 21 you had an overfill, said why didn't you trip the booster 22 pumps? And what they get into is if you trip the booster >
| |
| 23 pumps, then you have a certain timeframe.
| |
| 24 CHAIRMAN EBERSOLE: To start? [
| |
| 25 MR. SZUKIEWICZ: Exactly. -
| |
| i HERITAGE REPORTING CORPORATION -- (202)628-4888
| |
| | |
| 236 1 HR. MICHELSON: Let him finish. Was that their only f'\ 2 cancern, restart?
| |
| 3 MR. SZUKIEWICZ: Exactly.
| |
| 4 MR. MICHELSON: Why were they concerned about the 5 restart when they were already overfilled?
| |
| 6 MR. SZUKIEWICZ: What they were concerned about, if 7 they lost water, that kind of transient for them was much 8 worse.
| |
| 9 MR. MICHELSON: They have already overfilled the 10 vessel. The last thing you are going to worry about is 11 whether you have got plenty of water.
| |
| 12 MR. SZUKIEWICZ: With that event, I think what they
| |
| () 13 did was they did something with the RCIC pumps. They weren't 14 available. Before that, they tripped the RCIC pumps, they 15 didn't have another water supply.
| |
| 16 MR. MICHELSON: One of the issues which I didn't 17 push very hard on and that is in a steam generator or in a 18 reactor vessel overfill, what happens is the water gets in 19 line, you try to run the HPCI turbine auxiliary feedwater 20 turbines for whatever reason or spurious start-up, I think you 21 might very well bust a hole somewhere. When you open up the 22 low pressure systems, when you open the valve and you admit 23 that inrush, you are going to carry--
| |
| 24 MR. ANDERSON: We are looking at that, but not in 25 A-47.
| |
| I HERITAGE REPORTING CORPORATION -- (202)628-4888
| |
| \ ,
| |
| i
| |
| | |
| y 237 1 MR. MICHELSON: That is why I worry about ever 2 getting--
| |
| 3 MR. SZUKIEWICZ: That overfill problem really.is a
| |
| ~
| |
| 4 border line whether we should do something about that or not.
| |
| 5 We have a number of events. We didn't have any major 6 catastrophies. And with the instances that we did have with 7 some significant water now are now really major concerns, so--
| |
| 8 MR. MICHELSON: We could say the same for THI.
| |
| 9 MR. SZUKIEWICZ: We justified the' overfill scenarios 10 and the concern, but we used very conservative assumptions 11 when it came to postulating breaks as a result of water in the 12 steam line.
| |
| () 13 MR. MICHELSON: If Nine Mile is the only one with 14 high booster pressure, maybe you ought to just address Nine 15 Mile as a special case and then require them to trip their 16 valves as well. The other ones, if the other ones are in the 17 300 pound range, I wouldn't worry about them. That one is 18 sitting there at 600; just too much to swallow.
| |
| 19 MR. SZUKIEWICZ: What we understood, the pressure 20 conditions, they had another failure where they popped a, some 21 kind of relief valve, which dropped the pressure, so they had 22 a number of independent failures that caused the pressure to 23 drop below the cutoff area.
| |
| 24 MR. MICHELSON: Opened one of the valves on the, 25 overflooded the steam line.
| |
| HERITAGE REPORTING CORPORATION -- (202)628-4888
| |
| | |
| . = -
| |
| i l
| |
| 238 1 MR. SZUKIEWICZ: I understand some of the turbine 2 bypass valves. l 3 MR. MICHELSON: Spurious reason or because water was 4 getting to it?
| |
| 5 HR. SZUKIEWICZ: I don't know.
| |
| 6 CHAIRMAN EBERSOLE: When you close up the_ system
| |
| *7 like that with water, it approaches the relief set point of 8 relief systems.
| |
| 9 Does it do so with mechanical pump?
| |
| 10 MR. BAER: This one couldn't get it up.
| |
| 11 CHAIRMAN EBERSOLE: Couldn't get it up there, could 12 it?
| |
| () 13 MR. BAER: I think part of the reason the pressure 14 drops so rapidly was the relief valves and that's what dropped 15 the pressure and they didn't realize it and suddenly booster 16 pump started putting water in it.
| |
| 17 MR. SZUKIEWCIZ: It is a fairly new design. Because 18 of that, you have pressure drops that you don't expect once 19 you get more decay heat.
| |
| 20 MR. MICHELSON: We take great precautions on safety 21 injection and so forth to be sure that we get the water in 22 when we need it and also shut it off when you don't need it at 23 that high level. We have got the elaborate arrangements to 24 stop high pressure injection and intermediate pressure
| |
| {;
| |
| 25 injection. We have no provisions to stop intermediate HERITAGE REPORTING CORPORATION -- (202)628-4888
| |
| | |
| 239 1 pressure condensate, i
| |
| . '. 2 CHAIRMAN EBERSOLE: There is no stopping RHR at all;
| |
| ~
| |
| 3 just keep running. You do the--
| |
| 4 MR. MICHELSON: RHR is the exception, but you are 5 right. Yes. The HPCI RICI we do, very fine auxiliary 6 feedwater control and so forth, but not on RHR, but any rate, 7 here we have got what I call an intermediate pressure pump.
| |
| R 8 It is not a pressure pump. It is just as high as some of the 9 other capabilities like RHR.
| |
| 10 CHAIRMAN EBERSOLE: Let me remind everybody we are 11 running I think 15 minutes--
| |
| ; 12 MR. MICHELSON: I thought we were going to five
| |
| () 13 o' clock?
| |
| i 14 CHAIRMAN EBERSOLE: I am detecting we are about 15 done. Hang on. What--first of all, are there any comments -
| |
| 16 from any of the subcommittee members? Let me say something. [
| |
| 17 First of all--
| |
| l !
| |
| j 18 MR. MICHELSON: Yes, sir. I had four events that we
| |
| ,' 19 had left to bring us a little information on. Are we allowed 20 to go through and ask a couple of questions and seeking 21 information on those?
| |
| 22 CHAIRMAN EBERSOLE: Why not? I am not time 23 sensitive if nobody else is.
| |
| 24 MR. MICHELSON: I want to go on here for several l
| |
| 25 reasons.
| |
| l 1
| |
| HERITAGE REPORTING CORPORATION -- (202)628-4888
| |
| | |
| 240 1 CHAIRMAN EBERSOLE: The.four individual' events.
| |
| 2 'MR. MICHELSON: We have spoken to them, of them a 3 couple of times today already.
| |
| 4 CHAIRMAN EBERSOLE: I am trying to work up a summary 5 of today's discussions.
| |
| 6 MR. MICHELSON: I think we have got time yet unless 7 Charlie is in a hurry.
| |
| 8 CHAIRMAN EBERSOLE: Are you, Charlie?
| |
| 9 MR. WYLIE: No. ,
| |
| 10 MR. MICHELSON: Let's talk first about the Limerick 11 and the Peach Bottom events that you put the LERs on, and I ,
| |
| l 12 think it appears to me pretty straightforward.
| |
| ] () 13 The fact is that they were pretty good LERs I 14 thought. One of the questions was in the case of Limerick, 15 apparently the four wires, one going to each of the four 16 dedicated engines, the trip signals going to the four 17 dedicated engines, were they all bundled in conduit or cable 18 tray? ,
| |
| 19 HR. SZUKIEWICZ: I understand it was in conduits.
| |
| , 20 MR. MICHELSON: All four of them in same conduit, a
| |
| s 21 not four conduits?
| |
| i :
| |
| I 22 MR. SZUKIEWICZ: Exactly.
| |
| 23 MR. MICHELSON: They were clearly non-safety related f 24 because they are classified as such.
| |
| l 25 MR. SZUKIEWICZ: They violated the safety criteria ,
| |
| 1 c HERITAGE REPORTING CORPORATION -- (202)628-4888
| |
| | |
| .i 241 1 for the dedicated generators. [
| |
| 2 MR. MICHELSON: Well, they violated a lot of things, 3 but that was one of them. But now they were apparently missed 4 in the early Appendix R reviews and just picked up more 5 recently? Is that what happened? ,
| |
| 6 MR. SZUKIEWICZ: No. From what I understand, it was 7 picked up on an Appendix R review.
| |
| 8 MR. MICHELSON: It was a sort of re-review or was 9 that the first time through?
| |
| 10 MR. SZUKIEWICZ: That I don't know, and I don't.know !
| |
| 11 which of the two plants, but I guess at one time they didn't ;
| |
| 12 even realize that it was one of those reportable events. Is
| |
| () 13 that the event that they identified?
| |
| 14 MR. MICHELSON: No. That's the one we will talk 15 about next, the Peach Bottom. The Limerick, they reported it 16 in what I would call timely fashion, but I was just trying to 17 understand one detail was just what the problem was with the 18 wiring. Apparently that conduit then was in a postulated fire 19 zone and they realized that the fire was tripped. Now 20 tripping the engines per se was not vital if they assured it 21 was off-site power.
| |
| 22 MR. SZUKIEWICZ: From what I understand, if they 23 would have tripped, they would have tripped the dedicated 24 generators and the dedicated generators would not 25 automatically start on loss of power, but if they didn't have HERITAGE REPORTING CORPORATION -- (2021628-9888
| |
| | |
| 242 [
| |
| 1 an accident, like the loss of coolant, then they could 2
| |
| O% 2 manually start that because there is a safety grade bypass 3 system that is qualified, seismically qualified, 279 4 requirements,-so to bypass all trips on the dedicated 5 generators except two, which is a differential and an 6 overspeed.
| |
| 7 MR. MICHELSON: There is pressure. t 8 MR. SZUKIEWICZ: Now the newer designs, from what I i
| |
| 9 understand, bypass all these interlocks if you have a loss of 10 power. Some of the older designs do not.
| |
| 11 MR. MICHELSON: So a newer design might not be 12 acceptable to this arrangement even if it was designed?
| |
| () 13 MR. SZUKIEWICZ: Exactly.
| |
| 14 MR. MICHELSON: Now do other plants, do you know if 15 anybody else in the country has done this or is this an ;
| |
| ; 16 isolated case or how do we know or when will we know?
| |
| 17 MR. SZUKIEWICZ: We do not know, but I discussed 18 this with Pat Burnowski in the Events Analysis Group, and I 19 looked at the other Peach Bottom event which also had a single 20 failure criteria for dedicated generators, and I said look, f
| |
| 21 and again it was from the same source which was the fire i
| |
| 22 suppression area, and I said look, it looks like there is a i
| |
| 23 trend, and what they told me was that they are looking into it l 24 right now. They recognize this, and they will be s;nding out i
| |
| 25 an information bulletin.
| |
| 1 i
| |
| l HERITAGE REPORTING CORPORATION -- (202)628-4888
| |
| | |
| 1 l
| |
| 243 1 MR. MICHELSON: The case of Peach Bottom, the !
| |
| O- 2 problem there was that they found that they had used four t 3 mercury 2 relays.
| |
| 4 MR. SZUKIEWICZ: Non-qualified equipment.
| |
| 5 MR. MIChELSON: Very likely quite susceptible to 6 vibration, and those kind of devices don't take much of a tap 7 to make them do a lot of things, bumps around. Seismic event-8 is real world. Of course, we have mercury in the CARDOK-9 systems for I don't know how many years, and I thought the 10 staff on more than one occasion--not you people 11 necessarily--assured us that they didn't have mercury switches 12 in the control systems, and I understood after seeing the
| |
| () 13 event Charlie Wylie asked TVA whether they were sure that they 14 didn't have any, and I think the answer that came back finally
| |
| ; 15 was yes, we are sure we don't have any, and they ought not to 16 have any since it was started at, the crew started it at TVA 17 20 years ago on these things. We discovered it didn't at that ,
| |
| 18 time. Although we weren't tripping the engines, the mercury 19 switches were back on the panel at that time and it is our ,
| |
| 20 understanding they were all stripped out in places, and that i
| |
| 21 is what we have been told, too.
| |
| 22 I was surprised why. I don't know--do you know J 23 where thece four switches--were these in the CARDOK panel 24 itself? ;
| |
| O 25 HR. SZUKIEWICZ: I don't know the details.
| |
| HERITAGE REPORTING CORPORATION -- (202)628-4888 ;
| |
| | |
| 244 1 MR. MICHELSON: Was it added somewhere else?
| |
| 4 2 HR. ANDERSON: Don't know.
| |
| 3 MR. MICHELSON: I also wonder if there are four 4 separate CARDOK panel, one for each dedicated compartment, or )
| |
| 5 using a single panel with four branches going off the control 6 rooms?
| |
| 7 MR. ANDERSON: We don't know the details.
| |
| 8 MR. MICHELSON: There is a-lot of things here you 9 worry about when you start talking about these kinds of 10 systems, and we have been addressing this in the fire 11 protection for quite a while now, and this couldn't have been j 12 more timely in that regard, because we were absolutely sure ;
| |
| i
| |
| () 13 that kind of problem doesn't exist anymore. CARDOK doesn't 1
| |
| 14 have, although they aren't seismically qualified, they don't l l
| |
| 15 have the mercury switches. I don't know if they do yet. l G
| |
| 16 HR. DAVIS: I had a comment on this event also. i i
| |
| 17 There is a little discussion under the significance of event, 1
| |
| 18 and I was a little bit disturbed by the statement that this i l
| |
| 19 had a small impact because seismic event would have had to i
| |
| 20 occurred at the same time as a loss of off-site power, i
| |
| 1 l 21 suggesting that these are independent events, and if you look i
| |
| ! l
| |
| ! 22 at some of the PRA work, one of the first things that occurs j
| |
| ; 23 during seismic event is loss of off-site power, and I think j 24 that this does not adequately reflect the concern over this
| |
| (~}
| |
| s-25 problem. i l
| |
| 1 i
| |
| 1 J HERITAGE REPORTING CORPORATION -- (202)628-4888 l t -. -. .
| |
| | |
| 245 !
| |
| 1 CHAIRMAN EBERSOLE: Reflects the concern over 2 something else--the quality of the people who wrote the 3 report. h 4 HR. DAVIG: That is what I was going to ask next. (
| |
| 5 Was this written by the utility?
| |
| 6 MR. SZUKIEWICZ: This is written by the utility. !
| |
| 7 MR. DAVIS: They perhaps should be made aware that J
| |
| 8 the ceramic insulators in the substations are going to go l 9 about .1G approximately, although we have had some survive as 10 high as .9 in Colico, but there is a lot of variation.
| |
| 11 CHAIRMAN EBERSOLE: There isn't a clue as to other, 12 other strange viewpoints that might be coming-from that same
| |
| () 13 operating organization.
| |
| 14 HR. DAVIS: There was another statement later on 15 saying that seismic is not a problem for the plant. That's 16 the impression I got, because they have two off-site sources 17 of power and it is unlikely a seismic event would get a bolt.
| |
| 18 I think it is very likely that seismic even would get a bolt.
| |
| 19 MR. ANDERSON: Probably happen in the switchyard.
| |
| 20 MR. DAVIS: About 70 percent of the losses of power 21 occurred in the switchyard.
| |
| 22 CHAIRMAN EBERSOLE: Whose was the statement?
| |
| Q 23 MR. DAVIS: There is a guy's name at the front here.
| |
| I 24 CHAIRMAN EBERSOLE: I think we ought to have a word j 25 with him. j HERITAGE REPORTING CORPORATION -- (202)628-4888
| |
| | |
| ~
| |
| b.
| |
| l 246 !
| |
| i l
| |
| 1 HR. WYLIE: He is out of the licensing section. i l
| |
| ( 2 MR. SZUKIEWICZ: He is not in NRC.
| |
| 3 MR. MICHELSON: The other thing I wondered about is 4 Peach Bottom did a PRA. Has anybody gone back to see what P
| |
| 5 Peach Bottom did in their PRA Khen it came to the stuff like
| |
| ; 6 the fire protection system and the dedicated rooms and whether 7 they included that in their PRA?
| |
| 8 HR. SZUKIEWICZ: I suspect nothing was done.
| |
| 9 MR. MICHELSON: I have no way of--
| |
| 10 MR. ANDERSON: I don't know that anyone--
| |
| 11 MR. MICHELSON: I was just curious. PRA could have 12 picked this up pretty easily if it were, you know, well 6
| |
| () 13 modeled and everything. This is very straightfsrward. Here 14 is a dedicated engina tripped by a single from a non-seismic, 15 not qualified source, and it is in the process of making up 16 your models you come across that.
| |
| l 17 MR. DAVIS: This would have been a good test for the 18 PRA to see.
| |
| j 19 MR. MICHELSON: I suspect PRA just said we aren't 4
| |
| 20 going to get into the fire protection, i n
| |
| l
| |
| ; 21 MR. DAVIS: It might occur as a fragility estimate 1
| |
| L 3 22 for the diesels if in fact they looked at that. l 1 l 1
| |
| ! 23 MR. MICHELSON: That is about the only place you l
| |
| 24 could put it. There aren't any good numbers for fragility of !
| |
| l 25 these non-seismic fire protecti_.. systems, but on that I think l l
| |
| HERITAGE REPORTING CORPORATION -- (202)628-4888 l I
| |
| | |
| 247 1 the probability in this case is virtually nil that the engines O
| |
| 's/ are going to trip.
| |
| 2 3 MR. ANDERSON: The mercury relay, I would have to 4' agree with that.
| |
| 5 MR. MICHELSGN: The final question on detail on this 6 one, as you look to see if the signal from the mercury relay 7 comes in first, does that lock out or how far does that lock 8 out operator actions starting the engines manually or how, how 9 hard is the recovery when this signal comes in und does it 10 lock in and how hard? ,
| |
| 11 MR. ANDERSON: I don't know. The check that I made, .
| |
| I 12 I was quite concerned when I saw that. We are getting ready
| |
| () 13 to go on on A-46 and look at these systems, including the 14 diesels. We have a relay' review procedure which includes a i
| |
| 15 systems check.
| |
| 16 MR. MICHELSON: Look for mercury switches?
| |
| i 17 MR. ANDERSON: That's right, but the way we found, 18 the way that the A-46 relay systems review would have found it j l
| |
| 39 is that they would have traced back the set of contacts that I
| |
| 20 has the capability of tripping the diesel and they trace back, l 21 find those contacts, and powered by that mercury relay in the ;
| |
| 22 system would have gone because one of the, one of our primary 23 ground rules is you don't use mercury switches, you know, and l 24 after talking to the people at the, that develop the 25 procedure, and after looking at how the procedure reads, I I
| |
| l l HERITAGE REPORTING CORPORATION ---(202)626-4888
| |
| | |
| 248 1 have no doubt that doing that systems review, they would have
| |
| ('%
| |
| N/ 2 picked up those switches.
| |
| 3 MR. MICHELSON: That hasn't been done on Peach 4 Bottom?
| |
| 5- MR. ANDERSON: Has not been.done on Peach Bottom. .
| |
| 6 MR. MICHELSON: One final point on this thing, and ;
| |
| 7 that is that with the way these relays are actuated, I 8 think--I am only speculating, but you, if you have looked'into 9 it, I think when the actuation panel actuates the CO 2, the CO 10 2 pressure actuates these relays. That's where they call them 11 electric relay I believe, because they are probably--very f
| |
| 12 often on a CO 2 system you use the pressure to do other things
| |
| () 13 like trip louvers closed. At Surry they tripped louvers 14 closed with that CO 2 pressure. So the interesting thing here 15 is that you need to really go back to the panel itself, 16 whatever set off the CO 2 system, and be very careful to see 17 what kind of common modes do that. May be water in the area.
| |
| 18 May be a fire in the area or whatever. May be the fire under 19 the panel is the worst thing that can happen.
| |
| 20 MR. SZUKIEWICZ: They just decided to remove them 21 and get something that would be qualified. -
| |
| I 22 MR. MICHELSON: That doesn't remove the problem.
| |
| 23 That only removes one aspect of the problem. The other aspect 24 of the problem still is these things here would not only, are 25 only one of the triggers. Another trigger is back in the HERITAGE REPORTING CORPORATION -- (202)628-4888
| |
| | |
| 249
| |
| ~
| |
| L whatever actuates the CO 2 system, because I can have a common q\ / 2 mode actuation of all four diesel compartments even though the 3 engines don't trip. Then what I have to worry about is how 4 the engine compartment functions with CO 2 filling it up.
| |
| 5 MR. SZUKIEWICZ: Since the diesel generator is a 6 safety-related piece of equipment, you have to make sure that 7 the single failures do not knock out the system per se.
| |
| 8 MR. MICHELSON: Whatever you did to assure that 9 should have picked this up long age.
| |
| 10 MR. SZUKIEWICZ: Those kind of contact--exactly.
| |
| 11 That's where it was a total oversight because I guess some 12 people recognize that it is. Others you need to--
| |
| () 13 MR. MICHELSON: Is it also oversight that we haven't 14 looked at the CARDOK control system to see what sets off the 15 CO 2 in all of this?
| |
| 16 MR. ANDERSON: Just the fact they have the mercury 17 switches leads me to believe they haven't looked at it for 18 many, many years.
| |
| 19 MR. MICHELSON: In the case of Surry, we worried 20 about it differently. There this is the same kind of a 21 triggering device. Instead of triggering the diesels, they 22 don't even know it yet, but it closed the ventilation to the 23 room, and the, all the air cooling from the engine comes out
| |
| 'N 24 of the room in that case. Sequoyah does not. This is (O
| |
| 25 Limerick. Peach Bottom does not. But in Surry's case, they HERITAGE REPORTING CORPORATION -- (202)628-4888
| |
| | |
| 250 1 take the cooling from radiators out of the room. When you p/
| |
| s- 2 close off the louver, you are done. That is, the engine will 3 last a few minutes without cooling. That's it.
| |
| 4 MR. SZUKIEWICZ: We do an audit review when we go 5 out to the plant, and one plant, we might gone through, looked 6 at the CARDOK system. They had completely different relays to 7 send the signal to the diesel generators, and another one, 8 they might have focused on a completely different aspect of it l
| |
| 9 to see how it would go. These kind of things do--
| |
| 10 MR. MICHELSON: Another problem I understand with 11 Surry, and I have to admit it is only hearsay, I think a l
| |
| 12 fairly reliable authority, was at Surry they told me they had
| |
| () 13 gone about and seismically qualified the CARDOK system. That 14 was part of what they said they did, and that person said--I l l
| |
| l 15 checked on another authority because I wondered how they did !
| |
| l 16 it. I checked another case and they said what they did aas to j 17 stay on the wall and so forth. They had not gone into the 18 circuitry to qualify the seismic effect on the circuitry to l 19 make sure that it did not spuriously actuate. ,
| |
| 1 20 That's only hearsay. I won't say it is right or l 21 wrong, but it is something you need to look into. They claim 22 they do seismically qualify, but what have they really done?
| |
| 23 It is questionable.
| |
| 24 In the case of this LER which is the one that, 25 relating to the Sequoyah fire pumps coting on load, do you HERITAGE REPORTING CORPORATION -- (202)628-4888
| |
| | |
| 251 1 know what size those fire pumps are? I think they said they (3
| |
| ss' 2 haven't found out yet.
| |
| 3 MR. SZUKIEWICZ: I don't know.
| |
| 4 MR. MICHELSON: Do you know how many there are?
| |
| 5 MR. SZUKIEWICZ: I think it was one on each bus, but 6 I'm not sure.
| |
| 7 MR. MICHELSON: It wasn't clear in here. This is 8 not the best written LER I have seen.
| |
| 9 MR. SZUKIEWICZ: -A lot of them are not.
| |
| 10 MR. MICHELSON: Didn't tell me really for sure how 11 many pumps, how they are were arranged and it didn't tell me, 12 tell me how big they were, but this again is what I call a
| |
| () 13 control system interaction problem. Now there has been an 14 event recently--
| |
| 15 MR. BAER: It is an implementation problem.
| |
| 16 MR. MICHELSON: It is an example of systems 17 interaction. You have got to look at all of loads on the bus 18 that are non-safety that can be brought on later to make sure 19 they aren't brought on earlier.
| |
| 20 MR. SZUKIEWICZ: There are a lot of different groups 21 and divisions within NRC to look at different areas of the 22 plant, and because of that, and I reiterate what I said 23 before, we scope the problem for areas that has not
| |
| {) 24 traditionally been looked at.
| |
| 25 Now if you are saying that really we should go back )
| |
| I i
| |
| 1 HERITAGE REPORTING CORPORATION -- (202)628-4888
| |
| | |
| 252 1 and look at the adequacy of the safety-related equipment which
| |
| ('/)
| |
| \- 2 is really your major concern, I agree with you that you know, 3 we should look into this and prioritize it.
| |
| 4 MR. MICHELSON: It will be part of residual study.
| |
| 5 MR. SZUKIEWICZ: What I would like to see, what I 6 would like to see is a different specific area so you could 7 focus in on these more well-defined problem areas, and not 8 again go into a control system A-47 type of a problem which 9 was really a witch hunt.
| |
| 10 MR. MICHELSON: What I would like to do--
| |
| 11 MR. BAER: I would think a much more straightforward 12 way if one can come up with enough examples on the specific
| |
| () 13 area of overloading of diesel non-safety loads coming on 14 diesels, and I know there has been at least a couple of '
| |
| 15 information notices, is to try and gather up enough 16 information, go over and talk to the people.who put out 17 bulletins and put out a bulletin to get every licensee to go 18 look at it. There has been at least one information notice on 19 that subject. That's discussed earlier. That's clearly 20 implementation of an existing requirement, because if you put 21 it into the multi-system response program, it is going to kick 22 out as already covered by regulations.
| |
| 23 MR. MICHELSON: Here is what bothers me, and I think 24 this would take care of the problem, and that is who is 25 watching the LERs, the deficiencies, and whatever that come in HERITAGE REPORTING CORPORATION -- (202)628-4888
| |
| | |
| 253 1 that tell us that things aren't quite as planned? Who is r~
| |
| (_)% 2 responsible to watch that in terms of whether or not we have 3 now seen enough experience of a particular kind so that it 4 re-elevates a generic issue perhaps that was dead, it was 5 discarded, low priority,'re-elevate it up to a medium or a 6 high? Who is watching to see when it is time to re-elevate 7 the, or alternatively time to generate a new one? And 8 everybody is watching is not a good answer because then 9 nobody--
| |
| 10 MR. ANDERSON: The people who are doing it 11 systematically are AEOD.
| |
| 12 MR. MICHELSON: I am not convinced they are looking I'l 13 at it from a viewpoint of generic issues that perhaps were on v
| |
| l 14 the low end and now need to be reactivated.
| |
| 15 MR. ANDERSON: Recurring events, operating history 16 indicates that there are, there is still problems in that 17 area, and then it would resurface.
| |
| 1 i
| |
| 18 MR. BAER:
| |
| May be flagged as request for bulletin.
| |
| 19 MR. MICHELSON: They understand they are watching )
| |
| 20 for that sort of thing and they are the ones responsible to 21 flag when they see that?
| |
| 22 MR. ANDERSON: Whether or not it is a generic issue, 23 any recurring problem--
| |
| 24 MR. MICHELSON: Don't really get--I am going to have
| |
| {s })
| |
| 25 to ask them that question at the next opportunity here to see HERITAGE REPORTING CORPORATION -- (202)628-4888
| |
| | |
| 254 l 1 if that that is the case. If it is the case, it is a
| |
| '\
| |
| (d
| |
| ' 2 perfectly good answer. I am not convinced that they 3 appreciate that as part of their charter.
| |
| 4 MR. ANDERSON: I have discussed it with several 5 individuals doing the studies there. As a matter of fact, 6 they have contacted us because they have picked up events and 7 they are doing studies on these events that are the same areas 8 of our generic issues. And they contact us, want to know what 9 is going on and tell us what they are doing, and in addition, 10 we get periodic reports from them telling what areas they are 11 interested in, what kind of reports they are doing, and what 12 areas they are highlighting from experience. So you krr .w , I
| |
| () 13 really don't know what more could be done there.
| |
| 14 MR. MICHELSON: May very well be they are doing it, 15 in which case I would have--
| |
| 16 MR. BAER: I am not sure they are doing it.
| |
| 17 MR. MICHELSON: I appreciate they are.
| |
| 18 MR. BAER: That they are just--I don't think they 19 are focusing on hey, here are generic issues that were 20 prioritized low or drop but I do think they are looking for 21 reoccurring events and they are not shy, as you know, about 22 picking them up when they think they have seen some.
| |
| 23 MR. MICHELSON: This new project that you are going 24 to start, is this going to be identified as a generic--how are 25 you getting this new project going which is handling these HERITAGE REPORTING CORPORATION -- (202)628-4888
| |
| | |
| 255 1 residuals from A-17 and A-47?
| |
| /~'t
| |
| \> 2 MR. BAER: It is going right now.
| |
| 3 MR. MICHELSON: Is it a new generic issue then or--
| |
| 4 MR. BAER: Doesn't have a number as such. We call 5 it multi-system response program. It is an ongoing program.
| |
| 6 As issues come out, we will send them over to be prioritized.
| |
| 7 MR. MICHELSON: In the case of A47, I would expect 8 to see in the resolution what residuals that you recognize f
| |
| 9 from A-47 that you didn't treat, and I would expect to see a 10 statement that they will be picked up and identify the issues, 11 and who is going to as a part of resolution of A-47, and then 12 I would, when I go to this other group, they don't act like
| |
| () 13 they never heerd of it. Here is the resolution of A-47 and 14 says you are going to start doing this, this and this, and 15 there is no question. I don't want to get this circular 16 thing, fire protecti:n interaction where it all keeps going 17 around the circle. I think it is still going around the )
| |
| 18 circle.
| |
| I i
| |
| 19 MR. ANDERSON: Okay. What it would say is that it i 20 had been identified, and is being considered.
| |
| 1 21 MR. MICHELSON: This also leaves the reader to 1 22 realize there is a residual that wasn't really resolved by i
| |
| 23 this issue, but it was being transported now to another group l
| |
| /~% 24 to monitor and to work on and maybe elevate it eventually to V
| |
| 25 the issue if there is justification, but it leaves the reader HERITAGE REPORTING CORPORATION -- (202)628-4888
| |
| | |
| 256 1 at least feeling that you haven't--one of two things. Either
| |
| . 2 you didn't even recognize it to begin with, or you just let it-3 fall in the cracks, excluded that. You say yes, 1 recognize 4 here is a problem, and I am, it is not going to fall in the-5 crack. It is going to go into the specs project and they 6 recognize they are catching the ball. Otherwise it is lost.
| |
| 7 At least it is lost when you go to that project, says we don't 8 have any money, we haven't work on that; furthermore, it is 9 not our responsibility anyway, which is what you tell me on 10 some things that I ask you about that I thought you were 11 doing.
| |
| 12 HR. ANDERSON: It is all those other guys.
| |
| () 13 MR. EBERSOLE: I sure want to emphasize all these 14 tnings you are doing ' is going to appear in the new 15 plants, the APWR and the other ones.
| |
| 16 MR. MICHELSCN: That is another whole problem. l 17 CHAIRMAN EBERSOLE: The things you are resolving 18 here ought to appear as improvements.
| |
| 19 MR. BAER: I can't talk about the light water 20 reactors, but my branch has generic issues branch of 21 activities. We are doing, providing input on some of the l l
| |
| 22 advanced liquid metal and gas cooled reactors. Those are far l l
| |
| 23 off and it is, it is not even the equivalent of-- !
| |
| 24 CHAIRMAN EBERSOLE: It is providing input like we 25 are talking about to the APWR. ;
| |
| HERITAGE REPORTING CORPORATION -- (202)628-4888 t -. -
| |
| | |
| 257 1 MR. BAER: Those plants, and I assume the light 2 water reactor plants,'have a commitment to go back to every 3 generic issue, including the ones listed-in 933 that were 4 listed as low and drop, and as I say, I am pretty sure the 5 water reactors are doing this also. j 6 MR. MICHELSON: They are not doing the low and the ;
| |
| 7 drops. Look at the high and mediums.
| |
| 8 MR. BAER: Gas cooled and liquid' metals are making a 9 statement.
| |
| 10 MR. MICHELSON: We got the distinct impression from 11 our early talks with him they were going to review every one 12 of the high and medium.
| |
| (]) 13 MR. BAER: My people aren't working on the water 14 reactors.
| |
| 15 MR. MICHELSON: I could be wrcng. I usually am.
| |
| 16 MR. BAER: I know at one meeting we were told that 17 the advanced liquid metal and gas cooled, not all.of these 18 applied to those reactors, but they are systematically looking 19 at them.
| |
| l 20 MR. MICHELSON: The reason I think you are, that's l 21 the right way to go is that sometimes you put something down l 22 low because it was so darned expensive to fix, you know, in 23 terms of its potential risk contribution, that it wouldn't 24 have been sensible to do on a brand new plant, and so I have 25 been concerned about the, you know--okay. If something be HERITAGE REPORTING CORPORATION -- (202)628-4888
| |
| | |
| l 258 l l
| |
| 1 low, dropped, just because I recognize that'the issue of what 7~
| |
| \ 2 can you'do with the, resources that you already have,.that 3 doesn't, that should not be the argument on a brand new plant.
| |
| 4 MR. EBERSOLE: A while ago you mentioned you did 5 retain all the low and--but in the light of that, I think' 6 these should be resurrected for the very reason that he says.
| |
| 7 They were low because it was just--
| |
| 8 MR. ANDERSON: I think that is an excellent point.
| |
| 9 A lot of those are 'ow because they are a multi-million 10 dollars system, sure.
| |
| 11 MR. BAER: Chet Siess, his subcommittee, it is his 12 subcommittee that is looking at generic issues.
| |
| ({) 13 CHAIRMAN EBERSOLE: Ought to make that point 14 explicit.
| |
| 15 MR. BAER: We are not really the people that handle 36 it.
| |
| 17 MR. MICHELSON: Charlie, the question that has come-18 up about the generic issues that EPRI agreed.to re-review and 19 each one of the boiler and pressured people are going to for 20 the advanced light water reactors, what was your impression as 1
| |
| 21 to whica ones of the issues they looked at?
| |
| i 22 MR. WYLIE: I don't know. I think that,-I mean they 1 23 said they were going to, going to consider all of them.
| |
| 24 MR. MICHELSON: I was tying to recollect. I 25 thought--I don't want to put words in your mouth, but I ;
| |
| t i
| |
| HERITAGE REPORTING CORPORATION -- (202)628-4888
| |
| | |
| ._ . ,. , __ .. . . . . ._~
| |
| 259 thougnt they said we will consider al1 the high'and medium,
| |
| ( 2 not the low and drops, but I am not sure. I think they.noed 3 to go look st the lc9 and drcpt because they were dropped, 4 they were made low because of the very high cost in proportion 5 to the risk.
| |
| 6 HR. WYLIE: I have had them go'back now-7 MR. MICHELSON: I thought when we queried them they 8 all met all of those--
| |
| 9 MR. WYLIE: Maybe-that is right. You are probably 10 right.
| |
| 11 MR. MICHELSON: Don't know for sure.
| |
| 12 MR. WYLIE: They said all of them first.
| |
| () 13 MR. MICHELSON: I think they did, and upon querying 14 them what do you mean by all of them, they meant-all of those 15 the staff was handling then, but we need to do that next
| |
| * 16 meeting we have. We will pursue it with them and won't let it 17 slip by.
| |
| 18 CHAIRMAN EBERSOLE: Did we get through your four 19 ce;es?
| |
| 20 MR. MICHELSON: Yes. There was actually one I 21 didn't bring up.
| |
| 22 CHAIRMAN EBERSOLE: Are we in a summary mode now? I 23 think maybe--let me give you my impression. I have got to go 24 back--this is my swan song, but I have got to go back before 25 the 31st anyway, examine these at Idaho and see, in fact' HERITAGE REPORTING CORPORATION -- (202)628-4888
| |
| | |
| 260 1 inspect these oversupplies. I have got to go back'and look1 at 2 these FEBAs and verify that they did look at excess flows, 3 pressures and supplies, and intermittent supplies with 4 variable power supplies and so forth that would tend to 5 misinform and cause malfuncticns of the safety systems, to 6 back them up or limiting systems.
| |
| 7 I would li).e to ask you, 'do you concur in the 8 impression that we don't really know whether that has been 9 done yet or not? I don't hear that it has. I heard Sid say 10 that it did, but then I heard Carl say, and my impression was 11 in reading them quickly over the last few days, they did not c 12 look at the excess of supplies.
| |
| () 13 MR. MICHELSON: The one at Calvert Cliffs, they had 14 not considered high air pressure, only considered loss of air.
| |
| 15 CHAIRMAN EBERSOLE: Historically the failure of 16 anything has been considered the abrupt disappearance of same.
| |
| 17 Never the excess or the oscilatory performance of some service 18 system, and I think this is a broad generic void in our 19 approach to these problems.
| |
| 20 MR. MICHELSON: By the way, Jesse, we didn't really 21 get into the discussion of these borderline voltages and 22 borderline areas where instruments do funny things, and they 23 are best all, to lose all their air.
| |
| 1
| |
| {} 24 CHAIRMAN EBERSOLE: I am including that in 25 oscilatory losses and variability.
| |
| HERITAGE REPORTING CORPORATION -- (202)628-4888 ;
| |
| i
| |
| | |
| 261 1 MR. MICHELSON: I don't think you have even m
| |
| (k l 2 considered that in systems interaction.
| |
| 3 CHAIRMAN EBERSOLE: That gets down to--
| |
| 4 MR. MICHELSON: Partially degraded air.
| |
| 5 CHAIRMAN EBERSOLE: What you might call out the 6 Salem case where we had a margin of force to come out; classic 7 expression as far as I am concerned. Here is the margin of 8 function. To hold a function properly you have got to have 9 some excess of a service to make it work.right, of something.
| |
| 10 MR. ANDERSON: I know in systems interaction one 11 concern was the failure modes and plant positions, and also I 12 know that, I remember one case specifically.where we were
| |
| () 13 looking at motor operated valves, looked at the operators and 14 what margin for operation that they had in terms of valve, and 15 we were talking about the hammer being moved off of the center 16 when they went to open it, enough left in it to pull'it off 17 the seat, and so I know that we have looked at it. It may be 18 not in a comprehensive manner.
| |
| 19 CHAIRMAN EBERSOLE:
| |
| ~
| |
| One case, an old gravity may 20 seal very well if there is pressure, but if there is not 21 pressure, it will leak like a sieve.
| |
| 22 MR. MICHELSON: I did go back and look at some of 23 FEMAs, but I found that what they were looking at'on total
| |
| {} 24 loss of voltage, all through the control elements fail. Some 25 fail as is. Some fail downscale. Some fail upscale. I HERITAGE REPORTING CORPORATION -- (202)628-4888
| |
| | |
| 262~
| |
| l didn't find in the FEMA what happens when we get town to 80
| |
| (~)
| |
| k/ 2 percent voltage on the device or for whatever reason, and now 3 how does--may be the same answer. I am not sure. I don't 4 know and they didn't say.
| |
| 5 MR. ANDERSON: With' regard to valve openers, I 6 remember that one specifically that, because we did talk to 7 the manufacturers about what their performance would be with 8 degraded voltage.
| |
| 9 MR. MICHELSON: On that one, we recently, in our 10 subcommittee meeting we got a great deal of detail on that.
| |
| 11 Turned out to be a non-problem.
| |
| 12 MR. ANDERSON: That is what we concluded. I know
| |
| () 13 that this was looked at in other areas. I don't know how 14 extensive.
| |
| 15 MR. MICHELSON: That is the principle here we are 16 discussing, and I think that we kind of focused always on the 17 loss of the function, I mean loss of a supply and auxiliary 18 supply, and not on its degradetion to some new or lower level.
| |
| 19 MR. SZUKIEWICZ: In the context of A-47 for 20 non-safety grade control systems, we did look at that. We 21 didn't find any intermediate values to be worse than the fully 22 open, fully closed valve.
| |
| 23 MR. MICHELSON: Wait a minute. You looked at fully 24 opened, fully closed?
| |
| 25 MR. SZUKIEWICZ: As far as, for example, we didn't l
| |
| HERITAGE REPORTING CORPORATION -- (202)628-4888
| |
| | |
| 7-263 l
| |
| 1 look at what would happen if you had 50 percent flow, if it 2 was going to be worse than--
| |
| 3 MR. MICHELSON: What we are saying is what is the 4 difference between having no air pressure at all or having 150 5 pounds or having the normal air pressure and how does the 6 equipment behave as you degrade from a hundred pounds maybe j 7 down to 70 pounds and not down to zero?- Now what happens?
| |
| 8 And I think you are saying that that didn't make any l f 9 difference?
| |
| 10 MR. SZUKIEWICZ: In the context of the scope of what 1 1
| |
| 11 we looked at, but again,-going back to your concern about how 12 this degraded condition can affect protection systems, that we r~
| |
| 13 didn't know.
| |
| 14 MR. MICHELSON: You also didn't look at what- happens 15 with the pressure being a hundred pounds, goes up to 150 I l 16 think you said--
| |
| 17 MR. BAER: Right. I think we did not. I don't.
| |
| 18 think we did. Sid said he thought he did, but I have a note j i
| |
| 19 that the air system-- l 1
| |
| 20 MR. MICHELSON: This report on Calvert Cliffs is it 21 didn't treat the overpressure, only the various underpressure 22 conditions, and by that I mean various reasons to lose all 23 pressure is what they did. Apparently did a good job of that.
| |
| {} 24 MR. SZUKIEWICZ: I recommend you look always at the 25 BWR and the Westinghouse analysis because in some cases, HERITAGE REPORTING CORPORATION -- (202)628-4888
| |
| | |
| 1 264- l 1 instead of looking at the, that particular concern, they !
| |
| /~T
| |
| \/ 2 looked at the end result of what would happen to the actual 3 controllers that were being affected by the air system, and 4 there they ran a number of transients, so--and if the 5 transients weren't significant, then they wouldn't_go back and 6 they wouldn't care if it goes 50 percent open, or 90 pounds, 7 and if the worst case is a hundred percent open, it'really-8 doesn't matter. Can the air system get you that high? Some 9 other component or some other failure can, and that's what 10 they were focusing on.
| |
| 11 MR. MICHELSON: One of your real problems is going 12 to be you don't have a very good data base on how equipment
| |
| () 13 forms. You don't know what reduced air does to_a piece of 14 equipment, or elevate it or--you almost have to do a test on 15 the equipment.
| |
| 16 MR. SZUKIEWCIZ: That is why in a lot of cases we 17 had to do what we call the bounding analysis.
| |
| 18 MR. MICHELSON: Bounding is always thought to have 19 been no air at all, but that may not be the bound. There may 20 be more severe cases immediate. That's what, was-the case, 21 very case in the case of boiling water reactors SCRAM control, l 22 You have got to get all the air off. That's why they go back 23 in and beefed up the bleed-off systems, dumping all the, all 24 the pressure off. Intermediate pressures caused them to leak 25 and fill up before they can SCRAM.
| |
| HERITAGE REPORTING CORPORATION -- (202)628-4888
| |
| | |
| 265 1 CHAIRMAN EBERSOLE: I am going to rope in some I')
| |
| \- 2 opinions just as a discussion here. Paul, I always enjoy your 3 reports on these. This has been a particularly interesting 4 session. Give us your views to admit here.
| |
| 5 MR. DAVIS: 'I had a couple of comments related to 6 NUREG 1217 which is supposedly the document that formed the 7 basis for making the decision on this issue, and I must 8 confesc I didn't have time to read it carefully, but I didn't 9 skip through all of it. My concern is 1 didn't see much in 10 here--in fact, I saw almost nothing in here on the risk l
| |
| 11 significance of these events.
| |
| 12 MR. SZUKIEWICZ: That would be 1218, NUREG 1218.
| |
| () 13 That's the regulatory analysis.
| |
| 14 MR. DAVIS: That one I didn't see. This one showed 15 a bunch of events. Some of them have probabilities as high as 16 about ten to the minus two and some as low as ten to the minus 17 eight, but I couldn't tell whether I should worry about any of 18 them because none of them lead directly to core melt. There 19 has to be some consequential failures, at least one, and then 20 usually some additional failures of safety systems before you 21 get into the loss of cooling.
| |
| 22 MR. SZUKIEWICZ: We summarized what your concerns 23 are in NUREG 1218. However, you will have to go back to the
| |
| {} 24 specific PNL contractor reports which describe the risk 25 analysis and the assumptions made and even identifies in a lot HERITAGE REPORTING CORPORATION -- (202)628-4888
| |
| | |
| 266 1 more dialogue what the conservatisms are.
| |
| (\ > 2 HR. DAVIS: That's fine. I didn't realize 1218 was 3 something that we needed to look at.
| |
| 4 MR. BAER: At least you read the right one first 5 because our format has the regulatory analysis first and then 6 the technical findings, and it is much worse to read the 7 regulatory analysis without knowing what the technical 8 findings are.
| |
| 9 MR. DAVIS: The other concern I had, and this was 10 the last one, again I didn't read it in detail, but the human 11 error rates that are quoted in here seem to me to be extremely 12 high. They are like .3, .4, and .7, and I did see some words
| |
| () 13 like if there was--some of the contractors assumed that if 14 there was only ten minutes available, there was, no human it action was assumed at all. ;
| |
| 16 Other contractors used some third or some other kind 17 of analysis, and it seemed like a fairly inconsistent approach 18 to that problem, and I think it is very important for these I
| |
| 19 kinds of events, and it looked like a good many of these human 20 error rates were excessively high. I don't know whether that 21 was done as part of the analysis that you were doing or 22 whether there were, really was belief in those kind of 23 numbers.
| |
| l r3 24 MR. SZUKIEWICZ: We factored in the time of l V
| |
| 25 transient and you know, the severity of the transient to give i
| |
| HERITAGE REPORTING CORPORATION -- (202)628-4888 I J
| |
| | |
| 267 i
| |
| 1 the operator time to respond, and that's sometimes, depending s/ 2 on failure mechanism or the scenario, some-of them were higher l
| |
| 3 than others, but that depended on the transient, sequence of 4 events.
| |
| 5 MR. BAER: Even when we went to CRGR, one of the 6 comments we got from a member of CRGR was somewhat similar.
| |
| 7 He thought we were very conservative on human error, and on 8 probability of steam line break given an overfill event, and 9 what we have done since, and this individual has reviewed it 10 and agrees and we went ahead and we did a sensitivity analysis 11 where we varied not human factors failure rate in itself, but 12 lumped it all together with the probability of steam line
| |
| () 13 break, which is the crucial event, by a couple orders of 14 magnitude, and what we found was that in most cases, our 15 decision wouldn't change, but in some cases, I think if the 16 steam line break probability went down I think two orders of 17 magnitude, there was a couple of cases where--
| |
| 18 MR. SZUKIEWICZ: Marginal in some cases.
| |
| 19 MR. BAER: And revised draft that has an appendix.
| |
| 20 MR. SZUKIEWICZ: The operating frequencies or the 21 frequencies that we identified in those reports were based on 22 failure rate data, and operator responses that we took as best 23 estimates. In the sensitivity P.nalysis, as Bob mentioned, we 24 compare those results to the actual operating history, and
| |
| }
| |
| 25 found that although we were off on an order of, a factor of HERITAGE REPORTING CORPORATION -- (202)628-4888
| |
| | |
| 268 1 two or three off, which was still within the uncertainty bands 1 2 of our analysis.
| |
| 3 MR. BAER: We did vary other parameters a couple 4 orders of magnitude.
| |
| 5 CHAIRMAN EBERSOLE: I have got interesting reaction 6 from the absolutely required operator action to pick up the 7 LOCA cooling process by hand on the builders; you know, the 8 primary loop process is automatic, start the flooding waters, 9 but the heat rejection system is not. You have to manually 10 start the service water systems up and get the heat out of the 11 circulating systems by hand.
| |
| 12 I have numerous instances of divergent opinions as
| |
| () 13 to whether that is proper. If the operator is going to do 14 that, he is up the creek. He has to bring on by hand the 15 service water rejection system in the case of a LOCA. It is a 16 little funny. Then it gets into the broad issue which is is 17 the operator a control system? If so, can we depend on him as 18 the human-being or should we automate? Test a control system.
| |
| 19 MR. DAVIS: You are talking about the suppression 20 cooling?
| |
| 21 CHAIRMAN EBERSOLE: Yes. f 22 MR. DAVIS: The PWR has a similar problem when they 23 have to go fro.T. injection to recirculation.
| |
| f 24 CHAIRMAN EBERSOLE: It was later on down the road.
| |
| 25 MR. DAVIS: For large break with all systems going HERITAGE REPORTING CORPORATION -- (202)628-4888
| |
| | |
| 269 1 full force.
| |
| G
| |
| / 2 MR. BAER: I headed up a task force a number of 3 years ago that looked at it, and the disturbing part was it 4 was not a known time. Given variations in rate flow whether 5 you had a single failure or didn't have a single failure, not.
| |
| 6 only under ECCS but on your containment spray, the time that 7 the operator had to start was quite variable, and you had a 8 window of time that depends again how many systems were 9 running.
| |
| 10 MR. DAVIS: I have one final general observation, 11 Mr. Chairman, and it seems to me like a lot of these problems 12 we have discussed today should be picked up as part of the
| |
| () 13 individual plant examination initiative where each utility is 14 supposed to determine if they have a severe act vulnerability, 15 and since a lot of these issues are plant-specific problems, 16 it occurs to me that that is the place where they should
| |
| [
| |
| 17 examine these things.
| |
| 18 I don't think it should be up to the NRC to look at 19 all of these things. The problem is that most PRAs don't pick 20 up all of these things. If you could take the best features 21 of all the PRAs then you might get most of them, but I don't 22 think that's the, right now at least, the thrust of tne IPE 23 examination, but it could be, and I think that's the place
| |
| (} 24 where these kinds of problems should ce picked up.
| |
| 25 CHAIRMAN EBERSOLE: Do you think this would be HERITAGE REPORTING CORPORATION -- (202)628-4888
| |
| | |
| 1 l
| |
| l 270 1 picked up in the--what's the acronym we have got for the PRA?
| |
| s 2 That's the comment.
| |
| 3 MR. DAVIS: IPEM?
| |
| 4 CHAIRMAN EBERSOLE: No, individual plant--what am I 5 thinking about?
| |
| 6 HR. DAVIS: It is IPE.
| |
| 7 CHAIRMAN EBERSOLE: IPE is, I am thinking about-the 8 other one.
| |
| 9 MR. DAVIS: ISAP?
| |
| 10 CHAIRMAN EBERSOLE: ISAP would catch it, and I am 11 bothered by the fact you can catch it in two places. We 12 shouldn't have--to catch it in one or the other. I rather
| |
| () 13 look at ISAP as collective process to get everything.
| |
| 14 MR. DAVIS: My understanding is ISAP is not moving 15 forward with excessive vigor at this point.
| |
| 16 CHAIRMAN EBERSOLE: PRA that goes with it which 17 ought to contain all of the elements of these.
| |
| 18 MR. DAVIS: That's right. I agree certainly.
| |
| 19 CHAIRMAN EBERSOLE: Any other comments? Anymore?
| |
| 20 MR. ANDERSON: No.
| |
| I 21 CHAIRMAN EBERSOLE: I compliment you on having l I
| |
| I 22 probably the most interesting piece of work in the business.
| |
| l 23 MR. DAVIS: I hadn't thought of it that way.
| |
| l 24 MR. BAER: We will take that as a compliment--the
| |
| /} <
| |
| 25 only one we got today! ,
| |
| l HERITAGE REPORTING CORPORATION -- (202)628-4888 1 1
| |
| | |
| 271 1 MR. ANDERSON: That's the nicest thing anybody has
| |
| (^-
| |
| \~- 2 said about us all day!
| |
| 3 CHAIRMAN EBERSOLE: I certainly have enjoyed.it. I 4 ask you for what you might have fornarded to me, to Mr.
| |
| 5 Michelson I think. I just handed you something.
| |
| 6 MR. MICHELSON: You can't hand it to me. I don't 7 want it!
| |
| 8 CHAIRMAN EBERSOLE: With that, I will close the 9 meeting. Any objection? None. Here we go.
| |
| 10 (Whereupon, at 4:05 p.m., the meeting was 11 adjourned.)
| |
| 12
| |
| () 13 14 l
| |
| 15 !
| |
| l 16 17 18 19 ,
| |
| I 20 l 21 22 23
| |
| () 24 25 HERITAGE REPORTING CORPORATION ---(202)628-4888
| |
| | |
| 1 CERTIFICATE 2
| |
| C:)
| |
| 3 This is to certify that the attached proceedings before the 4 United States Nuclear Regulatory Commission in the matter of:
| |
| 5 Name ACRS--Subcommittee on Instrumentation and Control Systems 6
| |
| 7 Docket Number:
| |
| 8 Place Washington, D,C.
| |
| 9 Date: March 24, 1988 10 were held as herein appears, and that this is the original 11 transcript thereof for the file of the United States Nuclear 12 Regulatory Commission taken stenographically by me and, 13 thereafter reduced to typewriting by me or under the direction 14 of the court reporting company, and that the transcript is a
| |
| () 15 true and accurate' record of the foregoing procee ings.
| |
| 16 /S/ f e/ M u ,n i
| |
| ~
| |
| n.
| |
| f i 17 (Signature typed): Catherine S. Boyd 18 Official Reporter 19 Heritage Reporting Corporation 20 21 22 23 24 25 O Heritage Reporting Corporation (202) 628-4888 m---. m-. g , . - , -..v -
| |
| r-*-+
| |
| | |
| - . _ _ . . _ - . . . ._. -- . _ _ . . ~ - . - . - _ _ _ _ _ . _ . . . _ _ .,._.
| |
| I e
| |
| f f(
| |
| h UNRESOLVED SAFETY Isai,- (USI) - TASK A-47 "SAFETY IMPLICATIONS OF CONTROL SYSTEMS" PRESENTATION TO THE ACRS SUBCOMMITTEE MEETING ON INSTRUMENTATION AND CONTROLS' MARCH 24, 1988 t
| |
| :l 4 4 1
| |
| 4 l
| |
| I
| |
| ! O 4
| |
| 5 4
| |
| w.-.-evy7,,*,omw-----,--m----.,remen,w-,.--,,-.m.w-----,---,w---, rw--v,
| |
| | |
| O .
| |
| INTRODUCTION 0 GENERAL DISCUSSION OF SCOPE OF GENERIC ISSUES HOW SCOPE IS DEFINED DEVELC? MENT OF TASK ACTION PLANS l l
| |
| 0 USI A-47, SAFETY IMPLICATIONS OF CONTROL SYSTEMS SCOPE I l
| |
| OVERVIEW 0F METHODOLOGY 0 USI A-17, SYSTEMS INTERACTIONS i
| |
| SCOPE :
| |
| 1 l
| |
| OVERVIEW 0F PROPOSED RESOLUTION 0 MULTIPLE SYSTEMS RESPONSE PROGRAM
| |
| ~
| |
| OVERALL DESCRIPTION OF PROGRAM EXAMPLES OF CONCERNS BEING STIJDIED O :
| |
| 1 l
| |
| l
| |
| | |
| d O
| |
| GENERIC ISSUE SCOPE 0 FIRST STEP IS IDENTIFICATION OF A SAFETY CONCERN 0 ISSUE MAY COME FROM MANY SOURCES - SUCH AS -
| |
| 0 INDIVIDUAL SAFETY CONCERNS 0 CONCERNS OF ACRS OR OTHERS 0 AE0D REPORTS 0 OPERATING REACTOR EVENTS 0 INITIAL SCOPE IS DEFINED BY INITIATOR O O SCOPE IS FURTHER DEFINED DURING PRIORITIZATION O PRIORITIZATION SUBJECTED TO MANAGEMENT REVIEW 0 IF PRIORITIZATION WARRANTS, ISSUE IS ASSIGNED TO A TASK MANAGER FOR RESOLUTION 0 FIRSTSTEPISDEVELOPMENTOFATASKACTIONPLAN(TAP) .
| |
| O
| |
| --a , -
| |
| | |
| I l
| |
| O l TAP DEVELOPMENT 0 TAP MUST INCLUDE:
| |
| .i ,
| |
| O CLEAR STATEMENT OF ISSUE AND OUTLINE OF APPROACH j 0 OBJECTIVE, ASSUMPTIONS AND LIMITATIONS !
| |
| O DEFINITION OF TASKS TO BE ACCOMPLISHED 0 JUSTIFICATION FOR CONTINUED OPERATION PENDING RESOLUTION OF ISSUE O SCHEDULE FOR RESOLUTION O IDENTIFICATION OF RESOURCES (TA AND STAFF) 0 TAP SUBMITTED FOR REVIEW AND APPROVAL i 0 MUST HAVE MANAGEMENT APPROVAL BEFORE WORK IS INITIATED 0 TAP REVISED IF NECESSARY DURING RESOLUTION O SCOPE OF TASKS CHANGE 1
| |
| 0 CHANGE IN RESOURCE REQUIREMENTS ]
| |
| l J
| |
| O !
| |
| | |
| o
| |
| _ CONTROL OF SCOPE 1
| |
| 0 SCOPE IS DEFINED BY TAP OBJECTIVES,. TASK DEFINITIONS, ASSUMPTION, AND LIMITATIONS 0 SCOPE IS CHANGED AS NECESSARY BUT ONLY WITH MANAGEMENT REVIEW AND APPROVAL 0 TAP IS UPDATED AND RESUBMITTED FOR REVIEW AND APPROVAL IF SCOPE IS CHANGED 1
| |
| 0 ,
| |
| i s
| |
| i l
| |
| 1
| |
| ; O 1
| |
| 1 i
| |
| 7
| |
| , . , _ , , , . , . , , - ,, ,. , , . _ , . _ . ..,,,,,,._.,_,.,.__,.-,---,,,,,,n-g-_..,,,,,,ve, ,
| |
| | |
| -i I
| |
| l 1
| |
| LO USI A-47 PRESENTATION OUTLINE O INTRODUCTION O BACKGROUND O INSTRUMENTATION DEFINITION i
| |
| i 0 A-47 SCOPE - TASK ACTION PLAN
| |
| | |
| ==SUMMARY==
| |
| | |
| 0 0 ASSUMPTIONS AND LIMITATIONS l 4
| |
| i 0 PROGRAM OVERVIEW O CONDUCT OF STUDY O
| |
| | |
| ==SUMMARY==
| |
| OF PROPOSED RESOLUTION J
| |
| l .
| |
| 1 1
| |
| = ,
| |
| 1 :
| |
| l 4
| |
| : O
| |
| | |
| O INTRODUCTION O USI A-47 IS A PROGRAM TO EVALUATE THE EFFECTS OF NON-SAFETY GRADE CONTROL SYSTEM FAILURES ON PLANT SAFETY 0 THE PURPOSE OF THIS PRESENTATION IS TO:
| |
| 0 DEFINE SCOPE OF REVIEW 0 PRESENT THE REVIEW METHODOLOGY 0 SUMMARIZE PROPOSED RESOLUTION TO USI A-47 0 SEEK ACRS RECOMMENDATION TO ISSUE PROPOSED RESOLUTION FOR PUBLIC COMMENT O O RES, NRR, AE00, AND OGC HAVE CONCURRED IN THE PROPOSED RESOLUTION O DOCUMENTS TO BE ISSUED FOR PUBLIC COMMENTS ARE:
| |
| 0 TECHNICAL FINDINGS REPORT (NUREG 1217) 0 REGULATORYANALYSIS(NUREG1218) 0 GUIDELINES FOR IMPLEMENTING PROPOSED RESOLUTION -
| |
| O
| |
| 'l
| |
| | |
| \
| |
| O UNRESOLVED SAFETY ISSUE TASK A-47 BACKGROUND 0 CCMMISSION APPROVES A-47 AS A USI DECEMBER 1980 0 TECHNICAL ASSISTANCE CONTRACTS STARTED MAY 1982 0 TASK ACTION PLAN APPROVED SEPTEMBER 1982 0 TECHNICAL WORK COMPLETED JANUARY 1986 0 PROPOSED RESOLUTION PACKAGE COMPLETE SEPTEMBER 1986 0 0 A-47 PACKAGE APPROVED BY CRGR DECEMBER 1987 0 A-47 PACKAGE ISSUED FOR PUBLIC COMMENT APRIL 1988*
| |
| O FINAL RESOLUTION OF A-47 APRIL 1989
| |
| * SCHEDULED O
| |
| | |
| o USI A-47 i
| |
| "SAFETY IMPLICATIONS OF CONTROL SYSTEMS" l
| |
| 0 INSTRUMENTATION SYSTEMS COMPRISE TWO BASIC GROUPS I. SAFETY-GRADE PROTECTION SYSTEMS II. NON-SAFETY GRADE CONTROL SYSTEMS ,
| |
| O 0 USI A-47 FOCUSED ON GROUP II i
| |
| e i
| |
| 4 i O J
| |
| ~ _ - - - _ - . . ._- - _ _ _ . _ . . . _ _ _ - . , _ _ _ _ _ . . _ - _ . _ _ _ _ ._.._,-, _ _
| |
| | |
| USI A-47 SCOPE (TASK ACTION PLAN
| |
| | |
| ==SUMMARY==
| |
| )
| |
| f 0 TASK ACTION PLAN INITIALLY APPROVED - SEPT.1982 4
| |
| 0 SCOPE DISCUSSED WITH ACRS - DEC. 1982 0 REVISED TASK ACTION PLAN - APRIL 1984 - ISSUED AS NUREG-0649 REV. 1 0 FEVISED TASK ACTION PLAN - MARCH 1985 - APPROVED BY STAFF - NOT PUBLISHED
| |
| ]
| |
| i
| |
| ! l 1
| |
| b l
| |
| )
| |
| I
| |
| )
| |
| ; O .
| |
| ]
| |
| 0 i
| |
| | |
| o USI A-47 SCOPE (TASK ACCOMPLISHMENT) l TASK N0. EFFORT DESCRIBED IN TASK ACTION PLAN WORK ACCOMPLISHED 1
| |
| 1 IDENTIFY CONTROL SYSTEMS WHOSE FAILURE SAME AS TAP CAN LEAD TO SIGNIFICANT PRIMARY SYSTEM TRANSIENTS ,
| |
| (1) IDENTIFY CANDIDATE SYSTEMS USING SAME AS TAP TOOLS SUCH AS FMEA, USE NON.
| |
| MECHANISTIC "WORST-CASE" FAILURES SAME AS TAP (2) EVALUATE INDEPENDENT FAILURES AND SAME /S TAP j
| |
| g FAILURES CONCURRENT WITH ACCIDENTS OR l
| |
| TRANSIENTS !
| |
| (3) CONDUCT 2.AT-A. TIME INDEPENDENT FAILURES SAME AS TAP OF CO?iTROL SYSTEMS IF CONSEQUENCES APE SIGNIFICANT (4) CONDUCT SELECTED NON-MECHANISTIC TASK ADDED IN 1984 MULTIPLE FAILURES OF MAJOR CONTROL REVISION i 1
| |
| SYSiEMS TO ASSESS COMMON. MODE FAILURE (S)REVIEWLERs,IEBULLETINS,ETC. SAMEdSTAP I
| |
| (6) SAB0TAGE NOT INCLUDED IN SCOPE 1984 CLARIFICATION (7)SYSTEMATICINVESTIGATIONOFALL 1984 CLARIFICATION SEISMICALLY OR ENVIRONMENTALLY O INDUCED FAILURES NOT INCLUDED IN SCOPE J
| |
| | |
| 1 a a 4
| |
| 9 h
| |
| USI A-47 SCOPE (TASK ACCOMPLISHMENT)
| |
| TASK NO. EFFORT DESCRIBED IN TASK ACTION PLAN WORK ACCOMPLISHED (8) OPERATOR ERRORS THAT COULD CONTRIBUTE SAME AS TAP TO ADDITIONAL CONTROL FAILURES OVER AND ABOVE MULTIPLE FAILURES NOT CONSIDERED (9) ONE TRAIN OF EXISTING REDUNDANT 1984 CLARICICATION PROTECTION SYSTEMS IS ASSUMED TO BE AVAILABLE O 2 DEY::.0P AND CONDUCT COMPUTER SIMULATION SAME AS TAP STUDIES ON 4 PLANT DESIGNS 3 IDENTIFY FAILURE MODES OF SIGNIFICANT SAME AS TAP CONTROL SYSTEMS 4 EVALUATE EFFECTS OF LOSS OF POWER SUPPLY SAME AS TAP TO CONTROL SYSTEMS.
| |
| (1) EVALUATE MULTIPLE FAILURES AS A SAME AS TAP RESULT OF COMMON EVENT (LOSS OF POWER - ELECTRIC AND AIR SYSTEMS .
| |
| CONSIDER LICENSEES RESPONSES ''O IEB
| |
| [ ])
| |
| 79-27
| |
| | |
| . 1 l
| |
| l l
| |
| O USI A-47 SCOPE (TASK ACCOMPLISHMENT) 1 l
| |
| TASK NO. EFFORT DESCRIBED IN TASK ACTION PLAN WORK ACCOMPLISHED (2) IDENTIFY CONTROL SYSTEMS HAVING SAME AS TAP A SIGNIFICANT SAFETY IMPACT DUE TO l l
| |
| POWER SUPPLY FAILURE.
| |
| (3) DEVELOP CRITERIA TO IMPROVE RELIABILITY CONCLUDED NOT TO l
| |
| 0F CONTPOL SYSTEMS (IF NECESSARY) BE NECESSARY O S DETERMINE THE NEED FOR CONTROL OR ONLY LIMITED PROTECTION SYSTEMS. IMPROVEMENTS JUSTIFIED BY l COST / BENEFIT ,
| |
| 1 l
| |
| 6 PROVIDE CRITERIA FOR EVALUATION CONCLUDED NOT TO 0F CONTROL SYSTEMS (IF NECESSARY) PE NECESSARY ,
| |
| 7 IDENTIFY CONTROL SYSTEMS THAT COULD LEAD OVERFILL OR OVERC00 LING TRANSIENTS.
| |
| (1) OVERFILL EVENTS SAME AS TAP +
| |
| (2) REACTOR OVERC00 LING EVENTS OVERPRESSURE, ;
| |
| Q OVERHEAT A REAC-TIVITY TRANSIENTS i
| |
| 1
| |
| | |
| l l
| |
| l O
| |
| USIA-47 SCOPE (TASKACCOMPLISHMENT) l l
| |
| TASK NO. EFFORT DESCRIBED IN TASX ACTION PLAN WORK ACCOMPLISHED (3) IDENTIFY LESSONS LEARNED FROM PAST CONTROL SYSTEM FAILURES 8 EVALUATE THE POTENTIAL FOR WATER TASK ADDDED IN 1985 HAMMER IN THE STEAM LINES AS A RESULT REVISION OF A STEAM GENERATOR OR REACTOR VESSEL OVERFILL.
| |
| 4 9 PERFORM RISK ANALYSIS AND COST / BENEFIT TASK ADDED IN 1985 i ANALYSIS ON SIGNIFICANT CONTROL SYSTEMS REVISION (1) PERFORM VALUE/ IMPACT ANALYSIS ON i
| |
| PROPOSED DESIGN MODIFICATIONS l 2
| |
| l I
| |
| l
| |
| : O l i
| |
| l
| |
| | |
| a O
| |
| ASSUMPTIONS AND LIMITATIONS 0 MINIMUM NUMBER OF SAFETY GRADE PROTECTION SYSTEMS ARE AVAILABLE, IF NEEDED, TO TRIP REACTOR AND INITIATE OVER PRESSURE PROTECTION SYSTEMS OR ECCS.
| |
| O POTENTIAL EFFECTS OF COMMON CAUSE EVENTS (SUCH AS EARTHOUAKES, FLOOD, FIRE, SABOTAGE, OR OPERATOR ERRORS OF OMISSION OR COMMISSION),
| |
| WERE EVALUATED IN A LIMITED MANNER BY EVALUATING SELECTED MULTPLE FAILURES.
| |
| i O
| |
| O TRANSIENTS DURING LCO AND ATWS EVENTS WERE EXCLUDED FROM SCOPE.
| |
| O PLANT-SPECIFIC DESIGNS VERE APPROPRIATELY MODIFIED TO COMPLY WITH IE BULLETIN 79-27 ("LOSS OF NON-CLASS IE INSTRUMENTATION AND CONTROL POWER SYSTEM BUS DURING OPERATION")
| |
| AND NUREG-0737 (TMI ACTION PLAN) USI A-47 4
| |
| 0
| |
| | |
| O USI A-47 PROGRAM OVERVIEW i ,
| |
| O PERFORMED DETAILED REVIEW 0F FOUR PLANT DESIGNS, ONE FOR EACH
| |
| ; NSSS SUPPLIER B&W - OCONEE (REVIEW BY ORNL)
| |
| CE - CALVERT CLIFFS (REVIEW BY ORNL)
| |
| GE - BROWNS FERRY (REVIEW BY INEL)
| |
| W - H. B. ROBINSON (REVIEW BY INEL) 0 EVALUATE MANUAL AND AUTOMATIC NON-SAFETY GRADE CONTROL SYSTEMS THAT INTERFACE WITH THE PRIMARY REACTOR FLUID SYSTEM AND THE STEAM AND FEEDWATER SYSTEMS
| |
| , O INCLUDED BOTH NSSS AND B0P CONTROL SYSTEMS.
| |
| j I
| |
| O ;
| |
| 1
| |
| - ~ - - - - -- _ . - - , ,, - ,, , --- . . , . ,,.-,-.,.,.-
| |
| | |
| l
| |
| ()
| |
| USI A-47 PROGRAM OVERVIEW (CONT'D) 0 CONCENTRATED ON IDENTIFYING CONTROL SYSTEM FAILURES THAT COULD CAUSE: i
| |
| : 1. REACTOR CORE OVERHEAT (OVER TEMP / PRES., HIGH REACTIVITY)
| |
| : 2. REACTOR VESSEL OVERC00L
| |
| : 3. STEAM GENERATOR (REACTOR VESSEL) OVERFILL 4 EVENTS OR ACCIDENTS MORE SEVERE THAN PREVIOUSLY ANALYZED IN THE FSAR 0 PERFORM FAILURE MODE AND EFFECTS ANALYSES FOR CONTROL SYSTEMS (BOTH SYSTEM LEVEL & COMPONENT LEVEL).
| |
| O O REVIEW OPERATING HISTORY. (LER'S,INPO,AE00,ETC.).
| |
| O DEVELOP PLANT T-H TRANSIENT MODELS TO SIPULATE THE DYNAMIC RESPONSE OF THE PLANT DURING TRANSIENT CONDITIONS.
| |
| O PERFORM MODEL VERIFICATION USING ACTUAL PLANT DATA.
| |
| 1 4
| |
| O ;
| |
| i
| |
| | |
| i
| |
| ~
| |
| O l USI A-47 PROGRAM OVERVIEW (CONT"D) l i
| |
| 0 EVALUATE CONTROL SYSTEM FAILURES DURING AUTOMATIC AND l 1
| |
| MANUAL MODE OF PLANT OPERATION AND FOR DIFFERENT REACTOR j POWER OPERATIONS.
| |
| l 0 EVALUATE TW MNSEQUENCES OF POSTULATED WORST CASE FAILURE SCENARIOS AND COMPARE THEM TO THE FSAR TRANSIENTS ANALYSIS. ;
| |
| 0 FAILURE COMBINATIONS EVALUATED: ,
| |
| 1
| |
| : 1. SELECTED SINGLE AND MULTIPLE INDEPENDENT CONTROL SYSTEM FAILURES.
| |
| O
| |
| : 2. MULTIPLE DEPENDENT FAILURES OF SAFETY AND NON-SAFETY GRADE SYSTEMS RESULTING FROM A SINGLE EVENT (SUCH AS 4 1
| |
| A LOSS OF POWER).
| |
| : 3. SELECTED SINGLE AND MULTIPLE FAILURES OF ECCS SYSTEMS.
| |
| l 1
| |
| I 4 :
| |
| ! O 4 l l
| |
| l
| |
| | |
| \
| |
| l O
| |
| EXAMPLE OF APPLICATION REACTOR CORE POSITIVE REACTIVITY INCREASE (BWRMETHODOLOGY) !
| |
| l 0 IDENTIFY ALL SYSTEMS WHOSE FAILURE COULD CONTRIBUTE TO POSITIVE REACTIVITY 0 IDENTIFY THE FAILURE MODES FOR EACH SYSTEM THAT LEADS TO POSITIVE REACTIVITY.
| |
| O EVALUATE THE BOUNDING FSAR ANALYSIS FOR MAXIMUM REACTIVITY INCREASE AND IDENTIFY THE FAILURES ASSUMED IN THE FSAR ANALYSIS.
| |
| O DETERMINE OPERATING CONDITIONS (I.E., LOW, MIDDLE, OR HIGH POWER OPERATION) THAT PRODUCE WORST CASE REACTIVITY TRANSIENT (S).
| |
| O EVALUATE THE CONTRIBUTION OF INDIVIDUAL (OR SELECTIVE MULTIPLE) SYSTEM FAILURE (S) TO POSITIVE REACTIVITY l TRANSIENTS (AN ITERATIVE PROCESS BASED UPON l PREVIOUSLY SIMULATED OR PREVIOUSLY ANALYZED FAILURES).
| |
| O NON MECHANISTIC SYSTEM FAILURE COMBINATIONS OR O EXCESSIVE FLOW CONDITIONS (PORE SEVERE THAN USED IN THE FSAR ANALYSIS) WERE EVALUATED TO DETERMINE A BOUNDING THERMAL-HYDRAULIC ENVELOPE THAT COULD OCCUR IF SUBJECTED TO MULTIPLE SYSTEM FAILURES.
| |
| | |
| u -.*.4- -.---gp a :-.,-. .ma 2 -m-u- -- a v .- a...-.-& - - . ..--- .. . -... - --
| |
| 9 3
| |
| (:)
| |
| REACTOR CORE POSITIVE REACTIVITY INCREASE (CONT) 0 IF NON MECHANISTIC COMBINATIONS EXCEEDED THE FSAR ,
| |
| ANALYSIS THE CREDIBILITY OF THE CHOSEN FAILURE COMBINATIONS WAS RE-EVALUATED. IF NON MECHANISTIC FAILURE COMBINATIONS WERE BOUNDED bY THE FSAR ANALYSIS A NUMBER OF MULTIPLE FAILURE COMBINATIONS COULD BE ELIMINATED FROM FURTHER REVIEW. ,
| |
| i l
| |
| l e
| |
| l 4
| |
| l l
| |
| (:)
| |
| 4 4
| |
| L_ . _ . _ . __ _ - _ . - - - . _ . .. . . . _ - . _ - - - _ - -- _ - - _ . . _._ ___._ _.-_ _ - .
| |
| | |
| D f.
| |
| 9 TABLE C-22. SELECTED SUSPECT SYSTEMS FOR A REACTOR CORE POSITIVE REACTIVITY INCREASE EVENT Loss of Electrical Power Safety k o r A i r* Grade . Postulated Effects s System failure Mode ,
| |
| High flow Rate No increasing recirculation flow is the normal mode of ,
| |
| Reactor Ecci rculation adding posi tive reactivi ty.
| |
| Flos System 1 Yes This failure mode would result in a pressure increase tdain Steam isolation inadvertent Valve that reduces the voids in the core and results in a Closure -5 Valves System positive reactivity addition.
| |
| No This failure mode would reduce the numbe r o f voids Deactor Core Isolation inadvertent Sta rt i,n the core due to the colder makeup water which t Cooling (RCIC) encreases power.
| |
| I Yes This failure mode would reduce the number of voids ir.
| |
| Hesidual tica t Removal Inadvertent Start the core due to the colder makeup which i nc rea se s f,
| |
| ( ititR ) System, Lov power.
| |
| Pressure Coolant !
| |
| Injection (LPCI), High Pressure Coolant inject ion (itPCI ), Core
| |
| }
| |
| 5p ray System (CSS)
| |
| No Thi s f a ilure mode would add positive reactiv i ty.
| |
| n Feacto r Manua l Control inadvertent Rod e
| |
| and Control Rod Drive W i thd rawa l or Ejection
| |
| [
| |
| o System No Thi s f a i lure mode would cause a decrea se en tr.c so ia . $
| |
| kf *n ;E- Concensate and Reactor High flow Rate, or failure to Trip when a drop in the coolant tempe ra tu re, a nd a ;;o s i t i ve ,'
| |
| reactivity addition.
| |
| .;P&/]j, '
| |
| f cccsa ter Systems Required P This failure mode would cause a pressure .u.: case,
| |
| $ Inadvertent i t, ine No decrease the number of voids, and add pas.t.se f
| |
| , .8 l orb e ne Cenc ra tor Control or Stop Valve d
| |
| :sf Svstem reactivity, I
| |
| ~
| |
| OpetrTng cL,fxg $j 1 No This failure mode would inc rea se pressu re , h i .1 % Jj Ma.n Conden .c r and No flow or Loss the number of voids, and add positive r e. 6 ..
| |
| Condenser Circulating of Vacuum water Sy r. t c m .
| |
| N
| |
| {3 Loss of Cicctrical Powe r -- 1, Lo s s o f A i r -- 2. __.
| |
| 2
| |
| ?
| |
| I#~ O* /. J eelf th 1L ,. g *N
| |
| * e - -
| |
| | |
| o +;
| |
| 't 3k A
| |
| W 1
| |
| \,*' h It t
| |
| \ L o *
| |
| \
| |
| \
| |
| * Qs ,
| |
| \
| |
| z aw)- w> 4 naH X- v. N s (anc app >r?&-
| |
| QY'
| |
| \
| |
| X x. } }t e, $
| |
| 4 x M.
| |
| OVWFAs)_u>enaw2 4v e ;> w+ =w x X x d gw my P'!/!N
| |
| ~
| |
| 4 9 s?u viso t9 >D L x - - . lti q
| |
| keh Q x y \
| |
| Jxew1? - p u, s - ~ . ~'
| |
| kyspdo . -
| |
| . nom > X f/ 6.l- A.3 ~ , * - -
| |
| d idU P' e.r_my *7 N'4 T m/((f
| |
| 'X Y um Efff) prV/s w V >25H'0Y m 2 X CD W
| |
| @A e% e O T (w $o
| |
| * s aa 'b{i u
| |
| d5 15 E*%
| |
| ~
| |
| g h O g hd3 (O
| |
| s \
| |
| q 0- g
| |
| \
| |
| a v sua
| |
| \
| |
| 4
| |
| | |
| 1 i
| |
| (I CONDUCT OF STUDY i t
| |
| 0 PERFORMED STUDIES AND DEVELOPED CONCLUSIONS FOR REFERENCE PLANTS 0 CORE-MELT FREQUENCY AND RISK CONTRIBUTIONS WERE ASSESSED FOR SIGNIFICANT FAILURE SEQUENCES ,
| |
| O REVIEWED DESIGN VARIATIONS OF EACH PLANT GROUP O ASSESSED GENERIC APPLICABILITY OF REFERENCE PLANT STUDY O DEVELOPED GENERIC CONCLUSIONS FOR EACH PLANT TYPE O SELECTED ALTERNATIVES FOR PLANT IMPROVEMENTS I
| |
| O ASSESSED VALUE IMPACT OF ALTERNATIVES 0 SELECTED PROPOSED PLANT CHANGES ON BASIS OF VALUE IMPACT i
| |
| i 1 ()
| |
| l 1
| |
| | |
| l 1
| |
| O
| |
| | |
| ==SUMMARY==
| |
| OF PROPOSED RESOLUTION O LIMITED NUMBER OF REQUIREMENTS l i !
| |
| ! l l
| |
| 0 PROVIDE OVERFILL PROTECTION (ALL PLANTS) {
| |
| 0 PROVIDE PERIODIC VERIFICATI0'. OF OVERFILL PROTECTION (TECH SPECS) l O PROVIDE DIVERSE AUTOMATIC INITIATION OF EFW (OCONEE ONLY) 3 l
| |
| 0 IMPROVE EMERGENCY PROCEDURES FOR 59LOCA
| |
| ; (CEPLANTSWITHLOWHEADPUMPS) i l
| |
| 4 l
| |
| i !
| |
| 1 i
| |
| l i
| |
| 4
| |
| -. - . , - , . ~ , , . - . , _ . - - _ _ _ _ _ _ - - - . - . . . , - - , _ _ , . _ , . - - - - _.--...,,_,.,-,.,,_,v,_
| |
| | |
| i O 1 A-17 SCOPE 0 1978-1983 DIFFICULTY WITH DEFINITION / SCOPE l
| |
| 3 0 1983 MAJOR RE"JSION TO TASK ACTION PLAN (TAP)
| |
| MET WITH ACRS ON SCOPE O 1984 REVISED TAP APPROVED l
| |
| 0 DEFINITIONS PRESENTED IN TAF SYSTEM INTERACTION (SI) 2 -
| |
| ADVERSE SYSTEM INTERACTION (ASI)
| |
| UNDESIRABLE RESULTS CLASSES OF SIS 0 SOME EXCLUSIONS / LIMITATIONS IN TAP
| |
| - COMMON MODE FAILURE INCLUDING THOSE DUE TO: MAINTENANCE ERRORS, i TEST ERRORS, MANUFACTURIllG ERRORS, EXTERNAL EVENTS.
| |
| l i 0 DESCRIBED IN WORDS AND PRESENTED IN DIAGRAM IN THE TAP.
| |
| !O 3
| |
| | |
| 7
| |
| ; kb.*.kIfkkh h,k $k i.- o S Acis, m :.a ,m m .,,...
| |
| ;,,4...,........ .u h tr0K
| |
| ~
| |
| .1 SIGN!F1 CANT EVENTS IGNORE N(
| |
| CLAS$iFY COMMON CAUSE MULT:PLE FAILURE EVENTS INCEFE'i''E NT i FARUAE EVENTS l
| |
| SP N OTF RESCLVE OTHER COMMON 1 CAUSE ADVERSE SYSTEMS
| |
| ". INTERACTION C
| |
| h
| |
| ~
| |
| l EXTERNAL PHENOMENA IDENTICAL ERRORS IDENTICAL ERRORS FAILURE IN ONE WH:CH CAN IN REDUNDANT FAILURE IN ONE IN REGJNDANT FAILURE IN SYSTEM SNULTANE00 SLY SYSTLM WHICH SYSTEM WHICH SAFETY SYSTEMS SAFETY SYSTEMS WHICH H'NCERS CHALLENSE REDUNDANT IS FUNCTIONALLY IS SPATIALLY DUE TD- DUE TO: THE CPERATCRS SAFETY SYSTEMS COUPLED TO SAFETY .
| |
| * DESIGN COUPLED TO SAFETY (E.G. WIND.
| |
| * MAINTENANCE SYSTEMS DUE T0: RESP 0''SE BY SYSTEMS DUE T0-
| |
| * MANUFACTURE
| |
| * TEST EARTHOUAXC
| |
| * lNSTALLATION
| |
| * R DU,
| |
| * 0PERATION
| |
| * PHYSICAL CONNECTION IN0tCATlG!p
| |
| * SPATIAL INTERTIES .
| |
| *SHAR NG OF
| |
| * SHARING OF *FRCH:31TED SUPPORT SYSTEMS LOCATIONS ~ ACCESS I
| |
| 'l Rgure 1. DefinitionslScope
| |
| ,1 Il
| |
| | |
| . . rrer .- _ - - - - _
| |
| o O O TECHNICAL
| |
| ~
| |
| REPORT TASK 2 TASK 4
| |
| * TASK 1 ASSEMBLE COMMON SCREEN ADVERSE DEVELOP CAUSE EVENTS SYSTEM IfJTERACTIONS
| |
| .LERs
| |
| > IRENDSIPATTERNS >
| |
| 0F EVENTS SAFETY SIGNIFICANCE
| |
| *PRAs
| |
| * S! STUDIES
| |
| - TASK 7 TASK 3 DEVELOP IP-3 DEMONSTRATION
| |
| , ' itCHN! CAL i -PASNY STUDY '
| |
| RESOLUTION 0 -OlGRAPH MATRIX NALUEllMPACT) s -lNTERACTIVE FTl \ TASK 6 FMEA COMPARE AND EVALUATE METHODS TASK 5 COLLECT SEARCH METHODS
| |
| * WALKTHROUGH
| |
| * PRA TECHNICAL
| |
| * FMEA ,
| |
| REPORT
| |
| )
| |
| Rgure 2. A-17 Task Row 2
| |
| b ~
| |
| .,-TR
| |
| | |
| . = . . _ . - . - .. .. . _ -
| |
| 4 O
| |
| A-17 PROPOSED RESOLUTION 0 GENERIC LETTER
| |
| - PROVIDE INFORMATION TO ALL LICENSEES REQUEST VERIFICATION OF FLOODING EVALUATIONS 0 ACKNOWLEDGE RELATION WITH A-46 0 PROVIDE POWER SUPPLY INFORMATION TI GI-128 0 PROVIDE SYSTEM INTERACTION INFORMATION FOR PRAS O O DEVELOP OTHER CONCERNS FOR SEPARATE TREATMENT - MULTIPLE SYSTEM RESPONSES NOTE: ELIMINATED THE COMMITMENT TO DEVELOP A REGULATORY GUIDE FOR FUTURE PLANTS. I O
| |
| i l
| |
| | |
| 4
| |
| \
| |
| O -
| |
| MULTIPLE SYSTEM RESPONSES j OUTLINE :
| |
| ?
| |
| l O PROGRAM PLAN !
| |
| 0 AREAS OF CONCERNS INVOLVING MULTIPLE SYSTEM RESPONSES 1
| |
| I O SOURCES OF INFORMATION ON CONCERNS i
| |
| t 0 EXAMPLE BREAKDOWN OF SEISMIC CONCERN i
| |
| O i
| |
| -i i
| |
| O
| |
| | |
| I
| |
| 'O MULTIPLE SYSTEM RESPONSES PROGRAM PLAN O IDENTIFY CONCERN FROM SOURCES 0 CLASSIFY CONCERN (ONE OF THREE OPTIONS)
| |
| - COVERED UNDER ANOTHER PROGRAM OR ISSUE
| |
| - DEVELOP A BASIS FOR WHY CONCERN IS NOT A SAFETY ISSUE
| |
| - DEVELOP CONCERN INTO ISSUE FOR PRIORITIZATION O PUBLISH RESULTS INTO A REPORT 0 PRIORITIZE ISSUES l
| |
| I l
| |
| i l
| |
| i O ,
| |
| | |
| . _ . _ . _ . _ . _ _ _ _ _ _ . . _ _ . _ . . _ . _ _ _ _ _ . . _ . . - _ _ . ~ . ._ _.._ . _ . . . _ _ - . _ _ _ _ _ . __ _
| |
| I i.
| |
| l 4
| |
| O l MULTIPLE SYSTEM RESPONSES l
| |
| AREAS OF CONCERNS - PLANT WIDE EVENTS j SEISMIC EVENTS PLANT TRANSIENTS / UPSETS - NOT ACCIDENTS INTERNAL PLANT FLOODING
| |
| -I INTERNAL PLANT FIRES O DESIGN BASIS EVENTS - LOCA, SLB SIMULTANE0US EVENTS i
| |
| l O
| |
| | |
| O MULTPLE SYSTEM RESPONSES l l
| |
| l l
| |
| SOURCES OF INFORMATION ACRS LETTERS / MEETINGS
| |
| - ON USIS A-17, A-46, A-47
| |
| - ON PROGRAMS SUCH AS FIRE RESEARCH, ENV. OVALIFICAITON l
| |
| GAPS IN REQUIREMENTS i
| |
| - STANDARD REVIEW PLAN O
| |
| t i - OPERATING EXPERIENCE I l
| |
| l 0
| |
| | |
| - .~ . - - - . . - . _
| |
| o l
| |
| l O
| |
| MULTIPLE SYSTEM RESPONSES l
| |
| SEISMIC RELATED CGNCERNS 0 INDUCED MULTIPLE FIRES 0 INDUCdD MULTIPLE TRANSIENTS 0 CONTROL SYSTEM ACTIONS
| |
| - RELAY CHATTER
| |
| - FIRE ALARMS 0 INDUCED MULTIPLE FLOODS 0 PIPE RUPTURE (NON SEISMIC PIPING) 0 FIRE SUPPRESSION INADVERTENT ACTUATit 0 INDUCED MULTIPLE ACTIONS IN NON-SEISMIC EQUIPMENT 0 FALLING, BANGING 0 UNANALYZED FAILURE MODES 0 INDUCED DESIGN BASIS ACCIDENTS 0 LOCA, MSLB l
| |
| 0 OTHER MULTIPLE, SIMULTANE0US EVENTS 0 FIRE, FLOOD, TRANSIENT O
| |
| . - - _ - _.}}
| |