ML20247L057
| ML20247L057 | |
| Person / Time | |
|---|---|
| Issue date: | 05/15/1998 |
| From: | Advisory Committee on Reactor Safeguards |
| To: | |
| References | |
| ACRS-T-3037, NUDOCS 9805220304 | |
| Download: ML20247L057 (163) | |
Text
{{#Wiki_filter:,a - - -
.. ,, - 2
, ., . .. , i-, 3, . , . ., ___
. c y .
- , a . ea . f , ,.- , y
.:.t z
,y, . , ,
. . e
.,...t ' . , .. . .. , .. .. . . . . ., . . . .. v. . .
. . . ' ' Y -.
> .. .n'- N? ' 5 .
9 - . m . e, ; - w...,......_ . .g ., .
',L ; ' y' ' ' ; * .l
~; , , . _ , .,
- l- } ^ -. y..
- ,,w._,.
. os_
,',7 , . (; _ ~-'
; ~.;
O . - ~ '*
$ ;.' , 3y..
g .
.c i v > *';j :, } ;
-}
; ,3.: ,.7 ., 7,., . 'j. j I~.,
- j .. ;.'.- - : .(( (.} ?. , : qH-f... m. 1. 7 l ,
3... .. .. 3y :.. , . .. +
. ' 2
.3~, . m .
~~
s _y, ~
"3 3 43y ; v; _,
0
., , - i -
.. J:. .
4.,... . . ,f .,.
- .t ,,
. ~..3.
.. . y - .
.e y w . . n .. w.. ,-( - ,,. ( .
r= , - ,. . . , ..i
-.r , ' . . - ./ . ,
. . . . . .. . . 3. _ .,
. . . . ... y. . -
u
._a } .;
- V', ..'
~ '
_c.- * . ., T g - -
. ~ .
. . .s
- o. _. . : .;.
,, a
.. y . . . .
.c .. . . -
_. . . .- . n. s.- .
,. , - - ' . ' . ' . . . , L - . ;, . .;
e *
. ' 5 . ;,
/ .- ( - .
.v- .x sw
- a. :
a1# -
- 1 ;.j. _
e , 1 ~. . -
.. .. . g....,.
. 4
-1 .s
*}'..
- .[: [.l j k , .'l c.
.- . _g : - l/ ; y. : ,. . ., .
4 ~
, . .' - ,, , .1- ' -
4 3' . . ; ,; . ~ .-' .-
- s. . .. - .
< r
- .- ,- . ,.z..._-.. 7 . . . ...w::,. . g u y .. . ,
. -. . .sg.~
./. ,
4 _,
, .w
, J =:w ,, ,' o s .- . .
.r- -
%. a -
,..yL.
s..- , c-z -...e;. . _ ,J., z .:.
, 3
. .. g.
. . -Wy >
- - -: . .y - . .- - _. -.
. . . ,- . . .4
^ N-. . . . ,. ~w
$ , a. ,. .' ...
.. . -o, , . >-- .,,.,. i- .,,p.
5 .. _ , .* 3<
.:q y.<
s .,
. a-W. . ,
t , . .- .
.. , , e. .. . . . . ..;
.. + ... ., ,.
yy -
~ ^ . , ' . h. .
. - i...
.o g .
. . e.
*/ .
. . .,s, -
n , . . < .
,, ~ . t' -
. . . . . . . . -. . . . . . . . #. . ~. .o
. - . :,c.; ;- -
e ; s: v. % , .; . - 9, . - . .. ;s q - - . - . ; .
.; . . . ,..,.j .
- - t-
- 1 '. . . ' % .. Ygy -
- n. .
. s . . . 4,.
. ,, ~ . c . . . ,s .
s.r, ,..n...
. ... :.... ;. .# .v . .,#,3..,......v,,.,-
. ~ ,
.y , . . .. c, , , ;... , . . . ... ....v...,u..
.. . ... .. o . . .. . ... . .. . , . . .
'l e ~. - ' ' - '
[1 f .
, , g. f. ,.4...
4 . . . . .
.g -. .
s - . . ,3_q s.n - . . a, w. t,
.; ' ^. , I. _
Q . :q . [. L '/ ;.. j ; ; , { .7,[ 7 ' .g f, : ... }. .s ..
'. 6
-p ,' .' . :,. ,* . ., <'. _. : , . . ., .-
,..",.3
..g , , , . .s ,- * ., .c
- o ~, _. ' , ' , . - ,- m.'. ? i'-',,._ .. ,, ;,
.,.r,; w; g'- .'4,...
i %.
%
- 4, .. ,-
n
,. . , _ _ !. ) _' 6 .* s - g ;
.' ." L ; . s :s ..
{ ' J'J ) ' ;.
~
o
*g . . . .. ; f,,
y .,
,s. '- F W, [ j ;. l s,-
. - . ;A i.l. . l ..h i. f.,; ' g, -
. ,, , , ..,, ,9 .
.. .. : . ~ .6 . .',:K,,. .,_ .._e . , .. __. '.. .
-_,3 s -
~,';_ ,
.p _,
v.., , , , , . ' y .-a' _ , =,a _y hl' i ' ~ .. ? ,- . g,. _ . _. ; ,..,;;.,
;:f 3* -
,;p ',f ' '. . , . , ,.
I; . ,;-s.t
- s. -a :e y
.:...,. -_ ;,_ _. . .. ' .' . .. ..'yq-{.,'_ . , gsj,$.y, t; ,:*: f;. -..:.: . Q Q ' '
,( .x -. - ., , ..
- . 't' .c -
- ._ ,,, =p
- . ; .. .s : .
s - 4 . tn ,- .: ...: V. :
.. ; : u '[ "w .
- k .'
q , . ; ,' g ,4 '
+
e, . S'a ? # 5 ,;. , ,; ;,.. +.J'y,:. , ' g ; .,i ,. j, ' ':. . , [ h. ,
.4 ...' i'. - .e.. ], k,y: , . . ,. .,s ;
k .- .
.: . . ;; .. . . .. ,g, . s;_ __ e., 4, . 'w y : 3..
a:
- . e -. e a
~_je
,,. ',n ,,;.s ., , . ' q.
_#,-N w . '.; '../..v.. . , , J-
; ',c.. .-gj;p . *-'.n.4
's
* .,A...t.$.,
g ' ' ' '
) '- '
, - ' _ l :*g .* g', .p.
-,[
+
[
',,y
. y< . ,.
4..
. . < ,, ,,.f ..; ;:, ,f, -.'.y' ' y' l+
w , . . . . - 1 4
+
_e, am
\_. ' '. _ . :' ' *
;' ,,a L
., ' , ' r. . t,.
- k b. .. . ? h+ . h .,;:. _ ; , . . , t, O , ',
- ,i- .I' , *4 -
*e,r
)e g,
, . i ), w ,' - : .; 4 . :^**/., ' .,5
. . ~ :
., .t s
o, ..
. . . 7; ..j !i.(7.
t w .c. ..q. . . ,,g pgAM.bf.9. g &. +: .. : ..';' c.
. :.. w * . .
A t . ., ,
,7g *.- y',,w a*f1,y; . . wi g,; . 3 tzE ., ,.
co a o u ,.
\ n_ ;
- . .. .. .. ' .a_ ' , ; ,.; ,' - :. ; : '.'.,;
. ~..-
q ;: ,:;..- ' ,,.: gg ,a; y f y. G .. ... . ;1; , t.
. w< n '. .
s . . - . . . , - . - . =- .
' ' ' , ' . **.* .' . 7 ".:. ;
',y
, *'% .. : . ,1 i
.. $ . e' '
,g s- . - . -t .
,t}e i.
H+ w 4
- - i ~ .;.. ,.. ,.
. 01G i\ A _
OFFICIAL; TRANSCRIPT OF PROCEEDINGS A V
? NUCLEAR REGULATORY COMMISSION-ADVISORY' COMMITTEE ON REACTOR SAFEGUARDS
Title:
, SUBCOMMITTEE ON ADVANCED REACTOR DESIGNS
- Docket No.:. {$yf*S$$b1NAL l a
Tc e M ITE l M/S T-2E26 l f, 1 c . n 3 0
-Work Order No.: ASB-300-278 " " "
() i
, LOCATION: Rockville, Maryland l
DATE: Friday, May 15,1998~ PAGES: 397 - 509 l l
' 9e052203o4 980515 Ff!fgggfRS
,,.,.s>*
PDR () ) l L - ANN RILEY & ASSOCIATES, LTD. lJ 1250 I Street, NW, Suite 300 D. AMSOffilfdiffleia'n for aeCe 0:'the >nm? fen
l l lf lNJ i i l DISCLAIMER i l UNITED STATES NUCLEAR REGULATORY COMMISSION'S ADVISORY COMMITTEE ON REACTOR SAFEGUARDS i l l l 4
- l. MAY 15, 1998 i
l l The contents of this transcript of the proceeding j of the United States Nuclear Regulatory Commission Advisory Committee on Reactor Safeguards, taken on May 15, 1998, as reported herein, is a record of the discussions recorded at l the meeting held on the above date. This transcript had not been reviewed, corrected l and edited and it may contain inaccuracies. I l l i I _ _ _ _ _ _ _ _ _ . _ _ _ _ _ _ _ _ _ _ _ _ _ . . _ _ . . . _ . _ _ _ _ _ _ _ _ _ _ _ . . _ _ _ _ _ . _ . _ _ _ . . _ J
397 l' UNITED STATES NUCLEAR REGULATORY COMMISSION
; 2 ADVISORY COMMITTEE ON REACTOR SAFEGUARDS 3 ***
4 SUBCOMMITTEE ON 5 ADVANCED REACTOR DESIGNS 6 7 8 U.S. Nuclear Regulatory Commission 9 Two White Flint North 10 11545 R.ockville Pike 11 Rockville, Maryland 20852-2738 12 l 13 Friday, May 15, 1998 r 14 15 The Committee met pursuant to notice at 8:30 a.m. 16 I 17 MEMBERS PRESENT: 18 JOHN BARTON, ACRS Chairman I l l 19 MARIO FONTANA, ACRS Member i I 20 ROBERT SEALE, ACRS Member 21 THOMAS KRESS, ACRS Member 22 DON MILLER, ACRS Member 23 DANA POWERS, ACRS Member 24 WILLIAM SHACK, ACRS Member 25 l i j O ANN RILEY & ASSOCIATES, L'IT) . Court Reporters 1250 I Street, N.W., Suite 300 Washington, D.C. 20005 (202) 842-0034 w__________-_-____________._____
i 398 1 PROCEEDINGS () 2 [8:30 a.m.) 3 CHAIRMAN BURTON: The meeting will now come to 4 order. This is a meeting of the ACRS subcommittee on 5 advance reactor designs. I am John Barton, Chairman of the 6 subcommittee. ACRS members in attendance are Mario Fontana, 7 Thomas Kress, Dana Powers, Robert Seale, William Shack. We 8 also have in attendance ACRS consultant James Carroll. 9 The subcommittee will continue its review of the 10 AP600 design. Specifically, the subcommittee will review 11 chapters 3, 6, 14, 16 and 17 of the AP600 safety analysis 12 report, the risk assessment, regulatory treatment of 13 non-safety systems and the associated NRC staff's 14 evaluation. The subcommittee will gather i'nformation, () 15 analyze relevant issues and facts and formulate proposed 16 positions and actions as appropriate for deliberation by the 17 full committee. 18 Noel Dudley is the cognizant ACRS staff engineer 19 for this meeting. The rules for participation in today's 20 meeting have been announced as part of the notice of this
]
l 21 meeting previously published in the Federal Register on 22 April 22, 1998. A transcript of the meeting is being kept 23 and will be made available as stated in the Federal Register 24 notice. It is requested that speakers first identify I 25 themselves and speak with sufficient clarity and volume so i O I I ANN RILEY & ASSOCIATES, LTD.
/ Court Reporters 1250 I Street, N.W., Suite 300 j Washington, D.C. 20005 i (202) 842-0034 l l
i !
l 399 1 that they can be readily heard. '( ) 2 We have received no written comments or requests 3 for time to make oral statements from members of the public. 4 This is the third day of a three-day meeting. Today, the 5 subcommittee will hear presentations on and discuss SSAR 6 Chapter 17, quality assurance, and the regulatory treatment 7 of non-safety related systems. 8 Copies of the AP600 SSAR and PRA are available at
)
9 the front of the room for reference. We will now proceed 10 with the meeting, and I call upon Mr. Bryan McIntyre of 11 Westinghouse to begin. 12 MR. McINTYRE: John, we have a leftover item that l 13 maybe Alan Levin could help us with. 14 CHAIRMAN BURTON: What's that, John? I
) 15 MR. McINTYRE: I guess we wanted to further
( 16 explore with Alan the water hammer calculation that he 17 performed, leak before break business. l 18 MR. SHACK: I ask the question, Alan, did you just 19 basically hypothesize that or you actually had some 20 scenarios that would lead to that, the question of the l 21 estimating the likelihood of the water hammer that you're 22 predicting? l l 23 MR. LEVIN: This is Alan Levin from the staff. 24 No , I did not try to estimate the likelihood. I set up a 25 postulated situation where you would have a steam bubble () N-ANN RILEY & ASSOCIATES, LTD. Court Reporters 1250 I Street, N.W., Suite 300 Washington, D.C. 20005 (202) 842-0034
400 1 collapse driven by essentially the operating pressure of the ,
\
[} \d 2 feedwater system with the sink pressure, if you will, the 3 pressure on the collapse side of the bubble, being - 4 equivalent to essentially whatever the cold water 5 atmospheric pressure, whatever it was, and try to derive a 6 velocity using that driving pressure, and then looked at the 7 impact loading from the slug. Very, very much of a back of 8 the envelope type Joukowsky equation calculation to estimate 9 the load, and not trying to account in any systematic way 10 for frictional effects or other mitigating circumstances. I 11 The thing was that with even a fairly modest sort l 12 of assumptions and in trying to not be too over-conservative 13 in terms of trying to get a really high velocity. The 14 velocity still came out in the 500 foot per second or more
) 15 range, which gives you an impact load of several thousand 16 psi, and this is not a 2200 psi system. It's not designed 17 for that pressure. It's about 900 psi, and it looked like l 18 it was, you know, you couldn't rule out the possibility of 19 something like that happening, and we acknowledge when 20 Westinghouse made their presentation and we discussed this 21 further on, we acknowledged that you would have to have a 22 mismanipulation of several valves in the line to allow the 23 potential for this to get there, but it looked like 24 something that could still happen. Trying to put a 25 probability on it, we never really got to a point where I
() ANN RILEY & ASSOCIATES, LTD. 1250 I Street, N.W., Suite 300 Court Reporters Washington, D.C. 20005 (202) 842-0034
l \ l 401 1 felt like that was a meaningful thing to try to do. () 2 3 John? CHAIRMAN BURTON: Does that answer your question, 4 MR. McINTYRE: Yeah. 5 CHAIRMAN BURTON: Okay, thank you. Mr. McIntyre. 6 I'm glad you showed up today. I introduced you yesterday 7 and found out you were with the chairman. 8 MR. McINTYRE: That's correct. 9 CHAIRMAN BURTON: It was sort of embarrassing. 10 MR. McINTYRE: I do my best. 11 CHAIRMAN BURTON: I should have looked over there 12 before I did that. 13 MR. McINTIRE : My priorities do get frequently 14 rearranged. () 15 I'm going to talk about Chapter 17. Chapter 17 16 is, well, there's four subsections. There's really two 17 parts to it. The first three are the standard things that 18 are in the standard review plan. They're basically our 19 quality assurance program. At the request of the staff we 20 moved the reliability assurance program, the RAP, from what 21 had been Section 16.3 to 17.4. So, I'm going to cover the 22 first three sections. Terry Schultz is going to talk about 23 the reliability assurance program, 17.4. 24 When you are reading through the SSAR -- hopefully 25 this won't confuse things too much. We could have tried to ANN RILEY & ASSOCIATES, LTD. Court Reporters 1250 I Street, N.W., Suite 300 Washington, D.C. 20005 (202) 842-0034
402 1 find all the references to 16.3 and fixed ther. to change to 2 read 17.4, but what we did is we just took 16.3 out and [^))
'w 3 there's a pointer that says read 17.4 because that was the 4 way that we knew that at least it would be pretty much 5 right, and we probably didn't have any untied-up ends 6 somewhere.
7 The first two parts, Section 17.1 and 17.2, and if 8 you look in the SAR, 17.1 and 17.2 and 17.3 are about two 9 pages long in their entirely, so I now have a seven-page 10 presentation on two pages. The staff wrote about a 14-page 11 SAR on two pages. 12 The first two sections are basically things that 13 the combined license applicant will do that are 14 traditionally not -- this is not something Westinghouse has
) 15 really dabbled with very much because we're designing a 16 whole plant in this case, so basically, these are 17 commitments that the combined license applicant will have 18 quality assurance programs in place, and I'll go through and 19 the staff will review those when your combined license 20 application comes in.
21 For the things.that we do, which is really 17.3, 22 we have the standard Westinghouse -- it still says 23 Westinghouse Electric Corporation because that's what the l 24 document says, even though we're not Westinghouse Electric 25 Company, Jay, since you ask about that periodically.
'~)
ANN RILEY & ASSOCIATES, LTD. Court Reporters 1250 I Street, N.W., Suite 300 Washington, D.C. 20005 (202) 842-0034
403 1 We have a quality assurance program that we work () 2 3 through that says wo do things to appendix B and we check our calc notes when we go through that part of the process. 4 For the purposes of the AP600 since it was a l 5 bigaer scope than Westinghouse has ever done -- usually I 6 we've only had to deal with ourselves -- we have a report, a ) 7 project specific quality assurance program that is basically 8 a supplement that expands as it says for all of our 9 subcontractors here is how we're going to deal with them 10 here, how we're going to deal the things that are in the i 11 scope of AP600 that are not in scope of the standard i 12 corporate document. So, basically, we have -- it kind of l 13 looks like two quality assurance programs but it's a quality 14 assurance program then with a supplement, and the staff has ; (A) 15 reviewed that, and I asr,ume that you're going to be talking ; 16 about that when I sit down. , 17 We have -- if you look through how we did the 18 desigu certification, it was Westinghouse and all of our 19 partners. Originally, we started out with Bechtel and M.K. 20 Ferguson and Chicago Bridge & Iron and somebody that I can't 21 remember. 22 Mk. SCHULZ: Avondale? 23 MR. Mc1NTYRE: Avondale, yes, they're the people 24 in Louisiana. Thanks, Terry. We had to get them to make 25 sure, and particularly when you're working with a shipyard, ANN RILEY & ASSOCIATES, LTD . ()h \- Court Reporters 1250 I Street, N.W., Suite 300 Washington, D.C. 20005 (202) 842-0034
404 1 nuclear quality assurance was kind of a surprise to them and l ' ([ 2 it was a little bit of a change, and what we did is we made 3 sure that they had a quality assurance program. Basically, 4 we went down, we would audit them and then periodically go 5 back through and look and make sure that they were 6 performing according to our specifications. As the program l 7 went on then, we started to suck in all of the other people l
.in Spain, the people in Italy, and it got bigger and bigger 8
l 9 and a bigger organization. Basically, that's the process ) I 10 that we used. Jost like we would on any other vendor, go 11 out and make sure that they're qualified and then do 12 periodic updates on their programs. 13 The staff has come through and performed, it's 3 14 three audits -- two in 1997 and one in 1995. There were () 15 some things that they found in 1995, was primarily on the 16 testing program on how we had done -- their finding had to 17 do with the as-builts on the facilities in Italy, that we 18 hadn't done those exactly according to the procedures. We 19 went back and effectively, it says remeasured. That's what 20 we did. We remeasured and confirmed that the drawings that 21 they had done as as-builts were the as-builts. 22 In November of 1997, the staff came in to an 23 inspection and came up with two nonconformances and an 24 unresolved item. The nonconformance, the first one, there 25 were eight observations as part of that, and I'll summarize ANN RILEY & ASSOCIATES, LTD.
~s Court Reporters
- 1250 I Street, N.W., Suite 300 Washington, D.C. 20005 l (202) 842-0034 l
t
405 1 this. Hopefully, and I'm sure I'll be corrected by the
\ 2 people at the table on the other side there, is that we need
(/s-3 to write better calc notes. We tend to write our 4 calculation notes for ourselves, and you assume that the 5 person who reviews the calc note is familiar with the 6 Westinghouse technology, is familiar with AP6. It basically 7 has a large, built-in database, and a lot of things, the 8 staff found that some of this is also a change in 9 technology, that when we did calc notes all on paper, you 10 expect to look through and see little checkmarks and little, , i ' i 11 you know, hen scratching, and now we have computers. All 12 you see at the end on some of the calc notes is a signature, ! i 13 the guy that says yeah, verily, this is okay. So, that's a l 14 little different, which is really all .iat Appendix B j (~N ( ,) 15 requires that you have, is that second signature on the I 16 verification. 17 Things also they found were problems noted that 18 gee, this is an error, but it's okay. Well, it's an error 19 but it's okay. Well, why is it okay? What we found is that 20 you get a guy with 25 years of loca experience and he looks 21 at it and he knows it's okay. Well, how did he make that 22 engineering judgment? This is a comment that's been made 23 not only by the NRC but by some of our customers who have 24 come in who are also audited by the NRC and say you guys 25 need to, if you make an engineering judgment, show how and [~ Am/
) ANN RILEY & ASSOCIATES, LTD.
Court Reporters 1250 I Street, N.W., Suite 300 Washington, D.C. 20005 (202) 842-0034 L________________..______._____________________
406 1 why and the rationale that goes behind that engineering !X
! 2 Judgment.
3 What we've done in this case is changed our l 4 procedures that tells the engineers if you make an j 5 engineering judgment, for goodness sakes, please-explain 6 what it was you did and how you did that and how you reached 7 that conclusion. 8 There's one other thing in that first 9 non-conformance. We found that we needed to add a tech spec 10 and an I tech because there was something that had been left 11 out. 12 The second observation, the second nonperformance i 13 had to do with errors that they found in the computer codes, 14 specifically with the gothic, computer code gothic -- review (Of 15 for WGOTHIC computer code which is based on the gothic 16 computer code which was developed by another company. We ! l l'7 had received a list over 100 errors from this company, and l- 18 it wasn't obvious from the documentation we could provide at 19 the time that those had been addressed and signed off by the 20 engineer. He had reached a conclusion that yes, there are t 21 no problems with this or that he could deal with it. 22 They went back subsequent to the audit and found I ( 23 out that yeah, the guy had evaluated them. He had not t 24 necessarily documented them according to our procedures, but l 25 he did have the documentation in his desk drawer, and we ANN RILEY & ASSOCIATES, LTD. Court Reporters l- 1250 I Street, N.W., Suite 300 Washington, D.C. 20005 (202) 842-0034
407 i 1 1 looked at that and we have now provided that to the staff, O D 2- and also done some more remedial training. Hey, guys, if 3 you get these things from the outside vendors and there are 4 more and more things that are billed to outside vendors, 5 that you do need to follow our process. This is a case that 6 we had to process, and it wasn't followed as well as it j 7 should have been. 8 The unresolved item had to do with a concern by 9 the staff that geez, we audited a certain number of calc 10 notes, and it seems to us, we found an inordinate number of l 1 11 small errors, and if that's what we can expect, then you 12 guys may have a more significant problem. 13 Westinghouse went away and did a design assurance l l 14 review where we did a broader subset with our own people and 15 one person from an outside source and looked at a larger i i 16 number of calc notes. They also, as part of this, did a , 17 statistical evaluation to look at how many calc notes you l 18 need to look at determine if you had a high confidence that 19 you'd found any big errors that were out there. l 20 I guess the good news -- it's kind of a good news, I 21 bad news story, that the good news in this design assurance 22 review is we didn't find any really glaring errors. The bad 23 news is we found sort of the same things that the staff had 24 found, of you guys don't do as good a job documenting 25 engineering judgements. Things really aren't in hindsight h
'ul ANN RILEY & ASSOCIATES, LTD..
Court Reporters 1250 I Street, N.W., Suite 300 ( Washington, D.C. 20005 j (202) 842-0034 L-----------
l l 408 l 1 quite as clear, particularly when both the author and the () 2 reviewer have now left the company for whatever reasons. 3 When you've got a third party then going in scratching his 4 head kind of saying what the heck we did, it's a 5 clarification issue. l 6 We sent in three documenting our corrective 7 actions on this. We got a letter back from the staff on the 1 8 28th that said yes, the design assurance review resolves 9 that particular concern, and we got a letter on May 6 which 10 says that it's responsive, and I'm not quite sure what that 11 means. We hope it means that it closes out the open item in { l 12 the FSER concerning quality assurance. It doesn't say that, 13 but I'm hoping that Bob Pettis is going tc stand up and say 14 here at the end that it does. 'O l(_j 15 Our conclusion is, at least from -- 16 MR. SEALE: Not surprisingly. i 17 MR. McINTYRE: Well, that we do meet the 18 requirements of Appendix B. We have made some changes to j j 19 improve it as far as the documentation goes, and I'm not 20 sure, like I said, what the staff is going to say or how
]
21 they're going to deal with that specific open item, l 22 That's all I had to say on the first three parts 23 of Chapter 17. If there are any comments or questions, if 24 not, I'll let Mr. Schulz. Yeah, Bob? 25 MR. WILSON: Mr. Chairman, this is Jerry Wilson I l l
/~'\ ANN RILEY & ASSOCIATES, LTD.
kl s Court Reporters 1250 I Street, N.W., Suite 300 Washington, D.C. 20005 (202) 842-0034
409 1 from the staff. At the time that the staff issued the () 2 3 advance version of FSER, we had one open item on design QA resulting from the inspection, as Mr. McIntyre said, and 4 we're prepared to provide a status report on that at this 5 time, if it pleases the chairman. 6 CHAIRMAN BURTON: Yeah, go ahead. 7 MR. WILSON: I'll ask Mr. Pettis to give a 8 presentation. L 9 MR. PETTIS: Good morning. 10 CHAIRMAN BURTON: Good morning. 11 MR. PETTIS: My name is Bob Pettis. I'm with the 12 quality assurance and vendor inspection branch of NRR. I'm 13 going to provide you with kind of a brief overview with 14 respect to the items that were identified during the O (j 15 inspection that will arrive at closure. Can everybody hear 16 me okay? And pretty much follow what Mr. McIntyre has just f 1 17 discussed in probably less detai.~.. I 18 MR. CARROLL: I just got a comment that the QA 19 that doesn't follow procedures bothers me. He didn't put 20 the right title page or any of that on this thing. 21 MR. KRESS: No name, no date. 22 MR. PETTIS: I guess I'm in noncompliance with ! t 23 that. l 24 MR. CARROLL: I guess you are. 25 MR. PETTIS: Just to follow what Brian had just C ANN RILEY & ASSOCIATES, LTD. Court Reporters l 1250 I Street, N.W., Suite 300 l Washington, D.C. 20005 I (202) 842-0034
410 1 talked about, the staff again had conducted the QA 2 inspections. There were two that were performed, one in the [V} 3 April time frame and one in the November. I had i 4 participated in the November inspection, and basically those ! 5 inspections identified QA related items, findings that were l 6 later documented in several inspection reports and through 7 the normal inspection process, information was gathered, put j 8 in the report, and an exchange of information took place 9 between Westinghouse and the staff to close these items, i 10 which today are considered closed. Through the process, 11 there was quite a bit of information, documentation that 12 came back from the staff and Westinghouse, including several 13 meetings in between here at headquarters to provide the 14 staff additional information that would arrive at the O( ,/ 15 closure of these open items. ' 16 The April inspection that was performed at 17 Westinghouse, like was mentioned earlier, identified several 18 nonconformances and unresolved items related to structural 19 design activities, basically concerning basemat issues that 20 I believe arose from a review of the Bechtel San Francisco 21 and Imitec documentation. Imitec was one of the contractors 22 involved in the AP600 process.. I think those were discussed 23 probably previous to this meeting in the Chapter 3 review. 24 Westinghouse performed a sample review of design 25 deliverables from the foreign partners, and resolution was
\
[ ANN RILEY & ASSOCIATES, LTD. Court Reporters 1250 I Street, N.W., Suite 300 Washington, D.C. 20005 (202) 842-0034
l l 411 1 documented in the inspection report, 9702. So, through the
~
) 2 normal exchange of doing inspections and the inspection 3 process, we found some items, Westinghouse responded, and I 4 then we accepted that response and documented it in the i 5 inspection report. I 6 We went back to do a final QA inspection of 7 Westinghouse in November of '97, and that identified the 8 nonconformances that Brian mentioned, formed the basis for ;
9 this design assurance review. Basically, these were I 10 document quality type issues, quality issues relating to 1 11 calculations and calc notes, the maintenance of those. 12 Again, typically, members of the inspection team normally 13 like to follow design calculations and have some interaction i 14 between the author and the reviewer, but with the way
) 15 business is done today, calculations are kind of vanilla in 16 nature, and all you basically see at the end is just yes, it i 17 was accepted and approved, without the thought process 18 leading up to that decision.
19 The failure to evaluate the computer code errors 1 20 appeared to be something that would be more significant i 21 since we left the inspection. We had no information on l 22 that, and then Westinghouse came back and provided the 23 documentation to show that basically these items were 24 reviewed. This was by their third party provider of the 25 gothic code.
/ ANN RILEY & ASSOCIATES, LTD.
\- Court Reporters 1250 I Street, N.W., Suite 300 Washington, D.C. 20005 (202) 842-0034 i
l l 412 i i MR. KRESS: What kind of computer code errors are
D 2 we talking about?
(~J 3 MR. PETTIS: Well, we never actually got to see 4 the extent of each individual error to know exactly what the 5 significance of it was, but typically, I think in this case-j 6 it was NAI, which is Numerical Applications, Incorporated, 7 which is the author / developer of the gothic basic code. 8 They provide that gothic basic code to Westinghouse. 9 Westinghouse then customized it for their own use and calls 10 it WGOTHIC. In that transition, since NAI is almost like a 11 public domain version at that point, they come up with what 12 would be classified as errors, which could be -- 13 MR. KRESS: Who found the errors, NAI? 14 MR. PETTIS: Excuse me? (m) _, 15 MR. KRESS: Who found the errors? 16 MR. PETTIS: NAI, I believe is Numerical l l 17 Applications, Incorporated. Since Westinghouse is the i 18 purchase of the code -- 19 MR. KRESS: They found errors in their own version 20 or the version that Westinghouse -- 1 21 MR. PETTIS: In their own version. I 22 MR. KRESS: Their own version. 23 MR. PETTIS: In their own version of the coce, ! 24 which forms the basis for the Westinghouse code. So, there i i 25 may be' items in there that may have some significance that i l i ANN RILEY & ASSOCIATES, LTD. s_ Court Reporters 1250 I Street, N.W., Suite 300 ; Washington, D.C. 20005 (202) 842-0034
413 1 need to'be evaluated by Westinghouse. 2 MR. KRESS: Is Westinghouse apprised of these {} L 3 errors in some way? 4 MR. PETTIS: Yes, they were apprised of these 5 errors in a letter that basically came from NAI to l 6 Westinghouse. There were -- some were in'the order of 100, 7 120 of the so-called errors, and I guess you have to qualify 8 the term error because it doea have a negative connotation, 9 but it just could be -- it could be an input error. It 10 could be something where if you used this particular feature 11 of the program, you might wind up with erroneous results. 12 It's up to the user to then determine if, in fact, they're 13 using that program in that application, maybe using that 14 load sequence or using that portion of the program. l () 15 MR. KRESS: Well, what does failure to evaluate 16 computer code errors mean? Did they not-correct these l 17 things in their WGOTHIC or -- 18 MR. PETTIS: No, basically at the time of the 19 inspection, we had identified the letter from NAI that 20 basically said we have sent to Westinghouse over 120, 130 21 type " errors." Under the provisions of part 21, the NCFR50, 22 part 21, there was a program within Westinghouse to evaluate 23 the impact of those particular errors. So, one would have 24 to sit down and review the applicability of those errors to 25 the WGOTHIC code. None of them may have any resemblance to l O, ANN RILEY & ASSOCIATES, LTD. Court Reporters 1250 I Street, N.W., Suite 300 Washington, D.C. 20005 i (202) 842-0034 l l l l
414 f ( 1 what Westinghouse is using in WGOTHIC. On the other hand, 2 it may. So, the failure to evaluate, at the time, there was f)T 3 no documentation available at Westinghouse to demonstrate to l 4 us that those items had been reviewed and they had been 5 reviewed for applicability, and there is no problem. So, we 6 wrote that up as an open item of finding, and then j 7 subsequent to that, Westinghouse has basically gone back, j 8 found the documentation, discussed it with the individual, 9 and we've basically closed it out as a result. 10 It says Westinghouse requested to evaluate impact 11 of the findings in Chapters 6 and 15. This was the basis of 12 the design assurance review, which is what Westinghouse 13 undertook to basically look across the board generically at 14 the items that we had identified. Like Brian said, there (~h,j 15 was an inordinate number of " calculation discrepancies, 16 errors that were found within a limited sample of what we i 17 reviewed. So, the obvious question was, if we're reviewing l 18 a small sample and finding a high, or what appears to be a 19 high error rate, then there needs to be some review of that i l 20 across the board throughout the other facets of the AP600 21 project. 22 In February of '98, Westinghouse's assessment 23 concluded that the root cause of the lack of documentation 24 was that the analysis was basically being prepared for l 25 internal review. Like Mr. McIntyre had mentioned,
) ANN RILEY & ASSOCIATES, LTD. \~/ Court Reporters 1250 I Street, N.W., Suite 300 Washington, D.C. 20005 (202) 842-0034
415 1 internally within Westinghouse, each person doing the review (~, 2 is cognizant and familiar with that area of expertise and
'% J 3 maybe doesn't document it all to the extent that a third 4 party like us would like to see it.
5 The NRC staff concluded that Westinghouse did not 6 address the generic implications, and as a result, 7 Westinghouse initiated the design assurance review to assess 8 the sample of calculations. So, they embarked on a program 9 that basically would look at more calculations, more 10 calculations notes to try to identify if there was a generic 11 problem. As a result, like Westinghouse said earlier, they 12 pretty much concluded that they found the same types of 13 things that we found, although none of them had any impact 14 with respect to SSAR calculations. O ( ,) 15 April 13, Westinghouse came in to brief the staff 16 on the process, which included a discussion of configuration 17 management control and the results of the tech spec self 18 assessment. Preliminary DAR results, which was a slide 19 presentation that basically showed all of what went into 20 their DAR, Their own DAR identified potentially significant 21 technical and documentation quality issues, but concluded 22 that the calculations did not effect what was in the SSAR. 23 The staff went through those potentially 24 significant issues and basically exchanged more 25 documentation between us and Westinghouse, asking for more rO ANN RILEY & ASSOCIATES, LTD. k- Court Reporters , 1250 I Street, N.W., Suite 300 Washington, D.C. 20005 (202) 842-0034
1 416 i 1 clarification, more detailed information to convince the 2 staff that these items, in fact, did not have the potential 3 to cause any reanalysis or invalidate any conclusions that 4 were already in the SSAR. 5 On May 6, the NRC staff I; viewed the DAR scope I 6 objectives and results. Staff concluded that all the open I 7 QA issues had been satisfactorily addressed. The wording : 8 that Brian was alluding to, the responsiveness, is pretty 9 much standard practice with the way we responde to licensees 10 and vendors in that you have supplied information to us. 11 That information is responsive and basically meets our needs 12 and responds to the concerns that we have. As a result, all 13 of those open items that were in the inspection report and l 14 nonconformances as of May 6 have been closed out and () 15 formally addressed. 16 MR. GRAHAM: This is Bob Graham from the staff. I 17 I'd like to add, the current open item in the FSER will I 18 similarly be closed out in relationship to Chapter 17 issues i 19 on the basis of the acceptable conclusions of the 20 inspection. 21 MR. PETTIS: Any other questions? 22 CHAIRMAN BURTON: Thank you. Terry -- Mr. Schulz? 23 MR. SCHULZ: Thank you. My name is Terry Schulz. 24 I was involved in the AP600 DRAP program, partially because 25 the systems that I work on are key elements in that, and my []
\/
ANN RILEY & ASSOCIATES, LTD. Court Reporters 1250 I Street, N.W., Suite 300 Washington, D.C. 20005 (202) 842-0034
417 1 long-time involvement in the RTNSS process, and I was also a ( 2 member on the expert panel that supported the DRAP program. 3 The DRAP program for the AP600 is divided up into 4 three phases. These are talked about in the SSAR. The 5 first phase is basically what we have done in the design 6 certification time frame. The other two phases will be done 7 later. In phase one, it included the selection of the risk 8 significant structures and components. So, you'll find in 9 the SSAR and, in fact, in the presentation, a copy of what 10 is in the SSAR, which is the list of risk significant system 11 structures and components. 12 MR. KRESS: You did that with the PRA, of course? 13 MR. SCHULZ: Pardon me? 14 MR. KRESS: You did that with the PRA? ! /"N i ,) 15 MR. SCHULZ: Well, the selection process included l 16 numerical PRA importance measures, risk achievement worth, l l 17 reduction worth, level 2 insights. It also included an 18 expert panel review, which was, you know, it's kind of a 19 check on this. There's a few deterministic things. The I l j 20 regulations require it, things like that. For the most 21 part, things were captured by these two things, and a lot of 22 the things were captured by the PRA, both from a 23 quantitative importance measure, and in some cases, insights 24 from the PRA. 25 MR. KRESS: What were your risk metrics, CDF? ANN RILEY & ASSOCIATES, LTD. k-- Court Reporters 1250 I Street, N.W., Suite 300 Washington, D.C. 20005 (202) 842-0034
)
418 1 MR. SCHULZ: Are you talking about the core 2 damage? 3 MR. KRESS: Things you found -- the important 4 solid, the risk metrics. l l 5 MR. SEALE: The risk achievement worths, Terry, 6 and stuff like that. 7 MR. SCHULZ: What the criteria was? 8 MR. KRESS: Not the criteria, no. I want to know 9 what the actual metrics were. Was it CDF that you were 10 looking -- was that your risk? 11 MR. SCHULZ: We looked at both CDF at power and at 12 shutdown -- 13 MR. KRESS: This will be my next question. Does 14 it include shutdown? () 15 MR. SCHULZ: Yeah, and it was the whole PRA 16 quantifications, okay? So, it was at power, at shutdown, 17 core damage frequency, release frequency. 18 MR. KRESS: Condition containment failure? 19 MR. SCHULZ: No. 20 MR. KRESS: That wasn't in there? 21 MR. SCHULZ: No. That was the one element, We 22 did consider the seismic evaluation that was part of but not 23 NL8. 24 MR. KRESS: How do you do a risk worth - with the 25 shutdown PRA? Is that multiple PRA's for different shutdown O ANN RILEY & ASSOCIATES, LTD. Court Reporters 1250 I Street, N.W., Suite 300 Washington, D.C. 20005 (202) 842-0034
419 1 configurations? O (j 2 MR. SCHULZ: 'AP600 has, I think, a unique 3 situation from a shutdown perspective. Because of the fact 4 that the safety systems, the safety-related systems are 5 standby systems, we have a much simpler situation. 6 MR. KRESS: You rarely have any of those out of -- 7 MR, SCHULZ: Well, not only that, but they are not 8 used for shutdown operation, which is a great complication 9 -- 10 MR. KRESS: No, PRA, though, counts all your 11 active systems. 12 MR. SCHULZ: It does count them, but that's not 13 the point I'm trying to make. The point I'm trying to make
,c, 14 is that if you have a key safety system like an RHR system
( 15 that is a low-hit SI system and a shutdown cooling system, 16 and during shutdown modes you have to use it, but also you 17 have to maintain it during shutdown modes, and you're also 18 trying to maintain diesels in shutdown modes, you get into 19 extreme complication of interactions between normal 20 operation for maintenance and then so the permutations, 21 combinations of that get extremely hard to model. 2? MR. KRESS: Yeah, that's what I was concerned 23 about, actually. 24 MR. SEALE: That's the problem. 25 MR. SCHULZ: That's the problem. We don't have i l ANN RILEY & ASSOCIATES, LTD. (~/') Court Reporters 1250 I Street, N.W., Suite 300 Washington, D.C. 20005 (202) 842-0034
420 1 that problem because we don't use any of our passive safety 2 systems for normal operation. So, this interaction between 3 when do you maintain it, does its operational aspects effect 4 the PRA. 5 MR. KRESS: What I think I'm gathering from that 6 -is.your PRA is not a best estimate PRA but a conservative 7 one, where you leave out some of the things that -- you're 8 going to have this problem with your active systems. 9 Whenever you shut down to do anything, you're going to have-10 multiple _ configuration. 11 MR. SCHULZ: Yeah. 12 MR. KRESS: And I don't care whether your active 13 systems or passive systems are there are not. So, you're 14 going to have that: problem. b,r y_ 15 MR. SCHULZ: Going to have that problem to a much 16 less degree because our active systems are much more 17 .important. They are the only thing you have in current 18 plants, and in some modes, you don't have a lot of back-up 19 mid-lube operation and whatever, so it's very critical that 20 those active systems be available and -- 21 MR. KRESS: What you're saying is it a focus PRA, 22 no matter what that configuration of those active systems 23 are, they won't show up on your importance measure very
- 24 much.
l 25 MR. SCHULZ: Very much, they're very low \; ANN RILEY & ASSOCIATES, LTD. Court Reporters 1250 I Street, N.W., Suite 300 Washington, D.C. 20005 (202) 842-0034
421 l 11 importance. 2' MR. KRESS: That's probably true. 3 MR. SCHULZ: If you look through the results of P 4 the -- you know, I don't know how much we get into this. I 5 got the whole thing here. It's ten ~pages. We may talk 6 about it all. We may talk about one page,'but you see 7 there, some of the active systems get captured. Most of t 8 them get captured by expert panel because they didn't get 9- above the measures, but a few of them did, but they're on 10 the low end of the importance. 11 MR. KRESS: I understand. 12- MR. SEALE: It strikes me that.as a bounding 13 situation, if and when we.ever start looking into the 14 details of what might be required for completeness in a O( jj 15 shutdcwn analysis, that we might want to look at the AP600 16 shutdown analysis as sort of an extreme -- as an extreme. 17 MR. KRESS: A starting point, yeah. 18 MR. SEALE: I wouldn't say a.way to start, but as 19 a bound. 20 MR. KRESS: It's certainly not typical. 21 MR. SEALE: Certainly not typical, yes. 22 MR. SCHULZ: So, that's what we have completed so 23 far. Phase 2 will go on to develop more specific plant 24 maintenance and monitoring activities, and this really has 25 to, in some cases, wait until equipment is purchased so that 4[ \ ANN RILEY & ASSOCIATES, LTD.
\l Court Reporters 1250 I Street, N.W., Suite 300 Washington, D.C. 20005 (202) 842-0034
422 1 you know what the -- who the vendor is and what the specific () 2 requirements are. Then there's a third phase where the COL 3 applicant will'actually look for site specific things. Now, 4 we don't anticipate an AP600 to find any, and-that's again 5 partially related, mainly related'to the unique aspects of 6 'AP600 where we don't have a service water system that's a 7- key safety system, but for completeness, we still have 8 included this in the DRAF program. It's a necessary l 9 element. l 10 The final thing, and this is a bit of an open item 11 yet, is that we have an ITAAC on the DRAP program. The 12 ITAAC is, our approach to that has been a little bit 13 different than the evolutionary plants. One of the key 14 reasons for that was that the list of risk important SSC's () 15 in the SSAR, in our opinion, is the list. It's not an 16 example as it was in evolutionary plants. So, the 17 evolutiont_y' plants, when they got the ITAAC, basically had 18 to commit to a program, a process, because they didn't 19 really have completed anything. They had done some
' 20 preliminary work or example work.
21 So, in our ITAAC, instead of having the first 22 three steps or so of the evolutionary plants was to go 23 through the process to select the SSC's or to reconfirm them 24 or whatever. We put the list of SSC's out of the SSAR into 25 the ITAAC as a table, and then what we did in terms of O ANN RILEY & ASSOCIATES, LTD. Court Reporters 1250 I Street, N.W., Suite 300 Washington, D.C. 20005 (202) 842-0034 l
423 1 inspections was to assess the reliability of those -- of the [~} 2 as-built components -- this would be, of course, done in the V 3 future by the COL -- verify that the estimated reliability 4 of these components is at least as great as the assumed 5 reliabilities. { 6 MR. CARROLL: How do you go about doing that for, 7 say, a pump? I finally decide I'm going to buy a pump from 8 Pacific Pump that's sitting there. 9 MR. SCHULZ: It will still be done before there's i j 10 any real data on that plant. What we're expecting to happen ) 11 is that you will know who you bought the pump from. 12 MR. CARROLL: Yeah. 13 MR. SCHULZ: That you will assess experience and 14 data from that vendor. 15 MR. CARROLL: Okay. 16 MR. SCHULZ: And again, it's extrapolated from 17 similar applications for similar pumps, but at least that 18 vendor -- so it's more specific than we can be now. Now 19 we're using, you know, generic RHR pump data cr feedwater 20 pump data or whatever, and it's multiple vendors, multiple 21 plants, so it's a little more uncertain. We're getting more 22 certain when we get down to here. ! 23 We can also get down to dealing with maintenance 1 24 considerations relative to reliability, frequency of 25 rechanging of seals or oi.' or related to the vendor, where
'} ANN RILEY & ASSOCIATES, LTD.
Court Reporters 1250 I Street, N.W., Suite 300 Washington, D.C. 20005 (202) 842-0034
424 1 we can't really do that now. So, we're taking a step () 2 forward, and it's about all we think yr1 can do relative to 3- prior to starting the plant up, and it is getting more 4 specific and reducing uncertainty from where we are now. 5 MR. CARROLL: At that point, you have established 6 a minimum reliability numerically? 7 MR. SCHULZ: We have now in our PRA reliabilities. 8 MR. CARROLL: Okay. 9 MR. SCHULZ: I wouldn't necessarily call them 10 minimum. 'They're estimated reliabilities. 11 MR. CARROLL: Okay. 12 MR. SCHULZ: So when the DRAP says or the ITAAC 13 says verify that the estimated reliability of the as-built 14 component is greater than the assumed reliability, at that () 15 point in time may be the PRA number or it may be something 16 derived from that. Right now I would assume it would be the 17 PRA number that you're trying to assess that the as-built 18 component is at least as good as what you assumed now. 19 MR. KRESS: That's a pretty hard thing to do, 20 isn't it? l 21, MR. SCHULZ: It's easier to do it in the future 22 than it is now, but -- l l 23 MR. CARROLL: It's easier for the COL applicant to 24 do it, too. 25 MR. SCHULZ: Well, it's more possible. I mean, O ANN RILEY & ASSOCIATES, LTD. Court Reporters 1250 I Street, N.W., Suite 300 , Washington, D.C. 20005 l (202) 842-0034
425 1 the key thing is we're not saying we're verifying the s ( \ 2 reliability. You can't do that. We're estimating the u) 3 reliability based on more specific information than we have 4 now. We think that's about all we can do. Now obviously, 5 once the plant starts up and starts running, they start C accumulating their own data and then they eventually 7 transition presumably into use of their own data as opposed 8 to more generic historical data, and it gets better and 9 better as they go along. Hopefully, we'll have several 10 identical AP600's running, and that's another source of 11 data. 12 MR. KRESS: Let's hope so. 13 MR. SCHULZ: Yes. So, we're still working on 14 this. In fact. we've been exchanging some information the ( 15 last couple days trying to close that out. 16 MR. CARROLL: It reminds me, we talked the other 17 day about first three plants requiring certain testing and l 18 the first one requiring certain testing. How do you count? 19 Suppose we sell a U.S. plant and then two foreign plants? 20 MR. KRESS: Well, those don't count. 21 MR. SEALE: They count for Westinghouse but not 22 for the NRC. 23 MR. KRESS: For U.S. certification. 24 MR. LEVIN: This is Alan Levin. I'd like to 25 address that because I was involved in the ITP review, and b)\d ANN RILEY & ASSOCIATES, LTD. Court Reporters 1250 I Street, N.W., Suite 300 Washington, D.C. 20005 (202) 842-0034
426
- 1. Jlan Peralta is not here. Oh, he is? Oh, you're back
() 2 3 there. You want to get up and talk to them? MR. PERALTA: No, you can handle it. 4 MR. LEVIN: We've talked-about it a little bit. 5 Foreign plants, you would have -- Westinghouse would have to 6 be able to, in our view I think, to certify, to document-7- that the foreign plant met U.S. QA requirements all the way 8 down the line in terms of the entire program, . design, 9 construction and so forth, and in performance of an ITP and 10 all of that. If they could demonstrate adequately that the 11 plant that was built was the certified design, was according 12 to the rule and no deviations like that, then I don't think 13 that there would be a problem in taking that as part of the 14 database, but the burden would be on them to be able to () 15 demonstrate that. In fact, the plant was built effectively 16 equivalent to having been built in the United States. 17 MR. CARROLL: Okay. 18 MR SCHULZ: In think what Alan says is -- we 19 would completely agree with in respect to start-up testing. 20 MR. CARROLL: Yeah. 21 MR. SCHULZ: Okay, in thermohydraulics. 22 MR. CARROLL: Right. 23 MR. SCHULZ: Now, if you're asking a question 24 about reliability data -- 25 MR. CARROLL : No, I was asking about -- ANN RILEY & ASSOCIATES, LTD. \ Court Reporters 1250 I. Street, N.W., Suite 300 Washington, D C. 20005 (202) 842-0034
I 427 1 MR. SCHULZ: Okay, it's a different -- 2 MR. CARROLL: ( -- about start-up. 3 MR. SCHULZ: The rest of my handout is repetitious 4 of all the 10 pages of the DRAP data out of the SSAR. I was 5 not int'aiing to go through all of it. I.did want to point 6 out a few examples of things from it, and then it's up to 7 you how much we want to talk about it. 8 The general structure of this table is you'll see 9 a. listing for a system, and a system is listed only if there 10 g is some component under it that has been found through the l 11 either quantitative PRA measures or the expert panel or i i 12 deterministic criteria to be risk important. The system 13 would be listed, and the components under it are listed, and 14 there's then in the rationale, that basically says why it's 15 captured. 16 So, if you see something that's EP, that's expert panel 17 So, under the -- 18 MR. KRESS: That's risk import lyt if it is needed 19 to meet in the minus four CDF or -- 20 MR. SCHULZ: This did not use the focused PRA. ' 21 This used the baseline PRA. The measure of risk importance i 22 what not whether or not you needed it to meet the safety l 23 goals. It was the risk achievement worth type number. So, 24 if you made these valves perfectly reliable, how much did I
;25 the core melt frequency improve?
O ANN RILEY & ASSOCIATES, LTD.
\w / Court Reporters ,
1250 I Street, N.W., Suite 300 ' Washington, D.C. 20005 (202) 842-0034
t i 428 1 MR. KRESS: Okay. [ 2 MR. SCHULZ: Or, there's a couple RRW's here, so
\_- !
3 if you made the thing failed, how much did it increase the ' 4 -- l 5 MR. KRESS: So you had some delta CDF's for your 6 target? I 7 MR. SCHULZ: Well, realize what that means, is 8 when you're talking core damage frequency on AP600, you're l 9 extremely low numbers. 10 MR. KRESS: Ex&ctly. 11 MR. SCHULZ: And if you get like a one percent 12 increase in that, what does that mean? 13 MR. KRESS: Will you use percentages? 14 MR. SCHULZ: Percentages. (( ,/ 15 MR. KRESS: Ah-hah. 16 MR. SCHULZ: This is what the process is. 17 MR. KRESS: I see, so this is the same as the 18 maintenance rule process? 19 MR. SCHULZ: Yes, basically, yes. So, even though 20 on the RTNSS process is used a different measure of risk 21 importance that was more black and white, and it was related 22 to safety goal and focused PRA. This is the maintenance 23 rule type process. 24 MR. McINTYRE: Now, Terry, before you go on, I 25 wanted to build on something -- this is Brian McIntyre -- (s ANN RILEY & ASSOCIATES, LTD. Court Reporters 1250 I Street, N.W., Suite 300 Washington, D.C. 20005 (202) 842-0034
429 1 that. Tom had brought-up. We tried to get credit and have [)
\_J.
2 different risk achievement worth numbers for the AP600 3 .because it was so low and we thought, because if you look at 4 it on a percentage basis, you're hitting on something that's 5' near and dear to us. 6 MR. KRESS: Yeah, you're criticizing a really good 7 design. 8 MR. McINTYRE: Yeah, exactly, and we tried to get 9 credit for some better numbers, but the staff said you know, l j l 10 this is what'we did on the evolutionary plants and this is !
~
11 what you're going to do too. We went back and forth several i 12 times, and the first list was really kind of short. 13 MR. SCHULZ: Well, it actually didn't make a lot 14 of difference in how many components we capture. It did () 15 make some difference on why we captured them. 16 MR. McINTYRE: Right.
-17 MR. SCHULZ: Like the chemical and volume control 18 system, we had captured initially, but only on expert panel, 19 and now we pick up a few on RAW's, but these are down in the 1
20 one percent, two percent range, and we had proposed more 21 like a ten percent range, CEU's to 3-5 percent range. We l 22 .actually are going back to the maintenance rule kind of
'23 number.
24 There were a couple of things we did capture that i 25 we otherwish wouldn't have captured, but not very many. I
. , ANN RILEY & ASSOCIATES, LTD. !
Court Reporters ! 1250 I Street, N.W., Suite 300 I Washington, D.C. 20005 (202) 842-0034 l I r ! b__________.._____._____.__.__..__ . _ _ . _ _ . . _ _
430 1 MR. KRESS: I guess there is a certain rationale [') V 2 for using percentage because a lot of the judgments and 3 decision and regulatory controls and so forth are based on 4 the actual numbers of your risk level, and you know, it may 5 be -- percentages then become an important measure of how 6 far you're deviating away from that absolute value. I can 7 see a rationale for using percentages. 8 M1- McINTYRE: I'm sure it also gets into how good 9 is your PRA. 10 MR. KRESS: Yeah. 11 MR. McINTYRE: And you may not really trust the 12 ten to the minus 7, but you would probably trust the five 13 percent change. 14 MR. KRESS: Okay. r ( ,) 15 MR. SCHULZ: So, you will see things like the 16 point of cooling water is expert panel. The containment is 17 not really important from a level one point of view. 18 MR. KRESS: Yeah, that's why I was sondering how 19 it even got on there. 20 MR. SCHULZ: Well, it's expert panel. Also level 21 two. This is your -- L2 is level two, so from a containment 22 of activity, it obviously is quantified very important. 23 MR. KRESS: I'm surprised ~that the cooling water l 24 system shows up on level two. 1 25 MR. SCHULZ: This is the active component cooling l O ANN RILEY & ASSOCIATES, LTD. ss Court Reporters 1250 I Street, N.W., Suite 300 Washington, D.C. 20005 (202) 842-0034 l l
431 1 water system. The passive does. It's in a later stage.
,-~
( 2 MR. KRESS: Oh, it's not part of the containment 3 system? 4 MR. SCHULZ: No, we -- this is just the structure. 5 MR. KRESS: I see, okay. 6 MR. SCHULZ: And we also throw in the igniters 7 under the containment system. The -- and these are all 8 listed by the alphabetical, by the system official title, so 9 passive containment system is PCS, so it's about page four 10 or five. 11 MR. KRESS: Sprays didn't show up on there? 12 MR. SCHULZ: Sprays do not show up on here. 13 MR. KRESS: I just thought I'd throw that in just 14 for pride. () 15 MR. SEALE: This is your so-called non-safety 16 systems? 17 MR. SCHULZ: Right, the -- 28 MR. SEALE: There's quite a bit of them, l 19 MR. SCHULZ: Quite a bit of them. 20 MR. SEALE: I guess, in fact, if it's considered a 21 nca-safety system, it shows up on this list. 22 MR. SCHULZ: Not because it's non-safety. We 23 would basically put our blinders. The knowledge of safety, 24 non-safety, we take that off. We look at what was modeled 25 in the PRA and then -- I ANN RILEY & ASSOCIATES, LTD. Court Reporters 1250 I Street, N.W., Suite 300 Washington, D.C. 20005 (202) 842-0034
432 1 MR. SEALE: So this list is not inclusive of the 2 non-safety systems? [} G 3 MR. SCHULZ: It includes non-safety systems -- 4 MR. SEALE: But not all of them. 5 MR. SCHULZ: Not all of them. Includes the ones ) i 6 that were considered risk important by the deterministic or 7 PRA qualitative -- 8 MR. SEALE: Or expert panel. 9 MR. SCHULZ: -- or expert panel, right. l 1 10 MR. SEALE: Got you. l 11 MR. CARROLL: And what's CCF? l 1 12 MR. SCHULZ: Common cause failure. When you get 13 into highly redundant systems -- 14 MR. CARROLL: Oh, okay. O) q 15 MR. SCHULL: -- common cause failure can, to some 16 extent, mask importance of something because it tends to l 1 17 make a four-way redundant system rather unreliable, 18 relatively unreliable compared to what it might be without l 19 common cause failure. So, one of the thinking processes 20 that we put into this was that when you get into highly i 21 redundant systems, maybe we should give a little more l 22 consideration to what the reliability might be if common l 23 cause failure wasn't there. You do see it on make-up pumps, 24 and there's only two of those, and that was a very minor -- ) 25 I mean, this whole thing just barely makes the quantitative l [~ ANN RILEY & ASSOCIATES, LTD. l
\- Court Reporters 1250 I Street, N.W., Suite 300 Washington, D.C. 20005
( (202) 842-0034 u--------.---------_----------
I 433 1 numbers, but that common cause failure is much more
- af~) 2 important, especially in the INC systems where you -- or in l 3 an ADS --
4 MR. McINTYRE: ADS, yeah. 5 THE COURT: -- where you have multiple redundant 6 systems. 7 MR. SEALE: They sort of infest these low pressure 8 water systems, too, don't they? l 9 MR. SCHULZ: The, like IRWST? I 10 MR. SEALE: Yeah. 11 MR. SCHULZ: Yeah, and again, you're talking j 12 four-way redundant kind of pathways, and that's kind of why 13 you see that. I don't know if there's anymore specific 14 things that I would vant to point out here. If you have any
- s l 15 questions.
16 MR. CARROLL: I guess when I first looked at your 17 PRA, the very low numbers you have, I guess my first 18 reaction was how can they get things that low, given common 19 cause failure. I think.I'm at least semi-convinced that you 20 can. Why don't you give me your take on this. 21 MR. SCHULZ: Let me just show you -- I talked 22 yesterday a little bit about defense in depth and some of 23 the early assessments we did on trying to put on paper, not 24 necessarily a PRA basis but this event matrix. This is, the 25 right-hand column of this is out of a WCAP that we've sent
) ANN RILEY & ASSOCIATES, LTD.
s/ Court Reporters 1250 I Street, N.W., Suite 300 Washington, D.C. 2000b (202) 842-0034 l
t 434 1 the staff on this event matrix. The format of this is to l () 2 3 look at events, and I think I said yesterday we looked a 11 or so at power events, and six or so shutdown events, 4 looking at different modes of initiation of the problem. 5 For each event we looked at, we have an event, and then we 6 look at sort of levels of defense. This gives you a pretty l 7 good picture of why we think it's real that we are much 8 better than existing plants. The loop is loss of outside 9 power. 10 MR. CARROLL: Okay. 11 MR. SCHULZ: The current plant, your primary 12 success, and this -- the black boxes are the safety case 13 that's in the SSAR, which doesn't necessarily have a lot of 14 meaning here because this was more of a PRA real life C) ( 15 assessment, but it's interesting information. 16 So, the automatic start of the auxiliary feedwater 17 system with power from diesels and stuff like that, is the 18 primary success path. If that works, everything's okay, s 19 If that doesn't work, there's typically a feed and bleed 20 backup to that which uses high ADS pumps which would start 21 automatically in the situation. Containment cooling usually 1 22 by spray, sometimes fan coolers. There would be.a manual 23 element to that which would be opening up the vent. That is 24 not automated in current plants. If that works properly, l 25 the core is cooled, although you do put energy into the I ANN RILEY & ASSOCIATES, LTD. Court Reporters 1250 I Street, N.W., Suite 300 Washington, D.C. 20005 (202) 842-0024
435 1 containment. If.that doesn't work usually you're into core
/I 2 damage scenarios.
'V 3 Now, on AP600, we have'a parallel to the auxiliary 4 feedwater, which is startup feedwater, and that's not as 5' reliable. It's non-safety. It's not our safety case, but l l 6 it does add to the picture, okay, and when'you start going 7 down this, one of the things that you see is that we have 8 some highly diverse, very different ways of doing things, 9 and this is really the crux of why AP600 is very reliable, l 10 we think, because we have -- it's not because we have I 11 passive systems and we have one way of doing things and you 12 'just can't fail. That's not our story. It's.not why we 13- .think it's so good. It's that we have a startup feedwater. 14 We have a passive RHR, and we have several ways of doing () 15 feed and bleed with passive systems. 16 Then it's also important to look at common mode
- 17. ways of these things failing, like when you start getting
]
18 into here. These things are actuated by the protection ! 19 system. Well, can that be a common mode failure? Well, yes 20 it can. It is very reliable, but we've also put in diverse 21 ' actuation I&C which provides an independent way of doing 22 this actuation. , 23 What about power to components? Well, this non-1E l 24 AC power, non-1E DC power. This is fail safe. No power i I 25 required at all. The passive RHR, valves fail open, the I O ANN RILEY & ASSOCIATES, LTD. 1250 I Street, N.W., Suite 300 Court Reporters I i l Washington, D.C. 20005 (202) 842-0034 L______________________.__ _ _ _ _ _ _ _ . _ _ _ _ _ . _ _ _ _ _ _ _ . _ _ . _ _ _ . _ _ _ . . _ _ _ _ _ _ . _ _ _ _ _ _ _ _ _ . _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ . _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ . _ _ _ _ . _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ . . . _ _ _ _ . _ _ _ _ _ _ .
436 1 passive containment valves fail open, containment valves () 2 fail closed. So, if the thing goes black, really black, 3 this works. These require some elements of 1E-DC powerfro 41 open ADS valves or IWST injection. In some cases, you even 5 see mixed modes of -- with RNS providing some injection, 6 which minimizes the number of ADS valves needed. In other 7 cases, we need the full depressurization. 8 CHAIRMAN BURTON: A lot of defense in depth. 9 MR. CARROLL: The ADS is common to a lot of that. 10 MR. SCHULZ: It's common to these three elements 11 here, yes. 12 MR. CARROLL: And I guess I always think about the 13 L1011 engine oil drain plugs. Can a maintenance guy where 14 an incorrect spare part defeat ADS, and what happens to that
) 15 chain at that point?
16 MR. SCHULZ: Well -- 17 MR. CARROLL: The fourth stage, for example? 18 MR. SCHULZ: A couple of things. This element 19 doesn't require the fourth stage because of the RNS. This 20 only requires the first three stages. Now, those are motor 21 operated valves. They're completely different technology 22 than the Squib valves. 23 MR. CARROLL: Okay. 24 MR. SCEULZ: So, you know, you see ADS here. It 25 says partial, and what that really means is we only need i O- %- ANN RILEY & ASSOCIATES, LTD.
-Court Reporters 1250 I Street, N.W., Suite 300 Washington, D.C. 20005 (202) 842-0034 l
l
437 1 parts of the first three stages. Down here, yes, we do need p; 2 the fourth stage, but again, you're talking now a couple of 3 the blocks out of -- you have three other ways of doing you 4 don't need. 5 MR. CARROLL: I'm going to do something bad to the 6 MOV's for the first three stages. What does that do? 7 CHAIRMAN BURTON: That leaves you up to the -- 8 MR. SCHULZ: The fourth stage is important. I'm 9 not trying to say it's not important. 10 CHAIRMAN BURTON: Then you rely on the Squibs in 11 the fourth stage. 12 MR. SCHULZ: Right, but you've also got start-up 13 feedwater pumps up here. You've got passive RHR, which is 14 fail-safe here. You know -- (g,) 15 CHAIRMAN BURTON: A lot of things going wrong 16 before you get there. l 17 MR. SCHULZ: You have to feel a lot of things, 18 yeah. Now, when you look at a loca situation, then this is 19 a little different. This whole thing collapses a bit, but 20 you're talking about an event that's less probable, too. 21 This is a more probable event, or if you put loss of main 22 feedwater, you pretty much have the same defense, but it's 23 an event that happens once a year, twice a year. You're 24 talking about a loca that's more like one in a thousand, one 25 'in 10,000 years. You can get away with having less levels l l I ANN RILEY & ASSOCIATES, LTD. ( l s- Court Reporters ! 1250 I Street, N.W., Suite 300 Washington, D.C. 20005 (202) 842-0034 l u_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ - . . _ - - - - _ _ . _ - . _ - . _ _ _ - . - _ _ - . . _ _ _ _ _ _ . . - - - - - - _ _ _ . - - - - - - - - - - - _ _ _ _ _ _ _ _ _ _ _ _
t I L 438 l 1 of defense. You don't need as many. () -2
=3 RMR . KRESS:
a timer after the third stage opened? The opening of the fourth' stage is on 4 MR. SCHULZ: No, the fourth stage requires a 5 fseparate level signal out of the core make-up tanks. The l 6- core make-up tanks basically have two ADS set points. One-
- 7. is relatively high,.two-thirds full, and that gets you stage 8 one. Then two and three come off timers from stage one, but
! 9 we don't get stage four actuation until we get a'20 percent l p 10 full kind.of CMT. So, the CMT has to drain down, or you can 11 do it manually. So, that's basically a long answer to your 12 question.
. . l 13 MR. KRESS: Does that mean that stage one fails to I 14 open, then stages two and three also will fail?
() 15 MR. SCHULZ: That is not correct, no. There is no 16 feedback signal-from valve position intc the circuit. 17 MR. KRESS: I see. It's just that the -- 18 MR. SCHULZ: The instrumentation system gets the i i 19 level signal and then it starts timers going. l 20 MR. KRESS: It starts the timer. 21 MR. SCHULZ: So it will go one, two, three, and if
- 22- 'those valves don't open, it still waits for CMT low, low i
23 level, and it will get four, as long as the pressure is 24 down. There is a pressure interlock on stage four, but as 25 long as the event.with either the loca or passive RHR
, ANN RILEY & ASSOCIATES, LTD.
Court Reporters 1250 I Street, N.W., Suite 300 Washington, D.C. 20005 (202) 842-0034
- _ _ _ _ = _ _ _ _ _ _ . _ _ - _ _ _ _ - _ - - _ - _ - _ _ _ _ _ _ _ _ _ _ _ _ _ - _ _ - _-__-_- _ ___-_ - -_____ - - _ __ _ -_-
L 439 l 1 operation gets you down below 1200 pounds or something, then () 2 3 fourth stage will go off all by i*=e?f. Any other questions? 4 MR. FONTANA: Why is there a pressure interlock on 5 stage four? 6 MR. SCHULZ: It's trying to balance the -- 7 obviously we want it to work when it's supposed to work, but 8 it's very important for it not to work when it's not 9' supposed to work. So, you know, it can create an accident. 10 So, it was our balance of trying to basically optimize the 11 risk of the plant in consideration of initiating events 12 .versus mitigation. 13 We have ways of opening it manually if the 14 pressure is high. We can still do that, but it won't work () 15 automatically if the pressure is high. 16 CHAIRMAN BURTON: Thank you. 17 MR. SCHULZ: You're welcome. 18 CHAIRMAN BURTON: Staff, any other comments on 19 this chapter?
-20 MR. WILSON: No. It's Jerry Wilson, NRR. Staff 21 found the design reliability assurance program acceptable, 22 and we're available for committee questions.
23 MR. KRESS: What was your thinking on asking for a 24 percent change in the, say, the CDF as an acceptance 25' criteria on the risk worth measure? O' ANN RILEY & ASSOCIATES, LTD. Court Reporters 1250 I Street, N.W., Suite 300 Washington, D.C. 20005 (202) 842-0034
440 1 MR. CORREIA: Mainly to be consistent with the () 2 evolutionary designs and the maintenance rule process. We 3 found that it was a reasonable process for operating plants 4 to use in maintenance rule space. We adopted it for the 5 evolutionary plants. It seemed to be logical, if you will. l 6 MR. KRESS: Doesn't it strike you as being a bit 7 of a ratcheting? 8 MR. CORREIA: Well, since industry came up with 9 this process and we endorsed it, we didn't think -- I guess 10 I wouldn't consider that. 11 MR. KRESS: It did come straight from industry. 12 MR. CORREIA: Yeah, it was their idea. We adopted 13 it. 14 CHAIRMAN BURTON: It sounds like the industry C 15 ratcheted themselves on this one, Tom. 16 MR. CORREIA: Oh , my name is Rich Correia of the 17 staff. 18 CHAIRMAN BURTON: No other questions. We'll break 19 until ten to ten and pick it ? with Chapter 22. 20 [ Recess.] 21 CHAIRMAN BURTON: We're back in session. SSAR 22 Chapter 22, Terry Schulz. 23 MR. KRESS: Before we start -- l 24 CHAIRMAN BURTON: Before you start, yeah. ' 25 MR. KRESS: I looked at this RTNSS stuff, and it (' ANN RILEY & ASSOCIATES, LTD. Court Reporters 1250 I Street, N.W., Suite 300 Washington, D.C. 20005 (202) 842-0034
441 1 struck me that that's probably the best example I've seen of () 2 a risk informed performance based regulation. If you guys 3 want to know what I think a risk informed performance based 4 regulation is, look at this thing. 5 CHAIRMAN BURTON: Read Chapter 22. 6 MR. KRESS: Yeah, that's what I think one is. 7 CHAIRMAN BURTON: You'd better be looking that way 8 when you say that. 9 MR. CARROLL: I didn't think you felt that there 10 was such a thing as a performance based regulation. 11 MR. KRESS: Oh, no, I never said that. I said I 12 didn't like them. t 13 CHAIRMAN BURTON: I thirm he likes this one. 14 MR. KRESS: If you're going to have performance (f 15 based regulation, this one is the way to do it. 16 CHAIRMAN BURTON: Well, you might as well just sit 17 down now, Terry. It's all over. 18 MR. SCHULZ: I'll only get into trouble from this 19 point. Is that okay? Can I sit down? 20 MR. LEVIN: Don't screw around with success, 21 Terry. 22 CHAIRMAN BURTON: Don't open your parachute. 23 MR. SCHULZ: Okay, regulatory treatment of 24 non-safety systems. This whole process got started very 25 early on AP600 with initial contacts with the staff, both in O ANN RILEY & ASSOCIATES, LTD. Court Reporters 1250 I Street, N.W., Suite 300 Washington, D.C. 20005 (202) 842-0034
442 1 the URD requirements and in pre-SSAR submittal discussions l 2 with Westinghouse. There was a lot of early discussion
}
3 about get we like the passive systems, but why don't you 4 keep the active systems there. You know, wouldn't that be 5 better. We said no, AP600 is only going to be economically 6 viable if we don't have to duplicate and add layers of 7 safety equipment in the plant. The whole concept is that 8 passive systems are effective. They are capable. They're 9 reliable to do the safety functions. What used to be safety 10 related, such as diesels and start-up feedwater, they no 11 longer have those roles, but there was this remaining 12 question of how important are they. Do they need tech 13 specs? Do they need seismic requirements, fire separation, 14 all those kind of questions. () 15 So, there was a lot of discussion back in the, 16 actually late '80's and early '90's on, trying to define a 17 process that we would use to assess the importance. There's 18 actually several SECY's, but 94084 was a final version of 19 that. It included some other items, but item A talks about 20 RTNSS approach. We have implemented a process for AP600 21 which is in WCAP reference up there, that takes that SECY 22 requirement process and applies it to AP600. 23 What this process is is to basically look at all 24 of the non-safety systems in the plant and to assess their 25 importance and for those systems that are found to have some iO ANN RILEY & ASSOCIATES, LTD.
\s / Court Reporters
, 1250 I Street, N.W., Suite 300 Washington, D.C. 20005 (202) 842-0034
443 1 importance,.to identify basically the regulatory treatment () 2 3 that is appropriate for that importance. of.three key steps to it.
'So, there's kind One is a sort of screening 4 process that has both PRA.and deterministic elements to it,.
5~ which I'll talk about in the next page. 6 Then, the second part is for those non-safety 7 features that are found to have -- to be captured by that 8 criteria, to identify what the mission is. That's important 9 because ultimately, the regulatory treatment in our minds-10 and in the agreed process, should relate to what the' system 11 is supposed to do. This helps us all focus on is it some 12 seismic capability that's important? Is it some hazard 13- protection capability, or is it simply a random failure 14 availability of a pump that's important. This goes back to () lL5 why was it captured, and then to relate the specific mission 16 to that and then have the regulatory oversight focus on 17 that. 18 MR. KRESS: This is why I-said this is an ideal 19 example of risk informed, performance based because those l 20 first.two sub-bullets under the second bullet, are you risk ~ t 21 informed part. You got risk acceptance criteria. You do a 22 PRA and you've combined that with deterministic and expert 23 panel to determine what is risk important, and then you 24' identify missions that you deal with in a performance space 25 in terms of whether you accomplish those missions or not. O ANN RILEY & ASSOCIATES, LTD. Court Reporters 1250 I Street, N.W., Suite 300 Washington, D.C. 20005 (202) 842-0034 L o
444 1 This is what is meant by performance based, risk informed () 2 3 regulations. Those missions and those processes you go through to assure that you meet those missions are not 4 necessarily relatable to achieving the risk value. They're 5 performance in nature. So, this is what you mean by risk 6 informed, performance based. 7 MR. SCHULZ: Okay. Let's talk a little bit more 8 about what the criteria that was used to determine or assess 9 the non-safety systems again. One key element in the 10 probablistic area was uhat we've called the focus PRA. This 11 is something new and different for AP600 where we took the 12 baseline PRA with the same initiating events and same 13 initiating event frequencies and then stripped out the 14 mitigating effects of the non-safety systems. So, we would ( ) 15 have an event like a small loca, and any non-safety system 16 used, like in our case, the normal RHR we would have modeled 17 in the baseline PRA as being capable of the one branch of 18 success in the tree. Then we would say that is assumed to 19 be failed, period. 20 What we were trying to do there is to meet the NRC 21 safety goals with only the safety systems in the PRA. That 22 was the success criteria. Now, one of the side effects of 23 this, and this is a challenge for risk-based type licensing, 24 is that the baseline PRA became very important. Every 25 equipment reliability, every success criteria definition and l ('\~-) ANN RILEY & ASSOCIATES, LTD. Court Reporters l 1250 I Street, N.W., Suite 300 ! Washington, D.C. 20005 (202) 842-0034
445 1 the TNH work that supported the success criteria. 2 The.'PRA involves a lot of information. It's 3 probably not as mature in a sense as deterministic loca 4 analysis cn single failure criteria assessments are'. So, 5 there's a lot of opportunity for debate about what's right,. 6 and we had a lot of debate in this area. It affected --
-7 I'll show you.in the next slide the way we finally resolved 8 that.
9 A second element that's really in the probablistic 10 area is an assessment of initiating event frequency. As I 11 mentioned when we'did the focus PRA, we maintained from a 12 quantification point of view the baseline initiating event 13 frequencies. However, we all realized that there are 14 non-safety systems that play a role in those initiating 15- event frequencies. However, you can't simply turn those off 16 like you can in the mitigating systems because it becomes { 17 nonsensicle. You have what s the chance of loss of main' 18 feedwater if you have no main feedwater pumps? 19 So, we.never were able to quantify this in a PRA 20 calculation,-the importance of non-safety systems from an 21 initiating event frequency point of view. Instead, we did 22' 'an. evaluation that asked three questions, which are actually
- 23. shown a, couple of pages back.
1 24 Three questions that end up having some 25' quantification elements to them, but the first question is
-I ANN RILEY & ASSOCIATES, LTD. !
Court Reporters ! 1250 I Street, N.W., Suite 300 Washington, D.C. 20005 (202) 842-0034 i
446 1 -- and we do this for every initiating event, so does the I V) 2 initiating event frequency depend at all on non-safety 3 systems? So, if you go into like locus, does the initiating 4 event frequency of a pipe break depend on non-safety 5 systems? Now, on AP600, every loca is the break of a 6 safety-related pipe or, if there's a system like the CDS 7 that eventually gets to a non-safety pipe, we have redundant 8 safety-related valves to isolate the non-safety related 1 9 equipment. l 10 So, the loca frequency as calculated has no 11 elements there that are non-safety related. So, we wouldn't 12 capture anything else, any non-safety systems. However, 13 like loss of main feedwater. Obviously the answer to the 14 first question is yes. Main feedwater pumps are non-safety () 15 related, so when you try to figure out the loss of main 16 feedwater frequency, you do consider non-safety systems. 17 Then you get into the same question, is does the 18 availability of non-safety related equipment significantly 19 affect the calculation of the initiating event frequency? 20 Now, here you're starting to get into a key word, 21 significant. What is significant. Again, we had some
]
22 debates with the staff on what's the number to use, 10 23 percent, one percent, these kind of things. 24 There's a third criteria that we said. In some . 25 cases, you would answer the question yes here, and then we b ANN RILEY & ASSOCIATES, LTD.
\- / Court Reporters 1250 I Street, N.W., Suite 300 Washington, D.C. 20005 (202) 842-0034
447 l l 1 did another screening that said does the initiating event ( 2- significantly affect core damage or large release frequency 3 in the focused PRA. So, they could focus PRA results and 4 say that even if the non-safety equipment wasn't important 5 in calculating initiating event frequency, if the resulting l 6 ' core damage or release frequency was extremely low l-7 percentage-wise, then we would still not worry abo:'t that L 8 initiating event, not the equipment involved in it. 9 So, some examples here. Main feedwater, loss of
'10 main feedwater or reactor trip with -- how was that --
- 11. trying to think of it. There's an event we have where main I
12 feedwater was involved in the initiating event frequency. ' 13 It's important in calculating that. When we get down here, 14 it ends up being significant, like more than ten percent of () 15 'the risk, comes from that initiating event. So, we end up 16 saying okay, we should worry about that equipment. So, we 17 capture it and then later on define regulatory treatment for 18 that. 19 MR.-KRESS: It looks like a good approach. In the 20 part where.you defeated the active systems in the earlier 21 part, you used the baseline initiating event frequency? 22 MR. SCHULZ: Yes. 23 MR. KRESS: Irrespective of this? 24 MR. SCHULZ: That's right. 25 MR. KRESS: Because basically, that ought to be O AlRJ RILEY & ASSOCIATES, LTD. Court Reporters 1250 I Street, N.W., Suite 300 Washington, D.C. 20005 (202) 842-0034
448 , 1 captured. \,~ ((v ) 2 MR. SCHULZ: It ought to be captured? 3 MR. KRESS: Well, if you had a database or had 4 some reason for having an initiating event frequency, the 5 failure of.the component, any component that affects it
- 6 ought to be capture in that, but still, this is the process 7 that you have to go to to get the risk worth of this thing. I 8 You have to go back and see what its effect is on that.
f 1 l 9 MR. SCHULZ: Yes. I 10 MR. KRESS: So, I think it looks like a good 11 process, to capture it. J 12 MR. SCHULZ: It was -- the only problem we ran 13 into is the finding significant. 14 MR. KRESS: Well, you could probably back that out (n,) 15 of, you know, you go through the baseline PRA and see what 16 contributions each of the -- l 17 MR. SCHULZ: Well, that's to some extent what l 18 we're doing down here. 19 MR. KRESS: Yeah, okay. 20 MR. SCHULZ: We're not modifying the focused PRA 21 but we're getting insights out of it trying to say how 22 important is loss of main feedwater from initiating event 23 frequency from a core damage point of view. How many loss 24 of main feedwaters ultimately lead to core damage or large 25 release. ['} A-- IJR7 RILEY & ASSOCIATES, LTD. Court Reporters 1250 I Street, N.W., Suite 300 Washington, D.C. 20005 (202) 842-0034
449 I i 1 MR. KRESS: Now, in this case you're using actual I () 2 3= risk measures like CDF and CFP? MR. SCHULZ: Yes. 4 MR. KRESS: So, put percentages under criteria 5 here,.there's a little bit of disconnect, but if you make
-6 that percentage -- it's really like, you know, if your CDF h 7 .is really 10 to the minus 7, and your goal that you're i S trying to meet is still a minus 5 or 4 or whatever, then 9 using a percentage really is a conservative way to capture ;
i 10 these. ' l 11 MR. SCHULZ: .Okay, now those are basically.the 12 focus PRA and initiating event frequency were PRA related. l 13 Now, there was other criteria that we used conclude the 14 ATWAS rule, loss of OAC power rules, post-72 hour actions, h 15 containment performance, adverse interactions between these i 16 non-safety systems we're looking at here and safety systems j i 17 and seismic considerations, 18 MR. KRESS: Remind me what the containment j
\
19 performance criteria is. ' 20 MR. SCHULZ: Again, we did not use the conditional 21 failure probability considerations here. We were looking 22- more at level 2 type phenomenological type issues about 23 hydrogen burns or ex-vessel cooling. ! l
' :2 =4 MR. KRESS: The judgment that this was important l
.25 in testing the loads or --
l ANN RILEY & ASSOCIATES, LTD.
~ Court Reporters 1250 I Street, N.W., Suite 300 Washington, D.C. 20005 ,
(202) 842-0034 l E_---_---__--._-.__.- - - - _ _ - - - - - - - - - . - - - - - - - _ - - - - _ _ - - - - - - _ _ - - - - - - - - _ _ - - - - - - - _ - - - - - - - - - _ - _ - _ _
l 450 1 MR. SCHULZ: Yes, or -- yes, that kind of things. () 2 You actually see this captured reactor vessel insulation, 3 which is not really considered to be safety related but is 4 important, obviously, in the ex-vessel cooling capability. 5 So, this assessment captured that equipment. 6 MR. SEALE: Was there a systematic process you 7 used to assess adverse interactions? 8 MR. SCHULZ: We tried to be systematic about that, 9 but I don't know how you actually can be because you're 10 trying to, in essence, prove a negative again, okay? We did 11 an extensive evaluation, documented that in a WCAP for staff 12 review. That assessment had a bunch of elements to it, 13 okay, looking at T&H type interactions, things related to 14 operator actions, things related to physical location, and h qj 15 it's -- you kind of sit down and think about it. You can 16 also use some PRA, what is modeled in the PRA. You can get 17 some insights out of the Chapter 15 analysis because the 18 people that do that work are trying to think about what can l 19 make -- what's the worst that can happen. So, they will 20 find some. 21 Excessive start-up feedwater flow in a steamline j 22 break, for example. A reactor coolant pump operation that 23 may impede core make-up tank operation. Now, it turns out 24 in AP600, we seem to have done a very good job over the i 25 years at capturing the adverse interactions and putting in g ANN RILEY & ASSOCIATES, LTD.
\ Court Reporters 1250 I Street, N.W., Suite 300 Washington, D.C. 20005 (202) 842-0034 L_ _ _ _ _ _ _ _ _ _ _ _ _ _ - - _ _ _ _ _ _ _ _ _ _ _ _ . - _ _ _ _ _ _ _ _ _ _ _ __- - - _ _ _ - - _ ___- _ _ _ - -
l l 451 j I 1- safety.related features to prevent them. So, start-up 2 feedwater has safety-related isolation. Even though the j (} 3- system is not safety related to feed, the isolation is. 4 Reactor coolant pump trip for CMT operation has i j l 5 safety related breakers redundant to terminate the power to l l 6 the pumps so that they will stop., So, when we went through 7 this whole evaluation, we ended up not really finding any 8 non-safety features that were important in adverse 9 interaction prevention. 10- MR. CARROLL: Were we going to get a presentation 11 on that subject at some point? 12 MR. LEVIN: This is Alan Levin from the staff. I 13 have a presentation prepared which focuses on our overall 14 RTNSS evaluation. The-evaluation of' systems interactions I 15 are included in that, but what Mr..Schulz has said 16 accurately reflects the staff's conclusions. 17 MR. CARROLL: Okay. 18 MR. LEVIN: We asked lots of questions, but we 19 basically concluded that their treatment was acceptable. 20 MR. CARROLL: Okay. 21 MR. KRESS: If I were to ask you how defense in l 22 depth fits into all this, where would I look for it? 23 MR. SCHULZ: Defense in depth, I think the basic
~ 24 question of RTNSS is a defense in depth question. It's 25 almost one and the same, okay? Again, though, you always 4 ANN RILEY & ASSOCIATES, LTD.
Court Reporters 1250 I Street, N.W., Suite 300 Washington, D.C. 20005 (202) 842-0034 l
452 1 have to separate the elements of defense in depth that are [)i 2 embodied in the regulations from a safety perspective of 3 trapping activity between the fuel, the RCS and containment. 4 That's one way of thinking about defense in depth. 5 MR. KRESS: Which is automatically covered by your 6 design. 7 MR. SCHULZ: That's right, in the regulations, 8 absolutely. 9 MR. KRESS: And then when you talk about the 10 importance of -- 11 MR. SCHULZ: Non-safeties. 12 MR. KRESS: -- non-safety systems, that's a 13 defensive concept in itself. 14 MR. SCHULZ: That's right, and that gets more into
/'
(%) 15 what we're talking about here, of what -- how important are 16 these other ways of doing things, these non-safety related j 17 things, and it's trying to look at both from a PRA 18 perspective and sort of other thinking perspective. 19 MR. KRESS: That is a sort of a defense in depth 20 concept. 21 MR. SCHULZ: Yes. 22 MR. KRESS: As well as use an expert panel to pull 23 things in that might not have showed up on PRA. 24 MR. SCHULZ: That's right. j 25 MR. KRESS: It's an interesting concept. 1 O\d ANN RILEY & ASSOCIATES, LTD. Court Reporters 1250 I Street, N.W., Suite 300 Washington, D.C. 20005 (202) 842-0034
t 453 1- MR. SCHULZ: And there's a lot of ways of slicing () 2 3 that, and it's hard to do it with one, one way. The next several slides go through the results of
- 4 the screening and what criteria captured what system. The 5 focus PRA ended up, at least directly, not capturing any 6 systems. The AP600 focus PRA, the core damage frequency 7 increases. Now, this is shutdown and at power lumped 8 together. I'm not trying to get into the details of the 9 PRA, although that's kind of a whole other discussion, but I 10 just wanted to summarize the resultc.
l 11 So, the core damage frequency increased 2.6E to 12 the minus 7 to 8.3E to minus 6, so a little more than an 13 order of magnitude -- 14 MR, KRESS: When you defeated all the active ( 15 systems, that's the -- 16 MR. SCHULZ: Yeah, this is as I talked about it. l 17 Same initiating event frequency but no non-safety features 18 versus the NRC goal of 1E to the minus 4. So, in core l 19 damage frequency space, we have pretty good margin relative 20 to the goal. l l 21 The severe release frequency also increased a ) 22 similar amount, but the margin is less. It's a small margin l l i 23 there, and that ended up being a source of contention of
]
- 24. gee, if you're that close, you know, what happens if the 25 base line's a little bit wrong or the success criteria is a l l
l O ANN RILEY & ASSOCIATES, LTD. 1250 I Street, N.W., Suite 300 Court Reporters Washington, D.C. 20005 (202) 842-0034 4 l
454 1 little bit wrong, could you;go over the goal, and maybe you 4 () 2 3 need to capture something. MR. KRESS: I'll talk about uncertainties -- Where did this NRC goal of one times 4 to the minus 6 show up?? Where'will I. find that. 5 MR. CARROLL: In'the regulations. 6 MR. SCHULZ: I don't know. We kind of volunteered 7 that. 8 MR. McINTYRE: This is. Brian McIntyre. If you.go-. 9 back to the history of RTNE9, this is something that we, the 10 collective we on this, actuall) both sides of the room 11 reached during an ALWR steering committee industry NRC. 12 meeting out'in -- 13 MR. KRESS: It was up in URD maybe?
'14 MR. McINTYRE: No , this is what we agreed to do.
() 15 Tom Early's comment was -- 16 MR. KRESS: 'But it's not really -- 17 MR. McINTYRE: It's not in the URD. 18 MR. KRESS: It's not really appropriate to call it 19 an NRC goal I don't think. 20 MR, McINTYRE: No, I would say program objective 21 or agreed upon objective. 22_ MR. KRESS: .Okay. 23 MR. SCHULZ: You could, I mean, you notice here, j 24 this is two orders of magnitude different, which is a little 25 -- ANN RILEY & ASSOCIATES, LTD. O- Court Reporters l i 1250 I Street, N.W , Suite 300 Washington, D.C. 20005 ) (202) 842-0034 J
455
'l MR. KRESS: Do I interpret that to mean the CCFP 2 is. 01?
3 MR. SCHULZ: In this whole process we do not deal-4 with conditional containment failure -- 5 DR. KRESS: 'I understand, but that is kind of a l 6 way to think of that. 7 MR. SCHULZ: It is a way of thinking about it and 8 I point that out because you could argue that maybe this c 9 should be 10.to the minus 5 or should have been, but this is 10 hindsight. I don't think I can say any more -- 11 -- indicate .01 for the CCFP? DR. POWERS: 12 Doesn't it -- aren't you looking at the convolution of l 13 conditional vessel failure probability and containment l 14 failure probability here? () 15 DR. KRESS: Yes, yes, and if we talk -- it's not 16 really_ kosher to divide one of those by the other. l 17 DR. POWBRS: If we took the -- 18 DR. KRESS: Unless you have maybe one or two 19 really dominant sequences and then you can do that. 12 0 DR. POWERS: I wonder how the numbers for the SRF 21 would change if we took the probability of -- 22 DR KRESS.: CDF? l 23 DR. POWERS: -- vessel failure given core l l 24 degradation to be one? 25 DR. CARROLL: Vessel meaning reactor vessel? ANN RILEY & ASSOCIATES, LTD. i Court Reporters l 1250 I Street, N.W., Suite 300 Washington, D.C. 20005 (202) 842-0034
456 1 DR. POWERS: Yes, the reactor vessel. 2 MR. SCHULZ: They certainly would go up. They 3 would go up somewhat less here, because one of the things 4 that happens, happened to us, is that when we got into 5 focused PRA, for example the diverse actuation system was 6 assumed to fail, the diverse actuation system is very 7 important in ATWS. ! l 8 A lot of ATWS sequences, as Jim Scobel talked 9 about, lead to types of core damage scenarios that lead to 10 containment failure directly. Now we still have, obvious 1p, 11 in a lot of sequences we still end up with containment . l 12 working, as we calculated here, and if you assume 13 containment failure on core damage, then obviously this 14 becomes your severe release frequency, so it would go up an n () 15 order of magnitude. 16 But the bottom line right now is if you look at 17 the RTNSS assessment in our WCAP under focused PRA, we did 18 not capture any non-safety systems, except as sort of 19 related to the uncertainty discussion, which I'll get into 20 in a minute. 21 Initiating event evaluation, this is that 22 three-step process, one of the sets of equipment that was 23 captured out of this is the turbine island systems that 24 support power operation whose failure ends up in reactor 25 trip.
\
- ANN RILEY & ASSOCIATES, LTD.
[/ \- Court Reporters 1250 I Street, N.W., Suite 300 Washington, D.C. 20005 (202) 842-0034
457 1 It is particular those were transients with main ( 2 feedwater available -- those events were a little bit more 3 likely. 4 This is kind of interesting, because I mean all 5 plants have these systems. They are not less reliable for 6 AP600. They are probably more reliable with all the 7 advances, but this whole process done systematically 8 captures these things. 9 The other thing that it captured was RNS cooling 10 operation during reduced inventory conditions and this is 11 looking out of the shutdown risk aspect when RNS is running 12 and in reduced inventory conditions.you have less redundancy 13 and diversity in the passive systems because the passive RHR i 14 is assumed to be incapable of functioning in this mode, so l l'\) (_, 15 you only have the IRWST feed-and-bleed type cooling. 16 It does pick up the RNS, the cooling water 17 systems, and the AC power that are needed to make RNS work 18 get picked up in this item. 19 Well, let me talk a little bit about 20 uncertainties. 21 DR. KRESS: That is a pretty safe statement there, 22 you know? 23 MR. SCHULZ: Which one? 24 DR. KRESS: Some uncertainties exist. 25 MR. SCHULZ: Probably an understatement to some ANN RILEY & ASSOCIATES, LTD.
\ ss Court Reporters 1250 I Street, N.W., Suite 300 Washington, D.C. 20005 (202) 842-0034
458 1 extent. 2 DR. SEALE: Those two previous bullets -- you are (J) ~-
\
3 very right in that those are the things that really give you l l 4 indigestion when you look at the traditional assessment of 5 safety systems, the fact that those things are not there. 6 MR. SCHULZ: Yes. l 7 DR. SEALE: And it's nice to see them come out 8 when you take this kind of focused look at things. 9 MR. SCHULZ: It seems to make sense. 10 Now, uncertainties -- the big issue here is how . l 11 big are the uncertainties relative to the margin, in 12 reality, so we kind of thought more about the release ! 13 frequency issue than the core damage frequency issue, but 14 some of these are not -- they get tied together. . 7-( 15 You see a few things listed here which we 16 considered to be the more major -- at least points of 17 contention, points of discussions between Westinghouse and 18 the Staff. 19 T&H uncertainty for passive system success 20 criteria -- how many ADS valves do you need? That is really 21 the big question relative to core makeup tanks, 22 accumulators, those kind of interaction. 23 We spent a lot of time trying to resolve that 24 issue by studying T&H analysis, by making it more 25 conservative, to try to bound and limit uncertainty. How
/'] ANN RILEY & ACSOCIATES, LTD.
's / Court Reporters 1250 I Street, N.W., Suite 300 Washington, D.C. 20005 (202) 842-0034
459 1 accurate is MAAP is behind this, because we used MAAP to () 2 make 500 runs looking at different break sizes, locations, 3 combinations of ADV valves and all that. That is totally 4 impractical to do with a detailed DBA type code, NOTRUMP -- 5 it would take forever to do it. 6 We ended up benchmarking MAAP against NOTRUMP. We 7 ended up re-running some of the limiting cases with NOTRUMP. 8 We feel we have dealt with this uncertainty. However, it 9 still remained. It never really got taken off the table as 10 an uncertainty. 11 Another element of uncertainty was what is the 12 reliability that we should use for several of the key 13 components? They weren't uncertain because they were key, 14 but they were -- the combination of being important, (m) , 15 risk-important, and having some uncertainty is why they are 16 listed here, so this squib valves in particular used an ADS 17 here and the low DP check valves, what their reliability 18 was, and also the reactor coolant pump breakers. They are 19 important because if they don't work then the core makeup 20 tank in some cases doesn't work, and the core makeup tank 21 not working means you need manual ADS, which is less 22 reliable than automatic ADS, so that is kind of the thread
- 23 there.
24 There was some question -- the severe accident l 25 hydrogen burn really relates primarily to the IRWST events I i
'()/'s ANN RILEY & ASSOCIATES, LTD.
Court Reporters i 1250 I Street, N.W., Suite 300 j Washington, D.C. 20005 ) (202) 842-0034 i l 1
460 l' =and they-are close'to.the containment and we think that a
/ h 2 hydrogen diffusion flame coming out there won't fail the V
3 containment but that_was a point of deba'te. 4 The : initiating event importance' criteria -- I l .5 mentioned what "significant" means. We had some 6 discussion -- was it .1 or .01? What level should you use 7 there, and it is hard to make a decision there, to get 8 agreement. 9 The way we ultimately dealt with this in written 10 space was to define or capture some features that we tried 11- to relate to or cover off uncertainties with. The next page l 12 -kind of talks about'how we did that. L 13 Ideally we-tried to find what we called a direct 14 compensation. An example of that is there was some g 15 uncertainty in long-term cooling, T&H, how many ADS valves 16 we needed. One non-safety feature that would reduce the 17 reliance on the passive systems in that mode is the RNS, 18 because if the RNS works in long-term cooling situations, it 19 -is injecting and re-circulating and it's very insensitive to 20 how many ADS valves you would have to have, so the RCS 21 pressure, whether it is 15 psi or 10 psi or even 50 psi, it 22 doesn't matter. The pump can put the water in there, 23 whereas the gravity injection recirculation requires the 24 pressure to be very low. 25 In getting the pressure very low, how many ADS O ANN RILEY & ASSOCIATES, LTD. Court Reporters 1250 I Street, N.W., Suite 300 Washington, D.C. 20005 (202) 842-0034
461 1 valves do you need to work was the uncertainty.
,m
(
\m/
) 2 Now there are some situations where there was 3 uncertainty, where we couldn't really come up with a 4 nonsafety feature that sert of directly will reduce the 5 significance of that.
6 An example of that would be a direct vessel 7 injection line LOCA and the resulting, again, ADS valves you 8 need for short-term and long-term cooling. In a DVI line 9 break, or any LOCA, the only real nonsafety system that can 10 help you is the RNS in terms of how many ADS valves you 11 need. 12 In a DVI line break, that renders the RNS 13 ineffective -- it fails it basically because it is a 14 hindered system. It's got two injection points and the fN ( j/ 15 whole system spills and you can't do anything about that the 16 way the design is, so there's nothing we could come up with 17 that would directly compensate for that. j i 18 However, what we did was said, well, okay, what we i 19 are trying to do here is add margin in the severe release 20 frequency and core damage frequency, so if we put some 21 additional regulatory oversight on a feature that reduces 22 that, even if it is not the direct uncertainty, then it 23 still compensates. 24 In this case, by adding some regulatory oversight 25 over the diverse actuation system, that would reduce core ANN RILEY & ASSOCIATES, LTD.
\~ Court Reporters 1250 I Street, N.W., Suite 300 Washington, D.C. 20005 (202) 842-0034
462 1 damage frequency and severe release frequency and even
/%
- ( \ 2 though the uncertainty in DVI response remained, we had
%_)
-3 added margin to the calculated core damage frequencies and 4 release frequencies.
5 We picked DAS in this case because it was 6 relatively important to ATWS. ATWS ended up in focused PRA 7 as being a fairly significant contributor to core damage 8 release frequency kind of numbers so by adding that one 9 feature we got a fairly good improvement. 10 So here you see basically the features that we 11 ended up adding, capturing in this process to try to 12 compensate for uncertainties and it is the DAS -- the DAS 13 has sort of two parts you can think about it. 14 Part of it deals with ATWS mitigation and part of () 15 it dea.'.s with more ESF type functions, and we ended up 16 capturing both of those to deal with T&H uncertainty. 17 R&S injection, again T&H uncertainty as well as 18 some of the squib valve, check valve kind of equipment 19 reliability uncertainties. 20 Onsite AC power -- pretty much for the same reason 21 R&S and in fact they kind of go together. One of the things 22 you don't see here is the cooling water systems that 1 23 normally support RNS -- component cooling water and service 24 water. The reason you don't see that is that the way we 25 approached this problem is because we didn't really capture [ T ANN RILEY & ASSOCIATES, LTL. g
\-) Court Reporters 1250 I Street, N.W., Suite 300 Washington, D.C. 20005 (202) 842-0034 i
\
463 1 this equipment in focused PRA and we're covering f~) v 2 uncertainties, we say we don't really need the whole system. 3 We will accept as being sufficient one train of the system. 4 Now when you look at a system that is not normally 5 running, you don't even know if you have the one train, so 6 you should do something to put some regulatory oversight to 7 make sure you at least have one train, so the RNS doesn't 8 normally run so you should look at it. The diesels don't 9 normally run so you should look at it. 10 However, to run, to operate AP600 you need one 11 train of component cooling water and one train of service 12 water because they support some normal functions. You can't 13 run the plant without them. j 14 The same is true of the CVS, although.not quite l(Oj 15 the same way -- it doesn't run continuously, but it will be 16 turned on once a week a least to make up for small leaks out 17 of the reactor coolant system and again you really can't run 18 the plant without the CVS. 19 There is some equipment that would have been 20 captured to compensate for uncertainties, but we ended up i s 21 not capturing because we decided we only needed one train, l l 4 22 one out of two pieces of equipment, and those equipment l 23 normally ran, so they needed to be run. So we didn't feel 24 that we needed to do anything more. And we ended up i 25 capturing hydrogen igniters relative to the burn, especially l .f) ANN RILEY & ASSOCIATES, LTD.
\d Court Reporters 1250 I Street, N.W., Suite 300 Washington, D.C. 20005 (202) 842-0034
464 1 around IRWST.
! -s
]
2 DR. CARROLL: Give me an example of l L' )T i 3 thermal-hydraulic uncertainty? What is it we are 4 compensating for? 5 MR. SCHULZ: Gee. Where do I start? This whole 6 question grew out of -- when you do the PRA and your success l 7 criteria, you need to decide how many ADS valves do I need. ! 8 That's probably the most important focus. There's other 9 success criteria, but ADS is probably the key. 10 What we did to support that is literally hundreds ) 11 of MAAP runs to look at the different LOCA categories, the 12 min and the max size of those, hot leg, cold leg breaks, 13 with one accumulator or one CMT. Tried to assess whether -- 14 how important ADS stage 1, 2 and 3 was. Was it needed at
. r~N )
i
- (,
v ) 15 all or just 4th stage, how many 4th stage? You get into I 16 operator actions, when they open ADS, or is it automatic? 17 Is containment closure or containment isolation needed or j 18 not? Many, many questions. 19 We used MAAP to run that. There was a lot of 20 uncomfort -- discomfort with using MAAP to assess this. How 21 accurate is MAAP? What about inaccuracies? And so that was l 22 the original question, you know. Was our success criteria j 23 accurate? If we had, for example, proposed using DBA 24 success criteria, single failure, it would have gone away, 25 pretty much, I think. But we didn't. We had proposed, l[~D ANN RILEY & ASSOCIATES, LTD. Y_ I Court Reporters 1250 I Street, N.W., Suite 300 Washington, D.C. 20005 (202) 842-0034 l
i 465 1 because we thought, based on all of our MAAP work, that we 2 could take, in most cases, two four stage failures and still 3 get successful depressurization. 4 Now, we embarked then on an evaluation to try to 5 determine if there was enough uncertainty in the T&H 6 calculations that they would change the success criteria, . 7 that maybe we were wrong, maybe we were being optimistic. 8 So we did a benchmarking of MAAP versus NOTRUMP and looked j 9 at -- set up cases where we ran the same transients with-l 10 both codes, with the same kind of inputs. Because NOTRUMP 11 in Chapter 15 is run with conservative decay heat and all l 12 those kinds of assumptions. MAAP, as run for success 13 criteria, was run with best estimate decay heat. And it was ) 14 a lot of those things you had to kind of make equal so that 15- you could have an equal comparison. 16 Then we looked at the results and, of course, the 17 results didn't agree exactly, as you might imagine. We 18 tried to assess whether there were problems, uncertainties. 19 So it was a difficult question to answer. It was one that 20 was very hard to prove that MAAP was adequate, there wasn't 21 uncertainty. Or how much uncertainty, was it enough to 22 change success criteria? 23 After a lot of, lot of work, we think we proved 24 that point but, ultimately, we felt that the fastest way, 25 most reasonable way out of town was to propose some ANN RILEY & ASSOCIATES, LTD. Court Reporters 1250 I Street, N.W., Suite 300 Washington, D.C. 20005 (202) 842-0034
466 1 additional features which were another way of dealing with .I 2 these uncertainties. By saying that I'll put some 3 regulatory oversight on the RNS and that it more likely 4- ..wou)d be available and, therefore, the question of whether 5 you need two or three ADS valves becomes less important. 6 Okay. The deterministic criteria, we also looked-7 at. ATWS Rule, well, that captured the DAS. function that 8 deals with AWTS so the reactor trip, turbine trip, start of 9 passive RHR, those functions are required to meet the AWTS 10 Rule, so they got captured in this criteria. 11 Loss of AC power. The passive systems do a 12 wonderful job.with loss of AC power, so that really wasn't 13 much of a challenge, and we didn't capture anything there. 14 Post-72-hour actions. The equipment that we.have 15 added, the ancillary equipment, two small generators, the 16 PCS water storage tank and transfer up to the tank, some 17 fans for control room, I&C room cooling, those things, are 18 not safety-related. They are non-safety-related equipment, 19 with some enhancements. So because they are, technically I 20 speaking, non-safety-related, we looked at them and this, 21 the RTNSS process, and considered them important to dealiag 22 with the 72-hour long-term shutdown. So they got captured 23 here. 24 Containment performance. We -- and, again, this i 25 is what non-safety features are potentially important. For l l l l l ANN RILEY & ASSOCIATES, LTD. l M Court Reporters ' 1250 I Street, N.W., Suite 300 Washington, D.C. 20005 (202) 842-0034 l
467 1 i 1 example, things like the IRWST drain is actually achieved ' [~ ) 2 through the use of safety-related valves. Now, valves are U 3 safety-related because of containment recirculation for 4 normal design basis operation. However, because of the way 5 they were designed, they also can be used to dump the IRWST. 6 So that aspect of ex-vessel cooling is actually achieved by i 1 7 a safety-related function. And that's true of most of the 8 features that are important in dealing with containment l l 9 severe accident phenomena. One thing we did capture was the ' 10 reactor vessel insulation. 11 Adverse systems interaction, I have actually 12 talked about a little bit, that we basically did a separate ; 13 assessment of adverse interaction, systems interactions. 14 And all of the things that we identified there that were i C\ () 15 potential adverse interactions were dealt with by 16 safety-related features, isolation valves, that kind of 17 thing. And so they don't get involved in this process. 18 Seismic considerations by themselves did not 19 capture any SSCs, although when we end up dealing with these 20 72-hour things, because of their mission, we do get some 21 seismic requirements. But in looking at the seismic margins 22 evaluation out of the AP600, we did not capture any. 23 The next step in the process is to take the SSCs 24 that we captured in our evaluation of what might be 25 important or what is important and to define the mission ANN RILEY & ASSOCIATES, LTD. O() Court Reporters 1250 I Street, N.W., Suite 300 Washington, D.C. 20005 (202) 842-0034
468 1 statement for that. Now, I didn't show all those statements () 2 here, but in the WCAP we actually go through every feature, 3 like the RNS pumps for initiating event frequency, and we 4 talk about what is'important about it. Okay. 5 For example, in that initiating event frequency, 6 capturing of the RNS, it is not important what the start 7 capability of the system is -- of the RNS. It is not 8 important aligning the valves, because they are already 9 aligned. When that system becomes important, it is already l 10 operating in the RNS cooling mode. So the question is, what , i 11 is important in keeping it running? And that's the kind of 12 thing that we do in this part of the evaluation. 13 The third part then is, well, what is the i 14 appropriate regulatory oversight to try to achieve that l (~'s q ,) 15 mission? And there's many elements to those oversights, it l i 16 is not just one thing. The turbine island systems that got j 17 captured for plant transients with loss of main -- with main 18 feedwater available, the secondary side systems, we have 19 basically -- the proposed regulatory oversight is basically 20 what we already have. We have a description in the SSAR 21 that talks about features in those systems, and we think l 22 that there is nothing additional. We did not propose any 23 additional oversight. 24 Part of the reason for doing that, again, is these 25 systems are downgraded from current plants. They are
) ANN RILEY & ASSOCIATES, LTD.
(~/ w- Court Reporters 1250 I Street, N.W., Suite 300 l Washington, D.C. 20005 (202) 842-0034 u--__.-___----_------------___------_--------------_-- ----- _ - - . _ - - - - - - - - - - - - - - _ - - - - - - - - - - - - - - - - - . . - - - - - - - - - - - - - - - - - - - - - - - - - - - - _ - - -
l 1 469 1 already in current plants, they are already non-safety 2 AP600, they are non-safety. So we weren't doing anything (} j 3 here to make the systems worse. We also didn't think there 4 was much appropriate that you could do, or needed to do. So 5 in the WCAP on the RTNSS, we say that for the turbine island 6 systems, the SSAR description is sufficient. We do point 7 out in the WCAP some areas where features described in the 8 SSAR are enhanced over current operating plants to give a 9 flavor for -- we think we have improved them, but we really 10 didn't take credit for that. 11 For other -- Excuse me. 12 DR. CARROLL: Philosophically, I don't agree that 13 because the operating plants haven't tech spec'ed them, or 14 provided some regulatory oversight, that that shouldn't be () 15 done on AP600. I can certainly argue that the things in the 16 turbine island could have surveillance requirements, for 17 example, and probably be more reliable. 18 One of the things that has happened in this 19 industry is we have got people so caught up in tech specs 20 are the most important thing in the world, and they often i 21 tend to forget things or not put the focus on things that 22 are reliability and safety issues, even though they are 23 called non-safety grade systems. 24 Okay. That's just a comment. 25 MR. SCHULZ: Yeah. I may have slanted that -- [^'}
\/
ANN RILEY & ASSOCIATES, LTD. Court Reporters 1250 I Street, N.W., Suite 300 Washington, D.C. 20005 (202) 842-0034
l 470 1 i slanted that -- stated that incorrectly in a sense. i The I
[900] gpm of , applicability OR Verify that both RNS pumps are in operation and circulating reactor coolant at a flow > (1800] gpm i
r l Revision: 22 [ W85tingt100$e 16.3 15 April 6,1998 ( i l
- 16. Technical Specifications Table 16.3-2 (Cont.)
INVESD1ENT PROTECTION SHORT TERM AVAILABILITY CONTROLS 2.0 Plant Systems 2.2 RNS - RCS Open BASES: The RNS cooling function provides a nonsafety-related means to nonnally cool the RCS during shutdown operations (MODES 4,5,6). This RNS cooling function is important during conditions when the RCS pressure boundary is open and the refueling cavity is not flooded because it reduces the probability of an initiating event due to loss of RNS cooling and because it provides margin in the PRA sensitivity performed assuming no credit for nonsafety-related SSCs to mitigate at-power and I shutdown events. De RCS is considered open when its pressure boundary is not intact. The RCS is also considered open if there is no visible level in the pressurizer. He margin provided in the PRA study assumes a minimum availability of 90% for this function during the MODES of applicability, considering both maintenance unavailability and failures to operate. The RNS cooling of the RCS involves the RNS suction line from the RCS HL, the two RNS pumps and the RNS discharge line retuming to the RCS through the DVI lines. The valves located in these lines should be open prior to the plant entering reduced inventory conditions. One of the RNS pumps has to be operating; the other pump may be operating or may be in standby. Standby includes the g capability of being able to be placed into operation from the main control room. Refer to SSAR section 5.4.7 for additional information on the RNS. Both RNS pumps should be available during the MODES of applicability when the loss of RNS cooling is risk important. If both RNS pumps are not available, the plant should not enter these conditions. If the plant has entered reduced inventory conditions, then the plant should take action to i restore full system operation or leave the MODES of applicability. If the plant has not restored full I system operation or left the MODES of applicability within 12 hours, then actions need to be initiated I to increase the RCS water level to either 20% pressurizer level or to a full refueling cavity. Planned maintenance affecting this RNS cooling function should be performed in MODES 1,2,3 when the PRS is not normally operating. The bases for this recommendation is that the RNS is more risk imporW.t during shutdown MODES, especially during the MODES of applicability conditions than during other MODES when it only provides a backup to PXS injection. Revision: 22 O April 6,1998 16.3-16 [ W85tingh0058 _ _ _ _ . .- . _ _ _ _ . .. >}}