ML14077A287
| ML14077A287 | |
| Person / Time | |
|---|---|
| Site: | Diablo Canyon, Comanche Peak, 05200001  |
| Issue date: | 03/18/2014 |
| From: | Advisory Committee on Reactor Safeguards |
| To: | |
| References | |
| NRC-622 | |
| Download: ML14077A287 (317) | |
Text
Official Transcript of Proceedings NUCLEAR REGULATORY COMMISSION
Title:
Advisory Committee on Reactor Safeguards Open Session Docket Number: (n/a)
Location: Rockville, Maryland Date: Thursday, March 6, 2014 Work Order No.: NRC-622 Pages 1-224 NEAL R. GROSS AND CO., INC.
Court Reporters and Transcribers 1323 Rhode Island Avenue, N.W.
Washington, D.C. 20005 (202) 234-4433
1 1 UNITED STATES OF AMERICA 2 NUCLEAR REGULATORY COMMISSION 3 + + + + +
4 612TH MEETING 5 ADVISORY COMMITTEE ON REACTOR SAFEGUARDS 6 (ACRS) 7 + + + + +
8 THURSDAY 9 MARCH 6, 2014 10 + + + + +
11 ROCKVILLE, MARYLAND 12 + + + + +
13 The Advisory Committee met at the 14 Nuclear Regulatory Commission, Two White Flint 15 North, Room T2B1, 11545 Rockville Pike, at 8:30 16 a.m., John W. Stetkar, Chairman, presiding.
17 COMMITTEE MEMBERS:
18 JOHN W. STETKAR, Chairman 19 HAROLD B. RAY, Vice Chairman 20 DENNIS C. BLEY, Member-At-Large 21 J. SAM ARMIJO, Member 22 RONALD BALLINGER, Member 23 SANJOY BANERJEE, Member 24 CHARLES H. BROWN, JR. Member 25 MICHAEL L. CORRADINI, Member NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
2 1 COMMITTEE MEMBERS: (Continued) 2 DANA A. POWERS, Member 3 JOY REMPE, Member 4 PETER RICCARDELLA, Member 5 MICHAEL T. RYAN, Member 6 STEPHEN P. SCHULTZ, Member 7 GORDON R. SKILLMAN, Member 8
9 DESIGNATED FEDERAL OFFICIALS:
10 ZENA ABDULLAHI 11 CHRISTINA ANTONESCU 12 GIRIJA SKUKLA 13 14 15 16 17 18 19 20 21 22 23 24 25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
3 1 T-A-B-L-E O-F C-O-N-T-E-N-T-S 2 Opening Remarks 3 John Stetkar . . . . . . . . . . . . . . . . . 4 4 Selected Chapters of the Safety Evaluation Report 5 with Open Items Associated with the U.S. Advanced 6 Pressurized Water Reactor Design Certification and 7 Comanche Peak Combined License Application 8 Comanche Peak Combined License Application 9 Perry Buckberg, Staff . . . . . . . . . . . . 43 10 Diablo Canyon Units 1 and 2 digital 11 Replacement Project . . . . . . . . . . . . . . . 49 12 Pellet Cladding Interaction Fuel Failures 13 During Anticipated Operational Occurrences . . 137 14 Adjourn 15 16 17 18 19 20 21 22 23 24 25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
4 1 P-R-O-C-E-E-D-I-N-G-S 2 8:33 a.m.
3 CHAIRMAN STETKAR: The meeting will now 4 come to order.
5 This is the first day of the 612th meeting 6 of the Advisory Committee on Reactor Safeguards.
7 During today's meeting the Committee will consider the 8 following: Selected chapters of the Safety Evaluation 9 Report with open items associated with the United 10 States Advanced Pressurized Water Reactor Design 11 Certification and the Comanche Peak combined license 12 application; Diablo Canyon Power Plant Units 1 and 2 13 digital replacement of the process protection system 14 and portions of the reactor trip system and engineered 15 safety features actuation system; pellet cladding 16 interaction fuel failures during anticipated 17 operational occurrences; biennial review of the NRC 18 safety research; and preparation of ACRS reports.
19 Portions of today's sessions may be closed 20 to discuss and protect proprietary information.
21 This meeting is being conducted in 22 accordance with the provisions of the Federal Advisory 23 Committee Act.
24 Mr. Girija Skukla is the designated 25 federal official for the initial portion of the NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
5 1 meeting.
2 We received no written comments or 3 requests to make oral statements from members of the 4 public regarding today's session.
5 There will be a phone bridge line. To 6 preclude interruption of the meeting, the phone will 7 be placed on a listen-in mode during the presentations 8 and Committee discussion.
9 A transcript of portions of the meeting is 10 being kept and it is requested that the speakers use 11 one of the microphones, identify themselves and speak 12 with sufficient clarity and volume so that they can 13 readily heard.
14 Before we begin, I have one sad comment to 15 make. Dr. Sam Armijo, who has been with us for 8 16 years is participating in his last meeting as a member 17 of the Committee.
18 And, Sam, we're going to be really sorry 19 to see you go. You're going to be really missed.
20 Thank you very much for your long service and active 21 participation and energy and everything you've brought 22 to the Committee.
23 MEMBER POWERS: The trouble is he's going 24 to be spending his time with more mature people. His 25 granddaughter.
NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
6 1 (Laughter.)
2 CHAIRMAN STETKAR: And people who know the 3 difference between 8 and 18 probably already.
4 (Laughter.)
5 MEMBER ARMIJO: No, John, she's three-and-6 a-half.
7 (Laughter.)
8 CHAIRMAN STETKAR: Oh, doing partial 9 differential equations by now.
10 (Laughter.)
11 CHAIRMAN STETKAR: And with that, we will 12 begin our first topic, that is the US APWR and 13 Luminant Comanche Peak COLA. And I will lead that 14 discussion.
15 As a matter of introduction, this is 16 another of our chances to provide some interim review 17 comments on the DCD and COLA applications. As the 18 Committee is well aware, we have been doing that over 19 the course of the year. This particular session will 20 cover most of Chapter 3 and most of Chapter 14 for 21 both the DCD and the COLA, and all of Chapter 9 for 22 the COLA. We had Subcommittee meetings on Chapters 3 23 and 9 back in November of last year. And just very 24 recently, Tuesday of this week, we had a Subcommittee 25 on Chapter 14.
NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
7 1 And with that, I will ask the staff if 2 they have any introductory remarks. Perry?
3 MR. BUCKBERG: No thanks.
4 CHAIRMAN STETKAR: Okay.
5 MR. BUCKBERG: No remarks.
6 CHAIRMAN STETKAR: Good. So I'll turn it 7 over to MHI. Ryan?
8 MR. SPRENGEL: Good morning, everyone.
9 I'm glad to be back yet again. We will be covering 10 the majority of Chapters 3 and 14. The exceptions are 11 noted in the slide.
12 With me today are Masatoshi Nagai and 13 Rebecca Steinman, and they'll be covering the two 14 specific chapters that we're looking at.
15 The first bullet here gets a little busy, 16 and it's getting to the point Chairman Stetkar 17 highlighted earlier in the week. We're talking about 18 the remaining chapter because it's easier. So we 19 actually are down to a few areas after today of 20 remaining chapters or sections to bring to the Full 21 Committee, and those being Chapter 1, the Section 3.7, 22 3.8 with associated sections of 14 and Chapter 18. So 23 we're getting close in terms of our kind of interim 24 interactions with the Committee.
25 The next two portions are a reminder, a NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
8 1 carryover from the last time we met with US APWR is 2 going through some adjustments in our review and where 3 MHI is focusing their energies right now. So we are 4 nearing the end of our kind of slow down adjustment.
5 And we'll be starting a new period where we're 6 focusing on still getting our design certification but 7 in a reduced number of areas at any one time, the 8 first areas being Chapter 18 and defines topical 9 report. So those will be our initial focus areas.
10 And we will be working with the staff to complete the 11 -- or for the staff to complete their SER and then we 12 do it just bringing those to the ACRS Subcommittee and 13 Full Committee.
14 With that, I will turn over the 15 presentation to Masatoshi Nagai for Chapter 3.
16 MR. NAGAI: Thank you, Ryan.
17 Good morning. I am Masatoshi Nagai, the 18 licensing engineer for Chapter 3. DCD Chapter 3 is 19 titled, "Design of Structures, Systems, Components and 20 Equipment." Last October the NRC issued Safety 21 Evaluation Report with open items for this chapter 22 except 3.7 and 3.8. MHI and the NRC staff presented 23 that chapter to the ACRS Subcommittee on November 20th 24 and 21st last year.
25 In t Safety Evaluation Report there are 24 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
9 1 open items. Seven of them are considered closed at 2 this moment. The areas that require further review 3 and interactions with the staff include the DCD 4 sections listed on this slide. There are two 5 outstanding RAIs in Section 3.9.2 regarding US APWR 6 steam generator design methodology and criteria. So 7 responses to the RAIs have been prepared and provided 8 to the staff and the staff has been reviewing the 9 responses.
10 MHI recently submitted revised responses 11 to two RAIs in Section 3.9.4 regarding seismic design 12 of CRDM reflecting the latest seismic input. The 13 responses are available on the docket for the staff's 14 review. MHI also submitted a revision to Technical 15 Report MEUAP 10,023 initial type test result of class 16 1 mini gas turbine generator system, which includes 17 discussion on seismic qualification of the system.
18 There's one open item in Section 3.10 to track the 19 status of the review of the report.
20 In Section 3.11, the environmental 21 qualification, there are several RAIs that have been 22 closed including ones regarding environmental 23 qualification of non-metallic parts and the use of the 24 term "important to safety." And we have been working 25 with the staff to identify the path forward.
NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
10 1 There are a few other open items in the 2 Safety Evaluation Report to track the audit of design 3 specifications for ASME 613 components for 4 specifications and quote the seismic qualification --
5 I'm sorry, seismic and quality group classification.
6 The audit was conducted last month, February 2014.
7 There are several follow-up items from the audit which 8 I committed to address by revising some of the 9 specifications and the supporting documents and making 10 them available in future follow-up audit for the staff 11 to review the changes. Finally, reviewing responses 12 to the questions from the ACRS Subcommittee meeting 13 held last November will be submitted on the docket by 14 the end of this month.
15 Okay. The next slide will be presented by 16 Rebecca Steinman.
17 MS. STEINMAN: Hello, my name is Rebecca 18 Steinman and I'm the licensing engineer responsible 19 for Chapter 14 on verification programs. As Chairman 20 Stetkar mentioned, we were just here on Tuesday to 21 talk about that. And several of the members who are 22 today got to listen to that discussion on an area of 23 our initial test program and our ITAAC areas.
24 During that meeting on March 4th we 25 presented all sections of Chapter 14 except for NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
11 1 14.3.2, which is the section of Chapter 14 that goes 2 with the seismic information that we just heard about, 3 the open items associated with that. And then we also 4 did not include Section 14.3.9, which is associated 5 with HFE, which is our next topic that would be coming 6 in terms of the DCD chapters to the ACRS Committee.
7 In both cases the relevant Chapter 14 8 tests that are associated with those two technical 9 areas would be presented at the same time that the 10 technical topic came back to the ACRS. So you would 11 expect to see that Chapter 14 discussion included in 12 those presentations.
13 The remaining review areas for Chapter 14 14 are a little more limited than what was in Chapter 3.
15 We only had one open item in our SE and that was tied 16 to a Chapter 7 RAI. There was a follow-up that was 17 submitted and MHI just at the end of February 18 submitted their response to that. We believe that we 19 have adequately addressed it, but of course the staff 20 has not had an opportunity to completely review our 21 response and come to the same determination, but we 22 hope that we have a closure path for that one open 23 item kind of already in the pipeline so that we'll be 24 closing things up.
25 There are no additional RAIs that are open NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
12 1 in Chapter 14 right now. We are making a couple of 2 editorial types of corrections that have been found by 3 the staff in terms of specific English word usage and 4 some of the Tier 1 material that we're moving forward 5 with as we close out confirmatory items in Chapter 14.
6 During our meeting on Tuesday we received 7 approximately 10 questions from the ACRS and we'll be 8 providing a written response to those hopefully within 9 the next couple of weeks, but definitely by the end of 10 March.
11 And this completes my part of the 12 presentation, and I think our entire presentation for 13 that matter.
14 CHAIRMAN STETKAR: That is efficient. As 15 usual, we had a number of questions. I was going 16 through my notes from the Subcommittee meetings. A 17 lot of the questions during the Subcommittee tend to 18 touch on rather detailed information that is probably 19 not necessarily appropriate for discussion, especially 20 because you're planning to provide written responses 21 to most of our questions. MHI has been very, very 22 good in the past about following up on the questions 23 from the Subcommittee.
24 Recognizing that, I'll ask do any of the 25 Committee members, especially Subcommittee members who NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
13 1 attended the Subcommittee meetings, have any questions 2 for MHI on these topics, Chapter 3 and Chapter 14, 3 recognizing that the remaining sections of Chapter 3 4 will be the structural design and seismic analyses 5 which tend to be somewhat more meaty topics. Put it 6 that way.
7 (No audible response.)
8 CHAIRMAN STETKAR: If not, thank you very 9 much for the summary and we'll have the staff come up.
10 MR. SPRENGEL: Thank you.
11 MR. BUCKBERG: Good morning. My name is 12 Perry Buckberg. I'm the lead project manager for 13 review of the US APWR Design Certification 14 Application. I'll be presenting the staff's 15 evaluation of Chapters 3 and 14, to follow MHI.
16 The current public schedule reflects the 17 pending slow down of the review of US APWR since we 18 have certain chapters that have been issued with open 19 items, partial Chapter 3, Chapter 18 and a couple 20 other areas, exercising phase discipline, if you will, 21 Phase 2 is TBD along with the rest of the review.
22 We've been working with MHI to coordinate the slow 23 down process and how to reach a logical point for each 24 of the chapters that are still under review regardless 25 of what phase the chapter may be in, but TBD applies NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
14 1 because we're not sure when the slow down period will 2 end. Hasn't quite begun yet, but we're not sure when 3 it's going to end. So the schedule will change some 4 time, our estimate two to three years from now.
5 MEMBER SKILLMAN: Perry, let me this 6 question, please.
7 MR. BUCKBERG: Sure.
8 MEMBER SKILLMAN: How does the staff 9 ensure that there's continuity in review? Let's just 10 theorize that the slow down is 24 months, 36 months.
11 The cast of participants change or changes. New eyes 12 and new concerns arrive with new reviewers.
13 MR. BUCKBERG: Yes.
14 MEMBER SKILLMAN: And the work that has 15 been parked for 24 or 36 months now is exposed to new 16 challenge, yet 24 months ago the work was essentially 17 parked. What is in place to ensure continuity so 18 there isn't a redoing of work that has been closed?
19 MR. BUCKBERG: The process is more or less 20 unprecedented. Once the slow down was announced 21 informally in October and then formally in November, 22 we internally started working on that process.
23 Specifically we designed a spreadsheet, an Excel sheet 24 where the current reviewer, the current project 25 manager would document each open area where there is NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
15 1 possibly an RAI response to be reviewed or an open 2 item that hasn't been resolved to document and put in 3 writing certain aspects of that item and in data and 4 in text.
5 That spreadsheet, one for each chapter, 6 will be peer reviewed by their project managers to 7 make sure it makes sense to another reader.
8 Everything that's not represented on the spreadsheet 9 should be represented in an updated draft Phase 4 10 chapter. You either have an evaluation in the chapter 11 that's going to sit for a couple years, or you have 12 itemized documentation of what needs to be done.
13 That was the best plan we could come up 14 with. And the easy answer is I'll let you know if it 15 works.
16 (Laughter.)
17 MR. BUCKBERG: There's going to be some 18 re-review, but hopefully each technical branch to 19 whatever extent is possible will own up to what review 20 was done presently. And there may be a couple steps 21 backward. That's just going to be part of the 22 process. And one of the main reasons is each of the 23 new reviewers, which it could be several, it could be 24 a complete new branch, will have to sit up in this 25 chair and present their evaluation. They're going to NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
16 1 have to take ownership of what was done before them or 2 redo the work before they sit up here. It's very 3 stressful up here sometimes.
4 So that's the process of how we've planned 5 it. And we think it makes sense and it ought to work.
6 But anytime there's a delay of a couple months, or 7 even if a reviewer himself has been out of the office, 8 him or herself, for some period of time, there's a 9 readjustment period. And two or three years from now 10 there's going to be a couple steps backward before we 11 start moving ahead again.
12 MR. LEE: Let me add to Perry's comments 13 here, if I may. This is Sam Lee, the branch chief for 14 Licensing Branch 2 that's overseeing this particular 15 design and also APR-1400.
16 What we are envisioning is is that not 17 knowing how long the slow down period will last, 18 although Ryan has indicated that Chapter 18 will be 19 covered initially during the slow down period and then 20 there will be kind of a trickle-down approach and it 21 will be a very -- smaller fraction of the staff 22 resources dedicated to continuing the review during 23 the slow down period.
24 Having said that though, that's hard to 25 justify a staff of a good size of large -- a number of NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
17 1 PMs dedicated to this project during the slow down 2 period. So what we're envisioning is is that we're 3 going to try to package the chapters and the sections 4 in such a way that if they're not addressed during the 5 slow down period, whether it be two, three years down 6 the road, that the records will indicate, you know, 7 where the reviews have been, what has been done and 8 what needs to be done and what are the next steps to 9 be taken? So we're making sure that those road maps 10 are clearly identified and recorded at this juncture.
11 We're also envisioning that there may be 12 a new project manager and perhaps even a new technical 13 reviewer down the road. And so we're making those 14 assumptions in planning for how the work can be picked 15 back up in a couple of years. So we're giving our 16 best shot to make sure that we're leaving a good 17 record for whoever comes along next to pick up the 18 work.
19 MEMBER SKILLMAN: Thank you.
20 MR. SPRENGEL: This is Ryan Sprengel with 21 MNES. We do need to clarify that there is no 22 committed time period and we'll adjust our efforts and 23 kind of ramp back up depending on other conditions 24 outside of our control right now. So the two to 25 three-year time period is nothing that we're actually NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
18 1 specifically targeting.
2 MR. BUCKBERG: Any more questions on the 3 slow down?
4 MEMBER BLEY: Let me ask one more question 5 about the slow down. I don't know any details of it, 6 but tell me if I'm correct in assuming that any 7 responses to RAIs that are submitted before we really 8 stop this for awhile, you will complete your reviews 9 on those before finishing the flow charts and all of 10 that of where you stand, right?
11 MR. LEE: So when MHI informed us of their 12 plan back in November -- the staff has been trying to 13 package up, you know, close the issues, you know, 14 whether it's in Phase 1 or Phase 4. We saw a good 15 ending point by March 31 was to have an SE with 16 updated information and then so forth.
17 So, but as you might imagine, for every 18 chapter, and perhaps sections, too, we're all in 19 different places, right? And so it's important. For 20 example, where is that particular RAI, you know? You 21 know, if the RAI responses have been submitted, has 22 the staff had the opportunity to review it? And not 23 only have they reviewed it, but have they documented 24 the review?
25 And so we're trying to get to a place NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
19 1 where documentation is the end. And so this road map 2 that I spoke of specifically addresses each RAI, each 3 confirmatory item so that when the review is picked 4 back up, whenever, is that we have a clear sense of 5 where that RAI was, where that confirmatory RAI --
6 what was in that SE?
7 MEMBER BLEY: Just to help me a little bit 8 on this, it sounds as if March 31 -- after that date 9 you have no more money for the review. So there might 10 be some things that are --
11 MR. LEE: Yes.
12 MEMBER BLEY: -- some responses that are 13 partially completed but not all the documentation.
14 That would leave us in a tough spot, I would think.
15 MR. LEE: Well, so the goal here is is for 16 every chapter and every section we -- there is a plan 17 that MHI has been following. And we've been talking 18 with MHI on a weekly basis on where are we 19 specifically on each chapter. And so we're going to 20 try to practice redundancy and diversity ourselves in 21 such that we have records within the SE and the road 22 map and the records that we keep by the technical 23 reviewers and the PMs to make sure that where we are, 24 where we leave this is exactly, you know -- that all 25 parties agreed to that.
NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
20 1 MEMBER BLEY: Okay.
2 MR. LEE: And that has not been easy.
3 That's been a challenge. And we're in close dialog 4 with MHI to do that.
5 Now, I just want to say that nothing is 6 being shut down as far as I understand. It's being 7 called slow down because there are some resources 8 dedicated to this review. And as Ryan said, Chapter 9 18 is kind of next on line after, you know, April 1.
10 So projects will have some resources dedicated to 11 continuing the efforts, but obviously not at the level 12 that we are currently doing.
13 MEMBER BLEY: Thank you.
14 MR. SPRENGEL: I'll take a moment to 15 expand a little bit, maybe add some level of comfort 16 hopefully.
17 The chapter status reports I mentioned 18 that we'll be submitting at the end of March are doing 19 many of the same things that Sam spoke of, but it's 20 from the applicant's perspective and it will be sent 21 in and available on the public record. So it does 22 give a good snapshot of where everything stands in the 23 review of the individual chapters at this time.
24 And we'll also treat those as living 25 documents that we will update. So Chapter 18 is one NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
21 1 of our first starting points. And as we've progressed 2 with Chapter 18, staff finalized the SER. We come to 3 ACRS. We would update that document to show where we 4 stand at that time. So we are trying to keep a good 5 communication and keep a good public record of where 6 we stand in the review and what is happening over 7 time. Like Sam mentioned, you know, we are slowing 8 down, but we're remaining committed. And instead of 9 focusing on all 19 chapters at a time, we're trying to 10 just work on one main area at a time.
11 MR. BUCKBERG: If I might, in the case of 12 the example of the one RAI response, if an RAI 13 response was issued, we would have come to an 14 agreement with MHI that in most cases the staff would 15 review the RAI and at least give a preliminary 16 acceptance of non-acceptance. In many cases we would 17 have also discussed SE input being drafted to really 18 close it out because we found in the past that unless 19 SE input is drafted, even what looked acceptable may 20 turn out to not be. But we didn't arrive to that 21 point for every RAI, for every question. But we tried 22 to. We tried to get to a logical point, and that's 23 the process we're in right now through the end of the 24 month. And we have a plan, MHI has a plan, and we're 25 hopeful that it's efficient. That's about the best we NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
22 1 can do, I think.
2 CHAIRMAN STETKAR: That's important. You 3 know, I've obviously been following this for -- I said 4 earlier Sam's been here 18 years. It seems like I've 5 been following this for about 36 years.
6 (Laughter.)
7 CHAIRMAN STETKAR: But, you know, there 8 are RAI snapshots, and some are very focused on, you 9 know, one specific topic. Some of them are part of a 10 chain of evolving questions. And those, I think, are 11 a bit different. I hope the staff and MHI have been 12 sensitive to those issues where there are initial RAIs 13 issued and perhaps two or three subsequent iterations 14 of RAIs to successively refine an understanding of a 15 particular topic. Those are the ones where the 16 continuity, especially the knowledge base of the 17 current review staff, is probably more important than 18 just a specific RAI on, you know, an isolated, if you 19 will, topic.
20 MR. BUCKBERG: Right. And there are RAIs 21 as you described that affect several chapters.
22 CHAIRMAN STETKAR: Right.
23 MR. BUCKBERG: And there's one reviewer 24 that may be central in monitoring the whole thing like 25 the head coach. There's not much we can do but NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
23 1 document what the process was, what the status was and 2 move on.
3 CHAIRMAN STETKAR: Okay.
4 MR. SPRENGEL: We do actually have a very 5 good understanding and very good tracking of the kind 6 of sequential RAI question. So that issue is 7 important, and we've recognized that. And working 8 with the staff over really a couple years now, we've 9 kind of looked at the entire history of our RAIs and 10 we've linked the series of questions so that we do 11 understand the connection between them and that we're 12 really at this point focused only on those most recent 13 ones or any of them that are open for whatever reason.
14 So those linkages are very well aware of and 15 documented. So we're in good alignment with the staff 16 and we're following those.
17 CHAIRMAN STETKAR: Okay. Thank you.
18 MR. LEE: May I just add one thing just to 19 clarify here, because I don't want to create an 20 expectation that I didn't mean to create here. What 21 I said was that we were working toward making sure 22 that we document as much as we can and the end goal 23 being, you know, delivering a phase product via SER.
24 I also just want to say that, you know, that because 25 the chapters and sections are at various places in the NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
24 1 review phase, there are RAIs that we have yet to 2 review, RAI responses that we have yet to review. And 3 so for those, you know, we're making sure that those 4 are the next steps to be tackled, you know, when the 5 full review is resumed.
6 I also want to say that, yes, the slow 7 down that we're speaking of officially starts after 8 March, but we've kind of been in an initial slow down 9 period for the last three months. So with that, you 10 know, there have been some reduced effort on the 11 staff's part to work on this. So just to make sure 12 that not all chapters have ended with an SER, with 13 reviews of all the RAIs. They're in different places.
14 MEMBER BLEY: Not to beat a dead horse, 15 but to say things that are so obvious. You know, you 16 are taking care of them. But one thing I do want to 17 just -- I know in this process of RAIs and the reviews 18 of them there's a lot of verbal discussions and things 19 that are worked out. And I hope you're somehow trying 20 to get that documented so that whoever takes this over 21 sometime has the best understanding they can of where 22 things really stood, because I know it's tough to do.
23 MR. BUCKBERG: It's going to be tough.
24 And one thing that hasn't been mentioned yet is we 25 planned a public meeting on the 20th of March with MHI NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
25 1 to compare notes chapter-by-chapter, line-by-line.
2 And that will add some documentation to our side for 3 sure; possibly to MHI, and some of those notes that 4 need to be recorded will be. And that's part of the 5 process. That's an important part of it.
6 MR. SPRENGEL: But it's a good question.
7 And one of the key parts will be the upcoming meeting.
8 And actually over the last couple months we've 9 identified several areas and worked with the staff on 10 items that were kind of floating, maybe concerns, 11 maybe not and actually working with the staff we did 12 get them documented as RAIs issued out to us. Now how 13 that's resolved and how we respond to it, that's 14 something that we'll deal with over time.
15 The other part is the chapter status 16 reports that we're developing there is a section that 17 looks into the future. And if it's kind of a key area 18 that we know we still have some interactions and still 19 have some, I don't know, maybe development of a 20 response to go, we're giving an indication in that 21 section of where we intend to go for that area. So 22 again, it's meant to communicate with the staff and 23 it's also documenting on a public record where we 24 stand from the applicant perspective.
25 MR. BUCKBERG: Next slide? Reflected in NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
26 1 this slide are the chapters that have been issued and 2 by the close of this meeting will have been through 3 the ACRS Full Committee as well, which as MHI 4 represented is the vast majority of the chapters, 5 though there are some difficult areas yet to make it 6 through Phase 2 even.
7 During the November Subcommittee meeting 8 for Chapter 3, 20 open items were presented by the 9 staff. The current status of those 20 open items is 10 reflected in these three slides for Chapter 3. If 11 there are any specific questions, I hope we can answer 12 or take for action on these.
13 CHAIRMAN STETKAR: Perry, you noted --
14 never mind.
15 MR. BUCKBERG: Chapter 14 was presented on 16 Tuesday to the Subcommittee. One open item was 17 discussed. And no surprise, the status hasn't changed 18 since Tuesday, so it's just reflected on this slide as 19 well.
20 One ACRS question regarding steam 21 generator internals and vibration testing we had sort 22 of an interim answer that the staff is still 23 considering where to go with that and how it affects 24 Chapter 14 verification programs.
25 CHAIRMAN STETKAR: Yes, just for clarity NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
27 1 for the other members, there was some discussion 2 during the Chapter 14 Subcommittee meeting. And I 3 noticed -- the reason I said never mind was I looked 4 ahead to this slide. But there's a previous -- one of 5 the RAIs on -- I think slide 6 mentioned -- no, it 6 wasn't slide 6. One of the long list there someplace 7 that I can't find quickly mentioned continuing review 8 of the steam generators.
9 It was my understanding from the 10 Subcommittee meeting regarding the steam generators --
11 we had some questions about vibration testing of the 12 steam generators during the start-up program and its 13 resolution in the context of Chapter 14. And I 14 thought that I understood from staff -- is that you've 15 not yet completed -- I want to make sure that I 16 understand it and the other members who were not 17 present at the Subcommittee meeting have an 18 opportunity to gain the same understanding. You've 19 not yet completed your review of the steam generators, 20 is that correct?
21 MR. BUCKBERG: That's our understanding.
22 CHAIRMAN STETKAR: And when you complete 23 that review, you may revisit possible start-up testing 24 requirements for the steam generators. Is that an 25 accurate understanding?
NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
28 1 MR. BUCKBERG: That's an accurate 2 understanding.
3 CHAIRMAN STETKAR: Okay. Thank you.
4 MR. BUCKBERG: We're good?
5 CHAIRMAN STETKAR: (No audible response.)
6 MR. BUCKBERG: The RAI at the top of slide 7 5 is the one I believe you're referring to.
8 CHAIRMAN STETKAR: Yes.
9 MR. BUCKBERG: Just for the sake or 10 argument.
11 That being said, that's the last for 12 Chapter 14 and the end of my presentation. Any 13 questions?
14 CHAIRMAN STETKAR: Do any members have any 15 questions for the staff?
16 (No audible response.)
17 CHAIRMAN STETKAR: No? Thank you very 18 much. And thanks a lot for the summary on the slow 19 down information. That was helpful.
20 MR. BUCKBERG: Well, we appreciate the 21 questions. We field lots of questions. We have a 22 branch chief meeting today where we present and we 23 take a lot of notes. And there are a lot of opinions 24 and a lot of good suggestions on how to move forward 25 with this. So we're trying to take it all in.
NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
29 1 CHAIRMAN STETKAR: With that, we'll have 2 Luminant come up. They have a little bit more 3 material to cover than MHI and the staff.
4 John, you up first? Don?
5 MR. WOODLAN: I'm up first.
6 CHAIRMAN STETKAR: Okay.
7 MR. WOODLAN: Good morning. My name is 8 Don Woodlan. I'm the manager of Nuclear Regulatory 9 Affairs for Luminant and for the Comanche Peak, Units 10 3 and 4 projects. I want to thank you for letting us 11 present today, squeezing us into your schedule, 12 especially for Chapter 14.
13 With me today are John Conly and Bob 14 Reible. They're both from Luminant as well.
15 First slide. The agenda of what we intend 16 to cover today. Briefly an introduction of the 17 various topics. And the chapters we're looking at are 18 Chapter 3, less the seismic and structural sections; 19 Chapter 9; and then Chapter 14. And as mentioned in 20 the DCD presentation, that does not include the human 21 factors or the seismic structural aspects of Chapter 22 14. Those will be covered when those sections are 23 covered.
24 And some general topic information which 25 we presented in most of our briefings hasn't changed NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
30 1 much at all. The entire COLA uses the IBR, or 2 incorporated by reference, methodology. In the 3 chapters we're covering today, 3, 9 and 14, we take no 4 departures --
5 (Laughter.)
6 MR. WOODLAN: -- from the US APWR DCD. In 7 fact, we take not departures at all in the entire COLA 8 at this point in time.
9 MEMBER SKILLMAN: SKILLMAN: Don, as you 10 proceed do you anticipate taking departures based on 11 the final 3.7 and 3.8 for the DCD?
12 MR. WOODLAN: No, but I will say that we 13 have a list of potential departures that we would 14 consider after we got the license mostly for economic 15 reasons that there may be alternate ways of doing some 16 things that we may consider doing. But it's just a 17 list that we've maintained just in case and that we 18 want to evaluate at that point in time.
19 MEMBER SKILLMAN: So there are potential 20 departures --
21 MR. WOODLAN: Yes.
22 MEMBER SKILLMAN: -- awaiting the DCD and 23 the final deposition of this application?
24 MR. WOODLAN: Yes.
25 MEMBER SKILLMAN: And that will be based NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
31 1 on economics at the time?
2 MR. WOODLAN: I believe so.
3 Do either you recall exactly?
4 I think that's what they are.
5 MEMBER SKILLMAN: Okay. And those will be 6 based on Tier 1 information and Tier 2* information, 7 is that correct? If it's not that, it's supplement, 8 so it's Tier 1 or Tier 2*.
9 MR. WOODLAN: Yes, it could be either Tier 10 1 or Tier 2*
11 MEMBER SKILLMAN: Okay. Thank you.
12 MR. WOODLAN: We have no contentions 13 pending before the ASLB. I will mention that we are 14 one of the plants that was mentioned in the Waste 15 Confidence Rule activities that are ongoing. And so 16 we are part of that evaluation that the staff is 17 completing. I believe they intend to complete that 18 later this year.
19 All confirmatory items that have been 20 provided to us have been incorporated into the FSAR.
21 And I say FSAR Rev 4. And I believe that's true for 22 these chapters. There are a couple confirmatory items 23 that will be in Rev 5 when it gets issued.
24 Luminant has responded to all the open 25 items in these chapters and all outstanding issues NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
32 1 have been identified in the SERs that have been 2 provided.
3 Okay. With that, we'll move into kind of 4 a summary of the ACRS Subcommittee discussions and 5 we'll each take turns covering a chapter. I'm going 6 to turn Chapter 3 over to John Conly.
7 MR. CONLY: Thank you, Don. My name is 8 John Conly. I'm the COLA project manager for 9 Luminant's Comanche Peak Units 3 and 4.
10 In November of last year we presented 11 Chapter 3. And at that time we discussed with the 12 ACRS Subcommittee a couple of items in detail. One is 13 the military air crash probability, the assumptions 14 and numbers therefore. And the second item was the 15 turbine missile probability calculation, again numbers 16 and assumptions made during that calculation. Those 17 were the major items discussed.
18 Are there any further questions?
19 CHAIRMAN STETKAR: My recollection, again 20 for the members who were not present at the 21 Subcommittee meetings, the issues that we raised that 22 are noted here, the military aircraft crash 23 probability, there is a military air traffic corridor 24 within -- you'll have to correct me of the exact 25 distance of the center line of the site, but it's NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
33 1 within close enough that they need to actually 2 quantify a crash frequency. And we had some questions 3 about the military aircraft crash frequency data that 4 they're using, because military aircraft have 5 different crash frequencies than commercial aircraft.
6 So that's that item.
7 Turbine missile probability calculation 8 was more in terms of the completeness of the analysis 9 looking at all of the -- not just the turbine stop 10 valves and control valves and their associated 11 hydraulics, but all the way out through the signal 12 processing to get the trip signals into the solenoids 13 that open the hydraulic fluid valves and things like 14 that. I think there's a clear understanding. We 15 haven't received any feedback yet on either of those 16 items. Seem to be well under control. I don't know 17 where you're going to get the military aircraft crash 18 frequency data, but that's a different issue.
19 (Laughter.)
20 MR. CONLY: If there are no further 21 questions, I will ask Bob Reible to pick up Chapter 9.
22 MR. WOODLAN: No, I'm doing that.
23 MR. CONLY: I'm sorry, Don Woodlan.
24 MR. WOODLAN: Yes, this is Don Woodlan 25 again. Chapter 9, we have several topics that we've NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
34 1 listed here that were discussed during the 2 Subcommittee meeting. One was the use of wet bulb 3 temperature and especially using that in calculating 4 evaporative losses, whether or not the value we were 5 using was in fact a conservative representation of the 6 site. We talked about the duct heaters in the HVAC 7 system. And that came up because the duct heater 8 values, and actually in the presence of duct heaters 9 was different in the four trains. And it wasn't 10 obvious why they were different, so we discussed the 11 differences.
12 We discussed the sharing or the fire 13 brigade between Units 3 and 4 and how well that was 14 going to work. We discussed the term of incident 15 commander. And that also goes along with fire brigade 16 leader and exactly what that term meant as we were 17 applying it in the FSARs.
18 And the final topic was on flooding in the 19 emergency service water pipe tunnel and whether or not 20 that flooding had the opportunity to flow back into 21 other areas that had safety-related equipment.
22 Unfortunately we had some incorrect information in the 23 FSAR that looked like the tunnel was vented into one 24 of the safety-related areas and therefore flooding 25 would have been a concern. In fact, that is not a NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
35 1 vent path.
2 CHAIRMAN STETKAR: It is not open?
3 MR. WOODLAN: No, it's not open. That was 4 incorrect in the FSAR. We're increasing that.
5 CHAIRMAN STETKAR: So it's sealed?
6 MR. WOODLAN: It sealed. So there will 7 not be flooding into that area from the pipe tunnel.
8 And those were the issues --
9 CHAIRMAN STETKAR: The reason we discussed 10 that last item, and I'm glad -- I don't think we had 11 feedback that it was sealed, did we? My notes were 12 still open on that.
13 MR. WOODLAN: I don't know. We always 14 depend on your comments to the staff and then the 15 staff asks us and --
16 CHAIRMAN STETKAR: Okay. Well, we're 17 closing the loop today, so --
18 (Laughter.)
19 MR. WOODLAN: Okay. All right. Good.
20 CHAIRMAN STETKAR: But those are flood 21 protection sealed piping penetrations --
22 MR. WOODLAN: Yes.
23 CHAIRMAN STETKAR: -- into the reactor 24 building?
25 MR. WOODLAN: Yes.
NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
36 1 CHAIRMAN STETKAR: The reason this came 2 up, for the other Committee members' benefit, is that 3 the internal flooding analyses, if you want to call 4 them that, for the certified design which includes all 5 of the safety-related equipment areas in the -- I 6 always get the names wrong, the reactor building and 7 the power supply building are documented in the design 8 certification document. So anything that has to do 9 with internal flooding sources; pipes, pumps, valves, 10 that kind of thing, within the scope of the certified 11 design is handled in the DCD.
12 Luminant is responsible for the ultimate 13 heat sink and the piping connections between the 14 design of the piping connections from the ultimate 15 heat sink, which in their case are mechanical draft 16 cooling towers, into the normal plant and any 17 associated flooding analyses with their site-specific 18 scope of the design. And there's an interface where 19 the pipes from the service water system enter the 20 reactor building.
21 And there was some question, at least when 22 we had our review, about whether or not those pipe 23 tunnels were physically open to the reactor building 24 such that a break in the piping tunnel could spill 25 water into the reactor building, which was not NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
37 1 considered in the internal flooding analyses because 2 it was from a source outside of their scope. And in 3 principle, if they were open should have been 4 considered in the flooding analyses done by Luminant, 5 but it wasn't addressed there.
6 So that's the whole reason for that last 7 bullet there. And I'm glad to hear that those are 8 closed.
9 MR. WOODLAN: And the reason for the 10 confusion is when we were addressing freezing in the 11 tunnel, we had mentioned that this was a vent path 12 that would help assure no freezing. And that was 13 incorrect.
14 CHAIRMAN STETKAR: That was incorrect?
15 MR. WOODLAN: Yes.
16 CHAIRMAN STETKAR: Okay. That's the 17 problem? Okay.
18 MEMBER SKILLMAN: So now it can freeze but 19 it can't flood?
20 (Laughter.)
21 MR. WOODLAN: Well, it could flood. The 22 flood just won't flow into the other room.
23 MEMBER SKILLMAN: Yes.
24 MR. WOODLAN: And it does not freeze.
25 (Laughter.)
NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
38 1 MEMBER SKILLMAN: Thank you.
2 MR. WOODLAN: You're welcome.
3 CHAIRMAN STETKAR: It is open to the ESW 4 pump rooms, or are they sealed down there also?
5 MR. WOODLAN: I believe they're sealed at 6 both ends.
7 CHAIRMAN STETKAR: Okay. Thank you.
8 MR. WOODLAN: All right. And we'll go to 9 Chapter 14. And you'll notice there are no bullets 10 here, but there are bullets on the handout that we 11 gave you, because it just happened Tuesday. And I'm 12 going to turn it over to Bob Reible to cover Chapter 13 14.
14 MR. REIBLE: My name is Bob Reible. I'm 15 a project on the Luminant team and I'll address the 16 discussion topics for Chapter 14. The discussion 17 topics were also addressed with DCD and there were no 18 follow-ups for the COLA with regard to these topics.
19 One of them was on design air flows. And 20 the second one was the PRA success criteria versus the 21 testing requirements for the ultimate heat sink. That 22 concludes --
23 MR. WOODLAN: Both of which will work with 24 MHI and the DCD in preparing responses.
25 CHAIRMAN STETKAR: Yes, again, for the NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
39 1 benefit of the other members who weren't here, the 2 design airflow is -- part of the testing acceptance 3 criteria measures air flow from ventilation systems, 4 not necessarily the ability of the ventilation systems 5 to maintain temperature in a room. So we had 6 questions about whether the functional acceptance 7 criteria for those tests should also be measuring the 8 ability of the ventilation system to maintain design 9 temperatures rather than just measuring the flow 10 through the fans. And as Luminant mentioned, that 11 applies both for tests that were specified within the 12 scope of the certified design and for the essential 13 service water building ventilation system which is 14 part of Luminant's design responsibility.
15 The PRA success criteria, also a common 16 topic that's shared between the design certification 17 and the COLA because most of the -- or many, let's 18 say, of the testing programs confirm the operation of 19 systems to support the licensing basis of the plant, 20 which -- and the licensing basis of the plant is the 21 plant is nominally four 50-percent-capacity trains.
22 So in many cases the tests confirm the fact that any 23 two of the trains can support a safety function.
24 However, in the PRA there are many cases 25 where the PRA has done analyses to support the notion NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
40 1 that any one of the trains can support the PRA success 2 criteria. So we had questions about whether or not 3 the testing program would indeed confirm the PRA 4 success criteria. In other words, that one and only 5 one train operating would indeed support the success 6 criteria as evaluated in the PRA. The PRA success 7 criteria may be different than the licensing basis 8 because the PRA best estimate heat loads and the 9 timing at which the heat loads would be applied to the 10 various systems.
11 So that's the genesis of the second bullet 12 that we can't see on the screen up there, but that we 13 all have in our handout here. And as I said, that 14 also requires coordination between Luminant and the 15 DCD because the shared nature of some of their 16 responsibilities.
17 MR. WOODLAN: I was going to sneak in here 18 and type it in, but you went too fast.
19 CHAIRMAN STETKAR: There you go.
20 (Laughter.)
21 CHAIRMAN STETKAR: With that, do any of 22 the members have questions for Luminant? If not --
23 MR. WOODLAN: Well, let me just make some 24 closing. You discussed earlier about the slow down on 25 the DCD. Just to refresh everyone's memory, when MHI NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
41 1 announced the slow down on the DCD, Luminant evaluated 2 our status and we can't move any faster than the DCD 3 moves. So Luminant was to actually suspend review.
4 So as of March 31st we're suspending all reviews of 5 the COLA to be restarted whenever. Again, we don't 6 have a schedule either. We're very dependent on the 7 progress that MHI makes on the DCD.
8 But we have worked very well. The staff 9 has been extremely cooperative with us. We've gone 10 thoroughly through what's still open on the COLA 11 docket to get them to, as Perry said, a good closing 12 point to get all the SERs updated as much as possible.
13 We only have a handful, maybe five or six questions 14 that we have now responded to and three of those were 15 just issued last week. And the others are questions 16 that we can't respond to because we're dependent on 17 the DCD to give us information before we can respond.
18 And of questions under evaluation and 19 review, again there's only a handful, I don't know, 20 maybe five or six that are -- maybe more than that, 21 maybe a dozen that are in the evaluation category that 22 the NRC is reviewing. And most of those again are 23 dependent on the DCD activity. Chapter 19, for 24 example, they're focused on the DCD first. We always 25 come second. So that's the reason they're pending.
NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
42 1 It's not because there's any open issues.
2 Everything that could be responded to we 3 have responded to. Almost all the confirmatory items 4 have been closed out. There's only a couple that 5 haven't. And Perry said, the SEs are being updated as 6 they do that so that when we end this on March 31st 7 they'll be as clean as possible going out.
8 And with that I'd like to thank the ACRS 9 members, especially John and the Subcommittee and 10 everybody that participated in the Subcommittees for 11 the many briefings that we've had over the last 12 several years. Because of the suspension Luminant 13 probably won't be back here in front of the Committee 14 for a good period of time. And this is probably my 15 last time I'll be, unless something very unusual 16 happens.
17 I'm very much a firm believer in the 18 process, both the NRC reviews and the ACRS 19 involvement. I believe ACRS makes a good contribution 20 to that process and I believe the questions and the 21 comments and the feedback that we've gotten over the 22 years has been beneficial and has helped us to do a 23 better job and produce a better project. And then 24 that's all I have. Thanks, John.
25 CHAIRMAN STETKAR: Don, thanks a lot. We NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
43 1 appreciate your comments. And it's going to be sad if 2 we don't have any interactions at least with the team 3 in front of us in the future, because it's been very 4 useful. Luminant has taken a real interest. They're 5 knowledge people, good response and be sad if this is 6 the last time we see you, at least with all the faces 7 on both sides of the table. So thanks again for all 8 of your interactions and responsiveness to our 9 questions and things like that. It's been a good 10 process.
11 MR. WOODLAN: You're welcome.
12 CHAIRMAN STETKAR: And with that, we'll 13 have the staff come up for Comanche Peak.
14 MR. BUCKBERG: Hello again. My name is 15 Perry Buckberg. I'm the lead project manager for the 16 staff's evaluation of the Comanche Peak combined 17 license application. I'll be presenting the staff 18 review of Chapters 3, 9 and 14.
19 As Don introduced, the Luminant will be 20 suspended. And this is what that looks like in black 21 and white. Much like the MHI schedule, everything 22 from Phase 2 on is TBD and will remain that way until 23 the review is restarted at some period.
24 The review of COLA chapters has followed 25 closely the review of the design certification NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
44 1 chapters. So this slide looks much like the slide 2 that I presented previously where most chapters as of 3 the close of this meeting will have been through the 4 ACRS Full Committee. And there are some interesting 5 areas left, but a lot of progress has been made.
6 Chapter 3 was issued in October of 2013 7 and presented in November to the Subcommittee. The 8 current status of the three open items discussed are 9 reflected on this slide. And there's been some 10 progress, but still open items at this point.
11 MR. GALVIN: Perry, if I could just 12 mention, the staff -- this is Dennis Galvin. I'm the 13 Chapter 3 project manager. Sections 3.7 and 3.8 of 14 course were not presented, but also 3.41 was not 15 presented here to ACRS because there was a link to the 16 hydrology review which had not been completed. So 17 you'll be seeing that at a --
18 CHAIRMAN STETKAR: That's right.
19 MR. GALVIN: -- future date.
20 CHAIRMAN STETKAR: Because we haven't 21 reviewed those sections of Chapter 2 of the COLA, 22 right?
23 MR. GALVIN: Yes. I think those are still 24 being reviewed, yes.
25 CHAIRMAN STETKAR: Right, right, right, NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
45 1 right.
2 MR. BUCKBERG: Thanks, Dennis. Any 3 questions on the status of the open items?
4 (No audible response.)
5 MR. BUCKBERG: Chapter 9 was issued in 6 July of 2013 and also presented in November. One open 7 item was discussed during the presentation and its 8 status is changed to a confirmatory item where an 9 acceptable response has been provided and the staff is 10 awaiting the next update of the FSAR to verify the 11 change. Any questions?
12 (No audible response.)
13 MR. BUCKBERG: Moving on to the last 14 chapter. Fourteen was just issued a couple weeks ago.
15 And again we appreciated the opportunity to present so 16 soon after. There were no open items presented on 17 Tuesday and the staff did field one question regarding 18 license conditions being somewhat redundant with other 19 requirements and regulations. And all the staff 20 needed to discuss and come to an answer for that 21 aren't present this week, but we're looking into it.
22 It looks like it was a decision that was made a couple 23 of years ago. And it's being revisited and there's a 24 possibility of some change. We want to do what's 25 logical and if we can't find justification for it now, NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
46 1 it's a good opportunity to change it. So no promises, 2 but that's going to be revisited and discussed 3 internally.
4 Any questions on Chapter 14?
5 CHAIRMAN STETKAR: Any members have any 6 questions?
7 (No audible response.)
8 CHAIRMAN STETKAR: If not, thank you.
9 This was very efficient, but as all the participants 10 mentioned, there are a number of -- not many really 11 difficult open items, let's say, at least from our 12 perspective, and that's a little bit why we have this 13 efficiency meeting.
14 Before I go back to the Full Committee, 15 let me ask if there are any members of the public or 16 any people in the room who would have any comments.
17 (No audible response.)
18 CHAIRMAN STETKAR: And I don't know if we 19 have anybody on the bridge line. Girija, can we get 20 the bridge -- we do not?
21 (No audible response.)
22 CHAIRMAN STETKAR: Okay. I'm informed 23 that we do not have any participants on the bridge 24 line.
25 And with that, thanks very much to MHI and NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
47 1 Luminant and the staff; appreciate your participation, 2 and again, very much for the cooperation earlier this 3 week with the Subcommittee. It was a difficult 4 process, but we actually got it all done in terms of 5 logistics of the meeting. And again, I'd like to 6 thank everyone for their cooperation earlier this 7 week.
8 And with that, we will resume the Full 9 Committee meeting.
10 Now, for planning purposes we are about an 11 hour1.273148e-4 days <br />0.00306 hours <br />1.818783e-5 weeks <br />4.1855e-6 months <br /> ahead of schedule. What I would like to do is --
12 let me ask the members. Would we prefer to take a 13 break now, or do we want to just go into the next item 14 that I'm going to propose?
15 MEMBER CORRADINI: What is the next item?
16 It all depends.
17 CHAIRMAN STETKAR: What I'm going to 18 propose is we have an initial read-through of our 19 letters for both US APWR and Comanche Peak, only 20 because we have the time to do that. The letters are 21 relatively short and it's kind of fresh in our minds.
22 So I think we --
23 MEMBER POWERS: And they seem to be bold-24 faced lies.
25 CHAIRMAN STETKAR: And they could be bold-NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
48 1 faced lies.
2 MEMBER POWERS: Yes, because it says we're 3 going to review these chapters during our meetings and 4 we haven't really reviewed these chapters.
5 CHAIRMAN STETKAR: We've reviewed these 6 chapters. We just did that.
7 MEMBER POWERS: No, we conducted a wake.
8 (Laughter.)
9 CHAIRMAN STETKAR: Anyway --
10 MEMBER CORRADINI: I hope that's not on 11 the record.
12 CHAIRMAN STETKAR: It is on the record.
13 What I'd propose, given the time; it's probably too 14 early for a break, if we can just read through these 15 letters, get an initial read-through. I may need 16 some feedback on the -- you'll see on the Comanche 17 Peak letter based on information that we just received 18 during this meeting.
19 MEMBER CORRADINI: We're at your disposal, 20 Mr. Chairman.
21 CHAIRMAN STETKAR: So let's try to do 22 that. And we do that in open session, so you know 23 anyone --
24 MEMBER CORRADINI: Everybody can sit here 25 and watch us.
NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
49 1 CHAIRMAN STETKAR: -- is welcome to 2 participate.
3 Now, should we keep this on the record?
4 We don't normally do that.
5 MEMBER CORRADINI: No.
6 CHAIRMAN STETKAR: So let's close the 7 transcript record. It is still an open meeting. We 8 don't normally deliberate on the transcript record.
9 We'll reopen the transcript when we go back in Full 10 Committee session for the next presentation.
11 (Whereupon, at 9:34 a.m. off the record 12 until 10:44 a.m.)
13 CHAIRMAN STETKAR: We are back in session.
14 The next topic that well hear about is Diablo Canyon 15 Units 1 and 2 digital replacement project, and Mr.
16 Charles Brown will lead us through that discussion.
17 Charlie, its yours.
18 MEMBER BROWN: Okay. This is a briefing.
19 Obviously, Im going to use the title here. Diablo 20 Canyon process protection system is being replaced 21 from its current Eagle System with a new digital 22 protection system, and its for the reactor trip and 23 safeguards.
24 We had a subcommittee meeting on this on, 25 I believe it was February the 18th. We had a very NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
50 1 thorough and comprehensive subcommittee meeting where 2 all the aspects of this particular replacement were 3 covered pretty comprehensively and with a lot of 4 detail. And weve taken a little bit of that detail 5 out but not all of it. Hopefully, weve got the key 6 pieces here. The staff did an excellent job of giving 7 us the presentation, and Im sure theyll do the same 8 today.
9 So weve got about two hours. They have 10 to take less than that because there will be some 11 questions. Youve got 40-something slides, so just be 12 aware, as youre going through, get the sense, and 13 when its ready to move on, move on, okay? And other 14 than that, Ill turn it over to John, if you have any 15 comments, to make to light off.
16 MEMBER POWERS: The easiest thing is just 17 ignore questions from Charlie.
18 MR. THORP: Thats hard to do. He makes 19 himself known. So thats fine, thats fine. We wont 20 ignore those questions. Im John Thorp, Chief of the 21 Instrumentation and Controls Branch in the Division of 22 Engineering in the Office of Nuclear Reactor 23 Regulation. Our staff was requested to provide an 24 informational briefing to the ACRS on several topics 25 related to the digital Canyon process protection NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
51 1 system upgrade license amendment request that Charlie 2 has described to you.
3 So I just wanted to start off with a few 4 introductory remarks, and then well move on into the 5 briefing. Im just going to briefly describe the 6 regulatory history of the Tricon and ALS platforms, 7 i.e. the Tricon and ALS topical reports. Youll get 8 more detail a little bit later in the presentation.
9 And the Diablo Canyon license amendment request, Rich 10 Stattel and Rossnyev Alvarado are principal technical 11 reviewers for this evaluation, but you also see Steve 12 Wyman up here, up front with me, and hes going to 13 speak to the Tricon platform topical report. Samir 14 Darbali, who I believe was here this morning, is also 15 one of my staff members. Hes assigned as a reviewer 16 for this evaluation.
17 So I think we have some members from 18 Pacific Gas and Electric, the utility, that are here.
19 And Ill allow them to introduce themselves, if they 20 would like.
21 MR. SCHRADER: Im Ken Schrader. Im 22 responsible for obtaining the license amendment for 23 this application, and I work at Pacific Gas and 24 Electric, Diablo Canyon Nuclear Plant.
25 MR. PATTERSON: Scott Patterson. I work NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
52 1 at Pacific Gas and Electric. Im the project lead for 2 this project.
3 MR. WILSON: Allen Wilson. I work for 4 Pacific Gas and Electric. Im the project manager for 5 this project.
6 MR. HEFLER: John Hefler. Im with 7 Altran, and Ive been supporting the PG&E project for 8 some years now.
9 MR. THORP: Okay, thank you. In October 10 of 2011, Pacific Gas and Electric submitted a license 11 amendment request to replace the Eagle 21 digital 12 process protection control system at Diablo Canyon 13 Nuclear Plants 1 and 2 with an improved digital plant 14 protection system. The new plant protection system 15 will be comprised of two plant protection subsystems, 16 one of which is based on the Invensys Tricon platform 17 and the other is based on the Westinghouse Advanced 18 Logic System, or ALS as its known.
19 Now, the Tricon system is a computer-based 20 PLC or programmable logic controller type system. The 21 NRC issued a safety evaluation report for the Tricon 22 V10, which means Version 10, platform topical report 23 in May of 2012.
24 For the Advanced Logic System, the ALS, 25 its a field-programmable gate array, an FPGA-based NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
53 1 system that includes diverse features that youll hear 2 a little bit more about later to address the NRC 3 guidance for diversity in digital protection systems.
4 MEMBER BROWN: One comment on that for 5 those who dont know what FPGAs are relative to 6 computer-based systems. Thats the fundamental 7 difference. Tricon is a software-based system, PGA is 8 a, literally, burned-in gate logic. Thats a 9 simplified version, but its not software based. It 10 does have timers with a clock that runs it and all 11 that kind of stuff, but it is not software controlled.
12 So once youve set it in, its there. The software is 13 there. The design stage is where the software comes 14 in.
15 MR. THORP: Right, right. Software is 16 used in the design and construction of FPGAs, and 17 those instructions are then burnt in, as Charlie 18 described, to the chip. So we issued the safety 19 evaluation report for the ALS topical report in 20 October of 2013, and we accepted the LAR for 21 evaluation in January of 2011 for the overall digital 22 PPS. And we identified several issues that could 23 present challenges to approving the license amendment 24 request, and they were deterministic performance of 25 software, software planning documentation, equipment NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
54 1 qualification testing plans, and set point 2 methodologies.
3 Since we raised those particular concerns 4 or issues, Pacific Gas and Electric Company has 5 provided several license amendment request 6 supplements. And theyve responded to all of our RAI 7 questions to date. Now, weve sent out another set 8 that Rich can speak to, and theyre working on that.
9 Weve had two audits at the vendor 10 facilities of Westinghouse and Invensys. Those have 11 been conducted, and the results are publically 12 available.
13 So next will be just a very brief 14 discussion on the process protection system overview.
15 This figure shows the Diablo Canyon, its a very 16 simplified diagram obviously, process protection 17 system architecture, how it fits in with the plant 18 design.
19 Youll see the red box on the screen.
20 That, essentially, is the scope of the digital process 21 protection system or plant protection system being 22 modified. The white boxes that you see all around it, 23 the various other systems and components, are existing 24 plant components and systems that are not being 25 modified.
NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
55 1 The digital plant protection system 2 consists of four protection sets to support reactor 3 protection system and the engineered safety features 4 actuation functions with either two of four or two of 5 three coincidence actuation logic. Now, the 6 integration of RPS and ESFAS, as you may have heard it 7 called before, reactor protection system and engineer 8 safety features actuation system, combines two of the 9 four echelons of defense layers that are described in 10 the NUREG report 6303 for protection against software 11 common-cause failures, or CCF. Well discuss that 12 aspect in a little bit more detail in our discussion 13 of diversity.
14 At this point, Id like to turn over the 15 presentation to Rich Stattel for a more in-depth look 16 at the replacement process protection system.
17 MR. STATTEL: Thank you, John, and good 18 morning, everyone. Im the lead reviewer, and, 19 actually, Im just going to punt it right over to 20 Steve. Hes going to discuss the platform reviews.
21 So what we try to do, the vendors of the platforms 22 that develop and design these platforms, they provide 23 us with information and topical reports. We try to 24 evaluate them at a generic level with the 25 understanding that many of the applications, many of NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
56 1 the regulations that were evaluating against are 2 really dependent, we really have to know what the 3 application is, what the specific application is.
4 Heres a case where we know what the 5 application is. However, we do reference back to the 6 platform evaluations, and there are many 7 characteristics of the system that were previously 8 evaluated. Now, Steve was the lead reviewer for the 9 Tricon platform evaluation. And Bernie Dittman whos 10 in the back of the room here, he was the lead reviewer 11 for the ALS system evaluation. So there are some 12 important characteristics that were reviewed during 13 those applications, and Steve will talk about those 14 first. Go ahead, Steve.
15 MR. WYMAN: Slide, please. Okay. First, 16 the ALS platform. ALS stands for Advanced Logic 17 System. This is a depiction of a typical ALS 18 platform. It uses a standard form factor rack. Its 19 configurable. Each rack can host a variety of input 20 and output boards, and any combination of boards can 21 be placed in any given rack.
22 Theres a single configuration constraint 23 in that a single logic board must be used to 24 coordinate the processing of signals from all the 25 other boards that are connected in the rack. So well NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
57 1 show a block diagram in the next slide, and you can 2 see that a little bit better. Back up because Im not 3 finished talking about the chassis. Thanks.
4 The system is capable of using multiple 5 racks, and this gives them greater opportunity to use 6 more field signals. Whats unique about this platform 7 is that the processing engine of each board is a 8 single FPGA device. Although each board contains 9 unique programming, a common model FPGA device is used 10 on every board. Furthermore, the platform provides 11 two design variants of FPGA programming for each board 12 as a means to increase built-in diversity within an 13 application. Rich is going to talk about diversity a 14 little bit later in the presentation.
15 MEMBER BROWN: Can I ask one question that 16 I forgot to ask during the subcommittee meeting? The 17 back plane for this, I presume theres a back plane 18 that these all plug in to.
19 MR. WYMAN: Yes.
20 MEMBER BROWN: Is that a wired back plane 21 or a printed wiring board style back plane?
22 MR. WYMAN: Ill let Bernie answer that.
23 MR. DITTMAN: Bernie Dittman, Office of 24 Nuclear Reactor Regulatory Research. Its a PC copper 25 back plane --
NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
58 1 MEMBER BROWN: Printed circuit. Its a 2 printed --
3 MR. DITTMAN: Its vertical. Its a 4 printed circuit board.
5 MEMBER BROWN: Okay.
6 MR. DITTMAN: The cards mount to the 7 front, and the field signals mount on the back.
8 MEMBER BROWN: Okay. Thats all I wanted 9 to know. Thank you. I appreciate that.
10 MR. WYMAN: Okay. Slide, please. Its 11 a block diagram of the ALS platform. If you notice 12 the parenthetical values, we didnt have a chance to 13 label them, represent number of inputs or outputs on 14 each one of these. I just wanted to point that out.
15 These signals enter and exit the 16 instrumentation via connectors at the rear of the 17 chassis. As the block diagram is shown here, we have 18 inputs on the left and outputs on the right. Each 19 input and output board requires configuration 20 parameters but does not require changes to its FPGA 21 programming. The board shown on the bottom is a 22 communication board, which may be used to implement 23 interdivisional communications for voting purposes.
24 The board also requires configuration parameters 25 without requiring any changes to its FPGA programming.
NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
59 1 Once configured, a communications board 2 acts only as a unit directional receiver or unit 3 directional transmitter. In either case, the serial 4 data communication does not require handshaking.
5 MEMBER BROWN: This is one division, 6 right? Its one protection set? Its not, when you 7 say interdivisional communication, or, no, you said 8 for voting purposes, and thats a comment we didnt 9 make in the subcommittee meeting. Is that internal to 10 the division?
11 MS. ALVARADO: Hes presenting the generic 12 platform.
13 MEMBER BROWN: Okay, got it. Okay, fine.
14 Thank you very much. I appreciate that.
15 MR. STATTEL: In actuality, the Diablo 16 Canyon application does not use any ALS 601 boards.
17 MEMBER BROWN: Thank you.
18 MR. WYMAN: My next line, yes.
19 MEMBER BROWN: I apologize for being ahead 20 of the game here.
21 MR. WYMAN: The board shown on the top is 22 the logic board and the brains of the ALS platform.
23 The board controls the safety signal bus. As part of 24 the safety signal path, communication between the 25 logic board and the remaining boards occurs through NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
60 1 the motherboard over redundant serial bus, shown here 2 as RAB 1 and RAB 2. RAB stands for reliable ALS bus.
3 The use of multiple racks extends this bus.
4 The logic board acquires conditioned 5 inputs, performs logic functions, and commands the 6 control of outputs. The logic board is the only board 7 that requires application-specific programming. Part 8 of its application-specific programming is the 9 knowledge of the required configuration of all boards 10 connected to its bus. The logic board also provides 11 a limited amount of onboard input and output 12 capability. The signals shown as TxB1 and TxB2 13 provide unit directional outbound-only serial data 14 communications without handshaking.
15 The platform has connection for an 16 auxiliary service unit, shown here as the ASU 17 connector. The connection supports communication 18 between the maintenance workstation and each board.
19 These communications occur over another serial bus 20 shown here as TAB for test ALS bus. The test bus 21 operates similar to the safety signal bus but 22 independent of it. The maintenance workstation itself 23 is not part of the ALS platform.
24 MEMBER SKILLMAN: If I could, you didnt 25 present slide four. May I ask you to show that one, NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
61 1 please? No, back to slide four, please.
2 MR. STATTEL: Oh, that was just an 3 introductory slide.
4 MEMBER SKILLMAN: Let me ask my question.
5 MR. STATTEL: Oh, four was just, thats 6 just like a partition --
7 MEMBER SKILLMAN: Its a cartoon. But let 8 me ask my question. How are the four channels 9 powered? When they did the upgrade at Diablo, did 10 they use the same foundation with the same power 11 supplies? Im assuming this is DC vital or AC vital.
12 Was there a change to that while you were going 13 through the change to the digital equipment?
14 MR. STATTEL: I can answer that. Theyre 15 installing the new digital protection system in the 16 same cabinets as the old protection system, the Eagle 17 21 system. It is AC vital power, and its basically 18 the same power that powered the divisions of the Eagle 19 21 are powering the new digital equipment.
20 MEMBER SKILLMAN: Understand. So the 21 configuration control for the power supplies is 22 unchanged. Youre really changing the brain.
23 MR. STATTEL: That is correct.
24 MEMBER SKILLMAN: Got it. Thank you.
25 MR. WYMAN: The approved ALS platform. So NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
62 1 the approved platform from the review defines the 2 architecture and internal communications approach upon 3 which to build an I&C system. The approved platform 4 specifies seven boards, and all board functionality 5 and functional allocations programming, with the 6 exception of the allocation application-specific logic 7 of the core logic board, ALS 102.
8 The approved platform uses diversity 9 attributes to create two design variants of each board 10 and establishes the development process for the 11 boards, their programming, and verification and 12 validation. The approved platform also establishes 13 qualification boundaries for the platform and design 14 features support implementation of safety function for 15 a plants application-specific system.
16 MR. STATTEL: Okay. Were going to move 17 on to the Tricon system now.
18 MR. WYMAN: Okay. This is a Tricon V10 19 chassis. Ive actually got a nice real picture. So 20 if I stand up and point --
21 MEMBER BROWN: As long as you can talk 22 loud enough.
23 MR. WYMAN: I can talk loud enough. Thank 24 you. I just kind of wanted to go over, since weve 25 only had block diagrams before, the key switch that we NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
63 1 talked so much about last time for positions, run/stop 2 program, and remote. Each unit has redundant power 3 supplies built in. So for two separate independent 4 power inputs that power both of the independent power 5 modules, up here we have extension bus connectors. If 6 we want to extend the IO bus further, we can do this 7 with regular plain copper cables for local expansion.
8 Down here, we have the in-processor 9 boards. So a little bit different than ALS where they 10 have single processors doing all the thinking, the 11 Tricon uses three boards running in parallel, all 12 making the same decision at the same time and then 13 they vote on the outputs. Its a redundancy to 14 improve reliability and availability.
15 In a normal system, you would see this 16 here filled with a communications module. I even 17 asked Tricon about this. This was just an 18 opportunity, so they actually have two communications 19 modules stuck in this slot over here. So you can see 20 where they have four, one, two, three, the top four 21 are serial bus connections. This is a diagnostics 22 connector down here, and these two connections here 23 are for diagnostics.
24 Now, on the V10, we do not have -- Im 25 sorry. These are not for diagnostics. These are for, NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
64 1 these are the ethernet connections right here, two 2 channels of ethernet, four channels of serial, and one 3 diagnostics connector. The lights up on the top would 4 indicate status realtime, and the remainder of the 5 rack here is filled with IO parts.
6 Here they have, I believe, an input card, 7 a 32 point input card. And Im not familiar with 8 these, but all their cards use LED lights on the 9 surface to indicate status.
10 The box up here contains two redundant 11 batteries that would support saving information, data 12 and the control program, on the loss of power. So 13 theres redundant batteries. Each battery is capable 14 of holding up the information for a six-month period.
15 Over here, all these blue connectors are 16 simply just extensions of the IO points so you can put 17 terminations on. Thats the D10 chassis and all the 18 components described.
19 Slide, please. Okay. The block diagram 20 for the V10. This diagram is shown left to right, 21 input to output. So this would be a standard 22 termination panel. The V10 uses a set of standard 23 panels that were part of the approval process that go 24 in the back of the chassis. When we bring a signal in 25 on termination panel, internally it goes to three NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
65 1 different legs. So for each input module, it actually 2 has three identical circuits that are independent of 3 each other. Each one has its own processor, its own 4 clock. It processes the input signal, which then 5 communicates on the IO bus -- Im sorry, I cant see 6 over here. It communicates on the IO bus to the three 7 independent main processor boards. The IOC processor 8 on the main processor module controls all the 9 communications on this serial clearance IO bus, and 10 all the safety communications are on just the IO bus.
11 The same processor also controls 12 communications on the comm bus, which speaks to the 13 communications module that I pointed out earlier. The 14 communications module has single outputs for the 15 communications outside the unit and then internally 16 splits them to three separate channels separately to 17 each of these three cards.
18 MEMBER BLEY: And thats just a redundancy 19 issue?
20 MR. WYMAN: Yes.
21 MEMBER BLEY: And then some kind of 22 selection to make sure youre picking the good signal 23 coming out?
24 MR. WYMAN: Thats right. And the Tricon 25 product, I think, was originally developed NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
66 1 commercially to support applications where 2 availability was an issue. We couldnt get to the 3 unit, and we wanted to live a long time, so high 4 reliability and redundancy give them a longstanding 5 availability.
6 So information comes in. We have a dual 7 port RAM between the communications processor and the 8 application processor where we make our decision.
9 Each individual branch makes its own determination.
10 And if youre familiar with the TriBus, they vote the 11 information among the three independent channels.
12 Each one takes the input information in. It assesses 13 the information, decides if its good. It votes 14 between the three. They determine whether or not 15 anybody is out of sync and has bad information and, if 16 they do, they throw that information away and that 17 individual channel is given a good answer from one of 18 the other two cards. And then they all run the 19 algorithm based on the good information that they 20 have, and then they write the output back to the IOC 21 comm. Down here on the IO bus again, it will write 22 them out to the output modules. And where we voted 23 inputs over here in the processor, outputs are voted 24 in the output card. I know that was a point that we 25 discussed --
NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
67 1 MEMBER BROWN: We vote on the voting and 2 then we vote on the voting and on and on and on.
3 MR. WYMAN: And then back to our 4 termination panel on the output. And thats the basic 5 operation of a V10. Next slide, please.
6 MEMBER BROWN: Go back to that one for 7 just one second --
8 MR. WYMAN: Sure, absolutely.
9 MEMBER BROWN: -- because its the first 10 time weve really seen, youve modified the slide to 11 be a little bit more --
12 MR. WYMAN: I like it. This is the 13 drawing that I learned --
14 MEMBER BROWN: Yes, thats fine. I guess 15 one of the questions was where is the output to the 16 SSPS?
17 MR. STATTEL: Well, the answer to that is 18 --
19 MEMBER BROWN: The primary RXM module, 20 according to one of them.
21 MR. STATTEL: Theres an output forward 22 that plugs into all three of the IO bus -- this is 23 actually triplicated, right, this bus here? So 24 theres an output board that plugs into this. Now, it 25 receives the decision, so, basically, the actuation NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
68 1 decision, it receives that from all three processors.
2 Then it does -- the voting takes place on the output 3 board. Theres only one contact output here, so, 4 basically, its a solid state, so the trip decision, 5 the on/off decision of whether to actuate the trip 6 circuit are not, is made on that output board and that 7 is fed, basically, by a copper wire down to the 8 existing solid-state protection system.
9 MEMBER BROWN: Okay. Thats an important 10 point that we had great discussions on because it was 11 not clear. So you had clarified that very well, and 12 this is a good picture to illustrate that. Thank you, 13 Rich.
14 MR. WYMAN: Okay. Lets go for the Tricon 15 platform review. Obviously, this was an update from 16 V9. A significant number of the components changed.
17 Most of the changes were in the MP3008 main processor 18 boards and the communications module. The V9 unit 19 used three different individual communications modules 20 that were optional, and, in this one, they have an 21 altogether new different TCM, Tricon communications 22 module. A major part of our review focused on these 23 two modules.
24 The Tricon platform review establishes 25 guidance for communications and compliance with ISG-NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
69 1 04. I believe we only approved two of the individual 2 points, generically, for the system. Everything else 3 is application specific, but we do offer up some 4 guidance in the SE that would help on the application-5 specific reviews.
6 The platform report also establishes 7 development process for the boards and their 8 programming and verification and validation. And 9 similar to the ALS, it establishes qualification 10 boundaries of the platform, the design features to 11 support implementation of safety functions for the 12 plants application-specific system.
13 MR. STATTEL: Okay. Well, thank you, 14 Steve. What were going to do now is were going to 15 step back a little bit, and Im going to give you an 16 overview of how these two platforms have been 17 incorporated into the Diablo Canyon application-18 specific project here.
19 So this diagram here, this is an expanded 20 view of the existing Eagle 21 process protection 21 system. Theres a couple points Id like to emphasize 22 on this slide. As we mentioned before, as John 23 mentioned, both the trip system, reactor trip system, 24 and ESFAS systems share this sensor input, but the 25 sensors are isolated between divisions, as you can see NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
70 1 here.
2 The voting logic for the ESFAS and the 3 reactor trip function is performed by the solid state 4 protection system, which is shown as the gray box 5 below the blue box there. And thats not being 6 modified as part of this license amendment.
7 The actuation signals to the SSPS voters 8 are hardwired connections. They do not use digital 9 communications technology at all. There are no 10 interdivision communications being implemented in this 11 design.
12 Okay. This is a view of the replacement 13 process protection system. And like the previous 14 drawing, both the RTS and ESFAS systems will share the 15 same sensor inputs. Theres no changes there. The 16 voting logic will continue to be performed by the SSPS 17 system, which is not being modified. The actuation 18 signal to the SSPS voters will remain hardwired 19 connections, and there are no interdivision 20 communications being implemented.
21 The maintenance workstation boxes that are 22 shown on this diagram, these are these gray boxes that 23 are within the Tricon and ALS subsystems here, those 24 are maintenance workstation computers. Those are non-25 safety related, and they will be installed within the NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
71 1 PPS cabinets.
2 MEMBER BROWN: One comment just to 3 amplify, theres no connection between the Tricons and 4 the ALSs? Those are two separate connected 5 processing systems for the data?
6 MR. STATTEL: Yes. Later on in the 7 presentation, well be talking about communications 8 aspects.
9 MEMBER BROWN: Yes, theres one exception 10 to that, but its not a, its more feeding data that 11 is not processed -- I apologize for that confusion.
12 Theres a temperature signal thats fed out of the ALS 13 that thats where youve computed, and then its sent 14 to the Tricon within the division? So theres no 15 interdivisional, but thats the only connection 16 between them, roughly.
17 MEMBER SKILLMAN: Rich, what is the KVM, 18 the --
19 MR. STATTEL: Okay. KVM just stands for 20 keyboard, video, and mouse. So, basically, this is 21 the operator interface. Both the ALS and the Tricon 22 chassis that you saw pictures of earlier are going to 23 be mounted in the same cabinets as the existing Eagle 24 21. They have, each has an individual maintenance 25 workstation, basically a PC thats installed in that NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
72 1 cabinet. But there really wasnt room in the cabinet 2 for the licensee to put two separate monitors, two 3 separate keyboards. So what they do is they put one 4 switch in, and that just switches those peripherals 5 between the ALS maintenance workstation and the Tricon 6 maintenance workstation.
7 MEMBER SKILLMAN: Thank you.
8 MR. STATTEL: Okay. One other thing Id 9 like to point out on this figure, at the top of the 10 figure youll notice between the sensors and the 11 process protection system are a series of isolators.
12 And these are basically qualified analog devices, 13 analog isolators, that send signals over to non-safety 14 related systems, such as the AMSAC system which is 15 being used for ATWS protection.
16 Okay. The figures in this and the next 17 set of slides represent varying levels of detail how 18 the safety functions are accomplished by the process 19 protection system. All of these slides are going to 20 be laid out in the same format. On the left side are 21 the inputs to the system, in the center are the 22 processes being performed by the process protection 23 system, and on the right are the outputs from the 24 system.
25 So as an example, on the left side of this NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
73 1 figure are the monitored plant parameters. The blue 2 boxes represent parameters that are used to perform 3 reactor trip functions. The pink boxes are parameters 4 that are performing engineered safety features 5 functions, such as safety injection actuation. And 6 the purple boxes are parameters that are used for both 7 reactor trip and ESFAS functions.
8 On the right side are the functions 9 supported by the PPS system. The top box is a red 10 box. Thats the reactor trip. And all of the other 11 ones are ESFAS functions.
12 Okay. As you can see here, the 13 replacement system basically splits from what was 14 previous just a single Eagle 21 processor. Now were 15 going to have two subsystems, one is Tricon and one is 16 ALS.
17 This figure basically shows you which 18 functions are being performed by the Tricon system.
19 The determination of functions, function allocation 20 for the PPS systems were made based on the results of 21 a D3 analysis that had previously been performed.
22 All functions for which automatic --
23 MR. THORP: By D3, we mean diversity and 24 defense in depth analysis.
25 MEMBER CORRADINI: He was talking to NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
74 1 Charlie.
2 MEMBER BROWN: You just answered his 3 question.
4 MR. THORP: Yes, I have a little bit of 5 ESP. I got the memo from the Chairman of the 6 Commission that said we should not try to speak in 7 acronyms, so Im trying to do the best we can to 8 explain any acronyms that pop up without having 9 further . . .
10 MR. STATTEL: So the basis for the 11 function allocation was all functions for which 12 automatic diverse backup actuation signal could 13 already be credited in the analysis were assigned to 14 the Tricon subsystem. Ill point out and well 15 mention it later on, as well, there was an original D3 16 analysis performed in 1993 for the Eagle 21 system.
17 That was updated in, I believe it was 2010.
18 There were three signals for which no 19 existing automatic diverse actuation function was 20 available in the Eagle 21 design. Those are reactor 21 coolant flow, pressurizer pressure, and containment 22 pressure, and you can see those three signals on this 23 diagram have inputs to the ALS system. So those were 24 allocated, those functions were allocated to ALS. As 25 the next few slides will show, all the remaining NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
75 1 signals are allocated to ALS.
2 Okay. So this is the opposite slide, 3 which shows the ALS functions. Now you can see which 4 process signals are provided and which functions are 5 being performed by the ALS subsystem. For functions 6 associated with these signals, manual operator actions 7 needed to be credited for the original Eagle 21 8 design. The D3 analysis, the original D3 analysis 9 postulated a loss of all safety functions for the 10 entire PPS on a common-cause failure.
11 For these three functions, there basically 12 was not automatic diverse coping means for those.
13 And, therefore, they relied on manual operator 14 actions.
15 So, essentially, if you think about it, 16 this figure also represents what the PPS functionality 17 becomes when a CCF failure of the Tricon system 18 occurs. So, basically, these are the functions that 19 are retained on the postulated common-cause failure.
20 And as the figure shows, there are only 21 two functions that are, that become unavailable on the 22 CCF of the Tricon. And those are the turbine trip 23 feedwater isolation and ultra feedwater initiation.
24 However, both of those functions, the D3 analysis, had 25 identified coping means for them.
NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
76 1 CHAIRMAN STETKAR: Rich, before we leave 2 that, we had some discussion at the subcommittee 3 meeting about function allocation between Tricon and 4 ALS. And I just want to make sure that I left the 5 subcommittee meeting understanding that correctly. We 6 talked about auxiliary feedwater initiation, which is 7 one of the functions you just mentioned that is not 8 allocated to ALS, and I believe that the conclusion 9 was that the AMSAC logic would provide a diverse 10 signal for auxiliary feedwater actuation. At least 11 thats what my notes say here.
12 MR. STATTEL: Thats correct.
13 CHAIRMAN STETKAR: Mean steamline 14 isolation for steamline breaks outside containment, 15 not steamline breaks inside containment but steamline 16 breaks outside containment, I believe we were left 17 with the impression that that function is only 18 performed through the Tricon platform.
19 MR. STATTEL: Thats correct. The D3 20 analysis covers all of the accidents that are covered 21 in the safety evaluation for the plant. Its not just 22 these two. I really just pulled these two up as 23 examples.
24 CHAIRMAN STETKAR: I understand. Let me 25 finish, let me finish my observations, just for the NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
77 1 record and --
2 MR. STATTEL: Okay.
3 CHAIRMAN STETKAR: -- edification of the 4 other members who werent present. And that all of 5 the safeguards actuation signals for a LOCA are now 6 processed only through the ALS platform. We were told 7 that, well, for the steamline isolation for steamline 8 breaks outside containment, that still could be 9 mitigated by manual operator actions to isolate the 10 steamlines. And for safeguards actuation for a LOCA, 11 if the ALS platform were to become unavailable, the 12 operators could manually initiate safeguards 13 actuation. Is that --
14 MR. STATTEL: That is true. That is true 15 and correct.
16 CHAIRMAN STETKAR: I just wanted to make 17 members aware of the fact that weve, this change has 18 provided diversity for common-cause software failures 19 in the Tricon platform. It has not necessarily 20 provided diversity for all conceivable common-cause 21 failures.
22 MEMBER CORRADINI: But its better than 23 what was there?
24 CHAIRMAN STETKAR: Its different from 25 what was there.
NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
78 1 MEMBER BROWN: Well, I would call that, I 2 would expand that a little bit. I mean, they do 3 provide some automatic operation for stuff that was 4 only manual before.
5 CHAIRMAN STETKAR: They provide automatic 6 actuation for stuff that was only manual before for a 7 software failure in that particular platform.
8 MEMBER BROWN: Yes, in that Eagle 21 9 platform. Yes.
10 CHAIRMAN STETKAR: There are still manual 11 requirements for software failures in the Tricon 12 platform, and there are still manual requirements for 13 what, at the moment, Ill call unspecified common-14 cause failures in the ALS platform.
15 MR. STATTEL: Right. And these are all 16 considerations that were taking into account in our 17 safety evaluation. We recognize that the Eagle 21 is 18 an approved platform. The plant is operating today 19 with that. This modification does reduce the reliance 20 on manual operator action.
21 CHAIRMAN STETKAR: And that I absolutely 22 agree with. Its reduced the reliance, it hasnt --
23 I want to make the -- theres still a need for manual 24 operator action under certain conditions.
25 MR. THORP: Mr. Corradinis observation NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
79 1 that its better than the Eagle 21 is in that sense, 2 is in that respect.
3 MEMBER CORRADINI: Yes, but its hard to 4 extract a better than out of --
5 MR. THORP: Right, right.
6 CHAIRMAN STETKAR: My experience is new, 7 this is different. Better than requires a pretty 8 thorough reliability assessment, and I dont think 9 thats been done.
10 MR. THORP: Right. And as Rich pointed 11 out, I dont know that I mentioned that in the 12 beginning, but we are still in the process of 13 conducting our safety evaluation. This is not a 14 completed evaluation yet, so its an informational, 15 this is where we are right now, presentation.
16 MR. STATTEL: Now, of course, in 17 performing our review, were using our guidance, 18 right? So we have Chapter 7 guidance from the 19 standard review plan. Part of that guidance is BTP 7-20 19, which is the diversity defense in depth. And in 21 that guidance, there is a preference for automatic 22 diverse actuation instead of manual actuation. And 23 weve had discussions with the licensee, and this was 24 the basic premise that they were pursuing --
25 CHAIRMAN STETKAR: And Im not, you know, NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
80 1 Im not trying to, Im just trying to make sure that 2 the members here who didnt have the benefit of the 3 subcommittee discussions arent led to necessarily 4 believe that this change has eliminated completely the 5 need for any manual operator actions, that, 6 essentially, its not, they arent left with that 7 impression.
8 MR. STATTEL: Thats correct.
9 CHAIRMAN STETKAR: Those operator actions 10 is true, are approved under the existing design, given 11 the time available and the indications and, you know, 12 that approval, in a licensing perspective, would be 13 carried through, you know, your current guidance, I 14 presume.
15 MR. STATTEL: Yes, thats correct. So at 16 this point, this completes the system overview. So if 17 any of the members have questions about the general 18 layout of this system, now would be a good time for 19 that.
20 The next session, well be talking about 21 communications, so well talk about the communication 22 interfaces and well talk about the review criteria 23 that were using for that.
24 MEMBER SKILLMAN: Let me ask this 25 question: with the change to these two different NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
81 1 subsystems, are the response times that are modeled or 2 that are assumed in the analyses for the various 3 accidents and conditions unchanged?
4 MR. STATTEL: The specifications for 5 response time are basically being carried from the 6 Eagle 21 system response time numbers to the new 7 system. We are evaluating, theres a specific section 8 in our safety evaluation for both deterministic 9 performance and for response time performance 10 characteristics of the systems. That is, there is an 11 application-specific aspect of that that were 12 evaluating, and I will talk in more detail about that 13 later in the presentation.
14 MEMBER SKILLMAN: Thank you.
15 MR. STATTEL: So what Id like to do now 16 is turn it over to Rossnyev Alvarado, who is also a 17 lead reviewer for this license amendment review, and 18 shell be talking about communication aspects of the 19 system.
20 MS. ALVARADO: Hi. Im Rossnyev Alvarado 21 with the Office of Reactor Regulation, Division of 22 Engineering, Instrumentation and Controls Branch. I 23 am responsible for the review of the Diablo Canyon PPS 24 system communication.
25 This slide that we have here list the NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
82 1 guidance that we have available for communication.
2 603 provides criteria for independence between 3 redundant portions of a safety system and between 4 safety systems and other known safety-related system.
5 Then 7-4.3.2, in addition to the requirements 6 described in 603, states that data communication 7 between safety channels or between safety and non-8 safety systems should not inhibit the performance of 9 the safety function.
10 To clarify these two guidance, the Digital 11 Instrumentation and Control Steering Committee formed 12 the task working group. This task working group 13 prepared ISG 4, which provides adherence points for 14 evaluating a digital safety system compliance with NRC 15 communications guidance. Were using ISG 4 to 16 evaluate the Diablo Canyon PPS replacement system.
17 Next slide. I know Rich presented this 18 slide, but I just want to emphasize the description 19 provided regarding communication. The first thing is 20 that the PPS system consists of four independent 21 protection systems. You can see it here identified as 22 PS-I, II, III, and IV. The PPS system does not use 23 any means of interdivisional data communication. The 24 licensees maintain interdivisional independence by not 25 including any cross-divisional communication. This NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
83 1 means that theres no communication between the 2 vertical wall, so nothing goes between one protection 3 system to another one.
4 In addition, data communication doesnt 5 occur between the Tricon and the ALS system within a 6 division. As Member Brown points out, even though 7 this looks like theyre together, theyre not 8 communicating. So no communication link, in this 9 case, again, crosses the horizontal walls that you see 10 in this slide.
11 Rich points this out, but I just want to 12 emphasize that there are no communications between the 13 PPS and the SSPS. The lines shown in the figure only 14 represent the signal trip decision sent from the PPS 15 to the SSPS. And last but not least, the same level 16 of communication separation is provided for all four 17 protection sets.
18 CHAIRMAN STETKAR: Rossnyev, just for 19 clarity again, you said theres no communications 20 between ALS and Tricon. There is --
21 MS. ALVARADO: I go --
22 CHAIRMAN STETKAR: Youll have slides on 23 those? Okay.
24 MS. ALVARADO: What I mean, communication 25 means data communication.
NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
84 1 CHAIRMAN STETKAR: Okay.
2 MS. ALVARADO: But I will show that in 3 detail because there is a transfer of signal, yes.
4 This is a slide that shows the replacement 5 communication architecture. This slide was provided 6 by the licensee in the license amendment request.
7 This slide shows the links and pathways supported by 8 the Diablo Canyon PPS design. Again, these are just 9 data communication Im talking about.
10 Each protection set has the same 11 communication pathway. The PPS communication 12 architecture is designed to ensure communication 13 between safety and non-safety equipment within the 14 protection set adhered to the guidance described in 15 ISG 4.
16 Like I said, again, this slide shows the 17 ALS and the Tricon together. But as I mentioned 18 before, they do not communicate with each other.
19 Within each protection set, the PPS 20 incorporates safety-to-non-safety communication. The 21 non-safety components are towards my right, to your 22 right, sorry, the other right, the non-safety 23 components that they communicate.
24 I will talk about the Tricon and ALS in 25 subsequent slides, but I want to use this slide to NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
85 1 introduce and describe the components that are non-2 safety related. In this case, were talking about the 3 plant computer system, which is down to your right; 4 the maintenance workstation; the KVM switch; and the 5 Tricon remote RXM non-safety chassis, which is not 6 shown here but I will show later in the Tricon.
7 So Rich point out that we have the 8 maintenance workstation. This is on the right of the 9 slide. We have a maintenance workstation for each one 10 of the systems. In other words, one for the Tricon 11 and one for the ALS.
12 This maintenance workstation support 13 maintenance calibration and surveillance functions.
14 The maintenance workstation are stand-alone computers 15 that cannot connect to the internet, nor with the 16 plant computer system or network.
17 These workstations are in a division set, 18 and they cannot communicate with other workstations in 19 a different division. In addition, the workstations 20 cannot communicate with workstations in other 21 redundant protection sets or communication with 22 safety-related equipment, like ALS or Tricon, in other 23 protection sets.
24 Then were going to move into the KVM 25 switch. The KVM switch, its a switch that provides NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
86 1 access to peripheral devices, such as keyboard, video 2 displays, and mouse, for authorized personnel to 3 perform maintenance and calibration activities. One 4 KVM switch is provided for each protection set. So 5 authorized personnel would select with a KVM switch 6 what safety system they want to perform the activity.
7 The maintenance workstation and the KVM 8 switch will be located inside a locked cabinet in the 9 cable spreading room, minimizing the possibility of 10 the inadvertent action. Use of the maintenance 11 workstation and KVM switch is subject to site-specific 12 procedures and physical access control.
13 And last but not least is the plant 14 computer system, which is the one at the bottom to the 15 right. Both the Tricon and the ALS communicate data 16 to the plant computer system. The plant computer 17 system is part of the existing system and is not part 18 of our review.
19 Communication with the plant computer 20 system is one way. The Tricon transfer this data to 21 the port aggregator tap and the ALS does it through 22 the transmit TxB communication ports. I will talk 23 about them when I talk about each one of the systems.
24 Next slide.
25 MEMBER SKILLMAN: Before you go, Ive got NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
87 1 a question. Rossnyev, you say the KVM switch and that 2 gear is in the cable spreading room. One would assume 3 thats highly protected through plant security.
4 MS. ALVARADO: Right.
5 MEMBER SKILLMAN: But if somebody were to 6 find access to the cable spreading room and into that 7 locked cabinet, is there any way use of that equipment 8 in that locked cabinet could take control of any of 9 the channels?
10 MS. ALVARADO: First of all, there is, 11 like, password-protected access to the maintenance 12 workstation. So besides getting access and getting 13 the key to access to that, you need to have the right 14 password to access that. And Samir will talk about 15 that.
16 And second is you have to select which 17 protection set you want to do, you want access to.
18 But access is, if, for example, you were to alter the 19 ALS, its not so simple, and I will describe that, 20 because its not just logging into the maintenance 21 workstation. You also need to connect a cable to do 22 such a thing because the communication from the ALS to 23 the maintenance workstation through normal operation 24 is just to monitor. You cannot do anything. To do 25 any of your maintenance activities, you need to NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
88 1 connect what is identified as a TAB, a test ALS bus, 2 to be able to communicate two-way with them.
3 With the Tricon, its slightly different 4 because with the Tricon the port aggregator tap 5 permits two-way communication. However, there are 6 means inside the Tricon that you need to tamper with 7 to be able to do such a thing. For example, there are 8 different access level and they have a key switch that 9 you need to modify, to do something like that.
10 So its not as simple as I break in and I 11 go into the KVM switch and I can go on and alter that.
12 I mean, its a complicated series of steps.
13 MR. STATTEL: Id also like to add, 14 clearly, its feasible that someone could, a 15 knowledgeable insider could get access to the 16 equipment and they could break through all of these 17 measures if they know the password and they can 18 connect the ALS bus, they can turn the key switches on 19 the Tricon. However, all of those activities would 20 alert the operator because any of those activities 21 would cause an alarm in the control room.
22 So the answer is it is feasible for an 23 insider to get access and take control of the system 24 in the cable spreading room. However, its really not 25 conceivable that he could do that without the operator NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
89 1 being aware of that.
2 MEMBER BROWN: Could they access -- thats 3 only one protection set, though.
4 MR. STATTEL: Thats correct.
5 MEMBER BROWN: You still cant get through 6 the -- if youre accessing one, can you access another 7 one? I dont remember that from the previous --
8 MR. STATTEL: Theyre in different 9 cabinets. If you had more than one person accessing 10 them, I guess its theoretically possible.
11 MEMBER BROWN: Okay, all right.
12 MR. STATTEL: But there would be multiple 13 alarms in the control room, as well.
14 MEMBER BROWN: Yes, thank you very much.
15 MS. ALVARADO: Actually, whenever youre 16 doing modifications in the ALS, an alarm will be 17 enunciated and then a second alarm will be enunciated 18 for the Tricon.
19 MEMBER BROWN: Before you leave this 20 slide, from the previous meetings weve had and the 21 discussions relative to control of access to external 22 internet type functions, that would be through the 23 plant computer if anybody was going to do that. So 24 theres three lines: the ethernet line and the TxB1 25 from ALS A and the TxB1 from ALS B. Those are the NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
90 1 three lines that somebody, if they made access to the 2 plant computer, could come back.
3 Now, youre going to discuss why those are 4 hardware type one-way, as opposed to software based, 5 correct? So those are the key lines from a control of 6 access and external tampering via particularly the 7 software in the Tricon.
8 MS. ALVARADO: Right. Okay. What I did 9 was a cartoon to try to identify better the different 10 components that we have. And this slide shows the 11 communication architecture for the ALS system. There 12 are no communication paths between redundant safety 13 divisions or protection sets in the ALS portion of the 14 PPS replacement. It means that ALS and other 15 protection sets cannot communicate with this 16 protection set in particular. Im using protection 17 set four for these description, but all of them are 18 exactly the same.
19 In previous slide, we mentioned that there 20 is no communication between the Tricon and the ALS.
21 However, you can see that this figure shows these 22 green lines here. I want to clarify that these lines 23 represent analog temperature signals processed in the 24 ALS system that are used by the Tricon system to 25 perform the over power differential temperature and NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
91 1 over temperature differential temperature reactor trip 2 safety functions. So these are not communication 3 links. These are just analog signals that are sent 4 from the ALS to the Tricon.
5 Regarding communication with the 6 workstation, the ALS used the transmit TxB ports.
7 MEMBER BROWN: Rossnyev, can I make, I 8 want to make sure I understand one thing. The ALS A 9 and B are the same --
10 MS. ALVARADO: Yes.
11 MEMBER BROWN: -- but independent, and 12 they are both sending the same signal over the, you 13 still have that system? So you can move one of those.
14 Thats my memory anyway.
15 MS. ALVARADO: Yes, I apologize I didnt 16 explain that. I guess I forgot.
17 MEMBER BROWN: Thats okay. No, youre 18 fine, youre fine.
19 MS. ALVARADO: No, because in the 20 presentation that we did before, we went into this.
21 ALS has two cores. Its core A and core B, and this 22 is part of the redundancy that they have. Both cores 23 perform the same functions, so thats what Im talking 24 about.
25 MR. STATTEL: One minor correction, NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
92 1 Charlie, Id like to make. Theyre not the same 2 temperature signal being processed by ALS A and ALS B.
3 There are actually two elements in each RTD, and one 4 of the elements goes to A and one of the elements goes 5 to B.
6 MEMBER BROWN: Its the same temperature 7 signal to --
8 MR. STATTEL: Same signal, yes.
9 MEMBER BROWN: Im very familiar with that 10 process. Yes, okay, thank you. Its a good 11 clarification.
12 MS. ALVARADO: Okay. So were talking 13 about the transmit TxB port. As you can see, ALS A 14 and ALS B, each one of them has two transmit ports, 15 one goes to the maintenance workstation and the other 16 one goes to the plant computer system. These 17 communication ports are customized so they can only 18 transmit data to these connections, and this is done 19 in hardware.
20 Communication for the TxB port is only 21 directional and does not require the use of 22 handshaking signal. These ports are physically and 23 electrically incapable of receiving information from 24 external sources, in this case from the maintenance 25 workstation and the plant computer system.
NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
93 1 MEMBER BROWN: The TxB1 and each one of 2 them, is that the one where youve got the open 3 circuit, so its a physical open line, whereas the 4 transmit line is closed, obviously?
5 MR. STATTEL: Thats correct.
6 MEMBER BROWN: Thank you.
7 CHAIRMAN STETKAR: You have a very 8 resonate voice.
9 MEMBER BROWN: I pushed my microphone as 10 far away as I can.
11 MEMBER CORRADINI: Everybody else is not 12 as forceful. Stop using your command voice.
13 MS. ALVARADO: These ports provide a 14 barrier between class 1E and non-class IE. The use of 15 the transmit TxB ports was reviewed and approved for 16 the ALS platform.
17 Then regarding testing and maintenance of 18 the ALS, the test ALS bus, which you can see at the 19 top there, it says disconnect, needs to be connected 20 to the maintenance workstation and to the ALS core 21 that you want to perform activities to to provide 22 direct two-way communication. Normally, this tab is 23 disconnected and all you have is information that is 24 coming to the TxB.
25 MEMBER BROWN: Can I ask one other NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
94 1 question to make sure I still remember what you told 2 us in the subcommittee meeting? The ability to 3 communicate back to either one of the cores does not 4 allow changing the fundamental program, that it only 5 allows you to change set points, calibration data, 6 that type of information; is that correct?
7 MS. ALVARADO: Correct. Because as you 8 mentioned before about the FPGA, thats one of the 9 benefit of using FPGA. You need to burn the core in 10 the device itself. If you want to change it, you need 11 to remove the board to do that.
12 MEMBER BROWN: Put a new piece in?
13 MS. ALVARADO: Right.
14 MEMBER BROWN: Yes, thank you. Thats a 15 good clarification. Thank you.
16 MS. ALVARADO: Maintenance and calibration 17 activities for one of the ALS core, its required the 18 TAB is physically connecting, allowing two-way 19 communication between that core and the maintenance 20 workstation. Only one core can be connected to the 21 TAB, and this is restricted by process procedures.
22 There is no associated with disconnecting 23 or connecting this communication link. A TAB 24 connection is provided for each core.
25 If a diverse ALS subsystem or the core NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
95 1 that is not connected to the TAB will be performing 2 the regular functions, the one that has the TAB 3 connected to it will be taken out of service, with the 4 exception of the RTD signal, the temperature 5 processing functions that are needed to be sent to the 6 Tricon. An ALS trouble alarm will be initiated in the 7 main annunciator system when the TAB is physically 8 connected so the operators will know that someone is 9 performing activities in the ALS.
10 Next slide. The Tricon communication 11 architecture. This is presented in this slide. So 12 what I did was just try to focus in the different 13 components for the Tricon.
14 There are no communications again between 15 the Tricon in one protection set to the Tricon in 16 another protection set. All Tricon communication with 17 external devices for the Diablo Canyon PPS is via the 18 Tricon communication modules and their remote RXM.
19 The remote RXM is a new component that was not shown 20 before but still a slide pointed out.
21 These remote RXMs are used to acquire and 22 transfer non-safety related signals to support 23 functions that are not safety-related PPS functions.
24 In other words, what they represent is an expansion 25 chassis that is located several miles away from the NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
96 1 main chassis. There is no data exchanged between the 2 RXM chassis in other protection sets. In addition, 3 one remote RXM can just communicate with the primary 4 RXM.
5 The use of the RXM communication was 6 described in the Tricon platform topical report and 7 was evaluated by the NRC in the associated safety 8 evaluation. As a result, we have one of these plant-9 specific application items in which it is required 10 that we confirm that data received from a non-safety 11 remote RXM is not used to perform required safety 12 functions. So as a part of our review, we need to 13 confirm that, for Diablo Canyon, signals acquired by 14 these RXMs are not used to support mitigation 15 functions for a common-cause failure of the Tricon.
16 We did that and the last slide from my presentation 17 identifies this. I just wanted to point out.
18 Then lets go back to the Tricon 19 communication module. Inside the Tricon, there is 20 this Tricon communication modules that allows the 21 Tricon to communicate with the maintenance 22 workstation. To do such a thing, communication has to 23 occur through the dedicated one-way port aggregator 24 network tap. I will talk about the port tap in the 25 next slide just to show how it works, but the TCM uses NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
97 1 psychic redundancy checks, handshaking, and other 2 protocol-based functions to ensure data communication 3 integrity.
4 In addition, the Tricon uses dedicated 5 memory location for communication. In this model, 6 theres no direct communication between the 7 application processor and the TCM interface with the 8 maintenance workstation. So if I were to lose the 9 TCM, the main processor will continue to function.
10 The TCM was qualified under the Invensys Appendix B 11 program, and our evaluation is described in the safety 12 evaluation report.
13 The next slide. So in this slide, what 14 Im trying to show is what were talking about, this 15 port aggregator tap. We have three ports. If you can 16 see, there is port A, B, and 1. I tried to put arrows 17 so you can see to what configuration, how theyre used 18 in the Diablo Canyon. And what I want to point out is 19 that port 1 is one-way communications. Ports A and B 20 are two-way communication. This tap aggregator is a 21 hardware device that provides this communication TABs 22 and it does not rely on computer software.
23 The port tap was previously evaluated and 24 has been approved as an acceptable mean for isolating 25 safety system. The NRC performed a safety analyses to NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
98 1 confirm such a thing. This analyses, what they did 2 was that for data signals to flow from the TCM, the 3 Tricon TCM, towards the plant computer system, which 4 means for port A to port I, electrical signals pass to 5 a buffer amplifier integrated circuit component.
6 The NRC staff evaluated this proper 7 amplifier where the potential of electrical signals to 8 flow in the opposite direction, meaning coming from 9 the plant computer system to the Tricon TCM. And what 10 the staff found is that the amplifiers were not 11 capable of passing electrical signals in the reverse 12 direction under any conditions, which means that they 13 reckon a flow for port 1 to port A.
14 Regarding port B, which is the 15 communications with the maintenance workstation as a 16 set, there are different measures of protection to 17 allow this access to the Tricon, and these are like 18 the Tricon K switch that Steve was mentioning about.
19 They have different operation modes that you need to 20 change if you were to change the program inside the 21 Tricon. And for calibration and maintenance, you also 22 have to go to different layers of access in the 23 maintenance workstation to change the set points.
24 And last but not least, next slide, this 25 is the IO signals that are processed by the remote RXM NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
99 1 chassis. The reason we decided to list that is just 2 to show that, as a part of the application specific 3 item that we had, we needed to confirm that these 4 signals are not associated with systems required to be 5 diverse from the PPS system.
6 This concludes my presentation of all the 7 system communication, and now Rich Stattel will 8 describe his evaluation of the diversity and defense 9 in depth.
10 CHAIRMAN STETKAR: Rossnyev, I dont 11 remember whether we asked at the subcommittee meeting.
12 It is possible for personnel to use the Tricon 13 maintenance workstation to update the programming 14 software in the Tricon platform during power 15 operation, right?
16 MS. ALVARADO: Well, yes. But you will 17 want to have the specifics to do so, which is the 18 Invensys TS 1311. And then you need to modify, with 19 the key switch you need to modify to be in remote or 20 program to do that.
21 CHAIRMAN STETKAR: Yes, I know about the 22 things that people need to do that. But, indeed, the 23 difference, you cant, because of the programmable 24 gate arrays, you cant change the burned-in logic.
25 You can change the set points. You can change the set NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
100 1 points anywhere. But the question I had is are there 2 any restrictions for Diablo Canyon to not change the 3 programming during power operation to update the 4 software? There have been events where people have 5 updated software. Obviously, if youre going to 6 operate software in one protection --
7 MR. STATTEL: We actually have not made 8 that decision for Diablo Canyon.
9 CHAIRMAN STETKAR: Okay, okay.
10 MR. STATTEL: That will be, that will be 11 documented in the safety evaluation.
12 CHAIRMAN STETKAR: Okay, thanks.
13 MR. STATTEL: I will mention, though, for 14 the Oconee application, we had that discussion and 15 they committed to never changing software while 16 operating. So they basically have to shut down in 17 order to load a new version.
18 CHAIRMAN STETKAR: To update the software.
19 MR. STATTEL: It becomes very complicated 20 because if you allow that, so if you think about it, 21 you have four changes. You basically have to do an 22 operability determination for each configuration you 23 go through in the process of --
24 CHAIRMAN STETKAR: Oh, because, in the 25 interim, youre going to have different versions of NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
101 1 the software --
2 MR. STATTEL: And weve began those 3 discussions with the licensees, and theyre like, yes, 4 were just going to shut down any time we load 5 software.
6 CHAIRMAN STETKAR: I just didnt remember 7 in the subcommittee meeting whether they talked much 8 about that.
9 MS. ALVARADO: Now, I just want to add 10 that if, for example, there was something to happen 11 with your program and you just want to reload the 12 program, you could do that. But then you will have 13 to, like, check between all three processors to be, 14 you know, like, are we all having the same 15 configuration. And like Rich said, were still in the 16 decision part of it.
17 So Rich?
18 MEMBER BROWN: It would be a good idea to 19 highlight that and document it. I presume you will do 20 that in the SE, correct?
21 MR. STATTEL: Yes, we will. Typically, 22 the way we document that is well write, either well 23 have the licensee make a commitment, a documented 24 commitment, or well write inspection items. So we 25 basically list items to be inspected during the start-NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
102 1 up, so the region would go out and do inspections 2 during the site acceptance testing, and they would 3 follow through with documenting that.
4 MEMBER BROWN: Yes. But once you finish 5 that, now youre in operation. Somebody could try, so 6 theres still a downstream effect if somebody wanted 7 to go change the --
8 MS. ALVARADO: Well . . .
9 MEMBER BROWN: Now, but once youve 10 finished the initial startup and all the initial 11 testing and everything else, now youre back 12 generating electricity for everybody. So the same 13 concept would apply. You have to shut down before you 14 go modify something. If the vendor, Invensys, comes 15 up with an, uh-oh, weve got a little thing over here 16 we need to fix, then you have to go through the 17 shutdown process in order to do that to be consistent 18 on all four channels, I would think.
19 Thats why Im suggesting that that 20 thought process be carried clear through the 21 operational phase, as well, in the SE so we understand 22 what the final decisions are.
23 MR. STATTEL: Understood.
24 MS. ALVARADO: Okay.
25 MR. STATTEL: Okay. Thank you, Rossnyev.
NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
103 1 Im going to switch over, and were going to talk 2 about the diversity defense in depth characteristics 3 of the system. In the first slide here, I talk about 4 the guidance documents that we used for our diversity 5 review. There are three primary documents that cover 6 diversity. Theyre based on the direction provided by 7 the Commission in the SRM, or staff requirements 8 memorandum, for SECY-93-087.
9 The first one is a NUREG document, 6303, 10 which describes a method for analyzing a common-cause 11 failure, a software common-cause failure of a 12 computer-based nuclear safety system and its 13 potential effects on the overall plant safety 14 analysis. The second document is BTP, I mentioned 15 before, Branch Technical Position, 7-19, which is part 16 of the standard review plan. It provides guidance for 17 evaluating an applicants or a licensees D3 analysis 18 and the design of automatic and manual controls and 19 displays for use as a diverse actuation system.
20 The ACRS has reviewed that latest version.
21 I believe it was a couple of years ago. And, finally, 22 theres an Interim Staff Guide 02 document that was 23 developed as a result of direction we received from 24 the Digital I&C Steering Committee to provide clarity 25 for the established expectations for D3 analysis.
NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
104 1 I mentioned the ISG-02 document. Its 2 criteria have been incorporated into BTP-19. However, 3 the D3 analysis for this project was evaluated prior 4 to that, so it is a relevant document. Were actually 5 using the Revision 6 BTP-19 for our application 6 evaluation.
7 Okay, next slide. Okay. So what BTP-19, 8 what the criteria states is that there should be a 9 coping strategy to be developed for digital safety 10 systems to address the effects of a software common-11 cause failure when the potential for a common-cause 12 failure cannot be eliminated. So, basically, they 13 have two options. They either make a case that there 14 is no potential for a common-cause failure, or they do 15 the analysis and play it through and apply that to 16 every accident situation thats in the FSAR and 17 determine how the plant responds and what coping 18 mechanisms are available.
19 A D3 analysis was initially performed for 20 the existing Eagle 21 system back in 1993. That 21 analysis postulated an entire failure of the PPS 22 system, the Eagle 21 system. So if you think back to 23 the first diagram I showed you, that entire green box 24 fails and all of the safety functions on the right 25 side of that basically fail to perform. So the NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
105 1 reactor doesnt trip, the ESFAS doesnt actuate.
2 Thats what was postulated.
3 The result of that, there were several 4 accident scenarios where manual operator actions were 5 required to be performed in a given time frame. And 6 there were also other scenarios where there were 7 existing diverse system, such as the AMSAC system, 8 that were available and could be credited for 9 mitigating the accident.
10 Prior to this license amendment or 11 receiving this license amendment, the licensee 12 performed an update to the D3 analysis to address the 13 changes being made for this license amendment. The 14 NRC staff completed an evaluation of that updated 15 analysis in 2011. It was basically an update to the 16 previous tables that were done in 1993. It involved 17 the postulation of the software common-cause failures 18 for all plant accidents and AOOs described in the 19 FSAR.
20 The safety functions associated with these 21 parameters that were relying on manual operator 22 actions were allocated to the ALS. We talked about 23 how the functions were allocated on the earlier slide.
24 The D3 analysis does not make a case for 25 that software common-cause failure of either Tricon or NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
106 1 ALS is not possible. Instead, for the ALS, it 2 determined that the effect of the postulated common-3 cause failure does not cause a loss of the safety 4 functions, and thats because they have a means of 5 basically adding diversity into the system. And Ill 6 discuss that in the next slide.
7 So for the Tricon, basically, they just 8 postulated loss of all the functions, so theres 9 really nothing to discuss there. Its no different 10 than what was analyzed for the Eagle 21 system.
11 But for the functions performed by the 12 ALS, theyve designed two important redundancy 13 features that are being considered in the evaluation 14 were performing. They are core diversity. As 15 implemented in Diablo Canyon application, they 16 generate two redundant logic implementations for 17 placement within each FPGA for each standard circuit 18 board. So the two redundant logic implementations are 19 represented in this figure as the relation between 20 core A1 and core A2 and between B1 and B2 in this 21 slide.
22 So both of these implementations use the 23 same hardware descriptive language, so the same set of 24 instructions to program the FPGA are used. However, 25 the logic implementation is produced using different NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
107 1 synthesis directives. What that means is the tool 2 that theyre using to actually program the FPGA, they 3 set the, they change the settings on that tool and 4 they force the implementation to be different. And 5 thats something we call core diversity. This means 6 was previously used in Wolf Creek application as a 7 means of establishing some form of diversity.
8 Now, during the Wolf Creek application, it 9 was recognized for more complicated functions, such as 10 what were dealing with with the Diablo Canyon 11 application, additional means of diversity would be 12 required.
13 CHAIRMAN STETKAR: Rich, to help the other 14 subcommittee members, Wolf Creek was a digital 15 feedwater control system.
16 MR. STATTEL: No --
17 CHAIRMAN STETKAR: I mean feedwater and 18 steam isolation.
19 MR. STATTEL: It was a very simple system.
20 It basically took digital input, and it actuated main 21 feed isolation and main steam isolation.
22 CHAIRMAN STETKAR: Thank you.
23 MR. STATTEL: Thats all it did. Okay.
24 The second form of diversity Ill talk about is called 25 embedded design diversity. This provides an NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
108 1 additional level of diversity thats provided to that 2 thats provided by the core diversity. Embedded 3 design diversity requires the production of two 4 versions of ACL files. So theres two different 5 diverse sets of instructions that are used to program 6 the FPGA cards. This is represented as the 7 relationship between the A cores and the B cores in 8 this figure.
9 The Diablo Canyon application defines the 10 configuration and arrangements of the PPS system and 11 creates two different sets of FPGA design variants.
12 And you can see there are two sets of code, there are 13 two sets of requirements that are used to generate 14 that code. Is there any question about the embedded 15 diversity?
16 Okay. The next slide. Just also mention 17 the A and B design variants are housed in separate and 18 different chassis in this system.
19 Ill mention -- thanks, John. Somehow I 20 missed that in the notes, but another difference 21 between the A and B design variants is they use 22 completely design development teams. Theyre both the 23 same vendor, but they have different teams using 24 different instructions and different program 25 directives to develop different sets of instructions.
NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
109 1 MR. THORP: And just to add to that a 2 little bit, part of our audit process was to kind of 3 examine how well they did that, how independently 4 they, how did they assure independence between those 5 two teams and to look for any potential cross 6 pollenation.
7 MR. STATTEL: Okay. So, now, this figure, 8 it basically shows the functional architecture for the 9 ALS portion of the PPS. The postulated logic 10 implementation for CCF failure of the ALS would only 11 affect one of the cores within each protection set.
12 So only the As would lose functionality. The Bs would 13 still perform, successfully perform the safety 14 function.
15 Okay. Each of the core logic blocks shown 16 on the figure includes two diverse cores. This was 17 also shown on the previous slide. You can see the or 18 gate there. You might ask the question, well, isnt 19 that a software implementation, and the answer to that 20 is no. I couldnt think of any other way to represent 21 this or function. The way its actually performed is 22 on the next slide.
23 MEMBER BROWN: In the old days, if you 24 wanted to develop a combinational logic digital 25 circuit, that or gate was the symbol you used NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
110 1 and/or/nor/neither and all that kind of stuff. And 2 that was when you didnt use software. You were just 3 building the FPGA with discrete components, so an or 4 gate was an or gate.
5 MR. STATTEL: Thats correct. So even 6 though its performing an or function, theres no 7 software involved with that. And the next slide shows 8 that. This is a de-energized trip function. This is 9 a diagram thats right out of the license amendment 10 request. So you can see here theres 120-volt AC 11 source on the right side, and its used to energize 12 the relays. The SSPS train A and train B figures 13 there are relays within SSPS system.
14 So when its going through the ALS A and 15 ALS B digital output cards, so think of those as 16 contacts, so its de-energized to trip. So, normally, 17 those contacts are closed during plant operation. So 18 to actuate the signal, basically, youd need to drop 19 out those two relays, and thats performed either by 20 the A or the B. If either one of those contacts 21 opens, those relays will clearly drop out.
22 And you can also see the manual trip 23 switch simply opens the circuit, and its in series 24 with the other contacts. So its obvious that that, 25 that the manual trip function is retained and that NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
111 1 its not dependent on any of the software thats being 2 performed in the PPS system. So no matter what 3 happens with the software that goes into isolations, 4 the output fails open, fails closed, if the operator 5 wants to drop out those relays, he opens that switch, 6 and theyre going to drop out. And then you can also 7 see how the bypass functions are affected there, as 8 well.
9 Next slide. Okay. Ill talk a minute 10 about the ATWS system because part of our evaluation 11 is verifying that the new system doesnt create any 12 dependencies or violate any of the independence that 13 was established with the AMSAC system. This figures 14 shows the functional relationship between the PPS and 15 the AMSAC. As you can see, the steam generator level 16 and turbine impulse pressure signals are shared 17 signals. However, thats really the only interface 18 between those systems.
19 The steam generator level and turbine 20 impulse pressure signals used for the AMSAC actuation 21 are derived from the same sensors. However, those 22 sensors are not digital devices, so they would not be 23 subject to common-cause failure.
24 MEMBER SKILLMAN: Rich, what is turbine 25 impulse?
NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
112 1 MR. STATTEL: Its an indication of 2 loading of the turbine.
3 MEMBER SKILLMAN: Okay, thanks.
4 MR. STATTEL: Okay. So the staff is 5 confirming through review of the interface requirement 6 specification that the input signals used for the 7 AMSAC actuation are independent and isolated from the 8 PPS system.
9 Okay. Next slide. Okay. PG&E has shown 10 the existing ATWS system remains diverse from the 11 replacement system. And these are some of the 12 characteristics listed on this slide that were 13 looking at.
14 The staff performed the evaluation of 15 these differences or is performing evaluation of these 16 differences. This is the list. I will note both the 17 ALS and the AMSAC system are currently supplied by the 18 same vendor, Westinghouse. However, the ALS was not, 19 when it was developed, it was not developed by 20 Westinghouse Corporation. It was an independent 21 vendor that was later purchased by Westinghouse, so we 22 consider it to be an independent vendor.
23 Okay. Any questions on this? Okay. A 24 couple of words on manual operator actions. The new 25 system will reduce, as I mentioned before, will reduce NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
113 1 operator reliance on manual operator actions as a 2 means of coping with software common-cause failure.
3 The modification does not affect the ability of 4 operators to perform manual operator actions of safety 5 functions. So the existing component and division 6 level actuation capability is being retained, and 7 these capabilities are not changed at all as a result 8 of this PPS upgrade.
9 The manual initiation signals are provided 10 directly to SSPS system, which is not being modified.
11 Previously credited manual operator actions will still 12 be available to the operators and existing component 13 and division-level actuation from the main control 14 boards will be retained.
15 Okay. Are there any questions with regard 16 to the diversity of the system? All right. With 17 that, Im going to turn the presentation over to Samir 18 Darbali, who is also one of our technical reviewers, 19 and hes evaluating the secure development 20 environment.
21 MR. DARBALI: Thank you, Rich. So Ill be 22 talking about SDOE, or secure development and 23 operational environment, which we already talked a 24 little bit about in the communications section.
25 The staff is reviewing the secure NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
114 1 development and operational environment to ensure 2 reliable system functionality. Applicable guidance is 3 Reg Guide 1.152, Revision 3, criteria for using 4 computers in safety systems of nuclear power plants, 5 which endorses 7432 2003.
6 This reg guide is not intended to address 7 the ability of protective features to thwart malicious 8 cyber attacks. Secure development environment is 9 defined as the condition of having appropriate 10 physical, logical, and programmatic controls during 11 the system development phases to ensure that unwanted, 12 unneeded, and undocumented functionality is not 13 introduced into the digital safety system.
14 Secure operational environment is defined 15 as the condition of having appropriate physical, 16 logical, and administrative controls within a facility 17 to ensure that the reliable of operation of digital 18 systems are not degraded by undesirable behavior of 19 connected systems and events initiated by a access to 20 the system.
21 Next slide. As part of the Tricon and ALS 22 topical report reviews, the staff evaluated the secure 23 development environments used by Invensys and 24 Westinghouse to develop the respective generic digital 25 platforms. The staff is currently evaluating that NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
115 1 these secure development environments are maintained 2 for the development of the Diablo Canyon application.
3 The vendors control access to the 4 development environments by performing vulnerability 5 assessments, which identify both physical and life 6 cycle vulnerabilities. Control of access to the 7 development environment is accomplished by the use of 8 access security cards and by controlling development 9 areas, including computers, workstations, network 10 service, and portable medium.
11 The vendors have established procedures 12 for controlling access to signed documents and 13 materials, as well as for software development, 14 configuration management, testing, and non-conformance 15 reporting. PG&E will not be developing or modifying 16 the software at the plant. And once the PPS 17 replacement --
18 MEMBER BROWN: Excuse me, Samir. Thank 19 you. Ive just forgotten something. On the code 20 reviews, to detect and prevent the use of unintended 21 code or code functions, I mean, by that I think 22 friends, inheritance, things of that nature. Im 23 thinking C or C plus or whatever it is. Is that the 24 vendors doing that, or does NRC, does the staff 25 actually do a code review to determine whether theyve NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
116 1 used unintended code or code functions?
2 MR. DARBALI: The staff audits the 3 vendors procedures for --
4 MEMBER BROWN: Just the process reviews.
5 MR. DARBALI: Yes, yes.
6 MEMBER BROWN: So if their process misses 7 it, then thats the way it goes?
8 MR. STATTEL: Well, let me talk about that 9 a little bit. Heres how it goes. So we perform 10 threat audits, so we pick -- one of the aspects that 11 we cover during our audits is configuration 12 management. And configuration management, well 13 typically go to the vendor and well ask them this 14 question: how do you make sure that no unintended 15 functions or unintended software is introduced in this 16 system? And its very closely related to 17 configuration management because it has a lot to do 18 with who has access and who has the capability of 19 modifying the code and how thats managed and how you 20 make sure two people arent modifying the same code at 21 the same time, things like that.
22 And so we havent completed our audits 23 yet, so let me state that. We have performed audits 24 at the vendor facilities, but that was prior to them 25 having developed the software. So we plan on doing NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
117 1 audits at the vendor facilities this summer and 2 continuing on with these.
3 So the way the conversations go is, when 4 we ask those questions, they walk us through, well, 5 heres how a software engineer is going to modify the 6 code, heres the steps he has to go through. And 7 theyll show us the procedures, and theyll describe 8 the controls that are in place to make sure that the 9 software isnt inappropriately checked out or, if its 10 checked out, it doesnt get to be checked out by 11 another software engineer.
12 Then the other thing is the check-in 13 process. So once the code is modified, what approval 14 processes and what protections are in place to make 15 sure that that change in the code doesnt introduce a 16 function thats not called for, its unintended, or 17 its not documented. And this ties back in with the 18 traceability process because thats another aspect of 19 the audit that we pay very close attention to.
20 So, in other words, if theres a function 21 in there thats not described by a requirement, an 22 approved system requirement, and an engineer goes to 23 check that function in, the requirements traceability 24 process, and they perform audits on this, we review 25 those audits reports, as well, would catch that.
NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
118 1 Thats our expectation.
2 So we review that process. We have them 3 walk us through the process for developing the code.
4 In addition, we review their problem reporting 5 documentation, as well. So if anyone attempts to 6 check in software inappropriately or that hasnt been, 7 hasnt been tied to an official approved requirement, 8 that should show up in their corrective action 9 program, right? So we look for that, as well.
10 So thats kind of the process we go 11 through. Were talking, you know, many thousands of 12 pages of code to go through. We expect the vendors 13 V&V process to do those code reviews.
14 MR. DARBALI: Okay. Thank you, Rich. For 15 secure operational environment, once the PPS 16 replacement project is completed and the PPS system is 17 in the operations and maintenance phases, several 18 modifications to the Tricon and ALS platforms will be 19 controlled by the PPS replacement software 20 configuration management plan. Modification to the 21 PPS replacement components produced by the vendors 22 will be performed by the vendors, not the licensee.
23 Like we mentioned in the communications 24 portion of the presentation, the PPS replacement 25 system will be located in the cable spreading room, NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
119 1 which is a plant vital area. The PPS will be housed 2 in the same cabinet as currently houses the Eagle 21 3 system. These cabinets are locked, and the keys are 4 administratively controlled by operations personnel.
5 Also, access to the maintenance 6 workstation --
7 MEMBER BROWN: Excuse me, Samir. By 8 operations, you mean in the main control room?
9 MR. DARBALI: In the control room. Thats 10 correct, yes. And access to maintenance workstations 11 is password protected. An annunciator will inform the 12 control room if a maintenance workstation is accessed.
13 And during a visit we had last August at Diablo 14 Canyon, we did have operations personnel guide us 15 through the process.
16 MEMBER SKILLMAN: Let me ask this. Rich 17 raised the point that, if there are issues, one would 18 think that they would show up in the corrective action 19 program. If there is an error that the licensee in 20 software modification and there is a violation, is 21 that a violation of criterion 3 design control?
22 Thats an absolute ignorant question. Its just 23 curious to me. I understand how the SSCs are --
24 MR. STATTEL: Were not able to do, you 25 know, a 100-percent code review, so were really, we NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
120 1 really consider the V&V personnel and the processes 2 the vendor has in place to be as kind of our agents.
3 So we want to test those processes. So when we go to 4 perform these audits, we run these hypothetical 5 situations. We say, okay, now that Ive checked -- if 6 possible, we actually run through, lets check this 7 piece of software out, lets modify it, lets add a 8 function block in there that doesnt, thats not 9 called for by a requirement, and lets go try to check 10 it back in. Whats going to catch that? And, if 11 possible, they should be able to demonstrate, you 12 know, this is the thing, this is the measure that we 13 have put in place to prevent that from occurring.
14 And we have them kind of walk us through 15 that process. We interview the personnel that are 16 involved in all of those processes: the engineers, the 17 software librarian, the V&V engineers, because theres 18 always a V&V step in the process of checking that back 19 in. So theres a signature that goes in. So we ask, 20 well, what does that signature mean? Whats behind 21 that signature? And what were looking for is some 22 procedural step in some procedure they have that we 23 can read that will tell me, oh, this guy isnt going 24 to sign this unless he knows that theres a 25 requirement associated with every function thats NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
121 1 being added to that piece of software.
2 MR. THORP: Now, you had mentioned if the 3 licensee changed the software, just to be clear, the 4 licensee itself is not going to change the software 5 on-site. Theyre not going to do that.
6 MR. STATTEL: Well, theyre not completely 7 off the hook either, let me tell you.
8 MR. THORP: Well, theyre responsible, 9 theyre responsible. But I think theyre going to use 10 the vendor for software changes; is that right?
11 CHAIRMAN STETKAR: Just if you answer 12 things, make sure we get you on the record who you 13 are.
14 MR. THORP: Right. So thats Ken. Go 15 ahead and speak in the mike.
16 MR. SCHRADER: This is Ken Schrader, PG&E.
17 And the answer to that question is -- ask the question 18 again.
19 MR. THORP: Well, the question was if the 20 licensee had caused a change to the software that 21 created some inadvertent condition that wasnt 22 appropriate, would that be a violation of criterion 3 23 design control? Certainly, if the licensee did that 24 somehow, I would think, yes, wed be looking at the 10 25 CFR 50 Appendix B criterion. The folks in the NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
122 1 inspections area, the resident inspectors and whoever 2 else would get involved would be examining whether 3 that criterion would be what they would apply in terms 4 of a violation. But in terms of process itself --
5 MR. SCHRADER: Well, the last statement I 6 heard was is that PG&E would not be modifying the 7 software, and that is a true statement.
8 MR. THORP: So your point is well taken.
9 Yes, that would be --
10 MEMBER SKILLMAN: Let me explain why I 11 asked the question. Its because this is from a world 12 I really dont understand. I understand the old 13 analog and how we handled 10 CFR 50 Appendix B with 14 old equipment, but it seems like this is a new, a new 15 atmosphere that weve moved into where the vendor is 16 actually the adopted leader for the portion of the 17 licensees control system and the licensee is 18 depending on that vendor. And so there is a, at least 19 as I see it, a different relationship than the old 20 environment in which we operated where the licensee 21 really owned everything.
22 In this case, the licensee certainly owns 23 it but is fully dependent on this vendor to give the 24 licensee --
25 MR. THORP: And, nonetheless, we would NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
123 1 still, as an agency, hold the licensee accountable for 2 any issues or impacts on their systems and equipment.
3 And so as well find, Rich has been talking about the 4 audits that we do, we also are looking at the licensee 5 and looking at what kind of audits do they do.
6 Theyve got their vendor quality assurance program 7 that they have to follow, and theyre, I would think, 8 perhaps even more intensely interested in whats going 9 on in terms of the vendors controls for the software 10 design and configuration management even than we are.
11 But if you would like for them to speak to that, Id 12 be happy to . . .
13 MR. PATTERSON: And this is Scott 14 Patterson, Pacific Gas and Electric. We do review 15 every piece of software that the vendor produces. I 16 mean, weve gone through all their software design 17 descriptions, and we validate that theres no code 18 thats not supposed to be there. We also do a site 19 acceptance test once we get the code and validate that 20 everything works as expected --
21 MEMBER BLEY: Could you say the end of 22 that again? I couldnt quite hear you.
23 MR. PATTERSON: When we get the equipment 24 on site, we do a site acceptance test and validate 25 that the equipment works as desired for our NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
124 1 requirement specifications. So thats kind of a back-2 up to the factory acceptance test that the vendor 3 does. Do you want to talk about the audit that were 4 going to perform --
5 MR. STATTEL: Well, it is a different 6 paradigm. I recognize that. When I was on the 7 licensee side myself, when I was a system engineer, 8 believe me, I wasnt comfortable with this either. I 9 didnt like passing this responsibility to the vendor.
10 So like Scott mentioned, we did perform some very 11 comprehensive site acceptance testing before we would 12 declare a system operable. And thats our 13 expectation, as well.
14 Now, going back to the original point with 15 regard to the corrective action program and whether 16 entry into that is a Category 3 event, not 17 necessarily. You might think that we review the 18 corrective action and we never find any violations in 19 terms of unintentional code. But, in actuality, we 20 find many instances, but its usually not intentional.
21 Its usually, inadvertently, theres some piece of 22 code that wasnt properly documented. So it might 23 just be an administrative thing to correct that and 24 update the requirements in order to make sure that the 25 code is appropriately documented and it belongs there.
NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
125 1 Its not actually unintended.
2 And thats really part of a process 3 working, and thats what were really looking for when 4 we perform these audits. We want the process to be 5 adaptive, and we want it to be, you know, to provide 6 high assurance and theyre achieving the correct 7 software. And if there is something that goes wrong 8 or some code that gets inadvertently introduced, they 9 have a way of recognizing that and correcting that.
10 And thats why we review the corrective action 11 documentation.
12 MEMBER SKILLMAN: Thank you. Thanks.
13 MS. ALVARADO: Just for further 14 clarification, also we review the plans and process 15 that both the vendor and the licensee have in place to 16 catch this kind of, you know, software that is not 17 working right or doesnt meet our requirements. So we 18 do evaluate in this part of our safety evaluation.
19 And the last thing I wanted to add was 20 that the vendors usually have different layers of 21 corrective action programs. So it just depends of 22 what phase you are. But before they release it to the 23 licensee, they have different ways to document this 24 before reaching their corrective action program. And 25 we do look at those records to see how, you know, they NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
126 1 found it and how they address it. And usually it 2 requires not just the design engineers to fix it, but 3 it requires, you know, like a group of people or a 4 team to approve those changes. So its not as simple 5 as just like Im going to fix this.
6 MR. STATTEL: Final topic for today is 7 going to be deterministic performance of the PPS. And 8 well be talking about the attributes of both of the 9 subsystems. So both the Tricon and the ALS platforms 10 are designed to process every piece of plant input 11 data and every plant protection and safeguards 12 function, including process of all system outputs 13 during each program cycle.
14 Each of the platform evaluations 15 determined that there are application-specific 16 parameters which could influence the systems ability 17 to perform in a deterministic manner. The staff is, 18 therefore, evaluating the deterministic behavior 19 characteristics for each subsystem within the context 20 of the Diablo Canyon application, and Ill go into a 21 little bit more detail on what that entails.
22 Okay. Our guidance, the standard review 23 plan guidance advises that an evaluation should 24 confirm the systems realtime performance as 25 deterministic and known. What does that mean exactly?
NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
127 1 So BTP 21 discusses design practices to be 2 avoided for computer-based systems. And those 3 practices include non-deterministic data 4 communications, non-deterministic computations, use of 5 interrupt multi-tasking, dynamic scheduling, and 6 event-driven design.
7 So were reviewing these design processes 8 and looking to see that these are not incorporated.
9 So its kind of like a reverse criteria that were 10 applying here.
11 However, during the platform evaluation, 12 thats exactly what we did. So we followed this 13 guidance. So each of the platform evaluations 14 concluded that there are application-specific 15 parameters that I mentioned. The staff, therefore is 16 reevaluating deterministic behavior characteristics 17 for each subsystem for Diablo Canyon.
18 Lets go to the next slide. So first Ill 19 talk about the ALS subsystem. Its an FPGA design.
20 It does not embed microprocessor cores, which is 21 something thats used in some other FPGA designs. And 22 it does not use interrupts.
23 The staff is in the process of confirming 24 the Diablo Canyon application operates on fixed, it 25 does operate on fixed cycles, which are deterministic NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
128 1 sequence of acquire inputs, perform logic operations, 2 and generate outputs. That has to be followed without 3 the use of microprocessor core or interrupts, and 4 were confirming that now. This is consistent with 5 the ALS platforms approved topical report.
6 The staff is evaluating deterministic 7 performance of ALS. There are parameters which are 8 application specific and require separate evaluation.
9 In this case, only the ALS 102 core logic boards are 10 subject to application-specific response time. So as 11 you can imagine, the more functions and the more 12 complicated the logic is, the longer that process is 13 going to take. So thats why theres an application 14 component of this.
15 So part of our evaluation is we look at 16 the safety analysis. We understand what the expected 17 performance characteristics are for maintaining plant 18 safety. We look at the specifications for the system 19 that PG&E has developed and provided to the vendors, 20 and we look at the actual application in terms of the 21 logic thats performed and the time that it takes to 22 perform that logic.
23 With Diablo Canyon, we know exactly the 24 number of inputs, we know what the processes are, and 25 we know the exact number of outputs. So with that in NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
129 1 mind, we can calculate, the applicant calculates what 2 the expected response time is. And what weve seen so 3 far is that its much shorter than what the required 4 response times are provided by the licensee.
5 Okay. The Tricon system is a little bit 6 different. Its performance characteristics are 7 dependent on the specific application design. As part 8 of the application development process, a timing 9 analysis calculation is performed after the 10 application program is written. So we dont get to 11 see this until pretty late in the design process.
12 However, that calculation takes into account the 13 complexity and the extent of the application thats 14 being developed. So the more functions that are being 15 performed, the longer this calculation that time will 16 end up being.
17 Actually, go to the next slide. This kind 18 of represents our approach to this. So the variables, 19 the things that affect the time response are the 20 number of input and output parameters, the number and 21 types of function blocks utilized, and the 22 architecture of the design system.
23 The result of this calculation is used as 24 a baseline, which is kind of shown as the pink bar on 25 this graph here. Thats the results of the NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
130 1 calculation. And its used as a baseline for 2 establishing the program cycle time for the 3 application, and thats the next bar up, which is the 4 blue time. So they will basically add on a degree of 5 margin to the calculated time, and they will set the 6 processor to re-execute in the program scan time. So 7 that gives us a level of assurance that at least the 8 calculated, at least all functions will be performed 9 in that scan time.
10 The programs scan time is always longer 11 than the calculated execution time for the 12 application. The scan time is also shorter than the 13 required response time allocated to the Tricon system.
14 Another thing Ill mention is we talked 15 about the temperature processing signals. And you 16 might notice that the temperature signals are 17 processed by the ALS system, and then theyre fed as 18 analog signals over to the Tricon system. So in that 19 case, we consider the response time for those 20 functions that are supported by that, we consider the 21 response time of both systems in series, right? So 22 theres an allocation for the Tricon and allocation 23 for the ALS that are relied upon for performance of 24 those functions, right? So were evaluating that, as 25 well.
NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
131 1 Okay. And, finally, the purple bar on the 2 top of this diagram represents the response time 3 established by the plant accident analysis. And were 4 looking at that, as well.
5 And thats pretty much all I had planned 6 on talking about with regard to deterministic 7 performance. Do you have any questions on this topic?
8 MEMBER BROWN: Anybody?
9 CHAIRMAN STETKAR: The only question I 10 had, before you get asked for comments, Rich, do you 11 have -- the SE is still in progress. Do you have any 12 estimate of when you might be finished?
13 MR. STATTEL: Well, when it was originally 14 submitted, we were supposed to be completed in, I 15 believe, October of 2013. That was our two-year 16 metric. So we didnt meet that, but it was not a 17 result of any, of the licensing reviews. The licensee 18 has been very responsive to our questions. What, in 19 fact, happened is the licensee made some schedule 20 changes. They had some delays from the vendors in 21 terms of vendors going through the design process. So 22 those delays were factored in, and the licensee made 23 a decision to push the implementation back by one 24 refueling cycle. They informed us of that last year, 25 and we adjusted our schedule.
NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
132 1 Currently, we plan on completing our 2 audits. The factory tests are scheduled for this 3 spring, very soon actually. We plan on performing the 4 final audits in, I think, like, June - July time 5 frame. And once we receive the final test result 6 reports, the final summary reports, we hope to 7 complete our draft SE and have that to the licensing 8 folks by, I believe, September of this year.
9 CHAIRMAN STETKAR: The only reason I ask 10 is this is really the first fairly-detailed overview 11 of reactor protection safeguards actuation replacement 12 the Committee has been exposed to. We had kind of a 13 briefing on the Oconee upgrade, but it was fairly high 14 level and fairly short. And I think there might be an 15 interest in following up, you know, as you get closer 16 to finishing the SE, whether its at the draft form or 17 more finality among the Committee, have another 18 briefing, especially to see how youve closed out some 19 of these things.
20 MR. STATTEL: Sure.
21 CHAIRMAN STETKAR: Because it is kind of 22 an innovative design. Its a little different than 23 what the Committee has seen in the context of some of 24 the new reactors that have used different ways of 25 assuring diversity and things like that, and this may NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
133 1 be, you know, a coming wave among several licensees.
2 So I think theres some level of interest in it.
3 MR. THORP: Well, I can tell you that I do 4 sense, in my interactions with the industry at various 5 meetings, at ANS meetings, etcetera, that theyre very 6 carefully watching to observe how this, by the way, 7 this pilot process is occurring. Its a pilot with 8 respect to the Interim Staff Guidance number 6, which 9 is the guidance that lays out sort of the expectations 10 for what kind of information that should be submitted 11 and in what phases it should be submitted so that the 12 licensing process can go more smoothly. So were 13 learning things as we move through that process, and 14 I think what other folks who are looking at possible 15 protection system replacements and similar digital 16 upgrades are trying to determine for themselves is 17 whether this is going to be worthwhile for them to do 18 in terms of the efficiency of the time it takes them 19 to get it done, the predictability of when they can 20 see a safety evaluation. So there are some folks on 21 the sideline who are watching to see how this all 22 comes out.
23 CHAIRMAN STETKAR: Thank you.
24 MEMBER BROWN: Okay. Is there any one on 25 the phone line that would like to make some comments?
NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
134 1 Is the phone line open?
2 CHAIRMAN STETKAR: The answer to that is 3 no.
4 MEMBER BROWN: Is there anybody --
5 MR. LEWIS: Is the phone line open?
6 MEMBER BROWN: It is.
7 MR. LEWIS: Can you hear me?
8 CHAIRMAN STETKAR: Yes, thank you.
9 MR. LEWIS: My name is Marvin Lewis. I 10 have been trying to get through every time youve 11 opened the phone line supposedly. May I ask a 12 question, please?
13 CHAIRMAN STETKAR: Go ahead.
14 MR. LEWIS: Okay. Actually, I did just 15 ask a question, but thats all right. Answer it in 16 the positive. Heres my problem. You seem to be 17 doing various types of paperwork exercise. Let me 18 explain --
19 CHAIRMAN STETKAR: Mr. Lewis, could you 20 kind of keep a uniform distance from the microphone or 21 something? Youre kind of fading in and out.
22 MR. LEWIS: Is this a little better?
23 CHAIRMAN STETKAR: That is much better, 24 much better.
25 MR. LEWIS: All right. I had my speaker NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
135 1 on. Im sorry. Look, I know whats going on in labs, 2 in scrap yards, nuclear power plants. Its one thing 3 that the paperwork says, its another thing thats put 4 on the computer, and things go on like that. Lets 5 say, lets say people are human, okay?
6 For instance, let me give you a couple of 7 little for instances. One, a repair tag blocks the 8 view of a warning light and Three Mile Island Number 9 2 goes down and is still down and will still be down.
10 Theres a place out in New Mexico, I think its called 11 Carlsbad. Theres a waste site there, transuranic 12 waste. Oh, the paperwork was beautiful. I looked at 13 all the paperwork. I was sure that site would never 14 give anybody problems. Two days ago, that site leaked 15 radioactive big, and somebody put out an order, I 16 dont know who, and every reporting field meter in the 17 United States went down for maintenance. So I dont 18 know much about that episode, but I do know it 19 contradicts the paperwork.
20 Thats my question. Is this paperwork 21 thats going to get contradicted, like a Fukushima, 22 like at Three Mile Island, like at Chalk River, like 23 at a thousand other places, or is this going to be for 24 real on the site, on the ground? I hope Im making 25 myself clear.
NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
136 1 CHAIRMAN STETKAR: I think you have.
2 Thank you very much for your comments. Im sure the 3 staff, I see them taking notes, so thank you very much 4 for your comments, sir.
5 MR. LEWIS: Oh, look, if theyre taking 6 notes, let me give my email address.
7 CHAIRMAN STETKAR: Well, youre on the 8 record, actually, and all of this is public 9 information so . . .
10 MR. LEWIS: All right.
11 CHAIRMAN STETKAR: Were good. Thank you.
12 MR. LEWIS: Thank you. Bye.
13 MEMBER BROWN: Is there anyone else on the 14 phone line that would like to make a comment? Hearing 15 none, Christina, would you close the phone lines? I 16 went to the audience, and nobody stood up. Is there 17 anybody out in the audience would like to stand up and 18 make a comment? Hearing no one, we will then proceed, 19 and now well -- number one, I would like to thank the 20 staff before I hang out here for a very thorough, 21 comprehensive, again, discussion. There was a lot of 22 meat you presented during this briefing. And based on 23 response of the members, I think a lot of head 24 shaking, up and down, by the way, not side to side.
25 So I wanted to thank you all for a good presentation, NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
137 1 and I will now turn this back over to the Chairman.
2 CHAIRMAN STETKAR: Thank you very much.
3 And, again, Id like to echo Charlie. Thanks a lot.
4 You covered an awful lot of material. I didnt think 5 you had a prayer, and you did it pretty well. So 6 thank you.
7 With that, we will recess until 1:45. We 8 have another presentation scheduled at that time. I 9 will remind the PRA Subcommittee members that we have 10 a noontime meeting in the conference room. Anyone who 11 wants to attend, please do.
12 (Whereupon, the foregoing matter went off 13 the record at 12:47 p.m. and went back on 14 the record at 1:46 p.m.)
15 CHAIRMAN STETKAR: Were back in session, 16 and this afternoon the first item on the agenda is 17 were going to hear from the Staff on pellet cladding 18 interaction, and Dr. Armijo has one of his final --
19 MEMBER ARMIJO: My parting shot on this 20 one.
21 CHAIRMAN STETKAR: He will lead us through 22 that. So, Sam, its all yours.
23 MEMBER ARMIJO: Thank you, Mr. Chairman.
24 Ill just off with a little bit of history, and Ill 25 refer to something -- I got into the PCI problem in NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
138 1 the early 70s. Okay? Actually, what was really 2 driving it was something that the NRC put out, and 3 that was related to TCI-related cladding failures 4 during off-normal events. And this is the report that 5 was used to pretty much strong arm the BWR fuel 6 manufacturers into trying to solve this problem, this 7 PCI, pellet cladding interaction problem.
8 During normal operation we figured out how 9 to take care of that by very careful power 10 maneuvering, but NRC was concerned that if you had a 11 transient that took you above your normal peak 12 operating power you could fail a lot of fuel because 13 this would be a whole core transient and a lot of fuel 14 would be going up in power very fast. That was one of 15 the big drivers in the GE program to develop barrier 16 fuel, and thats a program that I led. So, the way we 17 tested, we tested the fuel to be PCI-resistant by 18 taking it up to very high powers, much higher than our 19 normal peak linear heat generation rate. Typically, we 20 would test it 16 kilowatts per foot, sometimes as high 21 as 18 kilowatts per foot before we were satisfied we 22 had something that would work in transients, as well 23 as during normal operation without any restrictions.
24 That turned out to work very well, and that fuel was 25 commercialized, licensed, and has been in BWRs around NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
139 1 the world for 30 years.
2 In PWRs they didnt have such a serious 3 problem because theyve got a more favorable 4 environment, higher pressure, higher temperature. They 5 dont change power that quickly, but the materials are 6 still susceptible to this stress corrosion cracking 7 problem, so the PWR guys never had to implement any 8 kind of a PCI remedy, although they talked about it 9 and they fooled around with it in limited number of 10 tests.
11 You had in 2007, I think, somewhere around 12 2009, we had several meetings. Paul was in, and we 13 were worried that some of the BWR operators had 14 forgotten why they were using PCI-resistant fuel, were 15 starting to talk about just going back to convention 16 cladding. And that was at the Susquehanna review. So, 17 we put out a White Paper, we met and we wrote some 18 letters. Dana, and I, and Sanjoy wrote some things 19 recommending that the Staff should come up with an 20 analytical tool, a regulatory tool to assess whether 21 this was a real problem, and to do something about it.
22 It turned out so many -- the world using 23 PCI-resistant cladding wasnt a problem for BWRs. More 24 recently, the PWR question came up in a review of the 25 MHI, the MHI certification, and we asked a lot of NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
140 1 questions, but it wasnt really fair to them because 2 its really a generic issue. So, we asked the Staff, 3 and weve been pressing the Staff to work on this some 4 more. And the fundamental issue is if you have -- how 5 much time do you have to correct the problem if you 6 dont have an automatic system that will terminate a 7 power transient very quickly, how much time do you 8 have for manual action? And the other part of it is, 9 can your fuel actually get to the powers that are 10 necessary for this problem to occur? So, thats really 11 the heart of the matter, you know, time, and power, 12 and the system characteristics because if youll ever 13 go to very high powers in the times were talking 14 about, and is the system capable of terminating the 15 event?
16 The other part of the problem is for years 17 people in the industry have been relying on a 18 cladding, pellet cladding mechanical interaction 19 criterion to protect the fuel from this over-20 straining, and it works very well, you know. Theres 21 1 percent -- youre allowed to have up to 1 percent 22 cladding strain during a power transient, and thats 23 a mechanical thing. And everybody designs their fuel 24 so that they stay below that during all the transients 25 for their system.
NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
141 1 The trouble with that is that the PCI is 2 not PCMI, has some parts of it but its a stress 3 corrosion problem, and all of the data say stress 4 corrosion happens well below 1 percent. And thats in 5 that little White Paper I sent around, and it happens 6 for BWRs, and it happens for PWR fuel.
7 So, the Staff has been working on how to 8 assess it for PWRs, and theyve written a White Paper 9 titled, PWR Susceptibility to PCI Cladding Failure.
10 And we had a June 17 subcommittee meeting on that, and 11 I think theres been a lot more work done since that, 12 maybe not. I see a lot more charts. But, anyway, Paul 13 is going to give us an update on where they stand, 14 what theyve done. And were fortunate that we have a 15 very large database on this subject of ramp testing, 16 which is the key tool that you use to assess PCI 17 susceptibility. So, Paul, with that introduction.
18 CHAIRMAN STETKAR: Before we get started, 19 let me just remind that Sam and Paul, were in open 20 session right now, so were open, so if you get 21 questions during this period that start to tread on 22 proprietary information either alert us and well 23 close it, or deflect those until we close the meeting 24 for the proprietary part. Make sure that were alerted 25 to that.
NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
142 1 MEMBER BALLINGER: Part of this 2 presentation has sensitive material label on the 3 bottom.
4 CHAIRMAN STETKAR: Thats correct. We will 5 close the meeting, but I just wanted to make sure 6 everybody was sensitized that if we start treading in 7 the open session into anything thats proprietary to 8 be sensitive to that.
9 MR. CLIFFORD: Okay, thanks. Dr. Armijo did 10 a great job with the background material, and hes 11 correct. The real purpose here is to kind of address 12 this in a generic fashion because during several NRO 13 reviews and NRR APUs the question kept coming up 14 generically, what have you done with respect to PCI on 15 these PWR reviews? So, we agreed to kind of take a 16 step back and look at this at a generic level.
17 The agenda is as follows. Well just talk 18 about the Studsvik Cladding Integrity Program, talk 19 about what weve done to validate the FRAPCON code, 20 and how weve used the FRAPCON code to come up with a 21 draft failure threshold. Then well talk about PWR 22 operating characteristics, and identify AOO overpower 23 scenarios that may be susceptible to PCI. Then well 24 get into some FRAPCON calculations we did to calculate 25 whether or not we would predict PCI cladding failure.
NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
143 1 And then well have conclusions.
2 As I mentioned earlier, Im not sure 3 everyone was here, but my counterpart in research, 4 Patrick Raynaud, he wont be joining us today. His 5 wife is pregnant and shes due any second so hes at 6 home waiting to drive to the hospital.
7 MEMBER CORRADINI: More important things.
8 MR. CLIFFORD: Exactly. But Im prepared to 9 answer any questions you have on the research portion, 10 and we have Harold Scott from the Office of Research, 11 too.
12 This is just general background.
13 Obviously, pellet cladding interaction can lead to a 14 variety of stresses and strains on the cladding, and 15 there are three pronounced types of cladding failure 16 mechanisms. Thats classical strain-based hydrogen 17 embrittlement, stress corrosion cracking which were 18 here to talk about today, and delayed hydride 19 cracking. Each one of them would occur at a different 20 time and different loading conditions.
21 MEMBER CORRADINI: Sam did this orally, but 22 you have a cartoon, so can I ask you a question?
23 MR. CLIFFORD: Sure thing.
24 MEMBER CORRADINI: Is this a steady state 25 issue, more of a ramp issue, or depending upon the NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
144 1 ramp rate a little bit of both? Thats what I didnt 2 understand in the description.
3 MR. CLIFFORD: Its a ramp issue.
4 (Off the record comment.)
5 MR. CLIFFORD: But its a change in power 6 and the duration of the change in power which 7 increases the stress loading. If youre at normal 8 steady state for a period of time you get stress 9 relaxation, so if you were operating at say 12 10 kilowatts a foot and you moved your way up to 14 11 kilowatts a foot, thats extreme condition, but after 12 a period of time you get stress relaxation --
13 MEMBER CORRADINI: Its not X to Y, 14 whatever X to Y is. Its the rate at which you go from 15 X to Y, or is it the absolute X and Y?
16 MR. CLIFFORD: Its both.
17 MEMBER CORRADINI: Okay.
18 MR. CLIFFORD: Its both, but its not 19 necessarily a peak, its the delta. In my view its 20 always the delta because thats the maximum --
21 MEMBER CORRADINI: So, its the ramp rate 22 and the magnitude that you end up at.
23 MR. CLIFFORD: Correct.
24 MEMBER CORRADINI: Okay.
25 MEMBER ARMIJO: Its all three. Its the NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
145 1 peak power, its the higher the delta power is, and 2 then the ramp rate. Just for perspective, the BWRs 3 used to have to increase from 8 kilowatts per foot 4 LHGR, and if they wanted to go to 13 kilowatts per 5 foot, they had to cross that 8 kilowatts per foot line 6 at a rate of .1 kilowatts per foot per hour. Thats a 7 long, long time, huge capacity factor loss. If they 8 went a little bit faster, it would fail by PCI. If 9 they went very fast it would still fail by PCI, so 10 its a very sensitive rate of change, and relaxation 11 of the cladding is a key thing. Thats how barrier 12 works, it relaxes very fast.
13 (Simultaneous speech.)
14 MEMBER BANERJEE: Paul, so on that 15 duration, so take a typical turbine trip event, where 16 would that put us?
17 MR. CLIFFORD: Were getting -- theres 18 specific slides on that.
19 MEMBER BANERJEE: Okay.
20 MEMBER CORRADINI: So, back to my original 21 question.
22 MEMBER BANERJEE: Its SEC. Correct?
23 MR. CLIFFORD: Yes.
24 MEMBER BANERJEE: In that case. Okay, 25 thats really what I wanted.
NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
146 1 MEMBER CORRADINI: So, all of these that 2 you talk about are chemical effects, not mechanical 3 effects.
4 MR. CLIFFORD: No, the classical PCMI --
5 MEMBER CORRADINI: Is mechanical.
6 MR. CLIFFORD: -- is a mechanical loading 7 strain-based capabilities thats affected by hydrogen 8 embrittlement. PCI stress corrosion cracking is a 9 combination mechanical and chemical interaction.
10 Delayed hydride cracking a little more complex because 11 you have reorientation of hydrides.
12 MEMBER CORRADINI: In the green boundaries.
13 MEMBER ARMIJO: No, not necessarily.
14 Radiation hardening hardens the cladding. The fission 15 build up during operation creates iodine or possibly 16 cadmium that are the embrittlement chemicals, and the 17 change in power creates stress, so you need three 18 things, stress, susceptible material, and aggressive 19 environment.
20 MEMBER BALLINGER: You have to maintain a 21 certain crack tip strain rate. I dont want to get too 22 technical, for a long enough period of time, and the 23 ramp rate, and the condition of the fuel, and how fast 24 you can relax stresses at a crack and all that kind of 25 stuff contributes to this. You have to maintain a NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
147 1 certain strain rate at the tip of a crack and then it 2 will just --
3 MEMBER CORRADINI: Go ahead, Paul.
4 MR. CLIFFORD: Okay. So, GDC 10 requires 5 that the fuel vendors define SAFDLs, Specified 6 Acceptable Fuel Design when its -- which encompass 7 all known degradation mechanisms and define 8 performance metrics of failure, where it fails, where 9 it doesnt fail. And then demonstrate that during 10 normal operation and all AOOs that they do not fail 11 cladding.
12 Theres many SAFDLs. The top three are 13 what we would use to delineate failure from non-14 failure during an AOO.
15 I put this slide in here because there has 16 been a lot of discussion about what the existing 17 cladding experience SAFDL is versus a PCI, whether 18 its PCMI, or PCI. And the 1 percent as its commonly 19 referred to is strictly PCMI, mechanical loading. And 20 the SRP clearly acknowledges that this 1 percent limit 21 will not protect against corrosion-assisted PCI 22 failure.
23 As you can see in this plot, this 24 withdrawal event, low power, you can have a rapid 25 power excursion. Youre at low power so you have NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
148 1 plenty of DNB margin so youre not going to fail by 2 DNB. Youre at relatively low fuel temperatures, 3 youre not going to fail by melt, but you may fail by 4 just cladding strain. So, its an important --
5 MEMBER CORRADINI: And just walk me 6 through, Im sorry, but since were -- so that means 7 the fission gases dont get out, so I do some initial 8 -- from a high ramp rate Id have some sort of 9 immediate swelling and contact, and then associated 10 chemistry.
11 MR. CLIFFORD: No, in this particular case 12 the chemistry aspect is irrelevant because of the time 13 frame.
14 MEMBER CORRADINI: So, its strictly a 15 strain --
16 MR. CLIFFORD: Its strictly mechanical 17 strain.
18 MEMBER CORRADINI: And the inability to 19 absorb the rapid change.
20 MR. CLIFFORD: Correct.
21 MEMBER CORRADINI: Okay.
22 MR. CLIFFORD: So, the SAFDL is based upon 23 separate effects testing on irradiated cladding 24 segments. It specifically accounts for hydrogen 25 embrittlement since its done as a function of NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
149 1 hydrogen, a function of burnup. Its generally chosen 2 as a lower bound of the uniform elongation data, and 3 the empirical strain limit would then be compared 4 against a predicted strain using conservative 5 analytical models. So, this cladding strain SAFDL 6 serves a purpose.
7 MEMBER ARMIJO: Oh, I agree.
8 MR. CLIFFORD: Okay. Now, how do we insure 9 that we prevent AOO, prevent failures during AOO?
10 Well, the power plants rely on many aspects including 11 fuel design features, operating procedures, initial 12 margin as preserved by their tech spec LCOs, automatic 13 system actuations, manual responses to insure that 14 they do not have fuel failure. The Chapter 15-type 15 safety analysis is based on very conservative models, 16 limiting initial conditions to the most unfavorable 17 allowable, system responses, along with high 18 confidence limits. So, if youre at 100 percent power 19 and you increase power due to excess steaming or 20 whatever is driving power up, in general, youre going 21 to approach your DNB SAFDL first. And then second 22 amount you would approach your fuel swelling, and then 23 finally youd approach fuel temperature, so thats 24 kind of the order of things.
25 So, the question is in blue here, if you NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
150 1 need to specifically model PCI failure would that 2 require a change to the tech specs, or the operating 3 limits, or the fuel design relative to the existing 4 criteria for which they specifically evaluate?
5 MEMBER BANERJEE: So, they would sort of 6 replace an OLM CTR or something, or what? Whats the 7 top there?
8 MR. CLIFFORD: Thats BWR talk.
9 (Simultaneous speech.)
10 MEMBER ARMIJO: It would be another way of 11 -- youd have to find another way of handling it.
12 CHAIRMAN STETKAR: Paul, Im sorry. You 13 were careful to say if you were at 100 percent power.
14 Suppose you were at 30 percent power, does PCI become 15 -- in terms of your hierarchical color boxes there, 16 does PCI ever overtake, for example, DNBR?
17 MR. CLIFFORD: At lower powers theres a 18 significant amount of initial DNB margin, so its 19 never really the limiting factor.
20 MEMBER CORRADINI: So, what youre saying 21 is the green box gets so big that the other boxes get 22 within it.
23 MR. CLIFFORD: Right.
24 MEMBER CORRADINI: Simply because of where 25 Im sitting in pressure, and temperature, and flow.
NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
151 1 MR. CLIFFORD: Correct.
2 MEMBER CORRADINI: Okay.
3 MEMBER ARMIJO: But no matter whether its 4 PCI or DNB, low power is a good thing. If youre at 5 low power and go up a little bit, lets say 10 percent 6 over your 30, big deal, from a PCI standpoint its not 7 a problem. Its when you --
8 CHAIRMAN STETKAR: I just think about the 9 ramp -- you know, if you had a 50 percent power 10 increase from 30 percent power.
11 MEMBER ARMIJO: Thats going to hurt you.
12 CHAIRMAN STETKAR: Okay.
13 MEMBER CORRADINI: But, Im sorry, this one 14 Im trying to learn, so Im going to slow you down.
15 So, if Im at high power this graphic of what comes 16 first, second, third makes sense, but as I shrink 17 power the green box in terms of its allowable space 18 gets bigger, so I could have other effects that will 19 essentially become limiting, one being this -- the 20 example you had of mechanical strain.
21 MR. CLIFFORD: Right. I mean, its not that 22 simple in the sense that as you go down in power your 23 tech specs change, so your allowable operating ranges 24 get wider.
25 MEMBER CORRADINI: Right.
NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
152 1 MR. CLIFFORD: You can put rods in deeper, 2 youre allowed to have more severe peaking factors and 3 actually power shapes, so where they are in that, the 4 box is bigger so where they maneuver the plant to can 5 actually then bring DNBR back into the picture.
6 MEMBER BANERJEE: Can you explain what 7 those colors mean again?
8 MR. CLIFFORD: Its more of a cartoon. I 9 wouldnt take too much out of the colors. It just 10 shows that as power is increasing youre approaching 11 three different existing SAFDLs. Each one of them 12 could be more limiting depending on what your initial 13 conditions are. And its really the question thats 14 the real take-away, if you needed to consider PCI 15 explicitly. Would that change tech specs, would it 16 change set points, would it change fuel design? It 17 would require something change.
18 MEMBER RICCARDELLO: So, each of those 19 colors is a different SAFDL?
20 MR. CLIFFORD: That was the idea.
21 (Laughter.)
22 MEMBER ARMIJO: I think its important, 23 its a very good drawing. And each of those axises 24 represents a SAFDL.
25 MR. CLIFFORD: Thats correct.
NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
153 1 MEMBER ARMIJO: So, in the case of -- lets 2 take the fuel swelling strain SAFDL, the horizontal 3 one there. If you -- if the only two you had to handle 4 PCI was a strain criteria, and PCI failures occur at 5 lower strains than 1, youd have to reduce that and 6 have a new SAFDL for PCI.
7 MR. CLIFFORD: Right.
8 MEMBER ARMIJO: Assuming you got into that 9 power range, but you have other tools. So, the 10 question is how do you define the region where youre 11 vulnerable, if any, and whats the right criterion to 12 do it. Thats a good drawing.
13 MR. CLIFFORD: Thats really where were 14 going with this presentation. Is there an area where 15 were vulnerable considering that youve already had 16 these systems that are tuned to protect against these 17 other failure mechanisms. Is there a vulnerable part 18 of operating space?
19 MEMBER BALLINGER: Theres a second time 20 variable, though. Theres not only a time variable 21 where they fix the strain rate, but theres a time 22 variable that affects the conditioning of the fuel.
23 So, if you operate the fuel at I dont know, 7 or 8 24 kilowatts per foot for a long period of time it gets 25 conditioned, and then if you have a transient your NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
154 1 cladding in relation to the fuel is set in a certain 2 way and you get can this transient. So, the fuel can 3 condition, if you will, at the beginning of the 4 transient also makes a difference.
5 MR. CLIFFORD: Right.
6 MEMBER BALLINGER: Especially with BWRs.
7 You know, this is a little bit -- you cant change 8 power that fast during normal operation. Right?
9 MR. CLIFFORD: Yes, I think what youll see 10 -
11 (Simultaneous speech.)
12 MR. CLIFFORD: The conclusion is for PWRs 13 operating most all rods out have full power, youre 14 not seeing that sort of issue. But lets move on with 15 slides.
16 MEMBER CORRADINI: Yes, keep on going, 17 dont look back.
18 MR. CLIFFORD: Okay, Ive got two slides.
19 Okay, so the NRC has been participating in the 20 Studsvik Cladding Integrity Program which is a large 21 multinational research program to evaluate various 22 cladding failure mechanisms, and PCI stress corrosion 23 cracking is one of the focal points of this large 24 research effort. And I have a summary here.
25 The SCIP program has performed in depth NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
155 1 investigations to better understand stress corrosion 2 cracking including hundreds, close to 1,100 power ramp 3 tests on irradiated fuel. Theyve done separate 4 effects testing and extensive characterization.
5 The PWR database exhibits a large scatter 6 with respect to many variables, and as such theres no 7 clear failure threshold. Generating a PCI criteria is 8 very complex and at least two large international 9 programs have failed to produce a unified criterion.
10 And we expect that the level of effort and funding 11 required to complete the work would be significant.
12 We continue to participate in the SCIP 13 program and there are explicit research plans to 14 further investigate PCI on the hopes of coming to some 15 consensus on how -- whats the best way to model it, 16 how do you develop a failure threshold?
17 The next slides are going to be going to 18 be sensitive.
19 MEMBER ARMIJO: Okay. Let me ask you, just 20 ask you a quick question. As I look through the 21 database which is really very user-friendly to analyze 22 that data, I recognized a lot of the BWR data seemed 23 to be the data that you did, and was published. So, 24 you know -- but I understand why people want to keep 25 it proprietary because they pay money to be in the NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
156 1 SCIP program and they dont want other guys to be 2 using the data.
3 MR. CLIFFORD: Well, the database that you 4 looked at was made available to only the SCIP 5 participants.
6 MEMBER ARMIJO: Right.
7 MR. CLIFFORD: Thats why its not --
8 MEMBER ARMIJO: Theres a lot of data in 9 the DOE public domain, the BWR data.
10 MR. CLIFFORD: Correct.
11 MEMBER BANERJEE: So, the BWR talking about 12 this barrier fuel are subject to the same sort of 13 behavior?
14 MEMBER ARMIJO: More subject, more 15 sensitive.
16 MR. CLIFFORD: And well get to that.
17 MEMBER BANERJEE: So, youre going to tell 18 us about that.
19 CHAIRMAN STETKAR: What we need to do now 20 administratively, if its okay, is we need to close 21 the transcript, and we need to make sure that the 22 bridge line is closed, and we need to make sure that 23 there is nobody in the room who should not be here. I 24 should not be here, not who doesnt want to be here.
25 (Laughter.)
NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
157 1 CHAIRMAN STETKAR: When I say close the 2 transcript its proprietary. Were not off the record, 3 were just -- they mark the transcript that were in 4 closed session.
5 MEMBER ARMIJO: I think were okay.
6 CHAIRMAN STETKAR: As long as weve got 7 confirmation that the bridge line is closed. It is?
8 (Closed session begins at 2:10 p.m.)
9 CHAIRMAN STETKAR: I think we are back 10 reoriented, so again were in open session. And 11 continue, Paul.
12 MR. CLIFFORD: Okay. The next --
13 (Phone dialing.)
14 CHAIRMAN STETKAR: Thats just me.
15 MEMBER ARMIJO: Well plunge ahead.
16 MR. CLIFFORD: Okay. So, this portion of 17 the presentation we will talk about the Staffs 18 efforts to develop a draft stress corrosion cracking 19 cladding failure threshold based upon the data we had 20 available.
21 With using the code FRAPCON, which is a 22 well validated and well calibrated code and NUREG/CR-23 7022 Volume 2 documents the validation on this code 24 which consists for ramp tests of a relatively large 25 database where the code is tuned, the fuel swelling NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
158 1 models are tuned to provide a best fit to the measured 2 strains from the ramp testing.
3 We can run through these slides here. Its 4 just predicted minus measured and it just shows you 5 the best fit of the fuel swelling data. It was a 6 function of burnup. Heres a function of ramp turn on 7 level. And we went through these in more detail during 8 the Subcommittee meeting. So, on to the efforts to 9 develop a stress threshold.
10 Theres a lot of scatter, as we have seen, 11 on failure strain and time to failure as a function of 12 power increases which make it difficult to develop a 13 purely strain-based criterion. And more importantly, 14 since this isnt really a macroscopic strain driven 15 mechanical failure as shown by a lot of the tests that 16 failed below .1 percent strain, it was difficult to 17 develop a strain-based criteria, so in place we 18 developed a stress-based criteria. And this is 19 consistent with some of the approaches that have been 20 started in the SCIP program. And thats where these 21 cases that were run by the Office of Research as part 22 of one of these investigations in the SCIP program.
23 They ran 16 Studsvik ramp tests including 24 six failures. The predicted cladding hoop stress on 25 the failed rods ranged from 229 to 297 megapascals NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
159 1 with an average of 265.
2 MEMBER ARMIJO: Paul, you know, heres 3 where I have a hangup. You could calculate stress all 4 sorts of ways but you can measure strain after the --
5 see, so when they calculated these kinds of stresses 6 did they also say okay, for that stress, you know, we 7 have a stress strain curve, what was the failure 8 strain? And I -- and the problem its going to be, 9 its very localized. Everything is so localized, as 10 you said, that it may be that you just -- you dont 11 know what the stress is unless you have a really 12 detailed stress concentration at the tip of a crack in 13 the pellet pressing on the cladding. And thats well 14 known to be where the problem starts, or it nucleates.
15 You know, weve got great pictures showing exactly 16 whats going on, so a global strain or a global stress 17 is doomed to failure because its all localized.
18 MR. CLIFFORD: I agree its localized but, 19 see, thats the problem, there are so many unknowns 20 were trying to predict whether there was a chip or a 21 fine that was pressed up against the pellet wall, a 22 gap between the pellet and the cladding. Whether that 23 stress riser caused the nucleation. Theres too many 24 unknowns.
25 MEMBER ARMIJO: Well, dont -- just use a NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
160 1 regular pellet with a crack in it, you know, as radial 2 cracks and that geometry, at least, as other people 3 have analyzed it.
4 MR. CLIFFORD: Right.
5 MEMBER ARMIJO: And I think FRAPCON could 6 do it, too, but I dont know if youre -- thats what 7 Im pushing to --
8 MEMBER CORRADINI: I dont understand your 9 comment, Sam. I apologize. Are you saying that you 10 would rather have them measure strain, or have the 11 threshold limit on strain?
12 MEMBER ARMIJO: I dont think --
13 MEMBER CORRADINI: Im not understanding.
14 MEMBER ARMIJO: I dont think theres a 15 strain limit that will work.
16 MEMBER CORRADINI: Oh.
17 MEMBER ARMIJO: I think it will be so low 18 that its impractical so you have to find some other 19 criteria that says its power and time, or delta power 20 and time. And if you stay out of that regime youre 21 going to be okay.
22 MEMBER BALLINGER: Yes, but thats what 23 EPRI did 20 years ago, that power shock. What did they 24 call it? What did they call -- you must know what the 25 data talks about.
NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
161 1 MEMBER ARMIJO: That was notably 2 unsuccessful, but the concept is right. The principle 3 is right, you know.
4 MEMBER CORRADINI: Well, they stopped --
5 MEMBER ARMIJO: Theres a map of power and 6 time and --
7 MEMBER RICCARDELLA: Sam, are you saying 8 that a nonlinear stress analysis is not sufficiently 9 accurate --
10 MEMBER ARMIJO: No, I think you can do it 11 but youre going to wind up with some numbers that 12 reflect -- you know, the measured strain on the 13 cladding typically in these PCI failures is way below 14 1 percent, sometimes .1 percent, sometimes not even 15 measurable. And its real, its not an error. Its 16 real.
17 MEMBER RICCARDELLA: Running the analysis 18 gives you stress.
19 MEMBER ARMIJO: Yes, but you do a localized 20 stress analysis at the tip of a crack which youre 21 capable of doing like a -- you get -- Joe Rashid does 22 this. He did it on his code, and FALCON code. So, it 23 can be done, and that gives you what the real stress 24 is where the crack is going to nucleate. So, these 25 generalized stresses, theyre interesting but they NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
162 1 wont save your bacon.
2 MR. CLIFFORD: No, I dont disagree. I 3 think there needs to be more work that goes into this 4 to develop more complex analytical tools with which to 5 evaluate. But this was just our first attempt.
6 MEMBER ARMIJO: No. I appreciate youve got 7 to start somewhere.
8 MR. CLIFFORD: Right, weve got to start 9 somewhere. We used the tools we have.
10 MEMBER SCHULTZ: Paul, do you have a 11 picture where youve shown the data associated? You 12 talk about making predictions, but are you predicting 13 successes as well as the failures?
14 MR. CLIFFORD: Yes, its in the backup 15 slides.
16 MEMBER SCHULTZ: Oh, okay.
17 MR. CLIFFORD: Its back here. Im going to 18 get to it.
19 MEMBER SCHULTZ: We dont have the backup 20 slides. You have them.
21 MR. CLIFFORD: This is it right now. So, 22 these 16 cases here you have predicted versus 23 measured. The ones that are kind of shown, difficult 24 to see but just look for the ones that have failure 25 time.
NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
163 1 MEMBER SCHULTZ: We can see them from here.
2 MR. CLIFFORD: Okay. You must be less color 3 blind than I am.
4 (Laughter.)
5 MEMBER ARMIJO: Measured failure time and 6 --
7 MR. CLIFFORD: FRAPCON doesnt have a 8 failure model, so were just predicting stress.
9 MEMBER ARMIJO: Right.
10 MR. CLIFFORD: And were just getting 11 stress distributions for the ones that failed and the 12 ones that didnt fail.
13 MEMBER RICCARDELLA: Are they predicting 14 local stress or just global hoop stress?
15 MR. CLIFFORD: Global hoop stress at a 16 particular node.
17 MEMBER RICCARDELLA: Yes, I understand, but 18 it doesnt see the concentrating effect.
19 MR. CLIFFORD: No, it does not. Thats 20 correct.
21 MEMBER BANERJEE: So, this is the RZ code.
22 Right? Its not --
23 MEMBER BALLINGER: FRAPCON is not three 24 dimensional. Its two dimensional.
25 MEMBER ARMIJO: Well, two dimensional will NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
164 1 do a good job.
2 MEMBER BANERJEE: Well, that was Graham 3 Wallis question, actually.
4 MEMBER SCHULTZ: Im trying to grab this.
5 It looks like the code is predicting very high 6 stresses for rods that did not fail.
7 MR. CLIFFORD: Well, its almost 8 representative of the database we saw earlier. I mean, 9 theres blue and red up and down.
10 MEMBER SCHULTZ: Yes. I just wanted to know 11 whether weve got something thats working. Were 12 really dont, were modeling. Thats fine.
13 MEMBER RICCARDELLA: Has this also got 14 creep effects in it, relaxation, or is it linear, 15 these stress calcs?
16 MR. CLIFFORD: Harold, would this have 17 creep?
18 MEMBER ARMIJO: Not for such short times.
19 Whats max -- were talking minutes.
20 MR. CLIFFORD: Minutes.
21 MEMBER ARMIJO: Yes.
22 MEMBER RICCARDELLA: So youre saying the 23 creep effects arent important.
24 MEMBER ARMIJO: I mean, they could be but 25 --
NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
165 1 MEMBER SCHULTZ: Theyre not modeled. I 2 mean, the model is not going to predict anything over 3 a short time.
4 MEMBER ARMIJO: Yes, its not a time 5 dependent stress.
6 MEMBER BANERJEE: So, this is a -- if we 7 remember its a finite difference code. Right?
8 MR. CLIFFORD: Harold, thats true. Right?
9 MEMBER BANERJEE: And what is the state-of-10 the-art right now? Are there other quotes finite 11 element right now? For example, the French.
12 MEMBER ARMIJO: The EPRI code, FALCON.
13 MEMBER BALLINGER: I think the MOOSE BISON 14 thing is finite element. Right?
15 MEMBER REMPE: It is, but its -- theyre 16 doing comparison calculations with FRAPCON for 17 verification, so its not validated is the bottom 18 line. Okay?
19 MEMBER BANERJEE: So, the finite element 20 codes are 3D, or --
21 MEMBER ARMIJO: 2D.
22 MEMBER BANERJEE: Theyre still 2D?
23 MEMBER CORRADINI: Well, theyre all 3D in 24 theory, but 3D calculations are quite expensive to do, 25 so most of the simulations are 2D, the ones that Ive NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
166 1 seen presented.
2 MEMBER BANERJEE: Is this potential 3D 3 then? Its just that you dont run it 3D.
4 MEMBER ARMIJO: No, this is a 1-1/2D I 5 think. At least thats what Raynaud -- Patrick did, 6 but I dont know what a 1-1/2D thing is anyway, so 2D, 7 you guys have.
8 MEMBER BANERJEE: Yes, okay.
9 (Off the record comment.)
10 MR. PORTER: This is Ian Porter from 11 Research. FRAPCON is a 1D one-half solution so its a 12 stacked 1D problem, so it solves only radial heat 13 transfer recalculated at every axial node so the 14 coolant conditions change axially, but the heat 15 transfer is only radial.
16 MEMBER CORRADINI: But I thought the -- our 17 question was on FALCON.
18 MR. PORTER: Oh, on FALCON?
19 MEMBER BALLINGER: FALCON is the EPRI code.
20 MEMBER CORRADINI: I know. Thats what I --
21 22 MEMBER BANERJEE: A more general question 23 I was asking, what is --
24 MEMBER CORRADINI: But in the simulations 25 that have been presented at least in other venues NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
167 1 theyve only been two dimensional comparisons.
2 MEMBER BANERJEE: OCTATA?
3 MEMBER RICCARDELLA: RZ.
4 MEMBER BANERJEE: RZ.
5 MEMBER CORRADINI: And the ones that Ive 6 seen between FALCON and the animal guys are RZ.
7 CHAIRMAN STETKAR: Can I interject here? I 8 said earlier were not really constrained on time but 9 I think --
10 (Laughter.)
11 CHAIRMAN STETKAR: Id like to sleep 12 tonight, and although I know you guys like to talk 13 about codes, but Paul does have -- hes a little more 14 than halfway through.
15 MEMBER BANERJEE: We have codes but dont 16 delete them.
17 MEMBER ARMIJO: What are we doing after 18 this? Working on letters?
19 CHAIRMAN STETKAR: Its all ours, so were 20 not constrained to a 3:15 time, but its just --
21 MEMBER ARMIJO: Give Paul a chance to 22 finish his --
23 CHAIRMAN STETKAR: No, no, no, thats -- I 24 just wanted to give him a chance to finish.
25 MR. CLIFFORD: So, using the codes we have NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
168 1 in place and comparisons to the Studsvik ramp we came 2 up with a lower bound and a best estimate stress 3 threshold to PCI failure.
4 Now, the next part of this presentation we 5 will talk about PWR operating characteristics and AOO 6 overpower, and that will then lead into the 7 calculations that we chose to run to show whether or 8 not we are susceptible to PCI failure.
9 As we touched upon earlier, BWRs have 10 shown to be susceptible to PCI and thats really due 11 to plant maneuvering with high worth control blades.
12 Operating experience has now shown that PWRs are 13 susceptible. The exception was a limited number of 14 failures due to missing pellet surface and that 15 problem has since been identified and resolved with 16 improvements in manufacturing specifications and 17 inspection.
18 Okay. So, there are 65 PWRs operating.
19 Because there are 65 there is always exceptions to 20 every rule, differences as they came up in the 21 generations, so well talk about them in more general 22 terms, just remembering that there are unique 23 situations like Palisades that its a PWR but it had 24 control blades.
25 So, reactivity control in a PW -- well, NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
169 1 let me start off by saying there are obviously 2 differences in operating characteristics between Ps 3 and Bs. Sam alluded to this earlier, PWRs operate at 4 higher temperatures and higher pressures, but there 5 are other unique characteristics, specifically 6 reactivity control. BWRs use deep insertions of the 7 control blades to hold down excess reactivity to 8 achieve long cycle lengths. PWRs employ boric acid 9 dissolved in the RCS, so one is kind of a gentle 10 global redistribution of our hold down of reactivity, 11 and the other one is a little more severe with respect 12 to local power densities.
13 BWRs can operate control blades 14 individually which increases their worth and their 15 impact on local power density; whereas, PWRs which 16 normally operate all rods out move their control rods 17 in assigned banks, and they are significantly 18 restricted based upon their tech spec allowable PDIL, 19 Power Dependent Insertion Limits. And the next page 20 will show an example of a PWR PDIL.
21 As you can see, at 100 percent power 22 theyre limited to, I thought I remembered this but 23 its something like 20 inches or maybe less of 24 insertion of Bank 5, and Bank 5 is, I believe, four 25 locations in the core so its overall bank worth is NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
170 1 very, very low when youre at full power. And they 2 normally wouldnt even insert them at all.
3 We talk about reactor kinetics. In 4 addition to negative fuel temperature coefficients, 5 BWRs operate with a negative moderator temperature 6 coefficient due to high concentrations of soluble 7 boron to hold down excess reactivity. They may have a 8 slightly positive MTC at the very beginning of cycle 9 at very low power, but by the time they get to full 10 power on day one they have a negative MTC.
11 Due to negative temperature feedbacks 12 controls, PWRs are very stable with respect to 13 increasing and decreasing power scenarios. In other 14 words, they always fight to stay where they are. So, 15 any increase in reactor power without a proportional 16 increase in secondary demand will promote increasing 17 reactor coolant temperature, which in turn would 18 result in the additional negative reactivity. And the 19 opposite would be true, also. So, in general terms, 20 reactor power follows secondary heat removal.
21 Here is a typical tech spec limit on MTC, 22 Moderator Temperature Coefficient. You know, the take-23 away here is its negative, and it gets more negative 24 as cycle goes, so at basically hot full power you 25 could have -- the most positive would be a minus .2, NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
171 1 and it could go all the way to minus 4 percent delta 2 rho, 10 the minus 4th percent delta rho 3 degrees 3 Fahrenheit.
4 So, the reactor protection system. For any 5 of the overpower scenarios, which is really what were 6 talking about here, the PWRs rely on a high neutron 7 flux or a variable high-power trip safety grade 8 reactor trip to provide a timely trip in order to 9 protect the SAFDLs.
10 Additionally, PWRs have trip functions 11 such as here is the overpower delta T, which is 12 applicable to Westinghouse and MHI, and low DNBR which 13 is CE and AREVA PPR.
14 MEMBER ARMIJO: Paul, are you saying that 15 all of the AOOs are protected by some sort of 16 automatic system, that theres no known AOOs where you 17 have to rely on an operator to --
18 MR. CLIFFORD: Any power-based AOOs, thats 19 true. There may be --
20 MEMBER ARMIJO: Power increase, thats all 21 Im worried about, power increase.
22 MR. CLIFFORD: Right. There may be an AOO 23 like inadvertent charging where someone turns on a 24 third charging pump and you start filling the 25 pressurizer. Youll get an alarm but its up to the NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
172 1 operator to then secure that. Thats not a power 2 transient. Power transients are all protected against 3 automatic response.
4 MEMBER ARMIJO: And in the control rod 5 withdrawal error do they have such a thing?
6 MR. CLIFFORD: Control rod withdrawal?
7 MEMBER ARMIJO: Yes.
8 MEMBER SKILLMAN: That would be a rate 9 limit.
10 MEMBER ARMIJO: A rate limit that trips it?
11 MEMBER SKILLMAN: Probably trip the reactor 12 on rate.
13 MR. CLIFFORD: In general, when we analyze 14 Chapter 15 events, Chapter 15 is part of the FSAR. I 15 always refer to it as Chapter 15. We dont allow 16 operator action, so they have to show that the system 17 is in place with their response times, and their 18 instrumentation, and their set points will provide a 19 trip when needed to insure that you dont have fuel 20 failure. We dont allow them to credit operator action 21 for our pure Chapter 15-type analysis. That doesnt 22 mean that during our actual event the operators 23 wouldnt respond. It just means that they have to be 24 failsafe.
25 MR. JACKSON: Right. For AOOs, the reactor NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
173 1 trip saves you under all circumstances with very few 2 exceptions, and that would be like the -- you know, 3 inadvertent SI signal is an AOO, and they calculate 20 4 minutes before the operator terminates that. That 5 would be one that would be terminated by operator 6 action.
7 MEMBER ARMIJO: Okay.
8 MR. JACKSON: Safety valves protect you.
9 The other one --
10 (Simultaneous speech.)
11 MEMBER ARMIJO: Is it different for the 12 BWR? Its a different philosophy? You know, for 13 example, loss of feedwater heater is the big one I 14 worry about in a B in that youve got the whole core 15 going up, and there have been instances where manual 16 operator action was required to terminate it because 17 the trip systems either didnt exist or were set too 18 high. And I dont remember how high they went in power 19 but I think Susquehanna had such a thing.
20 MR. CLIFFORD: I dont remember, but you 21 always have to remember when a transient analyst 22 chooses to show that the system can respond or ride 23 through a transient, sometimes they ignore trips. And 24 they say look, it can go up to a higher power and it 25 can stay there for a period of time, and I dont NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
174 1 violate my --
2 MEMBER ARMIJO: You dont shut --
3 MR. CLIFFORD: You know, CPR limits. So, 4 they can -- its the easiest way to get it through NRC 5 review is to say look, I know there are trips that 6 would help me here, but Im just going to ignore them 7 and show you that I dont fail my fuel.
8 MR. JACKSON: Right. And, typically, many 9 plants dont credit the positive rate trip so that 10 would be there to determine --
11 MEMBER ARMIJO: Okay.
12 MR. CLIFFORD: So, on this slide we just 13 show you the set points, the allowable set points that 14 are in the tech specs for these plants just to give 15 you a feel that theyre very similar. Theres a high-16 power trip that occurs somewhere between 105 and 111 17 percent for the plants.
18 MEMBER ARMIJO: Paul before you leave that 19 slide, just to get calibrated, they compare 110 20 percent. Lets pick the Westinghouse number. What is 21 that in kilowatts per meter for the peak rod in an AOO 22 that would generate the kind of a delta? Is it -- what 23 I want to do is say where -- on your Figure 13 where 24 would a transient that would take you to 110 percent 25 put you on this ramp terminal power versus burnup NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
175 1 failure plot?
2 MR. CLIFFORD: These are power as measured 3 by their explore detector channels, so this -- these 4 are continuously calibrated so it would be a 10 5 percent increase in neutron flux as seen by the 6 explore detectors.
7 MEMBER ARMIJO: Right, but --
8 MR. CLIFFORD: Thats not related to what 9 local power can be.
10 MEMBER ARMIJO: But thats --
11 MR. CLIFFORD: Especially if you have an 12 event thats not symmetric or global.
13 MEMBER ARMIJO: Well, thats what Im 14 looking for the rods that represent peak rods in the 15 bundle, whats the nodal power that they achieve? Is 16 it 30 kilowatts per meter, is it 40, is it more than 17 that?
18 MEMBER SCHULTZ: Not for the delta, no.
19 MEMBER ARMIJO: No, no, for the actual, not 20 the delta, the peak.
21 MEMBER SCHULTZ: Oh, for the terminal?
22 MEMBER ARMIJO: Yes, the terminal because 23 thats where the action is as far as PCI. So, this 24 number -- Im just trying to say where does that put 25 you on this -- on Figure 13 roughly?
NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
176 1 MR. CLIFFORD: Well, I mean, its an 2 impossible question to answer only because core 3 loading patterns are such that, you know, as they 4 design the core whats the peak rod? But on average, 5 the average liner heat generation rate is roughly 6 between 5.6 and 6 in the PWRs.
7 MEMBER ARMIJO: And theyre very flat.
8 (Simultaneous speech.)
9 MR. CLIFFORD: Bring it up to the maximum 10 rod would generally be about 9, 9-1/2 kilowatts a foot 11 at the peak node.
12 MEMBER ARMIJO: Okay.
13 MR. CLIFFORD: I mean, they have higher 14 limits, LOCA limits that they use to set their initial 15 conditions and their stored energy for the LOCA 16 analysis that could be as high as 13.1 Ive seen.
17 MEMBER ARMIJO: But you see what Im 18 getting at. If your peak nodal power in whatever 19 transient it is thats protected by a trip is below 20 threshold on this kind of a plot, you kind of made the 21 case.
22 MR. CLIFFORD: It really depends on the 23 type of transient. If its an asymmetric transient, in 24 other words, if it involves control rods, either a 25 drop of a control rod or withdrawal of a control rod, NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
177 1 youre going to get very high local power distribution 2 changes, so the --
3 (Simultaneous speech.)
4 MR. CLIFFORD: So, whereas, if you have 5 excess steam demand its not really local power 6 driven. Its a global power event, so youre going to 7 increase power uniformly across the core.
8 MEMBER ARMIJO: Small.
9 MR. CLIFFORD: No, I mean, you can go very 10 high in power but its still going to be a uniform 11 increase in power because its driven by cold water 12 coming into the core. It depends on the type of 13 events. When we talk about the AOOs, I talk about 14 whether its a local phenomenon or a global 15 phenomenon.
16 MR. JACKSON: The AOOs throughout the cycle 17 they calculate, they stay within all the limits for 18 all the AOOs, so the kilowatt per foot limit, the 19 peaking limits. So, if its a global event the 110 20 percent trip will get them. If its a local event, 21 either that, or one of the other trips will get them.
22 But they have to calculate for all three acceptance 23 criteria that he described before throughout the cycle 24 for all AOOs.
25 MEMBER ARMIJO: Right.
NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
178 1 MR. CLIFFORD: So, if you kind of go back 2 to Chapter 15 philosophy, youre defining your 3 limiting initial conditions to maximize the 4 consequences, in this case maximize say temperature 5 increase or DNBR margin degradation. And often you 6 choose to either try to avoid a reactor trip or to 7 overshoot a reactor trip to get the maximum power you 8 can before you scram the reactor. So, this strategy 9 yields conservative analysis results with respect to 10 margin of DNBR and melt, and your cladding strain, or 11 it would maximize the predicted fuel failure.
12 Its important to note, as we mentioned 13 earlier, stress corrosion cracking really requires 14 both stress and time, so is there an AOO overpower 15 scenario that exists which exhibits a prolonged power 16 excursion of a significant magnitude to where your 17 fuel rods would be susceptible to stress corrosion 18 cracking? And thats what well talk about.
19 If you look at this slide, theres a 20 survey of all the AOOs. I think this is a Westinghouse 21 or a CE plant, but theyre all pretty similar. And you 22 just kind of identify which ones are a global power 23 increase and which ones are a local power increase.
24 And really when we started talking about this issue it 25 was -- the concern was is there an event on a global NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
179 1 scale that would result in a lot of fuel failures 2 across the core, so were really sticking to global 3 changes.
4 MEMBER ARMIJO: Global ZED because, you 5 know, what -- fuel rods from a local area is not a 6 problem. And, actually, it started out with the issue 7 of power uprate, now were uprating the core, so that 8 -- now were going to be able to go to even higher 9 power than we normally used to be able to do. That was 10 at Susquehanna when it started.
11 MR. CLIFFORD: Right.
12 MEMBER ARMIJO: So, a global power increase 13 is a threat in time and power, maximum power are the 14 parameters.
15 MR. CLIFFORD: The PWRs, theres been a lot 16 of power uprates of PWRs but they -- really have they 17 achieved that power uprate by increasing local rod 18 power? Done it by putting a higher feed -- number of 19 feed batches so what happens is they flatten the 20 power. Weve seen peaking factors -- when I was doing 21 fuel management, you know, we had peaking factors of 22 one seven, now were down to peaking factors of one 23 five, so were really -- things have changed. They 24 really havent gotten worse from a local perspective.
25 MEMBER BANERJEE: So the limiting case will NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
180 1 be the rod withdrawal, I take it. Right?
2 MR. CLIFFORD: Right. Theres two types of 3 events here that were going to go into, and thats 4 the first one is the bank withdrawal, and the second 5 is really the whole class of increased secondary heat 6 removal. And all of the first five are from Chapter 7 15.1, increase in secondary heat removal. So, well 8 start with the bank withdrawal.
9 CHAIRMAN STETKAR: Paul, just go back for 10 a second. I love alphabet soup as much as anybody, and 11 I understand all of it. Whats ASGT? Thats the only 12 one I couldnt figure out.
13 MR. CLIFFORD: Its Asymmetric Steam 14 Generator Transient, so youre operating at full power 15 --
16 CHAIRMAN STETKAR: Oh, go on. Okay.
17 MR. CLIFFORD: You want to hear about it or 18 not?
19 CHAIRMAN STETKAR: You can.
20 MR. CLIFFORD: Youre operating at full 21 power and say one of your main steam isolation valves 22 inadvertently closes, so one steam generator output 23 would go to zero, the other one would pick up the load 24 and go from 50 percent to 75 percent, so you have the 25 inlet flow distribution changes and the temperature in NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
181 1 the --
2 CHAIRMAN STETKAR: I understand the 3 concept. Ive just never seen that acronym.
4 MR. CLIFFORD: Okay.
5 CHAIRMAN STETKAR: Or that kind of 6 connotation. Thanks.
7 MR. CLIFFORD: Okay. So, well start with 8 the bank withdrawal. The limiting CEA withdrawal 9 scenario in the FSAR would be to maximize the power 10 excursion, in other words, the overshoot of your trip 11 set point by selecting the maximum bank worth, least 12 negative MTC, least negative FTC, and minimum delayed 13 neutron fraction.
14 It is possible to identify a CEA 15 withdrawal event, say one that has a partially 16 inserted bank, or a very low worth bank which could 17 avoid the rapid trip. However, with no increase in 18 secondary steam demand reactor power will eventually 19 trend back down to match secondary removal, so power 20 will go up, temperatures will go up, negative 21 feedbacks will then just beat it back down. So, if the 22 operators arent doing anything on the secondary side 23 this is an event that could challenge fuel failure, 24 but its not a prolonged event. Its a short-lived 25 event.
NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
182 1 MEMBER BANERJEE: So, whats the typical 2 power pulse you could get in the -- in that scenario 3 typically?
4 MR. CLIFFORD: Because the tech specs limit 5 insertion at power its a very benign transient. Here 6 is a power trace at full power, because youre limited 7 to Bank 5 and you only can insert it 22-1/2 inches or 8 something like that. The worth is very low so its 9 really not even a significant event. But at low power 10 where youre allowed to have say not just Bank 5, but 11 Bank 4 and Bank 3 in, now you have a lot more worth 12 delta rho per inch. So you can get a significant power 13 increase. The previous -- previously I showed a trend 14 of a rapid power excursion that went from zero to 70 15 percent rated power in two or three seconds. That was 16 a hot zero where youre allowed to have a lot more 17 deep insertion.
18 MR. JACKSON: Right. So, this is a 19 situation where if a plant wanted to load follow and 20 they wanted to keep their rods in, they would have to 21 change their tech specs to allow bigger rod insertions 22 and then they would have to redo this analysis with 23 acceptable results. So, the way they choose to operate 24 their plants and their tech specs is a --
25 MEMBER ARMIJO: But that 18 seconds that NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
183 1 puts my mind at ease, so this one Im saying --
2 MR. JACKSON: Youre done.
3 MR. CLIFFORD: So, if its a primary driven 4 power excursion its going to turn itself around. I 5 mean, thats kind of the take-away, the rule of thumb, 6 and its based on how much time it takes for the water 7 to circulate around and to heat up a full bank, 8 whatever is driving it. So, this is a benign event for 9 two reasons. One, it turns itself around, which isnt 10 shown here because it hasnt reached that point yet.
11 And really its just the tech specs limit the worth 12 of the rod.
13 So, this event is really susceptible to 14 stress corrosion cracking because of the time 15 duration. And you can argue that since you dont 16 operate with rods in the core you really cant even 17 have this event. The probability of that event is so 18 low because they dont operate with rods in the core.
19 The delta rho is very low, such peaking factors are 20 minimized by tech specs. Youve got your negative 21 feedbacks, youve got your available trips, and the 22 operators would take action.
23 So, the excess demand events are really 24 the ones that -- of all of the AOOs would be more 25 vulnerable. And its really driven by how much excess NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
184 1 steaming or how much excess heat removal is there, and 2 what point of the cycle theyre in, whats the MTC?
3 So, if you had like an inadvertent opening of a steam 4 generator atmospheric dump valve, thats roughly 10 5 percent steaming, full power steaming, so power is 6 going to want to work its way up to 110 percent in the 7 reactor. How quickly it moves up there depends on what 8 the MTC is.
9 So, theres a wide variety of how this 10 event -- what the scenario would look like, what the 11 accident progression would look like based on the 12 amount of steam releases, the MTC, et cetera. But 13 there is a combination which will give you a prolonged 14 power excursion. The question is, is the magnitude of 15 the excursion such that you would have to worry about 16 stress corrosion cracking? So, the time part can be 17 achieved. The question is can the stress part be 18 achieved?
19 Here is just a plot of OSGADV and it shows 20 you that it can be at power for a long period of time.
21 Here is a steam bypass.
22 MEMBER ARMIJO: These are seconds, huh?
23 MR. CLIFFORD: Yes, 360 seconds.
24 MEMBER ARMIJO: Three minutes, so thats 25 long enough.
NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
185 1 MR. CLIFFORD: So, this is the type of 2 event where you could pick the right conditions where 3 you could go up in power but you could avoid the ex 4 core-driven high-power trip. Now, youre going to trip 5 on something. In this case, youre probably going to 6 trip on low steam generator pressures because once you 7 open your atmospheric dump valve pressure starts 8 dropping, and thats a safety grade trip.
9 MEMBER ARMIJO: Have these things ever 10 happened an OSGADV?
11 MR. CLIFFORD: Im sure they have.
12 MEMBER ARMIJO: Inadvertent -- what is it?
13 CHAIRMAN STETKAR: Somebody blew a safety 14 valve off them --
15 MR. JACKSON: Im mean theyre not common.
16 CHAIRMAN STETKAR: These are not common, 17 but I know somebody blew open a safety valve.
18 MEMBER ARMIJO: Would a steam break action 19 do this, too?
20 CHAIRMAN STETKAR: Steamline breaks are not 21 AOOs.
22 MEMBER RICCARDELLA: No, thats not an AOO.
23 Thats an emergency or fault --
24 MR. CLIFFORD: That scenario wouldnt --
25 that would be a very rapid power excursion, a very NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
186 1 quick trip. And then you -- and what youre really 2 worried about is the return -- if theres going to be 3 return to criticality and return to power if you keep 4 blowing down your steam generator if you cant isolate 5 it.
6 MEMBER ARMIJO: Paul, now lets just stick 7 with this thing so I can myself clear. If you were at 8 100 percent power and this happened, that means some 9 rods, and I dont know PWR assembly, lots of rods will 10 increase power. But the only thing I care about is 11 does it -- from what LHGR in kilowatts per meter does 12 it go, does it get -- your peak rods get up to 40 13 kilowatts per meter locally?
14 MR. CLIFFORD: During this event, its a 15 global increase. The only redistribution of power you 16 really see is the colder water will tend to drive the 17 actual power shift, will drive it down towards the 18 bottom of the core, which is very benign from a DNBR 19 perspective so we dont even allow them to credit 20 that. But theres not a redistribution that you would 21 see in a rod motion --
22 MEMBER ARMIJO: Lets just assume that the 23 whole core goes up uniformly just -- if your peak rods 24 are at 8 kilowatts a foot and they go up to 8.8, 25 thats pretty benign. And if you look at your data of NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
187 1 PCI failures below a threshold, at least theres no 2 data there. But if it was -- if you were operating at 3 10 and you went up to 11, youre getting into this 4 borderline, if you were at 12 and went up to 13 or 14 5 kilowatts per foot, then youre in the problem range.
6 But I dont know if you can get those powers in this 7 event in a PWR.
8 MR. CLIFFORD: When we do EPU reviews we 9 generally repeat -- and Ive presented these results 10 here before. We repeat the fuel mechanical design 11 analysis where theyll identify the limiting rods, 12 three or four of the limiting rod power histories, and 13 well run our transient analysis, I mean our FRAPCON 14 analysis to show that the rods meet all their fuel 15 design requirements. And generally those are 16 relatively benign because theyre getting pretty flat 17 with these power distributions. Theyre getting really 18 good. You dont want to have them in a peaky core 19 because youre not properly utilizing your uranium if 20 youre discharging --
21 MEMBER ARMIJO: Whats the number, whats 22 the LHGR that --
23 MR. CLIFFORD: The only regulatory limit 24 they have is the LOCA linear heat generation limit in 25 their code ware. Thats the only limit, regulatory NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
188 1 limit they have. Where they actually fuel manage to is 2 a different story.
3 MEMBER ARMIJO: What are they allowed to go 4 to?
5 MR. CLIFFORD: That would be at 13.1 6 kilowatts a foot. Ive seen that number.
7 MEMBER ARMIJO: Yes.
8 MR. CLIFFORD: Are they ever challenging 9 that? I dont think so. Are they within three or four 10 kilowatts a foot, probably not even, but theyre 11 allowed to be there.
12 MEMBER ARMIJO: Thats the key.
13 MR. CLIFFORD: Theyre allowed to be there.
14 MEMBER ARMIJO: Okay.
15 MEMBER BANERJEE: I think you have to count 16 on them being there.
17 MR. CLIFFORD: Absolutely.
18 MEMBER BANERJEE: You cant do anything 19 else. In fact, this issue came up earlier, this was a 20 BWR. Thats enough.
21 MEMBER ARMIJO: Okay. Thanks, Paul.
22 MR. JACKSON: For our current limits, and 23 the three criteria that he -- we look at all the times 24 and cycle through all -- I mean, you look at it all, 25 so we dont --
NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
189 1 MEMBER ARMIJO: Yes.
2 MR. JACKSON: I mean, heres where hes 3 speculating or hes working this if we apply new 4 criteria to --
5 MR. CLIFFORD: Right. So, there are events 6 that could you give you the time element you need for 7 stress corrosion cracking. Heres another type event, 8 this is a steam bypass control system malfunction.
9 This would give you significant over-steaming, so 10 youre going to get a rapid trip, so this particular 11 scenario would show thats not an issue. So, if an 12 event has a very high power and hence, a very high 13 stress, its going to be of short duration. So you 14 really have to find the scenario that has a 15 combination of time, which means it has to be a 16 relatively low power, otherwise it would have gotten 17 a trip.
18 So, heres just a summary here. Due to the 19 high-power trip and the low steam generator pressure 20 trip thats going to limit the magnitude and duration 21 of the power excursion, and theres additional trips 22 that also can be credited. And theres obviously going 23 to be control room alarms that would alert the 24 operators to take action. And then theres a whole 25 class of non-safety alarms and trips that we dont NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
190 1 credit but are there --
2 (Simultaneous speech.)
3 MR. CLIFFORD: So this event is something 4 that needs to be looked at for stress corrosion 5 cracking because, as I mentioned, you can have the 6 time duration. The magnitude of the power, hence the 7 magnitude of stress is going to be limited by the 8 existing reactor protection functions.
9 MEMBER ARMIJO: Paul, is this the worst one 10 that you found? Is this the transient that does --
11 MR. CLIFFORD: Theres an infinite 12 possibility of excess type events that could -- if 13 your trip was 118 you could find an event that would 14 get you to 118. If your trip was 104, you could find 15 an event that would get you to 104. You know, there is 16 really an infinite possibility, but theyre -- from 17 the traditional Chapter 15 theyre never limiting. You 18 want something that overshoots because thats one 19 thats going to challenge your fuel design limits.
20 MEMBER ARMIJO: Yes.
21 MR. CLIFFORD: So, we ran some FRAPCON 22 calculations, two different types of calculations. The 23 first one were answering the question do the existing 24 reactor protection system trip functions provide 25 adequate protection against stress corrosion cracking?
NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
191 1 And the second set was how much margin exists between 2 where we would expect them to be and when they would 3 be expected to have stress corrosion cracking.
4 So, the inputs, as I mentioned, a rapid 5 power excursion which overshoots the trip set point 6 wont have significant time duration so they were 7 scratched. So, as a result were really looking at a 8 prolonged power excursion event that stays below the 9 existing trip set points. And as you saw earlier, 10 theyre all somewhere between 105 and 110 percent. We 11 chose 112 percent for this exercise, so we chose three 12 different power histories, and on each of those power 13 histories we ramped power by 112 percent at different 14 burnup points, and then we calculated what the change 15 in stress was. And then we compared them against the 16 thresholds that we had previously estimated, the lower 17 bound and the best estimate.
18 So, at least from our calculations one 19 thing we can take away from this is that at low 20 burnups you have an existing gap. In an ideal world, 21 you have an existing gap, so if you just do 112 22 percent ramp based on where they are, 112 percent 23 higher than where they were, its insignificant.
24 Sometimes you wont even close the gap, so its 25 strongly dependent on power history, fuel design, et NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
192 1 cetera. But for these three rod designs or power 2 histories, we calculated the stresses. Lets see, what 3 else can I say about this? The maximum stress stayed 4 well below a threshold, below a threshold of 200 5 megapascals based upon our FRAPCON analysis of the 6 SCIP data, and the maximum hoop stress here is 164.
7 And this 164 is actually pretty aggressive in the 8 sense that a fuel rod with a local burnup of 67 9 gigawatt days was still operating at 7.75. This radio 10 falloff curve, as I mentioned, is not a power history.
11 Its actually the worst composite power history that 12 you could have. In other words, its a line drawn 13 above all the fuel rod power histories, so its a very 14 bounding case.
15 So, for that case where you already had a 16 significant stress, pre-ramp you have a significant 17 stress, and then youve increased that stress by 90 18 megapascals, youre nowhere near the stress threshold.
19 But in this simple exercise we ran, we were just 20 trying to answer the question, if you ramped up in 21 power, stayed below your trip set point, what sort of 22 stresses could you expect in your cladding? And would 23 those stresses be of sufficient magnitude to cause 24 this nucleation crack propagation stress corrosion 25 cracking? And our conclusion is that because of the NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
193 1 existing -- our conclusion is that the existing trip 2 functions and set points are adequate to protect 3 against this scenario, so we wouldnt expect there to 4 be stress corrosion cracking because the power 5 excursion is so minimal.
6 In the next set of calculations we used 7 the same power histories, and instead of going up to 8 112 percent we iterated on power, so we changed the 9 power increase until we hit either the 200 megapascal 10 or the 250 megapascals thresholds. So, this shows what 11 the maximum ramp could possibly be to get to that 12 point where you may predict stress corrosion cracking.
13 So, as with the previous analysis, at low burnups if 14 theres a preexisting gap, you can have a relatively 15 large power increase. But as burnup increases and the 16 gap closes and initial stress is higher what youre 17 seeing is the allowable power increase decreases.
18 MEMBER ARMIJO: And youre getting strains 19 that are in the range of the very low strains, much 20 less than 1 percent, if Im reading this right.
21 MR. CLIFFORD: Correct.
22 MEMBER ARMIJO: Well, this one you actually 23 worked backwards. Right?
24 MR. CLIFFORD: Right.
25 MEMBER ARMIJO: Okay.
NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
194 1 MR. CLIFFORD: So, calculations show that 2 you need a prolonged power excursion greater than 118 3 percent to achieve the lower bound, and 125 percent to 4 achieve the best estimate threshold. And these 5 calculations suggest that there is some safety margin 6 to stress corrosion cracking based upon how these 7 plants are operated, and what the existing trip 8 functions are.
9 So, another way of looking at it is you 10 set these trip -- you create these engineered safety 11 features, these trip functions and you set the set 12 points to protect you against other failure 13 mechanisms. And by doing that, youre inadvertently 14 protecting yourself against stress corrosion cracking.
15 MEMBER ARMIJO: But not the 1 percent SAFDL 16 doesnt do it. Your other --
17 MR. CLIFFORD: Not for this class, right.
18 MEMBER ARMIJO: Not for this kind of 19 mechanism, this failure mechanism. But what it says, 20 if your threshold is 200 megapascals for failure and 21 you go above it, youre taking from the SCIP data you 22 estimate that thats -- you would be getting failures, 23 but that calculates strains.
24 MR. CLIFFORD: Yes, 265 is the average.
25 This is just a very lower bound.
NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
195 1 MEMBER ARMIJO: Yes, at some point -- I 2 really dont understand how you got your 265 but Im 3 going to let that sit and think about it a bit. But 4 based on calculated strains and comparing that to the 5 measured strains to failure from the SCIP data, youre 6 in the failure regime.
7 MR. CLIFFORD: I mean, as we mentioned, I 8 mean, you can -- its not really a macroscopic strain-9 based failure, so its -- you can have strains of 10 close to 1 percent and not fail. Thats what we expect 11 on the data. You can get --
12 MEMBER ARMIJO: No, thats not correct, 13 Paul.
14 MR. CLIFFORD: Not by stress corrosion 15 cracking, but by -- so youre right. I mean, we dont 16 have an SEC failure model in FRAPCON, but were not 17 predicting the actual propagation and failure, through 18 wall propagation and failure. What were predicting is 19 just stress. Were kind of taking that leap of faith 20 that the stress needed as a function of burnup is X as 21 we calculate it, and were just trying to show that -
22 MEMBER SCHULTZ: But you apply FRAPCON to 23 the test data, and thats where the numbers came from.
24 MR. CLIFFORD: Correct.
25 MEMBER ARMIJO: Okay. So, your bottom line NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
196 1 is youre not going to get to the powers for a long 2 enough time without tripping.
3 MR. CLIFFORD: Yes.
4 MEMBER ARMIJO: And it isnt the strain 5 safe thats protecting you, its just --
6 MR. CLIFFORD: Correct.
7 MEMBER ARMIJO: -- the engineering --
8 MR. CLIFFORD: Its a combination of the 9 systems you have in place and the characteristics of 10 operating hot full power all rods out. You dont --
11 youre not moving blades. I mean, what were seen in 12 the past is you got PCI failures because you were 13 moving blades, high worth blades and exposing fuel 14 which is causing an increase in local power density 15 for a prolonged period of time. Theres none of that 16 in the PWR.
17 MEMBER SCHULTZ: The interesting thing is 18 if you were operating -- if one was operating in a 19 load follow mode youd have to look at this all over 20 again.
21 MEMBER ARMIJO: You might. You might have 22 to do that, yes.
23 MEMBER RICCARDELLA: But the French 24 experience indicates that thats not a problem, for 25 whatever reason that doesnt seem to be a problem.
NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
197 1 MR. CLIFFORD: Theyve evaluated that and 2 theyve set preconditioning guidelines, theyve set 3 maneuvering guidelines to avoid it.
4 MEMBER ARMIJO: As long as we stay out of 5 there, as long as we stay out of that business in the 6 U.S.
7 CHAIRMAN STETKAR: Maybe not.
8 MEMBER ARMIJO: It may not, we may --
9 MR. CLIFFORD: I can send you my 10 presentation. It doesnt look good.
11 (Laughter.)
12 MEMBER SKILLMAN: Well, there was a time in 13 the 70s where we did load follow with the Ps. I know 14 B&W was 150, 100 in 10 minutes and it would do it. It 15 wouldnt trip. ICS would keep it on line. And we did 16 not have failures, so I know there was a time when the 17 Ps in the United States were actually load following.
18 And as time went on into the 80s and 90s we went to 19 baseload and we did all shim with boron. We were 20 trimming with actual power shaping rods or power 21 length rods but we did load follow in the early days.
22 MR. CLIFFORD: I guess the conclusion is 23 its really a combination of the existing engineered 24 safety features and operating restrictions that insure 25 that PWRs are not susceptible to stress corrosion NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
198 1 cracking during normal operation, and thats certainly 2 backed by the operating experience weve had in this 3 country.
4 With respect to the vulnerability during 5 AOOs, the calculations show that theres margin to get 6 to a stress regime or a magnitude of stress where you 7 might become susceptible to stress corrosion cracking.
8 As we mentioned, its a difficult phenomenon to model 9 and I agree with some of the recommendations in the 10 White Paper that we should improve our analytical 11 methods so that we can be ahead of the curve because 12 change is upon us. And if, in fact, we start seeing 13 plants coming in for load follow license amendment 14 requests we want to have the tools available to 15 evaluate stress corrosion cracking.
16 We will continue to participate in the 17 SCIP program. And as I mentioned, there are ongoing 18 tests as we speak, and then theres an additional set 19 of tests in the SCIP-3 program which are upcoming, 20 which are specifically designed to help us further 21 understand stress corrosion cracking so that we can 22 work with our international counterparts and kind of 23 come up with a uniformed approach, you know, whats 24 the stress intensity factor? How do I model it? Whats 25 the duration? I mean, we need to identify -- we need NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
199 1 to increase our knowledge so that we can develop a 2 regulatory framework around this failure phenomenon.
3 MEMBER ARMIJO: Okay. Well, look, first of 4 all I go around the table and see if theres comments 5 or questions, and then Ill wrap up with some 6 comments. Mike?
7 MEMBER CORRADINI: Oh, youre going to 8 start with me?
9 MEMBER ARMIJO: Yes.
10 MEMBER CORRADINI: I appreciate the time 11 you took to explain it to those that arent expert in 12 it, but I dont have any comments. I guess my only 13 observation is that I guess your final conclusion was 14 the thing that Ill take away, which is by I wont say 15 happenstance but lets just say by good fortune things 16 apparently are covered. But your recommendation is 17 given the fact where therell be new activities, 18 better modeling of this and maybe better coordinated 19 analysis of it is necessary.
20 MR. CLIFFORD: Yes. We should spend the 21 time and complete what research is necessary to 22 validate future codes.
23 MEMBER REMPE: Well, I was part of the APWR 24 Subcommittee when this was mentioned and I really 25 think it was good to back it out of that and come and NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
200 1 do this in a generic fashion and have a better 2 perspective. And I appreciate your willingness to 3 participate and educate us on it.
4 Listening to whats being done in other 5 countries, I think it is a good place having a 6 research plan to bring up the need for better tools 7 perhaps, and to be anticipating what might happen in 8 the U.S. I think thats a really good forum for us to 9 provide comments, in my opinion.
10 I know that before this meeting started we 11 talked about some emerging other issues that theyre 12 seeing in France with corrosion on the rods, so 13 theres a lot of other benefits I think from the 14 international perspective, so I hope we get to learn 15 more about that, too.
16 MEMBER ARMIJO: Charlie.
17 MEMBER BROWN: Pass. I have nothing else.
18 MEMBER ARMIJO: Dr. Ballinger.
19 MEMBER BALLINGER: Well, its a very good 20 presentation. Id like to get the other presentations, 21 but I think we do need to be -- Im sort of heretic 22 when it comes to this stuff. I think its a 23 probabilistic problem. I think we have a problem with 24 fidelity of the models versus the fidelity of the 25 measurements that we can actually use on irradiated NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
201 1 rods. And its very expensive to do these as kind of 2 experiments, so we had to make a pretty good --
3 somehow strike a balance between spending a ton of 4 money looking at rods that have been ramped and things 5 like that, and what kind of -- how accurate the 6 information we get is compared to what we can actually 7 model. I mean, you could see some of the trends in the 8 data. Its not a black and white failure/no failure.
9 MEMBER ARMIJO: Theres various levels of 10 quality in that --
11 (Simultaneous speech.)
12 MEMBER BALLINGER: Increase in probability 13 of failure with certain types of -- and that sort of 14 lends -- that sort of screams to me that weve got 15 some uncontrolled variables. Either that, or variables 16 that we think we know that we dont, so -- but this 17 has been going on since like -- you know, the first 18 time Main Yankee had a massive amount of failures, 19 everybody went up the imaginary axis and wanted to 20 model fuel performance.
21 MEMBER ARMIJO: Well, I think more analysis 22 of the SCIP data, critical analysis, because some of 23 the data are not so good. In fact, I pointed out in 24 the White Paper a lot of testing was done on rods were 25 just cut out of full length PWR rods commercial stuff.
NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
202 1 Well, when you cut a rod out all the fission gases go 2 away, you mechanically change it, and we started to 3 see some differences in earlier failures with 4 refabricated rods. And thats the first time Id ever 5 seen that effect. I never liked that approach, but 6 theres different qualities of test data that are 7 suitable for validating your calibrating models.
8 MEMBER BALLINGER: We dont operate PWRs 9 like the transients that they run.
10 MEMBER ARMIJO: Well, thats clear.
11 MEMBER BALLINGER: Okay.
12 MEMBER ARMIJO: Anyway, Mike.
13 MEMBER RYAN: Nothing else, Sam. Thanks.
14 MEMBER ARMIJO: Dennis.
15 MEMBER BLEY: I really appreciated this. I 16 learned a lot from this and, you know, one cant with 17 good conscience say dont follow the data. You know, 18 of course, we want to follow that. The modeling side 19 of it I kind of agree with Ron, Im not -- it would be 20 nice to have a good model for this, but thats a long-21 term research effort I think.
22 On the other hand, if were worried about 23 anticipated operational occurrences, weve got not 24 really envelope couple of the 3,000 years of operating 25 experience and we arent getting them. So, if theyre NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
203 1 working there in some unusual transients theyre 2 postulated accidents under the design. And there are 3 postulated accidents that do a hell of a lot worse 4 than this, so Im not in a panic here.
5 MEMBER BALLINGER: I think understanding 6 that what appears to be a sudden drop in failure 7 probability at 50,000 megawatts --
8 MEMBER BLEY: That would be pretty neat to 9 understand.
10 MEMBER BALLINGER: Thats a different story 11 there.
12 MEMBER BLEY: We might learn something from 13 that that would be very helpful. Yes.
14 MEMBER ARMIJO: Okay.
15 CHAIRMAN STETKAR: I dont have anything 16 more.
17 MEMBER ARMIJO: Harold.
18 MEMBER RAY: AP1000 advertises a low 19 cooling capability uniquely. Is there anything about 20 that that you want to comment on? Is this just some 21 expectation they have?
22 MR. CLIFFORD: In the latest version of the 23 DCD they did change out and they put in these gray 24 rods to support load following. Not my understanding 25 that the Staff has approved the load -- because it was NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
204 1 never a load -- there was never a envelope, a power 2 time envelope presented to the Staff that says this is 3 the type of load follow we want you to do. Is this 4 okay? They just -- all of the -- if you -- one of the 5 things the IAEA was concerned about is that all of the 6 advanced reactors are just making these blanket 7 statements. Were good for load follow, were good for 8 load follow. And some of them have physical changes, 9 but most dont.
10 MEMBER RAY: Well, Vogtle will find out one 11 of these days, I guess. Thats all I have.
12 MEMBER ARMIJO: Dr. Powers.
13 MEMBER POWERS: I was intrigued by your 14 discussion of changes in the way plants are operated 15 in response to moves toward wind and solar sources 16 that are forced upon the utilities. I didnt hear 17 anything that suggested there was a risk to the public 18 health and safety. It strikes me as thats an issue to 19 stay alert to as you indicate this becomes more 20 pandemic, and were spending resources to the point 21 that we do have to operate nuclear units in an 22 unfamiliar way.
23 MR. CLIFFORD: Its no longer load follow, 24 its supply follow.
25 MEMBER SCHULTZ: I agree with Dana. I NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
205 1 really appreciate both the presentation and I -- I see 2 that you -- and agree that youve drawn the right 3 conclusions from the evaluation that you have done. I 4 dont think its just fortunate that this is not a 5 problem for PWRs. Theres been a lot of thinking 6 thats gone into PCI as a result of whats happened at 7 BWR, and even the -- what was, in fact, a very small 8 issue associated with missing pellet surface. A lot of 9 thought went into what that meant in terms of overall 10 fuel performance for PWRs. And the problem was 11 resolved, but its an interesting problem to bring to 12 bear on this because very small deviation associated 13 with pellet surface caused fuel failure.
14 MR. CLIFFORD: Yes, and I would just like 15 to add something. I mean, this may have been more of 16 an issue with PWRS except theyve been very aggressive 17 to try to get ahead of the curve. And, for instance, 18 if you look at the manufacturing of the pellets they 19 chamfer and have dishes in the pellets which reduces 20 the amount of ridging, which reduces the local stress 21 concentrations at the pellet-pellet interface. You 22 dont see that in all BWRs, so the PWRs have design 23 features just in the pellet stamping phase.
24 MEMBER SCHULTZ: Which goes back to as Dick 25 was saying the experience that was gained in the 70s.
NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
206 1 MEMBER ARMIJO: Dick.
2 MEMBER SKILLMAN: Yes, sir. On page 52, 3 what it takes to actually drive the failure, the newer 4 reactor protection systems are so dependable, they are 5 so precise. The new instrumentation is so good itll 6 be a long time before we let a P go up into that range 7 without some preemptive action to bring the power back 8 whether its automatic rod insertion through an 9 integrated control system or a trip.
10 The second thing has just been mentioned.
11 Its on slides your 13, 14, and 15. I think there 12 ought to be some explanation of why that fuel did not 13 fail above 50 megawatts days per kilogram. I still 14 hold out that there may be fabrication of the pin, 15 fabrication of the pellet, or just that these are the 16 strongest soldiers that statistically were able to 17 survive. But theres something in that group that 18 seems to me to be compelling for more information.
19 Those blue circles, why did that fuel not fail when 20 the fuel that was exposed to lower burnups did?
21 MR. CLIFFORD: Ill take an action item to 22 talk to Research, and as part of the SCIP program to 23 really try to drive that home and find out whats 24 causing that. I cant imagine, you know, after years, 25 and years, and years of evaluating this they havent NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
207 1 identified that and questioned it. I just dont know 2 the answer.
3 MEMBER ARMIJO: Youll have a little bit of 4 a debate but theres lots of good explanations.
5 (Simultaneous speech.)
6 MEMBER SKILLMAN: Paul, great presentation.
7 Thank you.
8 MEMBER ARMIJO: Pete.
9 MEMBER RICCARDELLA: Yes, I, too, think it 10 was a great presentation. I appreciate it, and I agree 11 with your conclusion that in the current operating 12 mode of PWRs that its not a problem. I think we need 13 to try to better understand the French experience into 14 why they havent had failures in that load following 15 mode because I believe its coming. I think that, you 16 know, the nuclear plants are going to have to operate 17 in a more flexible load following mode or theyre not 18 going to operate, theyre going to shut down.
19 MEMBER ARMIJO: Sanjoy.
20 MEMBER BANERJEE: At last. Last but not 21 least, whatever. But its a great presentation. I was 22 puzzled by a lot of the data because youve got a lot 23 of red dots where there were blue dots, as well. And 24 whether this is just random sort of behavior because 25 small problems can lead to problems, or there was NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
208 1 something more deep in that in terms of some history 2 effect or whatever that lead to those red dots, or 3 most of them, where the blue ones were operated in 4 some other way. That would be interesting to 5 understand. Is there some cumulative effect which is 6 there? Thats just a question.
7 Also, I noticed that at the high burnups 8 you had a lot of these blue dots and very few red 9 dots, actually, so I dont know if that was just an 10 optical illusion, or it was for real, you know. And 11 then what that was due to. Maybe you explained it, but 12 I missed it.
13 MR. CLIFFORD: Maybe we have to look at it 14 some more, but just fundamentally its tougher to push 15 a high burnup fuel to higher kilowatts a foot.
16 MEMBER BANERJEE: Right. But you knew the 17 ramp rate there sort of, you see, so I was assuming 18 those are sort of like equivalent ramp rates or 19 whatever.
20 MR. CLIFFORD: I cant go back to it right 21 now.
22 MEMBER BANERJEE: No, no, but its -- you 23 dont have to -- but if you look at it, youll see 24 that many of the indicators are somewhat similar, at 25 least the indicators you were looking at. Maybe NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
209 1 theyre a little bit lower, but theyre not actually 2 materially lower, so its sort of interesting to 3 understand that.
4 And the third thing, I echo what Pete 5 said. You know, its interesting to try to understand 6 what the French have done and where their data falls 7 on those curves that you showed because we can plot it 8 and see. And they would be blue dots. Right? Because 9 theyre not getting failures. So that would be very 10 interesting to know where they come in that failure 11 data.
12 And, finally, I think we should try to 13 follow this as closely as possible because I agree 14 with Pete that we are going to go to load following.
15 I mean, if youre going to make money out of these 16 nukes probably in 10 years, yes, well be doing load 17 following. Because whatever you say the political 18 reality is theyre going to be renewables, and theyre 19 going to have to be found.
20 MEMBER BLEY: Sam, could I sneak in a last 21 thing? I forgot to ask. And when we look at all those 22 curves it seems kind of clear we arent looking for 23 the right parameter. Now, you guys have mostly talked, 24 you think its rate, you think its extent of power 25 increase and the time at power. Is it possible from NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
210 1 the data from those tests to plot these against some 2 combination of ramp rate and time at power to see if 3 -- if you get the right parameter we ought to see the 4 good ones here and the bad ones over here. And we 5 havent found the right parameter yet.
6 MEMBER RICCARDELLA: Has anyone tried to do 7 a statistical analysis, generate Y-able curves or some 8 kind of curves to see --
9 MEMBER BANERJEE: Thats more --
10 MEMBER ARMIJO: In that little White Paper 11 I turned out, the BWR one, thats exactly what we did 12 back in the 70s. And you have curves at 1 percent 13 probability, 50 percent probability failure, 99 14 percent. But that was BWR.
15 MEMBER BANERJEE: You had 800 data points?
16 MEMBER ARMIJO: We had a lot of data 17 points. And we were very consistent in how we 18 fabricated it, but was still probabilistic. It wasnt 19 -- it has to be.
20 MEMBER BLEY: Thats just the way material 21 failure is.
22 MEMBER ARMIJO: Yes, and see similar things 23 with this. You know, there was a lot of different sets 24 of data. When you have one big set of data all made 25 the same way its much easier to analyze. But Id like NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
211 1 to, first of all, I cant help but to point out that 2 that high burnup effect thing, its been also seen in 3 BWRs. And Ill tell you an experiment we did many 4 years ago as a remedy for PCI was to change the oxygen 5 to uranium ratio. We made fresh pellets with a very 6 high ODU, irradiate them in the reactor, then in ramp 7 testing they worked pretty damned well. They didnt 8 all survive but they were much better than the 9 standard, so it has something to do with chemistry. We 10 never really could understand it. It had negatives for 11 manufacturing and thermal connectivity, had all sorts 12 of other problems, so theres lot of ponies out there, 13 and there may be better explanations on that, but the 14 trouble is you dont have those properties at 20,000 15 megawatts per ton in 30, you have to -- thats where 16 the power -- you have ability to get to high power, if 17 at all.
18 But Id like to, first of all -- first, I 19 was laboring under burden that we -- at some point 20 wed have to rely on an operator putting off one of 21 these very fast PCI events, and what Ive learned here 22 is that you really are -- that youre really covered 23 by the reactor protection systems. Theyre fast enough 24 and theyre covering all of them, and if the worst one 25 is that one that lasts what, what was it, six minutes, NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
212 1 or three --
2 MR. CLIFFORD: It was three minutes.
3 MEMBER ARMIJO: Three minutes, something 4 like that, and if thats the worst one and you have an 5 RP thats protecting you and youre not relying on 6 operator action, Im very, very happy.
7 The other thing that I felt was -- that 8 the Staff was taking comfort with the 1 percent PCMI 9 SAFDL. And, obviously, thats not what -- that 10 wouldnt protect you because if that was the only 11 thing was protecting you, you would have a lot of 12 failures because the system -- if the system wasnt 13 tripping or protecting you. So, anyway, that -- but 14 all in all I think a lot of progress has been made, 15 and a good presentation. Theres a -- I think the 16 Staff would benefit by really getting FRAPCON up to 17 better capabilities in this area of analyzing the fuel 18 and the pellet for these kind of things, whether its 19 a load following problem or something else that comes 20 up. I think the code is capable, but its going to 21 take some effort. Theres no crisis, but to improve 22 it.
23 MR. CLIFFORD: I mean, this is an area 24 where you guys need to help us to do that, too, 25 because you review the research plan.
NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
213 1 MEMBER ARMIJO: Yes. Well, thats very 2 timely.
3 MEMBER BALLINGER: Does FRAPTRAN have 4 anything -- what about FRAPTRAN? Doesnt that do 5 strain calculations?
6 MR. CLIFFORD: Yes, we -- let me see if I 7 remember this. Maybe, Harold, you remember. I remember 8 they used both FRAPTRAN and FRAPCON to evaluate the 9 subject ramp tests and I dont remember off the top of 10 my head why they felt that FRAPCON did a better job.
11 MEMBER BALLINGER: Because FRAPTRAN, they 12 were using that for the reactivity insertion stuff.
13 Right?
14 MR. CLIFFORD: Right, right.
15 MEMBER CORRADINI: What are they using for 16 --
17 MEMBER BALLINGER: FRAPTRAN. Transient 18 means transient.
19 MEMBER CORRADINI: But can I turn this 20 around since you brought up research. So, are you 21 telling me that theres no user need for an improved 22 FRAPCON?
23 MR. CLIFFORD: Every year --
24 MEMBER CORRADINI: Put you on the spot a 25 bit.
NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
214 1 MR. CLIFFORD: Office of Research -- well, 2 Ill let the Office of Research --
3 MR. SCOTT: This is Harold Scott from 4 Research. Patrick does have a plan for FRAPCON and 5 FRAPTRAN for the next few years, but right now theres 6 not a particular PCI effort in there. But let me bring 7 up another point that hadnt come up yet. This CASL 8 program that Department of Energy is sponsoring, a 9 consortium for advanced simulation light water 10 reactors, they have a big effort on PCI modeling. And 11 theyre going to probably spend $5 million, and 12 Patrick might spend $500,000, so -- and they have a 13 schedule for 14 asymmetric worldwide stress 14 calculations, local stress calculations, integrated 15 methodology by the end of this calendar year, so I 16 would suggest to Patrick that we wait and see what 17 happens in the DOE CASL program and then move forward 18 with something with FRAPCON. Well also have another 19 -- the SCIP-3 program is going to do improv tests, 20 manual tests, slow ramp rates. Therell be workshops.
21 As mentioned, the French have these more sophisticated 22 3D codes, that may not be applicable since they run 23 for hours, but there might -- Im just saying I think 24 if we wait a little bit, enough other people are 25 moving ahead rather quickly that we can piggyback off NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
215 1 of their efforts and maybe not have to spend a lot of 2 our time doing the same things.
3 MEMBER CORRADINI: So, can I just make sure 4 I understand what youre saying? So, youre saying 5 because the -- just be real careful because whatever 6 they call the animal that theyre using in CASL, I 7 think its Peregrine.
8 MR. SCOTT: Yes.
9 MEMBER CORRADINI: Right? The only 10 calculation Ive seen so far have been to 2D 11 asymmetric calculations. They have nothing to validate 12 it with as far as I can tell. They have integral tests 13 which youre using yourselves, so for all intents and 14 purposes theyre basically comparing Peregrine to 15 FRAPCON.
16 MR. SCOTT: Yes, thats what they started 17 with but eventually they could use the SCIP data and 18 PCI data itself that we have available thats been 19 mentioned.
20 MEMBER CORRADINI: So, let me just -- okay.
21 So, I agree with you there, but let me ask you a 22 different question. So, this is a question maybe you 23 guys dont want to answer it. So, is NRC going to 24 default and essentially use the DOE product as their 25 base tool?
NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
216 1 MR. SCOTT: Oh, Im not saying that.
2 MEMBER CORRADINI: Okay.
3 MR. SCOTT: Im saying --
4 MEMBER CORRADINI: Okay, so because -- what 5 I guess Im also asking is from the standpoint of a 6 user need, it strikes me that -- Im sure Sam is going 7 to show some version of a research report 8 recommendation that will say something like thou shalt 9 go forth and do good things in this area. But my only 10 thought is we have historically gotten the response 11 back that unless theres a user need from NRR thats 12 a potentially less than optimal way to do things. So, 13 I see Dr. Lee is up.
14 MR. LEE: Well, there are certain so called 15 infrastructure code that dont need to have the user 16 need from the other offices to do development or 17 maintaining. FRAP codes is one of it, MELCOR and the 18 TRACE code, for example, these are absolute we need to 19 have for the Agency, so we dont need to have the user 20 office keep writing us user need on specific things.
21 MEMBER BANERJEE: Could I ask a question?
22 Sorry, go ahead.
23 MEMBER POWERS: The fundamental trouble is 24 I suppose -- suppose you break fuels, so what?
25 MEMBER ARMIJO: Well, its your first NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
217 1 barrier, and were not supposed to break a lot of 2 fuel. Fundamentally, thats a poor way to run a 3 reactor. It never happens --
4 MEMBER POWERS: Thats kind of the 5 licensees business, if he wants to run crappy -- run 6 his reactor crappy, as he long as he doesnt threaten 7 the public health and safety, so what?
8 MEMBER ARMIJO: But, Dana, why do we spend 9 so much time on DNB?
10 MEMBER POWERS: Good question.
11 MEMBER ARMIJO: How much have we failed as 12 a result of DNB?
13 MEMBER CORRADINI: But thats different.
14 Thats the --
15 (Simultaneous speech.)
16 MEMBER CORRADINI: If you want to wait for 17 that answer, I can give you the answer.
18 MEMBER ARMIJO: I think the purpose of this 19 knowledge or these codes is to keep things from 20 happening that we can prevent, to spot where theres 21 a problem.
22 MEMBER POWERS: I mean, were getting into 23 the licensees -- how he wants to run his plant. He 24 can do it any way he wants to as long as it doesnt 25 threaten the public health and safety. I mean, youve NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
218 1 got to be able to tie this back in a fairly 2 transparent fashion to the mandate of the Agency 3 before you spend huge resources trying to -- I mean, 4 making a finite element three-dimension fuel response 5 code that covers the entire core strikes me as a 6 pretty ambitious undertaking.
7 MEMBER CORRADINI: But I wasnt -- I guess, 8 Dana, just to kind of join on Sams side on this one.
9 Im not saying that this is what the Agency should do, 10 but Im asking given the fact that I sense DOE is 11 supporting the industry which is going this way, 12 eventually NRC is going to have to have some tool to 13 say yes, we have done our evaluation model, whatever 14 the right word is, calculation. We agree or we dont 15 agree, and we have the database to do it. And my sense 16 of it is, at least with this one, unless Paul was 17 sending me the wrong path, it seems a bit muddled as 18 to if you started going down to -- if you started 19 ramping up and down the reactor and you start having 20 fuel failures, I dont think NRC is going to stand for 21 that, whether or not its dealing with the health and 22 safety or not. So, that then they will get involved, 23 and they will have to make some decision on if the 24 licensee is allowed to go on some percent change of 25 power per unit time. And its got to be some model NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
219 1 that you guys have to have confidence in. And I sense 2 that at least in this area you dont have confidence.
3 MR. CLIFFORD: Correct. But, I mean, we 4 havent done a load follow license amendment request, 5 but I would hope that one would include maneuvering 6 requirements or restrictions, and that we would 7 approve those.
8 MEMBER BALLINGER: But dont current fuel 9 have warranty -- there are warranty limits?
10 MEMBER ARMIJO: Those are commercial.
11 MEMBER BANERJEE: Can I ask about CASL?
12 Because it is DOE --
13 MEMBER ARMIJO: Who is doing CASL?
14 (Simultaneous speech.)
15 MEMBER BANERJEE: Can I ask you about CASL?
16 Is the information generated in CASL available to NRC, 17 because by and large it is proprietary. You know, we 18 have to sign NDAs and all sorts of things.
19 MEMBER BALLINGER: Theres a lot of 20 universities involved.
21 MEMBER BANERJEE: But not all have signed 22 NDAs. And who is doing this? Is it Westinghouse?
23 (Simultaneous speech.)
24 MEMBER POWERS: -- and their advisory 25 board.
NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
220 1 MEMBER BANERJEE: Who is doing it, and is 2 it available? Can you answer that?
3 MEMBER POWERS: Who is doing it?
4 MEMBER BANERJEE: Like who in the CASL 5 group? Is it Westinghouse doing the modeling?
6 MEMBER POWERS: Westinghouse, GE, AREVA all 7 have representatives on their applications board. The 8 center of it is at Oak Ridge. Lets see. University of 9 North Carolina, or North Carolina State.
10 MEMBER CORRADINI: But I think his question 11 is for Peregrine that is very limited distribution 12 because there specific proprietary correlations that 13 are horn swaggled, or that are fit into it that EPRI 14 controls, as far as I understand. The base tool which 15 is the -- as Dana was saying, is the finite element 16 tool which has a different name. I cant remember what 17 that name is. It is essentially open literature 18 correlations that FRAPCON uses and others use. But the 19 one that theyre using for their calculations for any 20 customer, such as Westinghouse, has proprietary 21 correlations in it for a lot of these details.
22 MEMBER BANERJEE: So --
23 MEMBER CORRADINI: Fission gas --
24 MEMBER BANERJEE: But what youre saying --
25 well, we should have the Staff answer this, but what NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
221 1 youre saying is really that its partly available the 2 developments on the CASL.
3 MEMBER CORRADINI: Yes, on the last review 4 Steve Bajorek was the NRC representative at the 5 review.
6 MEMBER BANERJEE: They have access to some 7 of this.
8 MR. CLIFFORD: There was a presentation 9 last week on the status of CASL, and theres two days 10 worth of slide presentations that are in ADAMS right 11 now.
12 MR. JACKSON: Right. I was at the briefing.
13 It was led by Steve Bajorek. DOE led the briefing to 14 us, but they had all the members. So, you know, at the 15 moment theyre focused on things that the industry is 16 concerned with, things that they can make a lot of 17 money on or save money, so CRUD. They want to have 18 very cool predictive tools on things that affect 19 operation, and PCI has a huge impact on their 20 finances, so this is one of the things theyre looking 21 at. Theres no regulatory submittal to us at this 22 point, not to say that there couldnt be in the 23 future, but theres nothing now. If they wanted to 24 push the envelope farther and operate the plants much 25 different, I guess hypothetically you could --
NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
222 1 MEMBER BANERJEE: So, could we do 2 confirmatory analysis? Just take their results?
3 MEMBER CORRADINI: This kind of goes back 4 my original question. I think now Ill take Danas 5 side, is that if we think FRAPCON is enough for the 6 regulatory agency, then theres got to be a set amount 7 of experimentation that both sides have got to be 8 pointed to and validate against so that were 9 comfortable with the tool that the Agency has versus 10 DOE or whoever EPRI is providing.
11 MEMBER BANERJEE: Yes, but I think if you 12 look at thermal hydraulics as an example, the industry 13 is pushing the boundaries because they want to get 14 closer to the limits. Right? Now, obviously, theyre 15 trying to do that. And we have to be able to at least 16 follow them. Right? I mean, they have more 17 sophisticated models already than TRACE, and theyre 18 putting that forward. And if we have no way to confirm 19 it, what do we do?
20 MEMBER BALLINGER: The CASL -- you can have 21 the mesh size of a nanometer in CASL and make great 3D 22 pictures which is exactly what they do, but you dont 23 have fidelity on the data for the ramp test.
24 MEMBER BANERJEE: But imagine 10 years, 5 25 years from now they come in with submissions which say NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
223 1 you know we can do this now, and our codes do it, and 2 we dont have a confirmatory tool.
3 MR. JACKSON: I think thats why Paul 4 recommended that we continue to improve the FRAP code, 5 that theres an opportunity for --
6 MEMBER BANERJEE: I mean, to me that 7 answers your question.
8 MEMBER ARMIJO: Mr. Chairman, sorry for --
9 CHAIRMAN STETKAR: No, thats fine. I was 10 going to give you two more minutes because my role 11 here is on average to keep everything average. I was 12 an hour under, Charlie was right on time. Youre an 13 hour1.50463e-4 days <br />0.00361 hours <br />2.149471e-5 weeks <br />4.9465e-6 months <br /> over, so I figured, you know, youve got two 14 minutes.
15 MEMBER ARMIJO: I think a lot of progress 16 has been made even though -- particularly in this 17 area, on the PWRs, so, Im much more relaxed about 18 this thing than I used to be. I dont think youre 19 going to have a PWR AOO that gets you up to the high 20 powers for enough length of time, assuming that these 21 trip systems actually work, that you have to ever 22 worry about some operator having to say oops, or 23 failing a lot of fuel. And unlike Dana, I have an 24 aversion to failing a lot of fuel in a transient. Its 25 a licensees problem and the fuel suppliers problem NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
224 1 if they fail a lot of fuel during normal operation, 2 thats the big commercial mess. But in a transient I 3 think its a regulatory issue. So, anyway, Paul, good 4 presentation. Thanks to the Staff for doing a lot of 5 work, appreciate it. And, Mr. Chairman, the meeting is 6 yours.
7 CHAIRMAN STETKAR: Thank you.
8 MEMBER ARMIJO: Right on schedule.
9 CHAIRMAN STETKAR: Fine. We will take a 10 break and we are going to be off the record when we 11 return. Come back at 4:30, please, and we can talk 12 about the Research report.
13 (Whereupon, the proceedings went off the 14 record at 4:13 p.m.)
15 16 17 18 19 20 21 22 23 24 25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 (202) 234-4433
LUMINANT GENERATION COMPANY Comanche Peak Nuclear Power Plant, Units 3 and 4 612th ACRS Meeting FSAR Chapters 3 (less 3.7, 3.8), 9, and 14 March 6, 2014
Agenda Introduction Topics of Discussion with ACRS Subcommittee Chapter 3 (less 3.7 and 3.8)
Chapter 9 Chapter 14 1
Introduction COLA uses Incorporated by Reference methodology FSAR Chapters 3, 9, and 14 take no departures from US-APWR DCD No contentions pending before ASLB All confirmatory items were incorporated in FSAR Rev 4 (Nov 2013)
Luminant has responded to all Open Items No outstanding issues identified in SERs 2
Topics of Discussion with ACRS Subcommittee Chapter 3 Military air crash probability Turbine missile probability calculation Chapter 9 Wet bulb temperature; calcs for UHS evaporative losses Duct heaters in electrical HVAC equipment rooms Sharing Fire Brigade between Units 3 and 4 Incident Commander Fire Brigade Leader Flooding in the ESW Pipe Tunnel 3
Topics of Discussion with Subcommittee (contd)
Chapter 14 4
Acronyms ASLB Atomic Safety and Licensing Board COLA Combined License Application DCD Design Control Document FSAR Final Safety Analysis Report HVAC Heating, air conditioning, and ventilation SER Safety Evaluation Report UHS Ultimate heat sink US-APWR United States Advanced Pressurized Water Reactor 5
US-APWR Design Certification Application Chapter 3 (except 3.7 and 3.8) and Chapter 14 (except 14.3.2 and 14.3.9)
ACRS Full Committee Presentation March 6, 2014 Mitsubishi Heavy Industries, Ltd.
UAP-HF-14014-0 ACRS Full Committee Meeting, March 6, 2014
Presenters Ryan Sprengel DCD Licensing Manager Masatoshi Nagai DCD Licensing Engineer, Ch 3 Rebecca Steinman DCD Licensing Engineer, Ch 14 UAP-HF-14014-1 ACRS Full Committee Meeting, March 6, 2014
Introduction Previous ACRS Full Committee meetings September 9, 2011 - Chapters covered: 2, 5, 8, 10, 11, 12, 13, 16 September 6, 2012 - Chapter 9 covered April 11, 2013 - Chapters 4, 15, 17, 19; Topical Reports supporting Chapters 4 and 15, respectively December 5, 2013 - Chapters 6 and 7; Topical Reports supporting Chapters 6 and 7, respectively Significant upcoming submittals Chapter Status Reports 3/31/2014 Adjustment of ongoing US-APWR DC Activities Letter (UAP-HF-13256) submitted to NRC 11/5/2013 Coordinated slowdown of DCD Licensing Activities, while maintaining a commitment to US-APWR UAP-HF-14014-2 ACRS Full Committee Meeting, March 6, 2014
Chapter 3 - Design of Structures, Systems, Components, and Equipment ACRS Subcommittee meeting held November 20 and 21, 2013 All sections except 3.7 and 3.8 presented Remaining Review Areas Areas that require further review and interactions include:
- 3.9.2 - Dynamic Testing and Analysis of Systems, Components, and Equipment
- 3.9.4 - Control Rod Drive Systems
- 3.10 - Seismic and Dynamic Qualification of Mechanical and Electrical Equipment
- 3.11 - Environmental Qualification NRC audit of Design and Procurement Specifications conducted February 2014 Written responses to ACRS SC questions to be submitted, March 2014 UAP-HF-14014-3 ACRS Full Committee Meeting, March 6, 2014
Chapter 14 - Verification Programs ACRS Subcommittee meeting held March 4, 2014 All sections except 14.3.2 and 14.3.9 presented Remaining Review Areas MHI response to RAI 1076-7368 Q 07-09-27 (follow-up to RAI 992-6999 Q 07.09-26) was submitted on February 25, 2014 to address the only SE Open Item No additional Ch 14 RAIs requiring MHI response Written responses to ACRS SC questions to be submitted, March 2014 UAP-HF-14014-4 ACRS Full Committee Meeting, March 6, 2014
Presentation to the ACRS Full Committee - 612th Meeting Comanche Peak Nuclear Power Plant, Units 3 and 4 COL Application Review Safety Evaluation Report with Open Items Chapter 3: Design of Structures, Systems, Components, and Equipment Chapter 9: Auxiliary Systems Chapter 14: Verification Programs Perry Buckberg US-APWR Design Certification Lead Project Manager March 6, 2014
CPNPP COLA Review Schedule COMPLETION DATE Phase 1 - Preliminary Safety Evaluation Report 10/09/2009 (SER)
Phase 2 - SER with Open Items TBD Phase 3 - ACRS Review of SER with OIs TBD Phase 4 - Advanced SER with No OIs TBD Phase 5 - ACRS Review Adv. SER with No OIs TBD Phase 6 - Final SER with No OIs TBD Rulemaking TBD March 6, 2014 Chapters 3, 9, 14 2
Summary of the CPNPP COLA Safety Evaluation Reports
- The staff has issued Safety Evaluation Reports (SERs) with Open Items for Chapters 2, 3 (partial), 4, 5, 6, 7, 8, 9, 10, 11 ,12 13, 14, 15, 16, 17 and 19 (partial).
- Of the issued chapters, by CoB today all will have been presented to the ACRS Full Committee.
March 6, 2014 Chapters 3, 9, 14 3
CPNPP Chapter 3 Design of Structures, Systems, Components and Equipment
- The following Chapter 3 Open Items were discussed during the November 2013 SC Meeting:
RAI 244-6222, Question 03.09.06-21: Audit of a sample of applicable design and procurement specifications for functional design, qualification, and inservice testing programs
- Status: Open - Audit conducted February of 2014, will remain open pending the issuance of the audit report RAI 239-6159, Question 03.11-18: Audit of a sample of applicable design and procurement specifications for the environmental qualification of mechanical equipment..
- Status: Open - Audit conducted February of 2014, will remain open pending the issuance of the audit report RAI 239-6159, Question 03.11-19: COL environment qualification operational program review is dependent on the completion of the review of MHIs MUAP-08015, US-APWR Equipment Environmental Qualification Program
- Status: Open - Review after shutdown March 6, 2014 Chapters 3, 9 & 14 4
CPNPP Chapter 9 Auxiliary Systems
- The SE for Chapter 9 addresses:
Fuel storage and handling Water systems Process auxiliaries HVAC Other auxiliary systems.
- The following Chapter 9 Open Item was discussed during the November 2013 SC Meeting Open Item 09.02.05-01: The governing heat load for UHS basin cooling capacity.
Status: Now a CI March 6, 2014 Chapters 3, 9, 14 5
CPNPP Chapter 14 Verification Programs
- The SE for Chapter 14 addresses:
Specific Information to Be Included in Preliminary/Final Safety Analysis Reports Initial Plant Test Program ITAAC
- There were no technical Open Items discussed during the March 4, 2014 SC Meeting March 6, 2014 Chapters 3, 9, 14 6
Presentation to the ACRS Full Committee - 612th Meeting United States - Advanced Pressurized Water Reactor (US-APWR)
Design Certification Safety Evaluation Report with Open Items Chapter 3: Design of Structures, Systems, Components, and Equipment Chapter 14: Verification Programs Perry Buckberg US-APWR Design Certification Lead Project Manager March 6, 2014
US-APWR DC Review Schedule COMPLETION DATE Phase 1 - Preliminary Safety Evaluation Report June 2009 (SER)
Phase 2 - SER with Open Items TBD Phase 3 - ACRS Review of SER with OIs TBD Phase 4 - Advanced SER with No OIs TBD Phase 5 - ACRS Review Adv. SER with No OIs TBD Phase 6 - Final SER with No OIs TBD Rulemaking TBD March 6, 2014 Chapters 3 & 14 2
Summary of the US-APWR Safety Evaluation Reports
- The staff has issued Safety Evaluation Reports (SERs) with Open Items for Chapters 2, 3 (partial), 4, 5, 6, 7, 8, 9, 10, 11 ,12 13, 14, 15, 16, 17 and 19 (partial).
- Of the issued chapters, by CoB today all will have been presented to the ACRS Full Committee.
March 6, 2014 Chapters 3 & 14 3
US-APWR Chapter 3 Design of Structures, Systems, Components and Equipment
- The following Chapter 3 Open Items were discussed during the November 2013 SC Meeting RAI 1015-7054, Question 03.09.03-31: Design/procurement specification audit
- Status: Open - Audit conducted February of 2014, will remain open pending the issuance of the audit report RAI 841-6055, Question 03.04.01-29: Flooding analysis audit .
- Status: Resolved RAI 841-6055, Question 03.04.01-30: Changes to the building layout, flood barriers, and water-tight doors resulting from seismic design changes.
- Status: Resolved RAI 546-4345, Question 03.04.02-6: The use of 0.7 as the coefficient of friction at the soil-concrete interface.
- Status: Resolved RAI 782-5910, Question 14.03.07-58: MHI modified the ITAAC for turbine generator arrangement and turbine missile probability
- Status: Resolved RAI 758-5680, Question 03.05.03-10: Automobile missile on all seismic Category I structures not covered by RG 1.76.
- Status: Resolved RAI 1013-7031, Question 03.09.02-103: Postulated steam generator failure mechanisms associated with the San Onofre.
- Status: Open - Under review.
March 6, 2014 Chapters 3 & 14 4
US-APWR Chapter 3 Design of Structures, Systems, Components and Equipment
- Chapter 3 Open Items cont.
RAI 1013-7031, Question 03.09.02-104: Preliminary design of the steam generator tube bundle and the design criteria for the steam generator tubes and retainer bars against flow-induced excitations, including random turbulence, fluid elastic instability (out-of-plane and in-plane), and vortex shedding.
- Status: Open - Under review.
RAI 209-1803, Question 03.09.03-21: Seismic analysis changes.
- Status: Resolved RAI 107-1293, Question 03.09.04-1, Subquestions 1293-01, 1293-06, and 1293-07, and RAI 848-6093, Question 03.09.04-14: Margin between the calculated maximum control rod drive mechanism deflection and the design limit prior to seismic analysis changes.
- Status: Open - Review after slowdown RAI 288-2274, Question 03.09.06-1: Design/procurement specification audit
- Status: Open - Under Review
- RAI 486-3861, Question 03.10-17: Gas turbine generator system qualification and methods, criteria, and procedures. TeR MUAP-10023.
- Status: Open - Review after slowdown
- RAI 650-5093, Question 03.11-39: Addressing all environmental qual.n requirements in 10 CFR 50.49 and ASME QME-1-2007, App QR-B
- Status: Open - Review after slowdown March 6, 2014 Chapters 3 & 14 5
US-APWR Chapter 3 Design of Structures, Systems, Components and Equipment
- Chapter 3 Open Items cont.
- RAI 589-4536, Question 03.11-36: Calculational methods/results for total integrated dose to equipment in containment following a LOCA.
- Status: Open - Review after slowdown
- RAI 589-4536, Question 03.11-37: Calculational methods/results for the beta ray source term for equipment inside containment following a LOCA.
- Status: Open - Review after slowdown
- RAI 589-4536, Question 03.11-38: Inconsistencies in the operability times of post accident equipment inside containment.
- Status: Open - Review after slowdown
- Status: Open - Review after slowdown
- RAI 805-5915, Question 03.11-41 and RAI 880-6142, Question 03.11-43: MHI demonstrate US-APWR satisfying the environmental qual for electrical equipment (10 CFR 50.49) (1)
- Status: Open - Review after slowdown
- RAI 901-6257, Question 03.11-55: The ITAAC do not include demonstration of environmental qualification of nonmetallic parts of mechanical equipment.
- Status: Open - Review after slowdown (supplemental RAI response needs to be reviewed)
- RAI 804-5938, Question 03.12-26: The design loads for piping were updated and the seismic analysis methods of steam generator supports unclear.
- Status: Resolved March 6, 2014 Chapters 3 & 14 6
US-APWR Chapter 14 Verification Programs
- The SE for Chapter 14 addresses:
Specific Information to Be Included in Preliminary/Final Safety Analysis Reports Initial Plant Test Program ITAAC
- The following Chapter 14 Open Item was discussed during the March 4, 2014 SC Meeting RAI 1076-7368, Question 07.09-27 (Follow-up to RAI 992-6999, Question 07.09-26): Provide ITAAC to verify that the as-built protection and control systems are separate such that failure of any control system or component would not impact the performance of safety functions to satisfy the GDC 24 requirements. The Open Item applies to Section 14.3.5.
Status: Still and Open Item March 6, 2014 Chapters 3 & 14 7
Presentation to the ACRS Full Committee - 612th Meeting Comanche Peak Nuclear Power Plant, Units 3 and 4 COL Application Review Safety Evaluation Report with Open Items Chapter 3: Design of Structures, Systems, Components, and Equipment Chapter 9: Auxiliary Systems Chapter 14: Verification Programs Perry Buckberg US-APWR Design Certification Lead Project Manager March 6, 2014
CPNPP COLA Review Schedule COMPLETION DATE Phase 1 - Preliminary Safety Evaluation Report 10/09/2009 (SER)
Phase 2 - SER with Open Items TBD Phase 3 - ACRS Review of SER with OIs TBD Phase 4 - Advanced SER with No OIs TBD Phase 5 - ACRS Review Adv. SER with No OIs TBD Phase 6 - Final SER with No OIs TBD Rulemaking TBD March 6, 2014 Chapters 3, 9, 14 2
Summary of the CPNPP COLA Safety Evaluation Reports
- The staff has issued Safety Evaluation Reports (SERs) with Open Items for Chapters 2, 3 (partial), 4, 5, 6, 7, 8, 9, 10, 11 ,12 13, 14, 15, 16, 17 and 19 (partial).
- Of the issued chapters, by CoB today all will have been presented to the ACRS Full Committee.
March 6, 2014 Chapters 3, 9, 14 3
CPNPP Chapter 3 Design of Structures, Systems, Components and Equipment
- The following Chapter 3 Open Items were discussed during the November 2013 SC Meeting:
RAI 244-6222, Question 03.09.06-21: Audit of a sample of applicable design and procurement specifications for functional design, qualification, and inservice testing programs
- Status: Open - Audit conducted February of 2014, will remain open pending the issuance of the audit report RAI 239-6159, Question 03.11-18: Audit of a sample of applicable design and procurement specifications for the environmental qualification of mechanical equipment..
- Status: Open - Audit conducted February of 2014, will remain open pending the issuance of the audit report RAI 239-6159, Question 03.11-19: COL environment qualification operational program review is dependent on the completion of the review of MHIs MUAP-08015, US-APWR Equipment Environmental Qualification Program
- Status: Open - Review after shutdown March 6, 2014 Chapters 3, 9 & 14 4
CPNPP Chapter 9 Auxiliary Systems
- The SE for Chapter 9 addresses:
Fuel storage and handling Water systems Process auxiliaries HVAC Other auxiliary systems.
- The following Chapter 9 Open Item was discussed during the November 2013 SC Meeting Open Item 09.02.05-01: The governing heat load for UHS basin cooling capacity.
Status: Now a CI March 6, 2014 Chapters 3, 9, 14 5
CPNPP Chapter 14 Verification Programs
- The SE for Chapter 14 addresses:
Specific Information to Be Included in Preliminary/Final Safety Analysis Reports Initial Plant Test Program ITAAC
- There were no technical Open Items discussed during the March 4, 2014 SC Meeting March 6, 2014 Chapters 3, 9, 14 6
Presentation to the ACRS Full Committee - 612th Meeting United States - Advanced Pressurized Water Reactor (US-APWR)
Design Certification Safety Evaluation Report with Open Items Chapter 3: Design of Structures, Systems, Components, and Equipment Chapter 14: Verification Programs Perry Buckberg US-APWR Design Certification Lead Project Manager March 6, 2014
US-APWR DC Review Schedule COMPLETION DATE Phase 1 - Preliminary Safety Evaluation Report June 2009 (SER)
Phase 2 - SER with Open Items TBD Phase 3 - ACRS Review of SER with OIs TBD Phase 4 - Advanced SER with No OIs TBD Phase 5 - ACRS Review Adv. SER with No OIs TBD Phase 6 - Final SER with No OIs TBD Rulemaking TBD March 6, 2014 Chapters 3 & 14 2
Summary of the US-APWR Safety Evaluation Reports
- The staff has issued Safety Evaluation Reports (SERs) with Open Items for Chapters 2, 3 (partial), 4, 5, 6, 7, 8, 9, 10, 11 ,12 13, 14, 15, 16, 17 and 19 (partial).
- Of the issued chapters, by CoB today all will have been presented to the ACRS Full Committee.
March 6, 2014 Chapters 3 & 14 3
US-APWR Chapter 3 Design of Structures, Systems, Components and Equipment
- The following Chapter 3 Open Items were discussed during the November 2013 SC Meeting RAI 1015-7054, Question 03.09.03-31: Design/procurement specification audit
- Status: Open - Audit conducted February of 2014, will remain open pending the issuance of the audit report RAI 841-6055, Question 03.04.01-29: Flooding analysis audit .
- Status: Resolved RAI 841-6055, Question 03.04.01-30: Changes to the building layout, flood barriers, and water-tight doors resulting from seismic design changes.
- Status: Resolved RAI 546-4345, Question 03.04.02-6: The use of 0.7 as the coefficient of friction at the soil-concrete interface.
- Status: Resolved RAI 782-5910, Question 14.03.07-58: MHI modified the ITAAC for turbine generator arrangement and turbine missile probability
- Status: Resolved RAI 758-5680, Question 03.05.03-10: Automobile missile on all seismic Category I structures not covered by RG 1.76.
- Status: Resolved RAI 1013-7031, Question 03.09.02-103: Postulated steam generator failure mechanisms associated with the San Onofre.
- Status: Open - Under review.
March 6, 2014 Chapters 3 & 14 4
US-APWR Chapter 3 Design of Structures, Systems, Components and Equipment
- Chapter 3 Open Items cont.
RAI 1013-7031, Question 03.09.02-104: Preliminary design of the steam generator tube bundle and the design criteria for the steam generator tubes and retainer bars against flow-induced excitations, including random turbulence, fluid elastic instability (out-of-plane and in-plane), and vortex shedding.
- Status: Open - Under review.
RAI 209-1803, Question 03.09.03-21: Seismic analysis changes.
- Status: Resolved RAI 107-1293, Question 03.09.04-1, Subquestions 1293-01, 1293-06, and 1293-07, and RAI 848-6093, Question 03.09.04-14: Margin between the calculated maximum control rod drive mechanism deflection and the design limit prior to seismic analysis changes .
- Status: Open - Review after slowdown RAI 288-2274, Question 03.09.06-1: Design/procurement specification audit
- Status: Open - Under Review
- RAI 486-3861, Question 03.10-17: Gas turbine generator system qualification and methods, criteria, and procedures. TeR MUAP-10023.
- Status: Open - Review after slowdown
- RAI 650-5093, Question 03.11-39: Addressing all environmental qual.n requirements in 10 CFR 50.49 and ASME QME-1-2007, App QR-B
- Status: Open - Review after slowdown March 6, 2014 Chapters 3 & 14 5
US-APWR Chapter 3 Design of Structures, Systems, Components and Equipment
- Chapter 3 Open Items cont.
- RAI 589-4536, Question 03.11-36: Calculational methods/results for total integrated dose to equipment in containment following a LOCA.
- Status: Open - Review after slowdown
- RAI 589-4536, Question 03.11-37: Calculational methods/results for the beta ray source term for equipment inside containment following a LOCA.
- Status: Open - Review after slowdown
- RAI 589-4536, Question 03.11-38: Inconsistencies in the operability times of post accident equipment inside containment.
- Status: Open - Review after slowdown
- Status: Open - Review after slowdown
- RAI 805-5915, Question 03.11-41 and RAI 880-6142, Question 03.11-43: MHI demonstrate US-APWR satisfying the environmental qual for electrical equipment (10 CFR 50.49) (1)
- Status: Open - Review after slowdown
- RAI 901-6257, Question 03.11-55: The ITAAC do not include demonstration of environmental qualification of nonmetallic parts of mechanical equipment.
- Status: Open - Review after slowdown (supplemental RAI response needs to be reviewed)
- RAI 804-5938, Question 03.12-26: The design loads for piping were updated and the seismic analysis methods of steam generator supports unclear.
- Status: Resolved March 6, 2014 Chapters 3 & 14 6
US-APWR Chapter 14 Verification Programs
- The SE for Chapter 14 addresses:
Specific Information to Be Included in Preliminary/Final Safety Analysis Reports Initial Plant Test Program ITAAC
- The following Chapter 14 Open Item was discussed during the March 4, 2014 SC Meeting RAI 1076-7368, Question 07.09-27 (Follow-up to RAI 992-6999, Question 07.09-26): Provide ITAAC to verify that the as-built protection and control systems are separate such that failure of any control system or component would not impact the performance of safety functions to satisfy the GDC 24 requirements. The Open Item applies to Section 14.3.5.
Status: Still and Open Item March 6, 2014 Chapters 3 & 14 7
Diablo Canyon Process Protection System LAR Presented by: NRR / EICB John Thorp Branch Chief EICB Rich Stattel Technical Reviewer EICB Rossnyev Alvarado EICB Samir Darbali EICB Thursday March 6, 2014 March 6, 2014 ACRS Diablo Canyon LAR 1
Presentation Outline / Agenda
- Introduction
- Platform Evaluation Background
- Tricon
- ALS
- Overview of Diablo Canyon License Amendment Request
- Safety Evaluation Topics
- Communication
- Diversity and Defense in Depth
- Secure Development and Operations Environment (SDOE)
- Deterministic Performance ACRS Diablo Canyon LAR Slide 2 March 6, 2014
Introduction Diablo Canyon PPS Replacement LAR
- Diablo Canyon License Amendment Request Submitted on October 26, 2011
- LAR is to replace the existing Eagle 21 Process Protection System with a new more modern digital system.
- The Diablo Canyon Digital Process Protection System (PPS) is based on both the Microprocessor based Invensys Tricon and the FPGA based Westinghouse ALS Platforms.
- The NRC accepted the LAR (January 13 2012) for review and documented several review areas which would require particular attention prior to approving the LAR. These are:
- Deterministic Performance of Software
- Equipment Qualification Testing Plans
- Software Planning Documentation
- Setpoint Methodologies ACRS Diablo Canyon LAR Slide 3 March 6, 2014
Process Protection System Overview ACRS Diablo Canyon LAR Slide 4 March 6, 2014
Overview of Diablo Canyon Application PPS System Architecture ACRS Diablo Canyon LAR Slide 5 March 6, 2014
ALS Platform - Physical Representation ACRS Diablo Canyon LAR Slide 6 March 6, 2014
ALS Platform - Block Diagram ACRS Diablo Canyon LAR Slide 7 March 6, 2014
ALS Platform - Scope
- The Approved ALS Platform
- Defines the architecture and internal communications approach upon which to build an I&C system
- Specifies seven boards
- Specifies all board functionality and functional allocation to programming (with the exception of the application-specific logic of the Core Logic Board, ALS-102)
- Uses diversity attributes to create two-design variants of each board
- Establishes the development process for the boards, their programming, and verification and validation
- Establishes qualification boundaries for the platform and design features to support implementation of safety functions for a plants application-specific system ACRS Diablo Canyon LAR Slide 8 March 6, 2014
Populated Tricon V10 Chassis ACRS Diablo Canyon LAR Slide March 6, 2014
TRICON V10 Block Diagram ACRS Diablo Canyon LAR Slide 10 March 6, 2014
TRICON Platform - Scope
- The Approved Tricon V10 Platform
- Reviewed against the SRP with emphasis on areas of change
- New MP3008 main processor and TCM communications module
- Establishes guidance on communications and compliance with ISG 4
- Establishes the development process for the boards, their programming, and verification and validation
- Establishes qualification boundaries for the platform and design features to support implementation of safety functions for a plants application-specific system ACRS Diablo Canyon LAR Slide 11 March 6, 2014
Overview of Diablo Canyon Application PPS System Architecture Sensors Sensors Sensors Sensors PS-I PS-II PS-III PS-IV Eagle 21 Eagle 21 Eagle 21 Eagle 21 Process Protection System MWS Operator MWS Operator MWS Operator MWS Operator Interface Interface Interface Interface Solid State Protection System (SSPS) (VOTING FUNCTIONS)
Reactor Trip Breakers ESF Components ACRS Diablo Canyon LAR Slide 12 March 6, 2014
Overview of Diablo Canyon Application PPS System Architecture Sensors Sensors Sensors Sensors AMSAC and other NSR Isolators Isolators Isolators Isolators Systems PS-I PS-II PS-III PS-IV Tricon KV Tricon KV KV Tricon KV Tricon M M M M Process Protection System MWS MWS MWS MWS ALS ALS ALS ALS MWS MWS MWS MWS MWS Operator Interface MWS Operator Interface MWS Operator Interface MWS Operator Interface Solid State Protection System (SSPS) (VOTING FUNCTIONS)
Reactor Trip Breakers ESF Components ACRS Diablo Canyon LAR Slide 13 March 6, 2014
Overview of Diablo Canyon Application Current PPS System Functions PPS Inputs PPS Functions PPS Processes Neutron Flux Reactor Trip (P-4)
Eagle 21 RCS Temperature Safety Injection Actuation Digital Process Plant Protection Function Turbine Trip FW Isolation (P-14)
Pressurizer Level Processes 2 of 3 Per SG Containment Spray 2 of 4 Reactor Coolant Flow Containment Isolation A 2 of 4 PZR Pressure Containment Isolation B 2 of 4 Steam Generator Level Containment Pressure Containment Vent Isolation Steam Line Pressure Main Steam Isolation 2 of 4 Main Feedwater Isolation 2 of 3 Aux Feedwater Initiation 2 of 3 ACRS Diablo Canyon LAR Slide 14 March 6, 2014
Overview of Diablo Canyon Application New PPS System Functions PPS Inputs PPS Processes PPS Functions Neutron Flux Reactor Trip (P-4)
Tricon Safety Function RCS Temperature Safety Injection Actuation Process Pressurizer Level Turbine Trip FW Isolation (P-14) 2 of 3 Per SG Containment Spray 2 of 4 Reactor Coolant Flow PZR Pressure ALS Safety Function Containment Isolation A 2 of 4 Process Containment Isolation B 2 of 4 Steam Generator Level Containment Pressure Containment Vent Isolation Steam Line Pressure Main Steam Isolation 2 of 4 Main Feedwater Isolation 2 of 3 Aux Feedwater Initiation 2 of 3 ACRS Diablo Canyon LAR Slide 15 March 6, 2014
Overview of Diablo Canyon Application PPS System Tricon Function Allocation PPS Inputs PPS Processes PPS Functions Neutron Flux T Reactor Trip (P-4)
Tricon Safety Function RCS Temperature T AT Safety Injection Actuation Process Pressurizer Level T T Turbine Trip FW Isolation (P-14)
A Containment Spray Reactor Coolant Flow A PZR Pressure AT ALS Safety Function AT Containment Isolation A Process A Containment Isolation B Steam Generator Level T Containment Pressure A AT Containment Vent Isolation Steam Line Pressure T AT Main Steam Isolation AT Main Feedwater Isolation A Function Performed only by the ALS Subsystem T Aux Feedwater Initiation T Function Performed only by the Tricon Subsystem AT Function Performed by both Tricon and ALS Subsystems ACRS Diablo Canyon LAR Slide 16 March 6, 2014
Overview of Diablo Canyon Application PPS System ALS Function Allocation PPS Inputs PPS Processes PPS Functions Neutron Flux T Reactor Trip (P-4)
Tricon Safety RCS Temperature T AT Safety Injection Actuation Function Process Pressurizer Level T Turbine Trip FW Isolation (P-14)
- T A Containment Spray Reactor Coolant Flow A PZR Pressure AT ALS Safety Function AT Containment Isolation A Process A Containment Isolation B Steam Generator Level T Containment Pressure A AT Containment Vent Isolation Steam Line Pressure T AT Main Steam Isolation
- The TT-FWI function is the primary mitigating function for Excessive Heat Removal AT Main Feedwater Isolation Due to Feedwater system malfunction event. This safety function has a backup mitigating function Power Range High Flux Reactor Trip. This backup safety function does not rely on the PPS system ad will thus not be affected by a CCF of the PPS.
Secondary Pipe Rupture - Major Rupture of a Main Feedwater Pipe, Loss of Non- **
Emergency AC power to station auxiliaries, Loss of Normal Feedwater events. This safety function has backup mitigating functions of Pressurizer High Pressure reactor trip, Safety Injection and Reactor Trip on High Containment Pressure. Both of these backup mitigating safety functions do not rely upon the PPS and will thus not be affected by a CCF of the PPS.
ACRS Diablo Canyon LAR Slide 17 March 6, 2014
Communications ACRS Diablo Canyon LAR Slide 18 March 6, 2014
Communication Guidance
- Guidance for Communication
- IEEE 603, IEEE Standard Criteria for Safety Systems for Nuclear Power Generating Stations
- IEEE 7-4.3.2, Standard Criteria for Digital Computer in Safety Systems of Nuclear Power Generating Station
- DI&C-ISG-04, Highly Integrated Control Rooms-communication Issues ACRS Diablo Canyon LAR Slide 19 March 6, 2014
Overview of Diablo Canyon Application PPS System Architecture ACRS Diablo Canyon LAR Slide 20 March 6, 2014
Communications Architecture Plant Computer ACRS Diablo Canyon LAR Slide 21 March 6, 2014
Overview of Diablo Canyon PPS Application ALS Communication Architecture 1E PSIV Non-1E Tricon Analog Temperature Signals for OPDT and OTDT Safety Functions KVM ALS-A TAB MWS Disconnect ALS TxB2 TxB1 ALS-B RTD Inputs TAB MWS Disconnect Operator Interface TxB2 TxB1 Plant Computer System ACRS Diablo Canyon LAR Slide 22 March 6, 2014
Overview of Diablo Canyon PPS Application Tricon Communication Architecture PSIV 1E Non-1E Tricon KVM MWS Port Tap ALS MWS Operator Interface Primary RXM Plant Computer System Analog Temperature Signals for OPDT and OTDT Safety Functions ALS Remote RXM ACRS Diablo Canyon LAR Slide 23 March 6, 2014
Port Aggregator Tap MWS Tricon TCM Tricon Plant Computer System ACRS Diablo Canyon LAR Slide 24 March 6, 2014
Overview of Diablo Canyon PPS Application Tricon Input/Output Signals Remote RXM Chassis I/O Signals INPUT:
- OTDT / OPDT Interlock Manual Trip Switches
- Power Supply Failure Relays OUTPUT:
- Delta T Indicator
- Over Power Setpoint Indicator
- Over Temperature Setpoint Indicator
- T average Indicator
- OTDT and OPDT Interlock Signals
- Various System Alarms to Main Annunciator System (MAS)
ACRS Diablo Canyon LAR Slide 25 March 6, 2014
Diversity & Defense-In-Depth ACRS Diablo Canyon LAR Slide 26 March 6, 2014
Diversity and Defense in Depth (D3)
Guidance
- Guidance for Diversity Assessment
- SRM to SECY-93-087 Item II.Q Establishes NRC policy for Diversity and Defense in Depth
- NUREG/CR-6303 Method for Performing Diversity and Defense-in-Depth Analyses of Reactor Protection Systems
- Branch Technical Position (BTP) 7-19 Guidance for Evaluation of Diversity and Defense-in-Depth in Digital Computer-Based Instrumentation and Control Systems
- Interim Staff Guide (DI&C-ISG-02)
Diversity and Defense-in-Depth Issues ACRS Diablo Canyon LAR Slide 27 March 6, 2014
Diversity and Defense in Depth (D3)
Analysis Preformed by Licensee
- Diversity and Defense-In-Depth Analysis Performed
- Eagle 21 (1993)
Assumed CCF of PPS resulting in loss of all PPS safety functions
- Replacement PPS System (2011)
Assumed loss of all Functions performed by the Tricon Subsystem.
- Update to Previous Analysis Tables
- All plant Accidents and AOOs are included in the analysis
- Three Parameters identified for which there is no existing Automatic Diverse Backup function.
- Pressurizer Pressure
- Containment Pressure
- RCS Flow
- Describes ALS Diversity and postulates CCF of ALS. This CCF does not result in loss of ALS assigned Safety functions ACRS Diablo Canyon LAR Slide 28 March 6, 2014
Diversity and Defense in Depth Diablo Canyon Diversity Solution Embedded Diversity HTL Code A HTL Code B Synthesis Process Synthesis Process Core #1 Core #2 Core #1 Core #2 Directives Directives Directives Directives Core Logic Board A Core Logic Board B Core A1 Logic Core A2 Logic Core B1 Logic Core B2 Logic Core Diversity Core Diversity ACRS Diablo Canyon LAR Slide 29 March 6, 2014
Diversity and Defense in Depth Diablo Canyon Diversity Solution Protection Set 1 Protection Set 2 Protection Set 3 Protection Set 4 Core Core Core Core Core Core Core Core Logic A Logic B Logic A Logic B Logic A Logic B Logic A Logic B Manual Manual Manual Manual SSPS Coincidence Voting Safety Component Actuation
- OR function is accomplished by DO contacts in series for De-energize To Trip (DTT) or in parallel for Energize To Trip (ETT) function.
ACRS Diablo Canyon LAR Slide 30 March 6, 2014
Diversity and Defense in Depth Diablo Canyon Diversity Solution ACRS Diablo Canyon LAR Slide 31 March 6, 2014
Diversity and Defense in Depth Anticipated Transient Without Scram (ATWS)
Turbine Impulse Pressure Steam Generator Level Sensor Class I Class II AMSAC Input Processing Qualified Analog Isolation Devices AMSAC Function Processing Tricon Input Tricon Input Tricon Input Processing Processing Processing 1 2 3 Main Turbine Trip Auxiliary Feedwater Actuation PPS System Function Processing Steam Generator Blowdown Isolation ACRS Diablo Canyon LAR Slide 32 March 6, 2014
Diversity and Defense in Depth Anticipated Transient Without Scram (ATWS)
- Diverse Attributes
- Different architectures
- Different vendors
- Different microprocessors produced by different manufacturers
- Different Electrical Power source
- Initiation path is separate and independent from the PPS
- Shared Sensors are not digital devices and are not subject to the effects of a software CCF.
- Input signals are isolated using qualified isolation devices
- The AMSAC output actuation signals are transmitted through relays that provide isolation between the safety-related control circuits actuated by AMSAC and the non-safety related AMSAC system.
ACRS Diablo Canyon LAR Slide 33 March 6, 2014
Diversity and Defense in Depth Manual Operator Action
- The new Diablo Canyon Digital Process Protection System reduces reliance on Manual Operator Actions as a means of coping with a software CCF within the PPS.
- The modification does not however affect the ability of operators to perform manual actuations of safety functions.
- Manual Initiation signals are provided directly to the SSPS system which is not being modified.
- Previously credited MOAs will still be available to the operators.
- Existing component and division level actuation capability at the main control boards will be retained ACRS Diablo Canyon LAR Slide 34 March 6, 2014
Secure Development and Operational Environment ACRS Diablo Canyon LAR Slide 35 February 18, 2014
Secure Development and Operational Environment (SDOE)
- Guidance for SDOE
- RG 1.152, Rev. 3, Criteria for Use of Computers in Safety Systems of Nuclear Power Plants
- A secure development environment must be established to ensure unwanted, unneeded, and undocumented functionality is not introduced into a digital safety system
- A secure operational environment must be established to ensure predictable, non-malicious events will not degrade the reliable performance of the safety system ACRS Diablo Canyon LAR Slide 36 February 18, 2014
Secure Development Environment
- The secure development environments for the ALS and Tricon platforms were reviewed as part of their respective Topical Report reviews and were found to be acceptable
- These development environments include:
- Vulnerability assessments
- Physical and logical access control of the development infrastructure
- Control of portable media
- Configuration Management of documentation and source code files
- Code reviews to detect and prevent the use of unintended code or functions
- The licensee will not develop or modify the software ACRS Diablo Canyon LAR Slide 37 February 18, 2014
Secure Operational Environment (Control of Access)
- Once the PPS replacement project is completed and the PPS is in the Operations and Maintenance phases, software modifications to the Tricon and ALS platforms will be controlled by the PPS Replacement Software Configuration Management Plan
- Modifications to the PPS replacement components produced by the vendors will be performed by the vendors, not the licensee
- The PPS replacement system will be located in a plant vital area
- In the cable spreading room
- In the same cabinets that currently house the Eagle-21 PPS
- These cabinets are locked and the keys are administratively controlled by operations personnel
- Access to the MWSs is password protected ACRS Diablo Canyon LAR Slide 38 February 18, 2014
Deterministic Performance of PPS ACRS Diablo Canyon LAR Slide 39 March 6, 2014
PPS Deterministic Performance Characteristics
- Deterministic performance characteristics for each platform were evaluated and accepted by the NRC as part of the associated platform safety evaluation.
- Each SE considered the following system characteristics;
- Input and Output Signal Processing
- Data Transfer Methods / Techniques
- Software or Logic Implementation Structure
- System Diagnostic functions
- The NRC is also evaluating Application Specific Characteristics of the PPS such as;
- System loading
ALS Deterministic Performance Characteristics
- No Embedded Microprocessor Cores
- FPGA Design Does not use Interrupts
- Deterministic sequence of performing logic operations:
- 1. Acquire Inputs
- 2. Perform Logic Operations
Tricon Deterministic Performance Characteristics
- The Tricon application program (calculational cycle) cannot be interrupted by any of the lower priority tasks during the program execution cycle.
- Actual processing time is established during program development.
- Once application program development is complete, the cycle time does not vary as a function of calculational loading of the system.
ACRS Diablo Canyon LAR Slide 42 March 6, 2014
Tricon Deterministic Performance Characteristics Accident Analysis Time Response Specified PPS Response Time Allocation Program Scan Time Calculated Response Time Time ACRS Diablo Canyon LAR Slide 43 March 6, 2014
Summary ACRS Diablo Canyon LAR Slide 44 March 6, 2014
Backup Slides ACRS Diablo Canyon LAR Slide 45 March 6, 2014
Tricon Deterministic Performance Characteristics ACRS Diablo Canyon LAR Slide 47 March 6, 2014
Diversity and Defense in Depth Diablo Canyon Diversity Solution ACRS Diablo Canyon LAR Slide 48 March 6, 2014
PPS Deterministic Performance Characteristics Input Processing Tricon - Main Processor Module ALS - Core Logic Board (ALS-102)
Communications Output Tricon - TCM ALS - Comm. Logic Board Tricon - Com and IO Buses (ALS-601) ALS - RAB Bus (2)
ACRS Diablo Canyon LAR Slide 49 March 6, 2014
Diversity and Defense in Depth Diablo Canyon Diversity Solution ACRS Diablo Canyon LAR Slide 50 March 6, 2014
Overview of Diablo Canyon PPS Application PPS Communication Architecture PSIV 1E Non-1E KVM Tricon MWS Port Tap Tricon Analog Temperature Signals for OPDT and OTDT Safety Functions ALS TAB Disconnect MWS TxB2 ALS RTD Inputs TxB1 MWS Operator Interface Plant Computer System ACRS Diablo Canyon LAR Slide 52 March 6, 2014
Overview of Diablo Canyon PPS Application OPDT and OTDT Functions Thot RTDs Tcold RTDs Dual Element Well Mounted Reactor Power 4 wire 200 Ohm Platinum RTDs PZR Press.
Signal Processing ALS-A Signal Processing ALS-B ALS Reactor Coolant System Temperature Processing Thot Averaging Tcold Averaging Tavg Calculation Delta T Calculation Over Power Differential Temperature (OPDT) Setpoint Over Temperature Differential Temperature (OTDT) Setpoint TRICON Reactor Trip ACRS Diablo Canyon LAR Slide 53 March 6, 2014
Project Schedule ALS FAT July - August Phase 2 Document Submittal Tricon FAT X 4 June June, August, September, October Invensys Audit May EICB Draft SE October ALS Audit June ACRS Diablo Canyon LAR Slide 54 March 6, 2014
Diversity and Defense in Depth Diablo Canyon Diversity Solution Functional Requirements Specification (FRS)
Licensee / PG&E Vendor / Westinghouse System Requirements Specification (SRS)
System Design Specification FPGA Requirements (SDS) Specification Core A FPGA Core B FPGA Design Specification Design Specification HDL Code HDL Code For A Cores For B Cores Core Logic Core Logic Core Logic Core Logic A-1 A-2 B-1 B-2 Core Diversity Embedded Diversity Core Diversity ACRS Diablo Canyon LAR Slide 55 March 6, 2014
ETSX & IOC Scan Loops ACRS Diablo Canyon LAR Slide 56 March 6, 2014