L-03-016, Reply to Request for Additional Information Regarding Risk-Informed Inservice Inspection Program Relief Request

From kanterella
(Redirected from ML030550118)
Jump to navigation Jump to search
Reply to Request for Additional Information Regarding Risk-Informed Inservice Inspection Program Relief Request
ML030550118
Person / Time
Site: Beaver Valley
Issue date: 02/18/2003
From: Lash J
FirstEnergy Nuclear Operating Co
To:
Document Control Desk, Office of Nuclear Reactor Regulation
References
L-03-016
Download: ML030550118 (26)


Text

IENOC Beaver Valley Power Station Route 168 PO. Box 4 Shippingport, PA 15077-0004 FirstEnergy Nuclear OperatingCompany 724-682-7773 James H. Lash Plant GeneralManager February 18, 2003 L-03-016 U. S. Nuclear Regulatory Commission Attention: Document Control Desk Washington, DC 20555-0001

Subject:

Beaver Valley Power Station, Unit No. 1 and No. 2 BV-1 Docket No. 50-334, License No. DPR-66 BV-2 Docket No. 50-412, License No. NPF-73 Reply to Request for Additional Information Regarding Risk-Informed Inservice Inspection Program Relief Request On July 24, 2002, the FirstEnergy Nuclear Operating Company (FENOC) submitted a relief request to allow implementation of a Risk-Informed Inservice Inspection (ISI)

Program as an alternative to the current ASME Section XI requirements for piping at Beaver Valley Power Station (BVPS) Unit 1 and Unit 2. The NRC, following an initial review of this submittal, issued a Request for Additional Information (RAI) on December 30, 2002, regarding the FENOC relief request. Information in response to the RAI is enclosed.

On February 6, 2003, a second RAI was issued by the NRC. A response to this issue is currently under development and will be submitted under separate letter by March 7, 2003.

If there are any questions concerning this matter, please contact Mr. Larry R. Freeland, Manager, Regulatory Affairs/Performance Improvement at 724-682-5284.

Sincerely, Enclosures c: Mr. T. G. Colburn, NRR Senior Project Manager A

Mr. D. M. Kern, NRC Sr. Resident Inspector Mr. H. J. Miller, NRC Region I Administrator

Enclosure I Reply to Request for Additional Information Regarding Beaver Valley Power Station (BVPS) Units 1 and 2 Risk-Informed Inservice Inspection (RI-ISI) Program Relief Request The Request for Information provided the following items to be addressed:

A. UNITS I AND2

1. Section 3.8 of the licensee's submittal addressesadditionalexaminations. It states, "The evaluation will include whether other elements on the segment or segments are subject to the same root cause and degradation mechanism. Additional examinations will be performed on these elements up to a number equivalent to the number of elements initially requiredto be inspected on the segment or segments. If unacceptableflaws or relevant conditions are again found similar to the initialproblem, the remaining elements identified as susceptible will be examined. No additional examinations will be performed if there are no additionalelements identified as being susceptible to the same service relatedroot cause conditions or degradationmechanism."

ASME Code directs licensee's to perform these sample expansions in the current outage. Confirm that the sample expansions of elements identified as being susceptible to the same service relatedroot cause conditions or degradationmechanism will be completed during the outage that identified the flaws or relevant conditions.

Response

It is confirmed that sample expansions of elements identified as being susceptible to the same service related root cause conditions or degradation mechanism will be completed during the outage that identified the flaws or relevant conditions.

2. Will the risk-informedIS! program be updated every 10 years and submitted to the NRC consistent with the currentrequirementsof Section X! of the American Society of MechanicalEngineers Boiler and PressureVessel Code?

Response

The risk-informed ISI program will be updated periodically in accordance with industry guidance currently being developed by the Nuclear Energy Institute (NEI) RI-ISI Living Program.

Enclosure I (continued)

3. Under what condition will the risk-informed ISI program be resubmitted to the NRC before the end of any 10-year interval?

Response

Resubmittal of the risk-informed ISI program will be in accordance with industry guidance currently being developed by the NEI RI-ISI Living Program.

4. You state that the BVPS-1 relief request used the 6/98 version of the probabilisticrisk assessment (PRA) and the BVPS-2 relief request used the 10/97 version of the PRA. You describe an administrativeprocedure that requiresa staggered3-year update cycle and a continuous evaluationof potentialchanges that may require more frequent updates. Even given the time to perform the risk-informed ISI analysis, the staggered3-year update appearsinconsistentwith the age of the PRAs used. You also state that the current BVPS-1 and 2 models reflect the actual design, construction,and operationalpractices,and that an evaluation based on the Electric Power Research Institute probabilisticsafety assessment Applications Guide was performed to confirm that the PRA conforms to the industry state of the art with respect to completeness of coverage of potentialscenarios. Clarify which parts of the discussion contained in the June 2002 reliefrequest refer to the proceduresand reviews that were applied to the 6/98 and 10/97 version of the PRAs and which are applied to the "current"version.

Confirm that all of the PRA quality discussion are applicable to the PRAs used to develop the risk-informed ISI relief request. Otherwise describe the procedures and reviews applied to ensure that the 6/98 and the 10/97 PRAs used to support the reliefrequests adequately reflected the actual design, construction, and operationalpracticesat the time that the relief request evaluation was initiatedor during its development.

Response

With regards to the staggered 3-year update cycle, the BVPS Unit 2 PRA model update was initiated within this suggested frequency but was not completed at the time that the Risk-Informed Inservice Inspection Program (RI-ISI) was started, early December 2000.

Also at that time, the Unit 1 PRA model was still within the suggested 3-year update frequency. In April 2001, during the development of the RI-ISI, Unit 1 began its PRA model update process. Therefore, the PRA model review and update process was started within the 3-year cycle for each unit, although not completed due to extensive background document updating required in order to support the Westinghouse Owner's Group (WOG) PRA Peer Review, which was performed during July 2002. This extensive updating process took longer than expected at Unit 2, and consequently the Unit 1 PRA model update process was delayed due to an effort to complete the Unit 2 Enclosure I (continued)

PRA model documentation in time for the peer review. The Unit 1 PRA model update process was resumed after the completion of the WOG PRA Peer Review, as well as updating the Unit 2 PRA model again, to incorporate the significant findings from the WOG PRA Peer Review. The Unit 1 PRA model is currently undergoing a similar updating process as the Unit 2 model..

During the development of the RI-ISI process, a position paper was developed, justifying the adequacy of the 6/98 and 10/97 versions of the PRA models for performing risk-informed applications. The BVPS PRA models meet these requirements. The following are major key points from the attached technical position paper, dated December 6, 2001.

"* RI applications use a blended approach using both probabilistic and deterministic analysis. Therefore, the decisions being made tend to reflect a significant influence from non-PRA based information (e.g., traditional design analyses).

" The RI-ISI probabilistic approach does not use absolute risk importance values from the PRA models in determining safety significance, but rather uses a relative risk rankings (delta CDF or CCDP). This approach compares a sensitivity case with a baseline value. Therefore, as long as the structure of the system failures and CDF sequences do not change too much, the relativity of the rankings should remain fairly consistent between the model updates even if the CDF increases or decreases significantly.

" Most PRA model updates will not change significantly due to just plant modifications and new failure data.

" The significant changes to the PRA model are typically due to removing conservatisms of previous models or improved state-of-the art knowledge on PRA issues in which no data is available (e.g., RCP seal LOCAs or large break LOCA initiating event frequencies).

" Current RI applications at BVPS will be revisited after every PRA model update to determine if any previous conclusions or rankings have changed. This was performed in the past for both the Maintenance Rule risk significance SSC scoping and setting performance criteria, as well as, MOV and AOV risk rankings.

Based on this information, and the re-evaluation performed for the BVPS Unit 2 Maintenance Rule risk significance SSC scoping using the current PRA model (BV2REV3A) revised 1/31/02, it is expected that the updated models will not significantly impact the submitted Risk-Informed ISI results.

Included with this response (as Attachment 2) is the technical position paper, dated December 6, 2001, justifying the adequacy of the 6/98 and 10/97 versions of the PRA models for performing risk-informed applications.

Enclosure I (continued)

5. State when, and which version, of your PSA has been peer reviewed by the Westinghouse Owner's Group peer review process.

Response

The Westinghouse Owner's Group peer review team was at Beaver Valley during the week of July 15-19, 2002. The team reviewed the Unit 2 PRA model version 3 (BV2REV3A, dated January 31, 2002) in detail and reviewed the Unit 1 PRA model version 2 (BV1 REV2, dated June 30, 1998) by comparison with the Unit 2 model.

6. Your submittal describesan improved methodology for a weakness identifiedby the staff in your IndividualPlantExamination and concluded that, "[s]ystem unavailabilityresultingfrom human errors is therefore accountedfor in the current models." Was this improved methodology implemented in the 6/98 and 10/97 versions of the PRAs? If the methodology was not implemented in the 6/98 and 10/97 versions or otherwise incorporatedinto the evaluation used to support the relief request, incorporatethe improved methods into the results or provide an explanation as to why no impact on the results is expected.

Response

Yes, both BVPS Unit 1 and Unit 2 models have incorporated the improved methodology to address the human errors. In the 6/98 and 10/97 versions of the PRAs, the system unavailability due to human errors were tracked using the Maintenance Rule Program data and evaluated by the PRA models.

Enclosure I (continued)

7. Are there any piping segments that include piping of different diameters? If so, how were the failure frequencies estimated for these segments? For segments including piping of different diameters and where the Perdue method could be applied,how were the number of locations to be inspected determined? How does the methodology for determining the failure frequency comport with the methodology describedon page 71 of the Westinghouse Owners Group WCAP-14572, Revision 1-NP-A, "Westinghouse Owners Group Application of Risk-Informed Methods to PipingInservice Inspection Topical Report," (WCAP-14572), dated February1999? How does the methodology for determining the number of inspections comport with the methodology describedon pages 170, 171, and 174 of the WCAP?

Response

Multiple piping diameters were included in some of the piping segments. Failure consequences were the primary factor utilized to initially divide systems into piping segments. This method led to some individual piping segments consisting of piping with a variety of pipe diameters. For example: a four inch diameter pipe with a two inch diameter branch line may be part of the same piping segment if a failure at any portion of the segment would result in the same consequences. For multiple pipe size segments, sub-segments were defined by pipe size for the failure probability analysis.

Failure probability estimates were generated for the piping segments using the Westinghouse Structural Reliability And Risk Assessment Model (Win-SRRA). Some of the input parameters used by the Win-SRRA code vary if the diameter of the pipe varies (e.g., nominal pipe size, thickness to outer diameter ratio). Failure probability estimates for segments made up of multiple pipe sizes were determined by performing multiple Win-SRRA cases. In instances with multiple cases, resulting in multiple failure probability estimates, the highest failure probability associated with the segment was then used to represent the segment.

For each case the Win-SRRA code requires 18 input parameters associated with the piping. For segments with multiple pipe sizes, some of the input parameters varied from case to case even though they represented the same segment. Different pipe diameters required different inputs for a number of the parameters. Other inputs also occasionally varied based on expert engineering judgment. FENOC subject matter experts in ISI, NDE, materials, and pipe stress analysis worked together to develop the input parameters for each Win-SRRA code case run. Therefore, each case represented a sub-segment and was evaluated for the expected conditions for the sub-segment.

Following the WCAP methodology, the group developed limiting inputs for evaluation of each segment or sub-segment. Input parameters may have varied for separate portions of the same segment for one of two reasons. One reason was that many segments contained multiple weld geometries (both butt and socket welds). In these segments, specific geometries were reviewed and different parameters were input to accurately model the geometry. Basic design practice would also suggest using more limiting Enclosure I (continued) inputs for dead weight & thermal stress and design limiting stress for small bore (socket welded) piping where spacing tables were utilized in the routing design versus actual analysis results. In a few other cases, the input parameters for sub-segments varied slightly based on engineering judgment. For these cases the inputs were developed by plant subject matter experts and were based on observed and recorded conditions. The basis for each judgment is documented in the BVPS Win-SRRA engineering analyses.

Though the input parameters for different cases of the same segment may vary, the parameters that were chosen for each case were the most limiting for that section of the piping segment. The limiting failure probability estimates associated with each pipe size for each segment are based on the realistic limiting inputs associated with that section of piping. For segments with multiple line sizes, multiple failure probabilities were determined. In every case the most limiting (highest) failure probability associated with the segment was used to represent the segment.

As shown in Figure 3.5-1 and accompanying text in the approved WCAP (WCAP 14572, Rev. 1-NP-A, Feb. 1999), failure probability estimation is the responsibility of the engineering team based upon their knowledge of the pertinent information at their plant and any potential concerns identified in industry experience at other plants. For example, recently PWR plants have evaluated the increased potential for stress corrosion cracking at the reactor vessel outlet nozzle weld based upon the leak at the V. C. Summer plant. The SRRA tool is used to simply quantify the effects of the engineering team's input on the calculated leak and break probabilities. In fact, the second concern of the summary and conclusions (Section A.25 on page A-21) of the Nuclear Regulatory Commission (NRC) safety evaluation (SE) for the SRRA tool (supplement 1 to the approved WCAP) endorses this position via the following:

"The results of SRRA calculations should always be reviewed to ensure that they are reasonable and consistent with plant operating experience. Data from plant operation should be used to review and refine inputs to calculations."

Our methodology of taking the limiting SRRA probabilities from the sub-segments of different sizes in a segment comports with the NRC approved methodology. The fifth concern in the previously cited section of the NRC SE recommends doing it this way:

"The simplified nature of the SRRA code has resulted in a number of conservative assumptions and inputs being used in applications of the code. It is therefore recommended that sensitivity calculations be performed to ensure that excessive conservatism does not unrealistically impact the categorization and selection of piping locations to be inspected."

Our methodology on how the degradation mechanisms in the different sized sub segments are to be "combined" fully complies with the approved methodology as stated in the last paragraph of Section 3.2.3, Piping Failure Potential, of the NRC SER and in Section 3.2, Simplified and Detailed Input, in the WCAP Supplement for SRRA:

Enclosure I (continued)

"If more than one degradation mechanism is present in a given piping segment, then the limiting input values for each mechanism should be combined so that a limiting failure probability is calculated for risk ranking."

As indicated on page 84 in Section 3.5.6, Failure Probability Determination, of the approved WCAP, combining degradation mechanisms does not imply adding the failure probabilities for each mechanism. Typically, one degradation mechanism will dominate the failure probability in the segment by several orders of magnitude. However, because of uncertainties, the engineering team may not know which of the potential degradation mechanisms will dominate, especially if there are sub-segments of different nominal pipe size in the segment. Multiple nominal pipe sizes in a single segment arise due to the establishment of initial segment boundaries based on consequence considerations as detailed on page 57 of the approved WCAP. An appropriate tool must be used to determine the failure impact of the potential degradation mechanisms to determine the dominant mechanism for the segment. As noted the SRRA tool was used in the calculation of failure probability estimates at Beaver Valley. As detailed in the supplement to the WCAP, multiple factors must be considered in determining the piping failure including:

1. degradation mechanisms,
2. pre-Service construction and inspection history and practice,
3. physical routing and configuration.

Table 3.5-1 of the WCAP and 1-1 and 1-2 of the WCAP supplement provide guidelines for items to consider. In Section 3.5.4 the estimated failure probability is identified as being dependent on and significantly influenced by the following four items:

configuration, components, materials/chemistry and loads.

A degradation mechanism's affect may vary based on the different physical configurations of the weld or welds. Socket welds are particularly noted as having low resistance to sustained vibration. It is also noted in this section that interactions among the factors are common. Distinction is made in the discussion between component dependent failure modes, which are generally noted as localized within a segment and materials dependent or operational dependent mechanisms, which may be present throughout the entire segment. This directly supports the opening paragraphs of Section 3.5, which identify that:

"The failure probability of a segment is characterized by the failure potential (probability or frequency as appropriate) of the worst case situation in each segment (not a single selected weld in each segment)."

Consider the following two hypothetical examples based on typical situations and calculated probabilities experienced by plant engineering teams for SRRA input:

Enclosure I (continued)

Example 1: Significant Differences In Pipe Sizes and Potential Degradation Mechanisms In this example segment for high temperature and pressure piping, a 6-inch sub segment extends some distance from a check valve to a tee, where the flow is split into two three-inch sub-segments that each extend to a pump. Because of a concern for water hammer that has occurred in this system at other plants, a one inch sub-segment was added at the high-points (near each pump) of the 3-inch piping to periodically vent the system. If the check valve leaked, then the weld in the 6-inch sub-segment closest to the valve could experience thermal stratification.

Although there is no evidence that the check valve is leaking, it has happened in similar plants so a high fatigue stress range and number of cycles for stratification is selected by the team for the simplified SRRA input. Because of the geometric layout of the piping, a weld in the 3-inch portion would see the highest water-hammer loading, which the team estimated only had a 1% chance of occurring due to the corrective actions that had already been implemented. Another weld in the same size piping also had a pre-service inspection indication that was small enough that a repair was not required per the American Society of Mechanical Engineers (ASME) code. Because some imbalance of the pump was observed after the one-inch vent was installed, there is a concern for the potential effects of vibration in the three-inch pipe welds but especially in the 1-inch pipe socket welds nearest to the pumps. All the piping in the segment is subject to fatigue loading due to normal heat-up and cool-down and periodic pump testing. The consequence is loss of inventory and the system disabling leak rate has been conservatively assumed to be 2 GPM for all three pipe sizes in the segment.

The SRRA calculated large-leak probabilities after 40 years are as follows:

a) 3.3E-05 for the 6-inch pipe with thermal stratification, b) 1.5E-05 for the 3-inch pipe with one-flaw, vibration (input corrected for size by SRRA Program) and a 1% chance of a severe water hammer, c) 5.OE-04 for 1-inch pipe with vibration (correction factor of 1),

d) 4.OE-02 for 1-inch pipe with thermal stratification, one-flaw, vibration and a 1%

chance of a severe water hammer.

The SRRA probability of 5.OE-04 should be selected by the engineering team for risk ranking because the probability of option d) is unduly conservative relative to plant and industry experience. The SRRA input for option d) would also be completely unrealistic relative to assuming the same 6-inch stratification loading near the check valve in the 1-inch line far away from the valve and the worst 3-inch water hammer loading in a 1-inch branch line.

Example 2: Small Differences In Pipe Sizes and Potential Degradation Mechanisms In this example segment for moderate temperature and pressure, three different pipe sizes are also used (NPS of 1, 1.5 and 2 inch). All the piping in the segment is subject to fatigue loading due to normal heat-up and cool-down and relatively high seismic (SSE) loading for the design-limiting event. The consequence is loss of the Enclosure I (continued) system function and disabling leak rate has been conservatively assumed to be 10%

of the flow through the largest of the three pipe sizes in the segment.

The SRRA calculated large-leak probabilities after 40 years for this example are as follows:

a) 8.9E-05 for the 2-inch pipe with its fatigue and SSE loading, b) 1.2E-06 for the 1.5 inch pipe with its fatigue and SSE loading, c) 7.5E-07 for 1-inch pipe with its fatigue and SSE loading, d) 9.1 E-05 for the 2-inch pipe with the highest fatigue and highest SSE loading independent of pipe size.

The SRRA probability of 9.1E-05 could be selected by the engineering team for risk ranking because the probability of option d) is not overly conservative relative to plant and industry experience and the SRRA input would still be realistic relative to the uncertainties in the actual loading for the different pipe sizes (i.e., the difference between the SRRA calculated probability values of 8.9E-05 and 9.1E-05 is not statistically significant).

It is our position that assessing the unique input parameters based on the configuration, components, materials/chemistry, and loads by distinct quantification of all of the potential degradation in regards to localized and generalized degradation mechanisms in the entire segment fully comports with the safety evaluation requirement to:

"...ensure that excessive conservatism does not unrealistically impact the categorization and selection of piping locations to be inspected" The consistency in the items used in determining the critical location or locations for inspection is supported by the requirement in WCAP Section 3.7.3. This section identifies that the selection of inspection location be based on the postulated failure mechanisms and the loading conditions for the piping segment considering the same four items as in the determination of piping failure, namely: configuration, components, materials/chemistry and loads.

Furthermore the inspection is not limited to a single degradation mechanism but must consider all possible mechanisms contributing to the potential pipe failure for a given segment at the most likely location of occurrence.

It is therefore our conclusion that the process followed in sub-dividing consequence defined segments in addressing the previously identified four items fully supports the directive to apply all possible degradation mechanisms at a single weld and ensure that there is no excessive conservatism on the piping categorization or selection of inspection location.

The Perdue Model is used to aid in the determination of the number of inspection locations for segments determined to be high safety significant by the plant RI-ISI expert panel. Segments were divided into sub-segments (or lots) during the Perdue Model evaluation using the following cases:

Enclosure I (continued)

Case A: There is an identified active degradation mechanism and the segment is placed in Region 1 of WCAP-14572 Figure 3.7-1.

For this case, the piping in the segment is the same nominal diameter. One lot consists of the welds/locations susceptible to the degradation mechanism (Region 1A). Each susceptible location is included in the inspection program if it is not already part of an augmented inspection program. Welds/locations which are included in an augmented program remain in that program and are inspected in accordance with that program. The other lot consists of the rest of the welds in the segment (Region 1B). These are evaluated with the Perdue Model based on SRRA parameters which exclude the active degradation mechanism. The total number of inspections for the segment is the sum of the susceptible locations plus the number of inspections required to achieve a 95% confidence using the Perdue Model (a minimum of one location is specified even if the Perdue Model shows 100%

confidence with no ISI). This comports with the description of segments in Region 1 on page 168 of WCAP-14572.

Case B: There is no identified active degradation mechanism and the segment has been placed in Region 2 of WCAP-14572 Figure 3.7-1.

For this case, there are multiple pipe sizes in the segment. The Perdue Model inputs are specific to the pipe material and size. The first approach is to combine the most limiting inputs from each pipe size, use the total number of welds in the segment, and analyze the segment as one lot. Alternatively, if this analysis does not result in a 95% confidence level, then each pipe size is analyzed separately with the appropriate number of welds and the appropriate SRRA results. This divides the segment into lots according to pipe size. The confidence values of each lot are multiplied together to get the confidence for the segment. The resulting confidence level must be greater than or equal to 95% for the Perdue Model evaluation to be acceptable. The total number of inspections for the segment is the number of inspections required to achieve a 95% confidence using the Perdue Model. A minimum of one location is specified even if the Perdue Model shows 100%

confidence with no ISI. This comports with the description of segments in Region 2 on page 168 of WCAP-14572 and with the description of dividing a segment into multiple lots on pages 174 and 175.

Case C: There is an active degradation mechanism and the segment has been placed in Region 1 of WCAP-14572 Figure 3.7-1.

For this case, there are multiple pipe sizes in the segment. One lot consists of the welds/locations susceptible to the degradation mechanism (Region IA). Each susceptible location is included in the inspection program if it is not already part of an augmented inspection program. Welds/locations which are included in an augmented program remain in that program and are inspected in accordance with that program. For the Perdue Model evaluation of the non-susceptible welds/locations (Region 1B), the steps followed are the same as in item b above.

The first approach is to combine the most limiting inputs from each pipe size after Enclosure I (continued) removing the active degradation mechanism, use the total number of welds minus the number of susceptible welds, and analyze the segment as one lot. If this is too conservative, then each pipe size is analyzed separately with the appropriate number of welds and the appropriate SRRA results. The confidence values of each lot are multiplied together to get the confidence for the segment. The resulting confidence level must be greater than or equal to 95% for the Perdue Model evaluation to be acceptable. The total number of inspections for the segment is the sum of the susceptible locations plus the number of inspections required to achieve a 95% confidence using the Perdue Model (a minimum of one location is specified even if the Perdue Model shows 100% confidence with no ISI). This comports with the description of segments in Region 1 on page 168 of WCAP-14572 and with the description of dividing a segment into multiple lots on pages 174 and 175.

Individual Perdue Model inputs are specific to the pipe material and size. Therefore, segments with multiple sizes must be evaluated in one of the three ways discussed. In all three approaches, the method for evaluating segments with the Perdue Model fully complies with the approved methodology.

8. Aside from three segments discussedin Unit l's submittal,you state that all segments in Regions I and 2, as discussed on page 167 of WCAP-14572, were evaluated using the Perdue model. The Perduemodel is not applied to locations in Region 1A where 100 percent of the locationsshould be inspected. Explain this apparentdiscrepancy.

Response

Since the Perdue model is not applied to Region 1A segments, the submittals (page 19 of the BV1 submittal and page 18 of the BV2 submittal) should have been more specific by stating that all high safety significant (HSS) segments in Region 1B were evaluated using the Perdue model instead of all segments in Region 1.

Enclosure I (continued)

9. Attachment 3 to the submittal is the table, "Comparisonof BVPS-1 and BVPS-2 PostulatedConsequences by System." In some cases differences appearto be physical differences such as the first entry in the Steam GeneratorBlowdown System differences (page 1) stating, "Unit 2 has a 2" line connected to the SIG steam space, which was modeled as a steam line break." In other cases, the differences appearto be PRA modeling differences. Forexample, the first entry in the Steam GeneratorFeedwater System differences (page4) states, "Main FeedwaterLine Break is not modeled in the currentUnit I PRA model. It was treatedas part of the Total Loss of Main Feedwaterevents." In the second example, the total loss of main feedwater event(s) may not fully reflect all the spatialeffects associatedwith the break of the main feedwater piping evaluatedin the risk-informed ISI. Confirm that, a) The physical differences between the units are appropriatelyreflected in the PRA models used to develop the risk-informed IS! evaluation for each unit.

b) The PRA model differences that reflect the use of less detailed models or less developed modeling techniques for one of the units have been evaluated and found to have a negligible impact on the risk-informed ISI results or were incorporatedinto the risk-informed ISI evaluation as appropriate.

Response to 9.a:

Yes, the physical differences between the units have been appropriately evaluated during the PRA model development and update process, which is the reason why there is a separate PRA model for each unit. These physical differences have been evaluated separately during the development of the RI-ISI evaluation for each unit.

Response to 9.b:

Yes, the PRA modeling differences between the units have been evaluated and were incorporated into the risk-informed ISI evaluation appropriately.

The difference in Steam Generator Feedwater (FW/FWA) System treatment of Main Feedwater (MFW) Line Breaks is due to the physical differences between the Units.

The Unit 1 Auxiliary Feedwater (AFW) line ties into the Main Feedwater line outside containment before feeding to the steam generator, while the Unit 2 Auxiliary Feedwater line ties into the Main Feedwater line inside containment before feeding to the steam generator. This physical difference results in Main Feedwater line breaks upstream of the AFW tie-in not immediately leading to a containment isolation (CIA) for Unit 1, while it is possible that they may lead to a CIA at Unit 2 if the break occurs inside of the containment building. Since the plant response was assumed to be similar for both the MFW line break (upstream of the AFW tie-in) and a total loss of MFW at Unit 1, these initiating events were combined as a Total Loss of Main Feedwater (TLMFW). At Enclosure I (continued)

Unit 2, since a CIA signal could be generated during a MFW line break (upstream of the AFW tie-in) but is not expected for a total loss of MFW, the plant response may be different. Therefore, Unit 2 treats these two initiating events separately.

However, to be consistent with the Unit 2 initiators, standard industry PRA modeling techniques, and to comply with the recommendation from NUREG/CR-5750 "Rates of Initiating Events at U.S. Nuclear Powers Plants: 1987 - 1995", the updated Unit 1 version of the PRA model will also include both "Main Feedwater Line Break" and "Total Loss of Main Feedwater" initiating events. Regardless of the initiating events modeled, the risk-informed ISI evaluation failed all impacted systems due to the postulated break sizes and locations. For example, if a break occurred at the MFW/AFW tie-in, Unit 1 modeled the event as a guaranteed failure of both MFW and AFW, since there are no restriction orifices in the AFW lines, allowing most of the AFW flow to go out the break.

Whereas, at Unit 2, only the MFW and impacted AFW line was set to a guaranteed failure.

Enclosure I (continued)

B. UNIT I

10. How many weld locationsor otherpotentialinspection locations are there in segments QS-O01, and QS-002, respectively? To which system do these segments belong and what degradationmechanism are present in these segments? What is the rationalefor selecting one location in each segment?

Response

QS-001 has one proposed inspection location and QS-002 has one proposed inspection location. These segments belong to the Quench Spray System. This system and the Recirculation Spray System constitute the Containment Depressurization System.

Thermal fatigue was the only degradation mechanism identified for either segment. The High Safety Significance ranking was assigned by the Expert Panel based solely on deterministic insights due to the consequence of failure. These segments are currently part of the ISI program and constitute piping that has proven to be highly reliable as demonstrated by the lack of any indications to date. The rational for selecting only one inspection location for QS-001 and QS-002 was provided in the submittal on pages 5, 6, and 7. This rational is consistent with the statement on page 184 of the WCAP which identifies that "Other situations may exist that warrant considerations beyond the above guidance".

11. Will the one potentialinspection location in QS-042 be inspected as part of the risk-informedISI program? Explain why or why not.

Response

The one potential inspection location in QS-042 has been scheduled for examination due to the RI-ISI program categorization as a high safety significant (HSS) segment.

Enclosure I (continued)

12. On page 18 you state that all 9 segments in Region I were exposed, or are susceptible, to a failure mechanism. Yet on page 25, at least one segment in the Main Steam System is only in Region lB. Explain why there are no locations placed in Region IA (e.g., susceptible locations).

Response

On page 19, the submittal indicates that 9 segments are in Region 1. This region consists of Region 1A and lB. Region 1A requires that all welds be inspected. There are 8 segments in the Main Steam (MS) system which are in Region 1B as a result of a designation of High Failure Importance and High Safety Significance. This is consistent with the High Failure Importance requirements on page 166 of the WCAP. The WCAP states:

"a segment meeting this description typically has either an active failure mechanism that is known to exist, which may be currently monitored as part of an existing augmented program, or alternatively may be analyzed as being highly susceptible to a failure mechanism, that could lead to leakage or rupture."

The MS segments are all part of the Break Exclusion Zone and Flow Accelerated Corrosion Augmented inspection programs. All are currently examined with a projected detection accuracy of approximately 0.005 inches but have not had any indications during the life of the plant. Failure importance of all of the segments were determined to be less than 1.OE-4 per 40 year operating life and are therefore considered to have an essentially benign susceptibility to the projected thermal fatigue and flow accelerated corrosion degradation mechanisms. Therefore, consistent with the WCAP requirements the segments are placed in Region I B.

13. On page 24, at least one segment in the Chemical and Volume Control System is only in Region IA. Are 100% of the elements in this segment inspected (e.g., the VT-2 segments in footnote e)?

Response

Yes, the segment is CH-051, which contains two socket welds.

Enclosure I (continued)

14. In general,segments in Region I require at least two inspection locations, one in Region 1A and one in Region lB. Since 100% of susceptible locations (Region 1A) require inspections, more than two locations is normally expected. Segments in Region 2 require at least one inspection location.

Based on information in Section 3.8 of your submittal, this would indicatea minimum total number of inspections of 2X9 (Region 1) plus 109 (Region 2) or 127 locations. Table 5-1 indicatesa total of 124 inspection locations.

Explain this apparentdiscrepancy.

Response

The number of inspections calculated by the NRC for Region 1 is based on the assumption that there would be a minimum of two for each segment placed in Region 1.

This assumption is not accurate for the MS system as discussed in the response to RAI Item 12. The actual number of 124 represents the sum of the following:

Description No. of Required Examinations 91 Segments with 1 butt weld examination 91 25 Segments with 1 socket weld examination 25 1 Segment with 2 butt weld examinations 2 1 Segment with 2 socket weld examinations 2 4 Segments with 1 socket weld examination added 4 to meet change in risk requirements Enclosure 1 (continued)

C. UNIT 2

15. On page 17 you state that all 10 segments in Region 1 were exposed, or are susceptible, to a failure mechanism. Yet on page 24, at least one segment in the Main Steam System is only in Region lB. Explain why there are no locationsplaced in Region 1A (e.g., susceptible locations).

Response

On page 18, the submittal indicates that 10 segments are in Region 1. This region consists of Regions 1A and lB. Region 1A requires that all welds be inspected. There are 8 segments in the Main Steam System (MSS) which are in Region 1B as a result of a designation of High Failure Importance and High Safety Significance. This is consistent with the High Failure Importance requirements on page 166 of the WCAP.

The WCAP states, "a segment meeting this description typically has either an active failure mechanism that is known to exist, which may be currently monitored as part of an existing augmented program, or alternatively may be analyzed as being highly susceptible to a failure mechanism, that could lead to leakage or rupture".

The MSS segments are all part of the Break Exclusion Zone and Flow Accelerated Corrosion Augmented inspection programs. All are currently examined with a projected detection accuracy of approximately 0.005 inches but have not had any indications during the life of the plant to date. Failure importance of all of the segments were determined to be less than 1.OE-4 per 40 year operating life and are therefore considered to have an essentially benign susceptibility to the projected thermal fatigue and flow accelerated corrosion degradation mechanisms. Therefore consistent with the WCAP requirements the segments are placed in Region 1B.

Enclosure I (continued)

16. In general,segments in Region I require at least two inspection locations, one in Region 1A and one in Region lB. Since 100% of susceptible locations (Region 1A) require inspections,more than two locations is normally expected. Segments in Region 2 require at leastone inspection location.

Based on information in Section 3.8 of your submittal, this would indicatea minimum total number of inspections of 2X10 (Region 1) plus 97 (Region 2) or 117 locations. Table 5-1 indicates a total of 115 inspection locations.

Explain this apparentdiscrepancy.

Response

The number of inspections calculated by the NRC for Region 1 is based on the assumption that there would be a minimum of two for each segment placed in Region 1.

This assumption is not accurate for the MSS system as discussed in the response to RAI Item 15. The number provided on Table 5-1 of 115 is not accurate due to a double counting of socket welds. The total number of 88 NDE and 25 VT-2 examinations for a total number of 113 exams is represented by the following:

Description No. of Required Examinations 82 Segments with I butt weld examination 82 23 Segments with 1 socket weld examination 23 2 Segments with 3 butt weld examinations 6 2 Segments with 1 socket weld examination added 2 to meet change in risk requirements A revised Table 5-1 for BVPS Unit 2 is included as Attachment I to this submittal.

Enclosure I (continued)

Attachment I (BVPS Unit 2 Table 5-1)

Table 5-1 STRUCTURAL ELEMENT SELECTION (SES)

RESULTS AND COMPARISON TO ASME SECTION XI 1989 EDITION REQUIREMENTS High Safety Total RI-ISI1 Significant Weld Count ASME XI Segments ASME (Welds requiring Program (No. of HSS in Degradation Safety Code Volumetric (Vol) Examinations System Augmented Mechanism(s) Class Exam and Surface (Sur))

Program / Total Category No. of Aug. Number of No. of Segments Vol & Sur only Vol & Sur only SES Matrix Program Exam in Aug. Program) _ _Sur IS Sur Region Segments Locations BDG 0(0/24) FAC/TF Class 2 N/A 0 0 0 0 3 24c 0 CHS 33 (0/0) TF/VF, TF Class I B-J 4 369 3 57 2, 3, 4 0 0 C-F-i 343 315 26 27 1 0 19+14b Class 2 CI 0(0/0) FAC/TF, TF Class 2 N/A 0 0 0 0 4 0 0 DAS 0(0/0) TF Class 1 B-J 0 36 0 24 4 0 0 FWA 0 (0/57) FAC/lT Class 2 C-F-2 56 0 9 0 3 57c 0 GNS 0(0/0) TF Class 2 N/A 0 0 0 0 4 0 0 HCS 0(0/0) TF Class 2 N/A 0 0 0 0 4 0 0 Class 2 C-F-2 136 3 17 0 1B, 3 53c 8e MSS 8 (8/53) FAC/TF QSS 15 (0/0) TF, VF Class 2 C-F-1 200 0 16 0 1A, 1B, 2, 4 0 15 +4 SCC/TF, Class 1 B-F 18 0 18 0 2,4 0 26+ d RCS 26(0/0)

SCC/TF/VF/SS, Class 1 B-J 217 350 57 136 0 TF RHS 1(0/0) TF/SCC, TF Class 1 B-J 22 6 7 2 2,4 0 1 Class 2 C-F-1 283 0 23 0 0 0 RSS 0(0/0) TF Class 2 C-F-I 199 0 16 0 4 0 0 SIS 24(0/0) TF Class I B-J 222 157 43 14 2,4 0 0 Class 2 C-F-1 934 200 71 17 _ 0 19+5*

SSR 0(0/0) TF Class I N/A 0 0 0 0 4 0 0 Class 2 N/A 0 0 0 0 _ 0 0

-19

Enclosure I (continued)

Attachment I (BVPS Unit 2 Table 5-1)

Table 5-1 STRUCTURAL ELEMENT SELECTION (SES)

RESULTS AND COMPARISON TO ASME SECTION XI 9F.1DITTON REOTIIREMENTS 10R Total RI-ISIa High Safety Significant Weld Count ASME XI Segments ASME (Welds requiring Program (No. of HSS in Degradation Safety Code Volumetric (Vol) Examinations System Augmented Mechanism(s) Class Exam and Surface (Sur))

Program / Total Category No. of Aug. Number of No. of Segments Vol & Sur only Vol & Sur only SES Matrix Program Exam in Aug. Program) Sur Sur Region Segments Locations FAC/TF, TF, 0 27 NDE +

SCC/TF, Class 1 483 918 128 233 2 VIS TOTAL 107 (8 / 134) SCC/TF/VF TF/ VF, WH, VF 61 NDE+

Class 2 2151 518 181 44 23 VIS Total 2634 1436 309 277 88 NDE +

I I_ I 1 1 25 VIS Summary: Current ASME Section Xl selects a total of 586 welds while the proposed RI-ISI program selects a total of 88 welds (113 - 25 visual exams), which results in a 85% reduction.

Degradation Mechanisms: VF - Vibratory Fatigue; TF - Thermal Fatigue; FAC - Flow-Assisted Corrosion, SCC - Stress Corrosion Cracking; Strip/Strat - Striping/Stratification Notes for Table 5-1

a. System pressure test requirements and VT-2 visual examinations shall continue in all ASME Code Class systems.
b. VT-2 examination at one location within segment.
c. Augmented programs for erosion-corrosion and/or high energy line break continue.
d. Examinations added for change in risk considerations (Total of two segments - RCS).
e. Included also in augment program for erosion-corrosion and/or high energy line break. Augmented program continues.

20-

Enclosure 1 (continued)

Attachment 2 FENIOOC F*i-n,ff gy Nuclea Ope-mrg c-m.7"n %

BEAVER VALLEY POWER STATION PLANT ENGINEERING DEPARTMENT PROBABILISTIC SAFETY ASSESSMENT SECTION Discussion on BVPS PRA Model Adequacy for Risk-Informed Applications (Prepared by F. William Etzel, Supervisor PRA Engineering, December 6, 2001)

This technical position paper provides a brief discussion on what the industry's guidance is for determining if a PRA model is adequate for use in performing risk-informed applications, and why the Beaver Valley PRA models are considered to meet these requirements. It focuses mainly on the Level 1 model (core damage frequency), since most changes to the Level 2 model (large early release frequency) are from new industry insights on containment phenomena and not plant modifications. It also only reflects the internal events modeling, as the external events models are not expected to change much within a typical 3-year update period. However, it should be recognized that during the PRA model update process both the Level 1 and Level 2 models, as well as, both internal and external initiating events will be evaluated for changes.

For applying risk-informed applications, Regulatory Guide 1.174 states that:

The scope, level of detail, and quality of the PRA is to be commensurate with the application for which it is intended and the role the PRA results play in the integrated decision process. The more emphasis that is put on the risk insights and on PRA results in the decision making process, the more requirements that have to be placed on the PRA, in terms of both scope and how well the risk and the change in risk is assessed.

Conversely, emphasis on the PRA scope and quality can be reduced is a proposed change to the License Basis results in a risk decrease or is very small, or if the decision could be based mostly on traditional engineering arguments, or if compensating measures are proposed such that it can be convincingly argued that the change is very small.

Based on past PRA model updates performed for the Beaver Valley Units (three on Unit 1 and two on Unit 2) it was observed that most PRA model updates do not change significantly due to just plant modifications and new failure data. To ensure that this remains valid NPDAP 7.6 requires that a PRA model be revised any time a plant modification increases the CDF by more than 20% above the baseline CDF value. The impacts of these plant modifications are documented on Risk Evaluation Request Forms, and are analyzed for any increases in the baseline CDF and LERF. To date no single plant modification has increased CDF by more than 3% and the accumulated change in CDF due to plant modifications since the last PRA model update at Unit 1 and Unit 2 are about a 4% decrease and roughly a 0.2% increase, respectively.

Additionally, in keeping within the established the Maintenance Rule performance criteria for risk significant SSCs, helps to ensure that the impact on CDF due to equipment unavailability and failures remains minimal. Therefore, it is our position that the current Beaver Valley PRA models are meeting the intent of Regulatory Guide 1.174 in that they reflect the actual design, construction, operational practices and experiences as they relate to risk significant systems.

Enclosure I (continued)

Attachment 2 (continued)

FENOC FffVE-egy N*,.Ala, op-rWt'a c-.777any BEAVER VALLEY POWER STATION PLANT ENGINEERING DEPARTMENT PROBABILISTIC SAFETY ASSESSMENT SECTION Furthermore, in the past, the significant changes to the PRA models were typically due to removing conservatisms of previous models (e.g., using best estimate analyses in place of design bases analyses) or by taking additional credit for backup components (e.g., using LHSI pumps in-place of HHSI pumps during small break LOCAs). Other significant changes involve improved state-of-the-art knowledge on PRA issues in which no data is available (e.g., RCP seal LOCAs or large break LOCA initiating event frequencies); however, these are usually less frequent. The preliminary results for the upcoming Unit 2 PRA model update show that the majority of core damage frequency reduction will come from these refined modeling and applying state-of-the-art knowledge type activities.

To be acceptable for performing risk-informed applications, such as a Risk-Informed In-Service Inspection, a PRA model must be of sufficient quality to reflect the current ("as-built, as operated") state of the plant and have sufficient detail to address the effects on risk. These types of applications use a blended approach using both probabilistic and deterministic analysis, but are primarily supported by the results of the traditional deterministic analyses and are only reinforced by risk insights. So the decisions being made tend to reflect a significant influence from non-PRA based information (e.g., traditional design analyses). Hence the term "risk informed" is used for these applications. It should also be noted that in the case of the Risk Informed In-Service Inspection, the probabilistic approach does not use absolute risk importance values from the PRA models in determining safety significance, but rather uses a relative risk ranking (delta CDF or CCDP). This approach compares a sensitivity case with a baseline value. Therefore, as long as the structure of the system failures and CDF sequences do not change too much, the relativity of the rankings should remain fairly consistent between the model updates even if the CDF increases or decreases significantly. It should also be noted that the Risk-Informed In-service Inspection will undergo an Expert Panel review utilizing both the traditional and PRA analyses to reach a final consensus in the decision making process. In more risk-based applications, such as Graded Quality Assurance, the PRA models are used as the primary tool for determining the objective of the application, and therefore it is required that the PRA models be of a higher tier quality. These types of applications receive extensive PRA model scrutiny by the NRC prior to approval. Therefore, PRA models need to be commensurate with the applications being developed. The PRA Peer Review process will be helpful in determining the quality of the PRA model to what applications it can support.

Below is an excerpt from a Westinghouse technical paper entitled "Overview of Considerations of PRA Adequacy for Risk-Informed Applications" written by Barry Sloane (member of the ASME PRA Standard Project Team and WOG PRA Peer Review Team Leader), which reiterates this philosophy:

Ideally, the PRA will be developed to a level of detail for which planned risk-informed applications do not require application-specific upgrades, and will be kept current with all plant changes that may have an impact on risk. Taken in the context of a "Living PRA,"

the question of adequacy is not one of age of the PRA, but instead one of scope and maintenance of the PRA.

- 22 -

Enclosure I (continued)

Attachment 2 (continued)

FENOC

. 1.9y N1 ar Opera$" Co'"p,'y 7

BEAVER VALLEY POWER STATION PLANT ENGINEERING DEPARTMENT PROBABILISTIC SAFETY ASSESSMENT SECTION The draft ASME PRA Standard (for at-power internal events PRAs) provides, in Section 3 (Risk Assessment Application Process), a process for evaluating the PRA capabilities needed to support an application, and matching the capability requirements to the capabilities that exist in the PRA. One way of assessing the existing PRA capabilities is to perform a peer review of the PRA, following a suitable review process and reviewing against a set of suitable technical criteria.

Both the Industry PRA Peer Review Process (NEI-00-02) and the draft ASME PRA Standard provide guidance, for use by both the PRA owner and peer reviewers, in measuring how detailed the PRA should be relative to general PRA capabilities needed, for several categories of applications. Both documents also provide guidance regarding suitable processes for how the PRA should be maintained and controlled so that the licensee and NRC can have reasonable confidence that the PRA is being kept sufficiently current with the plant. This is covered in the Maintenance & Update (MU) element of the Industry PRA Peer Review process, and in Section 5 (PRA Configuration Control) of the draft ASME PRA Standard. (There is also the related topic of verification of the PRA models, data, and assumptions; although this is only briefly noted in Section 5 of the PRA Standard, and not directly addressed in this discussion, it is an important aspect of PRA capability and quality, as noted in Reg. Guide 1.174, Section 2.5.)

Neither the Peer Review process nor the ASME PRA Standard specify a particular method or frequency for PRA maintenance. In the Westinghouse Owners Group implementation of the peer review process, the focus of the MU element review is to determine what process the utility is following to ensure that: (a) the PRA is sufficiently current with the plant; (b) applications of the PRA are consistent with the capabilities of the PRA; and (c) plant decisions that have been implemented based on PRA results or insights are revisited to determine continued applicability as the plant (and PRA) change over time. The philosophy is that, if a reasonable process is in place for accomplishing this, then there is a reasonable expectation that the recommendations from the other elements of the peer review will be implemented and the PRA will continue to be maintained in suitable condition to support plant applications.

Although no minimum update frequency is specified, a "typical" approach currently is to perform a full update (e.g., collect and apply equipment reliability data, plant event data, and generic data, incorporate accumulated plant and PRA model changes that have occurred since the last update, re-generate and re-disseminate results and insights) after every other refueling outage (e.g., - 3 years for most plants). More limited scope updates would be performed as needed to reflect significant plant changes that occur between full updates (e.g., change a particular fault tree to reflect a minor hardware change, or change the modeling of an operator action to reflect minor changes to EOPs or AOPs). As part of the PRA configuration control process, the effects on existing PRA applications of accumulating PRA changes since the last update would need to be

-23 -

Enclosure 1 (continued)

Attachment 2 (continued) evaluated during the interim between full updates, and would also need to be captured in any new risk-informed applications.

In closing, the current RI applications at BVPS will be revisited after every PRA model update to determine if any previous rankings have changed, in keeping with a living risk program. This was performed in the past for both the Maintenance Rule risk significant SSC scoping and setting performance criteria, in addition to, MOV and AOV risk rankings; and is intended to be performed for all future applications as well. It is therefore, felt that the quality of the current PRA models are adequate for performing the risk-informed in-service inspection applications at each Unit, even though they have not been updated for four years.

-24 -

ENCLOSURE 2 Commitment List The following list identifies those actions committed to by FirstEnergy Nuclear Operating Company (FENOC) for Beaver Valley Power Station (BVPS) Unit No. 1 in this document. Any other actions discussed in the submittal represent intended or planned actions by Beaver Valley. These other actions are described only as information and are not regulatory commitments. Please notify Mr. Larry R. Freeland, Manager, Regulatory Affairs/Performance Improvement, at Beaver Valley on (724) 682-5284 of any questions regarding this document or associated regulatory commitments.

Commitment Due Date

1. Regarding the additional examinations referred to in RAI Upon Item #1, sample expansions of elements identified as being implementation of susceptible to the same service related root cause conditions proposed RI-ISI or degradation mechanism will be completed during the program outage that identified the flaws or relevant conditions.
2. Regarding RAI Items #2 and #3, updates and resubmittals of Upon the RI-ISI program will be performed in accordance with implementation of industry guidance currently being developed by the NEI proposed RI-ISI RI-ISI Living Program. program