ML081910124

Memorandum of the ACRS Review of Draft Revised Regulatory Guide 1.178, an Approach for Plan Specific Risk-Informed Decisionmaking for Inservice Inspection of Piping, and the Associated Standard Review Plan Chapter 3.9.8, April 24, 2003

ML081910124
Person / Time
Issue date:	04/24/2003
From:	Newberry S NRC/RES/DRA
To:	Larkins J Advisory Committee on Reactor Safeguards
References
RG-1.178
Download: ML081910124 (70)

Text

_ UNITED STATES

• NUCLEAR REGULATORY COMMms,ON WASHINGTON, D.C. 20555-0001 April 24, 2003 ~

R~-Mi£)

AOASY,(QNW US fiJRC MEMORANDUM TO: John T. Larkins, Executive Director MAY - 1 2003 Advisory Committee on Reactor Safeguar n,,~' ,\').123 4 ~PM6

'i~~~.~j~J~ I J I I~I FROM: Scott F. New , C 1 Division of 'sk nalysis and Appli atitP s Office of N lear Regulatory Rese c' ,j

"'/  :'.1 SUB..IECT: ACRS REVIEW OF DRAFT REVISED REGULATORY GUIDE 1.178, "AN APPROACH FOR PLANT SPECIFIC RISK INFORMED DECISIONMAKING FOR INSEIRVICE INSPECTION OF PIPING," AND THE ASSOCIATED STANDARD REVIEW PLAN CHAPTER 3.9.8 In accordance with the Commission's Risk-Informed Regulation Implementation Plan (SECY-02-0131, July 12, 2002), the staff has prepared revisions to Regulatory Guide 1.178, "An Approach for Plant Specific Risk-Informed Decisionmaking for Inservice Inspection of Piping," and the associated standard review plan (SRP) Chapter 3.9.8. As a brief review of the history of these documents, in December 1998, and October 1999, the staff approved two methods describing how risk-informed inservice inspection (lSI) programs can be developed and implemented. One methodology was developed by the Westinghouse Owners Group (WOG), and one was developed by the Electric Power Research Institute (EPRI). A draft regulatory guide for trial use was prepared by the staff and used to document the review and approval of the two industry methodologies. These documents were issued for trial use in July 1998.

Based on the staff's experience during the trial use period involving the review and approval of numerous plant specific relief requests for lSI, the staff is now preparing to issue an updated final version of Regulatory Guide 1.178 and SRP Chapter 3.9.8. On request by your staff, preliminary copies of the revised regulatory guide and SRP were provided informally to your staff in February 2003. In March 2003, further review identified some additional revisions to be made to the regulatory guide and SRP, and these final revisions have now been completed.

Copies of the revised documents are attached to this memo followed by a list identifying the revisions that have been made.

On March 13, 2003, the staff held a public meeting to discuss the draft revisions, and some additional editorial suggestions were made that were incorporated by the staff in the final revisions.

The staff plans to brief the ACRS on the changes proposed for the regulatory guide and SRP in May. The schedule calls for the issuance of the revised documents in August 2003.

If you have any questions regarding the revisions to RG 1.178 and SRP Chapter 3.9.8, please contact Brad Hardin at (301) 415-6561 or Jit Singh at (301) 415-6243.

. / ACRSOFFlCECOPV til~2 /lJ DO NOT REMOVE FRO'vt ACRS OprtC~

11 ..-: 1J DRAFT REGULATORY GUIDE 1.178 AN APPROACH FOR PLANT SPECIFIC RISK-INFORMED DECISIONMAKING FOR INSERVICE INSPECTION OF PIPING A. INTRODUCTION During the last several years, both the U.S. Nuclear Regulatory Commission (NRC) and the nuclear industry have recognized that probabilistic risk assessment (PRA) has evolved to be more useful in supplementing traditional engineering approaches in reactor regulation. After the pUblication of its policy statement (Ref. 1) on the use of PRA in nuclear regulatory activities, the Commission directed the NRC staff to develop a regulatory framework that incorporated risk insights. That framework was articulated in a November 27, 1995, paper to the Commission (Ref. 2). This regulatory guide, which addresses inservice inspection of piping (lSI), with its companion Standard Review Plan, Section 3.9.8 of NUREG-0800 (Ref. 3), and other regulatory documents (Refs. 4-10), implement, in part, the Commission's policy statement and the staff's framework for incorporating risk insights into the regulation of nuclear power plants.

In September 1998, the Commission published a version of this regulatory guide for trial use (Ref. 4). As stated in the guide, the regulatory guide issued for trial use did not establish any final staff positions for purposes of the Backfit Rule, 10 CFR 50.109, and any changes to the regulatory guide prior to staff adoption in final form would not be considered to be backfits as defined in 10 CFR 50.1 09(a)(1). This was intended to ensure that the lessons learned from the subsequent regulatory review of industry methodologies and the pilot plant applications could be adequately addressed in this document and that the guidance is sufficient to enhance regulatory stability in the review, approval, and implementation of proposed RI-ISI programs.

In December 1998, and October 1999, the staff approved two methods describing how risk-informed lSI programs can be developed and implemented. One methodology (Ref. 11) was developed by the Electric Power Research Institute (EPRI). The other methodology (Ref.

12) was developed by the Westinghouse Owners Group (WOG). The regulatory guide for trial use was used to support the review and approval of the two industry developed methodologies.

Based on the experience during the review and approval of the industry methodologies and the review and approval of numerous plant specific relief requests, the staff is now issuing this updated final version of this regulatory guide.

Until the RI-ISI process is approved for generic use, the staff anticipates that licensees will request changes to their lSI programs by requesting NRC approval of alternative inspection programs that meet the criteria of 10 CFR 50.55a(a)(3)(i) in Section 50.55a, "Codes and Standards," of 10 CFR Part 50, "Domestic Licensing of Production and Utilization Facilities,"

providing an acceptable level of quality and safety. As always, licensees should identify how DRAFT April 2003 1

1 ..... '

DRAFT the chosen approach, methods, data, and criteria are appropriate for the decisions they need to make.

This guide's principal focus is on the use of PRA findings and risk insights for decisions on changes proposed to plants' inservice inspection programs for piping. Such changes include (but are not limited to) license amendments under 10 CFR 50.90, requests for the use of alternatives under 10 CFR 50.55a, and exemptions under 10 CFR 50.12. This regulatory guide describes methods acceptable to the NRC staff for integrating insights from PRA techniques with traditional engineering analyses into lSI programs for piping.

Background

During recent years, both the NRC and the nuclear industry have recognized that PRA has evolved to the point that it can be used increasingly as a tool in regulatory decisionmaking. In August 1995, the NRC adopted a policy statement regarding the expanded use of PRA (Ref. 1).

In part, the policy statement states that:

• The use of PRA technology should be increased in all regulatory matters to the extent supported by the state-of-the-art in PRA methods and data and in a manner that complements the deterministic approach and supports the NRC's traditional philosophy of defense-in-depth.

• PRA and associated analyses (e.g., sensitivity studies, uncertainty analyses, and importance measures) should be used in regulatory matters, where practical within the bounds of the state-of-the-art, to reduce unnecessary conservatism associated with current regulatory requirements, regulatory guides, license commitments, and staff practices. Where appropriate, PRA should be used to support the proposal of additional regulatory requirements in accordance with 10 CFR 50.109 (Backfit Rule). Appropriate procedures for inclUding PRA in the process for changing regulatory requirements should be developed and followed. It is, of course, understood that the intent of this policy is that existing rules and regulations shall be complied with unless these rules and regulations are revised.

• PRA evaluations in support of regulatory decisions should be as realistic as practicable and appropriate supporting data should be publicly available for review.

• The Commission's safety goals for nuclear power plants and subsidiary numerical objectives are to be used with appropriate consideration of uncertainties in making regulatory judgments on the need for proposing and backfitting new generic requirements on nuclear power plant licensees.

In its approval of the policy statement, the Commission articulated its expectation that implementation of the policy statement will improve the regulatory process in three areas:

foremost, through safety decisionmaking enhanced by the use of PRA insights; through more DRAFT April 2003 2

J... , f DRAFT efficient use of agency resources; and through a reduction in unnecessary burdens on licensees.

In parallel with the publication of the policy statement, the staff developed a regulatory framework that incorporates risk insights. That framework was articulated in a November 27, 1995, paper (SECY-95-280) to the Commission. This regulatory guide, which addresses lSI programs of piping at nuclear power plants, is part of the implementation of the Commission's policy statement and the staff's framework for incorporating risk insights into the regulation of nuclear power plants.

While the conventional regulatory framework, based on traditional engineering criteria, continues to serve its purpose in ensuring the protection of public health and safety, the current information base contains insights gained from over 2500 reactor-years of plant operating experience and extensive research in the areas of material sciences, aging phenomena, and inspection techniques. This information, combined with modern risk assessment techniques and associated data, can be used to develop a more effective approach to lSI programs for piping.

The current lSI requirements for piping components are found in 10 CFR 50.55a and the General Design Criteria listed in Appendix A to 10 CFR Part 50. These requirements are throughout the General Design Criteria, such as in Criterion I, "Overall Requirements," Criterion II, "Protection by Multiple Fission Product Barriers," Criterion III, "Protection and Reactivity Control Systems," and Criterion IV, "Fluid Systems."

Section XI of the American Society of Mechanical Engineers (ASME) Boiler and Pressure Vessel Code (BPVC) (Ref. 14) is referenced by 10 CFR 50.55a, which addresses the codes and standards for design, fabrication, testing, and inspection of piping systems. The objective of the lSI program is to identify service-induced degradation that might lead to pipe leaks and ruptures, thereby meeting, in part, the requirements set in the General Design Criteria and 10 CFR 50.55a. lSI programs are intended to address all piping locations that are subject to degradation. Incorporating risk insights into the programs can focus inspections on the more important locations and reduce personnel exposure, while at the same time maintaining or improving public health and safety. The justification for any reduction in the number of inspections should address the issue that an increase in leakage frequency or a loss of defense-in-depth should not result from decreases in the numbers of inspections.

When categorizing piping segments in terms of their contribution to risk, it is the responsibility of a licensee to ensure that the categorization of piping segments and the resulting inspection programs are consistent with the key principles and risk guidelines (e.g., core damage frequency (CDF) and large early release frequency (LERF>> addressed in Regulatory Guide 1.174 (Ref. 4). This regulatory guide augments the guidance presented in Regulatory Guide 1.174 by providing guidance specific to incorporating risk insights to inservice inspection programs of piping.

DRAFT April 2003 3

DRAFT Purpose of the Guide Consistent with Regulatory Guide 1.174 (Ref. 4), this regulatory guide focuses on the use of PRA in support of a risk-informed lSI program. This guide provides guidance on acceptable approaches to meeting the existing Section XI requirements for the scope and frequency of inspection of lSI programs. Its use by licensees is voluntary. Its principal focus is the use of PRA findings and risk insights for decisions on changes proposed to a plant's inspection program for piping. The current lSI programs are performed in compliance with the requirements of 10 CFR 50.55a and with Section XI of the ASME Boiler and Pressure Vessel Code, which are part of the plant's licensing basis. This approach provides an acceptable level of quality and safety (per 10 CFR 50.55a(a)(3)(i>> by incorporating insights from probabilistic risk and traditional analysis calculations, supplemented with operating reactor data. Licensees who propose to apply risk-informed lSI programs would amend their final safety analysis report (FSAR, Sections 5.3.4 and 6.6) accordingly. A Standard Review Plan (SRP) (Ref. 3) has been prepared for use by the NRC staff in reviewing RI-ISI applications.

Additional augmented inspection programs to address generic piping degradation problems have been recommended by the NRC to preclude piping failure and implemented by the industry.

Notable examples of augmented programs for piping inspections are to address intergrannular stress corrosion cracking (IGSCC) of stainless steel piping in boiling water reactors (BWR) (NRC Generic Letter 88-01), thermal fatigue (NRC Bulletin 88-08, NRC Bulletins 88-11, NRC Information Notice 93-020), stress corrosion cracking in pressurized water reactors (PWR) (IE Bulletin 79-17), Service Water Integrity Program (NRC Generic Letter 89-13) and flow accelerated corrosion (FAC) in the balance of plant for both PWRs and BWRs (NRC Generic Letter 89-08).

Augmented programs have generally been developed to address observed degradation and the inspections tend to be targeted at locations where the most severe effects are expected.

Selected augmented programs, or parts of the programs, may be incorporated into a RI-ISI program provided that the licensee identifies and the staff approves the specific programs and program changes.

This document addresses risked-informed methods to develop, monitor, and update more efficient lSI programs for piping at a nuclear power facility. This guidance does not preclude other approaches for incorporating risk insights into the lSI programs. Licensees may propose other approaches for NRC consideration. It is intended that the methods presented in this guide be regarded as examples of acceptable practices; licensees should have some flexibility in satisfying the regulations on the basis of their accumulated plant experience and knOWledge. This document addresses risk-informed approaches that are consistent with the basic elements identified in Regulatory Guide 1.174 (Ref. 4). In addition, this document provides guidance on the following for the purposes of RI-ISI.

• Estimating the probability of a leak, a leak that prevents the system from performing its function (disabling leak), and a rupture for piping segments, DRAFT April 2003 4

DRAFT

• Identifying the structural elements for which lSI can be modified (reduced or increased),

based on factors such as risk insights, defense in depth, reduction of unnecessary radiation exposure to personnel,

• Determining the risk impact of changes to lSI programs,

• Capturing deterministic considerations in the revised lSI program, and

• Developing an inspection program that monitors the performance of the piping elements for consistency with the conclusions from the risk assessment.

Until the RI-ISI process is approved for generic use, the staff anticipates that licensees will request changes to their lSI programs by requesting NRC approval of a proposed inspection program that meets the criteria of 10 CFR 50.55a(a)(3)(i), providing an acceptable level of quality and safety. The licensee's RI-ISI program will be enforceable under 10 CFR 50.55a.

Scope of the RI-ISI Program This regulatory guide only addresses changes to the lSI programs for inspection of piping. To adequately reflect the risk implications of piping failure, both partial and full-scope RI-ISI programs are acceptable to the NRC staff.

Partial Scope: A licensee may elect to limit its RI-ISI program to a subset of piping classes, for example, ASME Class-1 piping only, including piping exempt from the current requirements.

Partial scope applications should include the full population of piping within the selected subset of piping such as ASME Class and/or plant systems.

Full Scope: A full scope RI-ISI includes:

• All Class 1, 2, and 3 1 piping within the current ASME Section XI programs, and

• All piping whose failure would compromise Safety-related structures, systems, or components that are relied upon to remain functional during and following design basis events to ensure the integrity of the reactor coolant pressure boundary, the capability to shut down the reactor and maintain it in a safe shutdown condition, or the capability to prevent or mitigate 1Generally, ASME Code Class 1 includes all reactor pressure boundary components.

ASME Code Class 2 generally includes systems or portions of systems important to safety that are designed for post-accident containment and removal of heat and fission products. ASME Code Class 3 generally included those system components or portions of systems important to safety that are designed to provide cooling water and auxiliary feedwater for the front-line systems.

DRAFT April 2003 5

DRAFT the consequences of accidents that could result in potential offsite exposure comparable to 10 CFR Part 100 guidelines.

Non-safety-related structures, systems or components:

• That are relied upon to mitigate accidents or transients or are used in plant emergency operating procedures; or

• Whose failure could prevent safety-related structures, systems, or components from fulfilling their safety-related function; or

• Whose failure could cause a reactor scram or actuation of a safety-related system.

For both the partial and full scope evaluations, the licensee is to demonstrate compliance with the acceptance guidelines and key principles of Regulatory Guide 1.174 (Ref. 4).

The inspection locations of concern include all weld and base metal locations at which degradation may occur, although pipe welds are the usual point of interest in the inspection program. Within this regulatory guide, references to "welds" are intended in a broad sense to address inspections of critical structural locations in general, including the base metal as well as weld metal. Inspections will often focus on welds because detailed evaluations will often identify welds as the locations most likely to experience degradation. Welds are most likely to have fabrication defects, welds are often at locations of high stress, and certain degradation mechanisms (stress corrosion cracking) usually occur at welds. Nevertheless, there are other degradation mechanisms such as flow-assisted-corrosion (e.g., erosion-corrosion) and thermal fatigue that occur independent of welds.

Licensees implementing the risk-informed process may identify piping segments categorized as safety significant that are not currently subject to the traditional Code requirements (e.g.,

outside the Code boundaries, including Code exempt piping) or are not being inspected to a level that is commensurate with their risk significance. In this context, safety significant refers to a piping segment that has a relatively high contribution to risk. PRA systematically takes credit for systems with non-Code or exempt piping that provide support, act as alternatives, and act as backups to those systems with piping that are within the scope of the current Section XI of the Code. The RI-ISI program should result in inspections of safety significant piping.

Organization and Content This regulatory guide is structured to follow the general four-element process for risk-informed applications discussed in Regulatory Guide 1.174 (Ref. 4). The Discussion section summarizes the four-element process developed by the staff to evaluate proposed changes related to the development of a RI-ISI program. RegUlatory Position 1 discusses an acceptable approach for DRAFT April 2003 6

DRAFT defining the proposed changes to an lSI program. Regulatory Position 2 addresses, in general, the traditional and probabilistic engineering evaluations performed to support RI-ISI programs and presents the risk acceptance goals for determining the acceptability of the proposed change. Regulatory Position 3 presents one acceptable approach for implementing and monitoring corrective actions for RI-ISI programs. The documentation the NRC will need to render its safety decision is discussed in Regulatory Position 4.

Relationship to Other Guidance Documents As stated above, this regulatory guide discusses acceptable approaches to incorporate risk insights into an lSI program and directs the reader to Regulatory Guides 1.174 and SRP Chapters 19 and 3.9.8, and draft regulatory guide DG-1122 and SRP Chapter 19.1, for additional guidance, as appropriate. Regulatory Guide 1.174 describes a general approach to risk-informed regulatory decisionmaking and discusses specific topics common to all risk-informed regulatory applications. Draft regulatory guide DG-1122, when finalized, will describe one acceptable approach for determining the quality of the PRA, in toto or for those parts that are used to support an application, are sufficient to provide confidence in the results such that they can be used in regulatory decision making for light water reactors. Topics addressed in these documents include:

• PRA quality - characteristics and attributes for technical elements of a PRA

• PRA scope - internal and external event initiators, at-power and shutdown modes of operation, consideration of requirements for Level 1, 2, and 32 analyses,

• PRA peer review - approach, process, and documentation,

• Risk metrics - core damage frequency, large early release frequency and importance measures,

• Sensitivity and uncertainty analyses.

To the extent that a licensee elects to use PRA as an element to enhance or modify its implementation of activities affecting the safety-related functions of SSCs subject to the provisions of Appendix B to 10 CFR Part 50, the pertinent requirements of Appendix Bare applicable.

The information collections contained in this document are covered by the requirements of 10 CFR Part 50, which were approved by the Office of Management and Budget (OMB), approval number 3150-0011. The NRC may not conduct or sponsor, and a person is not required to respond to, a collection of information unless it displays a currently valid OMB control number.

2Level1 - accident sequence analysis, Level 2 - accident progression and source term analysis, and Level 3 - offsite consequence analysis.

DRAFT April 2003 7

DRAFT Abbreviations and Definitions ASME American Society of Mechanical Engineers SPVC Boiler and Pressure Vessel Code CCDF Conditional core damage frequency CCF Common cause failure CDF Core damage frequency CLERF Conditional large early release frequency Expert Elicitation A process used to estimate failure rates or probabilities of piping when data and computer codes are unavailable for the intended purpose.

Expert Panel Normally refers to plant personnel experienced in operations, maintenance, PRA, lSI programs, and other related activities and disciplines that impact the decision under consideration.

FSAR Final Safety Analysis Report IGSCC Intergranular stress corrosion cracking Importance Measures Used in PRA to rank systems or components in terms of risk significance lSI Inservice inspection 1ST Inservice testing LERF Large early release frequency NDE Nondestructive examination NEI Nuclear Energy Institute NRC Nuclear RegUlatory Commission PRA Probabilistic risk assessment PSA Probabilistic safety assessment RCPS Reactor coolant pressure boundary RI-ISI Risk-informed inservice inspection Staff Refers to NRC employees Sensitivity Studies Varying parameters to assess impact due to uncertainties SRP Standard Review Plan SRRA Structural reliability/risk assessment (refers to fracture mechanics analysis)

SSCs Structures, systems and components Tech Spec Technical specifications B. DISCUSSION When a licensee elects to incorporate risk insights into its lSI programs, it is anticipated that the licensee will build upon its existing PRA activities. The five key principles involved in the integrated decisionmaking process are described in detail in Regulatory Guide 1.174 (Ref. 4).

In addition, Regulatory Guide 1.174 describes a four-element process for evaluating proposed risk-informed changes.

DRAFT April 2003 8

DRAFT The key principles and the section of this guide that addresses each of these principles for RI-ISI programs are as follows.

9. The proposed change meets the current regulations unless it is explicitly related to a requested exemption or rule change. (Regulatory Position 2.1.1)

10. The proposed change is consistent with the defense-in-depth philosophy. (Regulatory Position 2.1.2)

11. The proposed change maintains sufficient safety margins. (Regulatory Position 2.1.3)

12. When proposed changes result in an increase in core damage frequency or risk, the increases should be small and consistent with the intent of the Commission's Safety Goal Policy Statement. (Regulatory Position 2.2)

13. The impact of the proposed change should be monitored by using performance measurement strategies. (Regulatory Position 3)

Section 2 of Regulatory Guide 1.174 describes a four-element process for developing risk-informed regulatory changes. These are: define the change, perform an engineering analysis, define the implementation and monitoring program, and submit the proposed change.

The order in which the elements are performed may vary or they may occur in parallel, depending on the particular application and the preference of the program developers. The process is highly iterative. Thus, the final description of the proposed change to the lSI program as defined in Element 1 depends on both the analysis performed in Element 2 and the definition of the implementation of the lSI program performed in Element 3. While lSI is, by its nature, an inspection and monitoring program, it should be noted that the monitoring referred to in Element 3 is associated with making sure that the assumptions made about the impact of the changes to the lSI program are not invalidated. For example, if the inspection intervals are based on an allowable margin to failure, the monitoring is performed to make sure that these margins are not eroded. Element 4 involves preparing the documentation to be submitted to the NRC and to be maintained by the licensee for later reference.

C. REGULATORY POSITION

1. ELEMENT 1: DEFINE THE PROPOSED CHANGES TO lSI PROGRAMS In this first element of the process, the proposed changes to the lSI program are defined. This involves describing the scope of piping that would be incorporated in the overall assessment and how the inspection of this piping would be changed. Also, included in this element is identification of supporting information and a proposed plan for the licensee's interactions with the NRC throughout the implementation of the RI-ISI program.

DRAFT April 2003 9

DRAFT 1.1 Description of Proposed Changes A full description of the proposed changes in the lSI program is to be prepared. This description should include:

• Identification of the plant's current requirements that would be affected by the proposed RI-ISI program. To provide a basis from which to evaluate the proposed changes, the licensee should also confirm that the plant's design and operation is in accordance with its current requirements and that engineering information used to develop the proposed RI-ISI program is also consistent with the current requirements.

• Identification of the elements of the lSI program to be changed.

• Identification of the piping in the plant that is both directly and indirectly involved with the proposed changes. Any piping not presently covered in the plant's lSI program but categorized as safety significant (e.g., through an integrated decisionmaking process using PRA insights) should be identified and appropriately addressed. In addition, the particular systems that are affected by the proposed changes should be identified since this information is an aid in planning the supporting engineering analyses.

• Identification of the information that will be used to support the changes. This could include performance data, traditional engineering analyses, and PRA information.

• A brief statement describing how the proposed changes meet the intent of the Commission's PRA Policy Statement.

1.2 Changes to Approved RI-ISI Programs This section provides guidance on the need for licensees to report program activities and guidance on formal NRC review of changes made to RI-ISI programs.

The licensee should implement a process for determining when RI-ISI program changes require formal NRC review and approval. Changes made to the NRC-approved RI-ISI program that could affect the process and results that were reviewed and approved by the NRC staff should be evaluated to ensure that the basis for the staff's approval has not been compromised. All changes should be evaluated using the change mechanisms described in the applicable regulations (e.g., 10 CFR 50.55a, 10 CFR 50.59) to determine whether NRC review and approval are required prior to implementation. If there is a question regarding this issue, the licensee should seek NRC review and approval prior to implementation.

2. ELEMENT 2: ENGINEERING ANALYSIS As part of defining the proposed change to the licensee's lSI program, the licensee should conduct an engineering evaluation of the proposed change, using and integrating a DRAFT April 2003 10

DRAFT combination of traditional engineering methods and PRA. The major objective of this evaluation is to confirm that the proposed program change will not compromise defense-in-depth, safety margins, and other key principles described in this guide and in Regulatory Guide 1.174 (Ref.

4). Regulatory Guide 1.174 provides general guidance for performing this evaluation, which is supplemented by the RI-ISI guidance herein.

The regulatory issues and engineering activities that should be considered for a risk-informed lSI program are summarized here. For simplicity, the discussions are divided into traditional and PRA analyses. Regulatory Position 2.1 addresses the traditional engineering analysis, Regulatory Position 2.2 addresses the PRA-related analysis, and Regulatory Position 2.3 describes the integration of the traditional and PRA analyses. In reality, many facets of the traditional and PRA analyses are iterative.

The engineering evaluations are to:

• Demonstrate that the change is consistent with the defense-in-depth philosophy;

• Demonstrate that the proposed change maintains sufficient safety margins;

• Demonstrate that when proposed changes result in an increase in core damage frequency or risk, the increase is small and consistent with the intent of the Commission's Safety Goal Policy Statement; and

• Support the integrated decisionmaking process.

The scope and quality of the engineering analyses performed to justify the changes proposed to the lSI programs should be appropriate for the nature and scope of the change. The decision criteria associated with each key principle identified above are presented in the following subsections. Equivalent criteria can be proposed by the licensee if such criteria can be shown to meet the key principles set forth in Section 2 of Regulatory Guide 1.174.

2.1 Traditional Engineering Analysis This part of the evaluation is based on traditional engineering methods. Areas to be evaluated from this viewpoint include meeting the regulations, defense-in-depth attributes, safety margins, assessment of failure potential of piping segments, and assessment of primary and secondary effects (failures) that result from piping failures.

The engineering analysis for a RI-ISI piping program will achieve the following:

1. Assess compliance with applicable regulations,

2. Perform defense-in-depth evaluation, DRAFT April 2003 11

DRAFT

3. Perform safety margin evaluation,

4. Define piping segments,

5. Assess failure potential for the piping segment,

6. Assess the consequences (both direct and indirect) of piping segment failure,

7. Categorize the piping segments in terms of safety significance,

8. Develop an inspection program,

9. Assess the impact of changing the lSI program on CDF and LERF, and

10. Demonstrate conformance with the key principles (e.g., maintaining sufficient safety margins, defense in depth consideration, Commission's Safety Goal Policy, etc.).

2.1.1 Assess Compliance with Applicable Regulations The engineering evaluation should assess whether the proposed changes to the lSI programs would compromise compliance with the regUlations. The evaluation should consider the appropriate requirements in the licensing basis and applicable regulatory guidance.

Specifically, the evaluation should consider:

• 10 CFR 50.55a

• Appendix A to 10 CFR Part 50 Criterion I, "Overall Requirements" Criterion II, "Protection of Multiple Fission Product Barriers" Criterion III, "Protection and Reactivity Control Systems" Criterion IV, "Fluid Systems," etc

• ASME Boiler and Pressure Vessel Code,Section XI (10 CFR Part 50.55a)

• Regulatory Guide 1.84 (Ref. 15)

• RegUlatory Guide 1.85 (Ref. 16)

• Regulatory Guide 1.147 (Ref. 17)

DRAFT April 2003 12

DRAFT

• Appendix B to 10 CFR Part 50.

In addition, the evaluation should consider whether the proposed changes have affected license commitments. A broad review of the licensing requirements and commitments may be necessary because proposed lSI program changes could affect issues not explicitly stated in the licensee's FSAR or lSI program documentation.

The Director of the Office of Nuclear Regulation is allowed by 10 CFR 50.55a to authorize alternatives to the specific requirements of this regulation provided the proposed alternative will ensure an acceptable level of quality and safety. Thus, alternatives to the acceptable RI-ISI approaches presented in this guide may be proposed by licensees so long as supporting information is provided that demonstrates that the key principles discussed in this guide are maintained.

The licensee should include in its RI-ISI program submittal the necessary exemption requests, technical specification amendment requests (if applicable), and relief requests necessary to implement its RI-ISI program.

NRC-endorsed ASME Code Cases that apply risk-informed lSI programs are consistent with this regulatory guide in that they encourage the use of risk insights in the selection of inspection locations and the use of appropriate and possibly enhanced inspection techniques that are appropriate to the failure mechanisms that contribute most to risk.

2.1.2 Defense-in-Depth Evaluation As stated in Regulatory Guide 1.174 (Ref. 4), the engineering analysis should evaluate whether the impact of the proposed change in the lSI program (individually and cumulatively) is consistent with the defense-in-depth philosophy. In this regard, the intent of this key principle is to ensure that the philosophy of defense-in-depth is maintained, not to prevent changes in the way defense-in-depth is achieved. The defense-in-depth philosophy has traditionally been applied in reactor design and operation to provide multiple means to accomplish safety functions and prevent the release of radioactive material. It has been and continues to be an effective way to account for uncertainties in equipment and human performance. Where a comprehensive risk analysis can be done, it can be used to help determine the appropriate extent of defense-in-depth (e.g., balance among core damage prevention, containment failure, and consequence mitigation) to ensure protection of public health and safety. Where a comprehensive risk analysis is not or cannot be done, traditional defense-in-depth consideration should be used or maintained to account for uncertainties. The evaluation should consider the intent of the general design criteria, national standards, and engineering principles such as the single failure criterion. Further, the evaluation should consider the impact of the proposed change on barriers (both preventive and mitigative) to core damage, containment failure or bypass, and the balance among defense-in-depth attributes. The licensee should select the engineering analysis techniques, whether quantitative or qualitative, appropriate to the proposed change (see Regulatory Guide 1.174, Reference 4, for additional gUidance).

DRAFT April 2003 13

DRAFT An important element of defense in depth for RI-ISI is maintaining the reliability of independent barriers to fission product release. Class 1 piping (primary coolant system) is the second boundary between the radioactive fuel and the general public. If a RI-ISI program categorized, for example, all segments in the hot and cold legs of the primary system piping as low safety significant and calculated that, with no inspections, the frequency of leaks would not increase beyond existing performance history of the ASME Code, the staff would continue to require some level of NDE inspection.

2.1.3 Safety Margins In engineering programs that affect pUblic health and safety, safety margins are applied to the design and operation of a system. These safety margins and accompanying engineering assumptions are intended to account for uncertainties, but in some cases can lead to operational and design constraints that are excessive and costly, or that could detract from safety (e.g., result in unnecessary radiation exposure to plant personnel). Insufficient safety margins may require additional attention. Prior to a request for relaxation of the existing requirements, the licensee must ensure that the uncertainties are adequately addressed. The quantification of uncertainties would likely require supporting sensitivity analyses.

The engineering analyses should address whether the impacts of the changes proposed to the lSI program are consistent with the key principle that adequate safety margins are maintained.

The licensee is expected to select the method of engineering analysis appropriate for evaluating whether sufficient safety margins would be maintained if the proposed change were implemented. An acceptable set of guidelines for making that assessment are summarized below. Other equivalent decision criteria could also be found acceptable.

Sufficient safety margins are maintained when:

• Codes and standards (see Regulatory Position 2.1.1) or alternatives approved for use by the NRC are met, and

• Safety analysis acceptance criteria in the licensing basis (e.g., updated FSAR, supporting analyses) are met, or proposed revisions provide sufficient margins to account for analysis and data uncertainty.

2.1.4 Piping Segments A systematic approach should be applied when analyzing piping systems. One acceptable approach is to divide or separate a piping system into segments; different criteria or definitions can be applied to each piping segment. One acceptable method is to identify segments of piping within the piping systems that have the same consequences of failure. Other methods could subdivide a segment that exhibits a given consequence into segments with similar degradation mechanisms or similar failure potential. The definition of a segment could encompass multiple criteria, as long as a sound engineering and accounting record is DRAFT April 2003 14

DRAFT maintained and can be applied to an engineering analysis in a consistent and sound process.

Consequences of failure may be defined in terms of an initiating event, loss of a particular train, loss of a system, or combinations thereof. The location of the piping in the plant, and whether inside or outside the containment or compartment, should be taken into consideration when defining piping segments.

The definition of a piping segment can vary with the methodology. Defining piping segments can be an iterative process. In general, an analyst may need to modify the description of the piping segments before they are finalized. This guide does not impose any specific definition of a piping segment, but the analysis and the definition of a segment must be consistent and technically sound.

2.1.5 Assess Piping Failure Potential The engineering analysis includes evaluating the failure potential of a piping segment.

Determining the failure potential of piping segments, either with a quantitative estimate or by categorization into groups, should be based on an understanding of degradation mechanisms, operational characteristics, potential dynamic loads, flaw size, flaw distribution, inspection parameters, experience data base, etc. The evaluation should state the appropriate definition of the failure potential (e.g., failure on demand or operating failures associated with the piping, with the basis for the definition) that will be needed to support the PRA or risk assessment. The failure potential used in or in support of the analysis should be appropriate for the specific environmental conditions, degradation mechanisms, and failure modes for each piping location.

When data are analyzed to develop a categorization process relating degradation mechanisms to failure potential, the data should be appropriate and publicly available. When an elicitation of expert opinion is used in conjunction with, or in lieu of, probabilistic fracture mechanics analysis or operating data, a systematic process should be developed for conducting such an elicitation.

In such cases, a suitable team of experts should be selected and trained (Ref. 18, 19).

When implementing probabilistic fracture mechanics computer programs that estimate structural reliability and are used in risk assessment of piping, or other analytic methods for estimating the failure potential of a piping segment, some of the important parameters that need to be assessed in the analysis include the identification of structural mechanics parameters, degradation mechanisms, design limit considerations, operating practices and environment, and the development of a data base or analytic methods for predicting the reliability of piping systems. Design and operational stress or strain limits are assessed. This information is available to the licensee in the design information for the plant. The loading and resulting stresses or strains on the piping are needed as input to the calculations that predict the failure probability of a piping segment. The use of validated computer programs, with appropriate input, is strongly recommended in a quantitative RI-ISI program because it may facilitate the regUlatory evaluation of a submittal. The analytic method should be validated with applicable plant and industry piping performance data.

DRAFT April 2003 15

DRAFT To understand the impact of specific assumptions or models used to characterize the potential for piping failure, appropriate sensitivity or uncertainty studies should be performed. These uncertainties include, but are not limited to, design versus fabrication differences, variations in material properties and strengths, effects of various degradation and aging mechanisms, variation in steady-state and transient loads, availability and accuracy of plant operating history, availability of inspection and maintenance program data, applicability and size of the data base to the specific degradation and piping, and the capabilities of analytic methods and models to predict realistic results. Evaluation of these uncertainties provides insights to the input parameters that affect the failure potential, and therefore require careful consideration in the analysis.

The methodology, process, and rationale used to determine the likelihood of failure of piping segments should be independently reviewed during the final classification of the risk significance of each segment. Referencing applicable generic topical reports approved by the NRC is one acceptable means to standardize the process. When new computer codes are used to develop quantitative estimates, the techniques should be verified and validated against established industry codes and available data. When data are used to evaluate the likelihood of piping failures, the data should be submitted to the NRC or referenced by an NRC-approved topical report. As stated in Regulatory Guide 1.174 (Ref. 4), "data, methods, and assessment criteria used to support regulatory decisionmaking must be scrutable and available for pUblic review." It is the responsibility of the licensee to provide the data, methods, and justification to support its estimation of the failure potential of piping segments.

2.1.6 Assess Consequences of Piping Segment Failures When evaluating the risk from piping failures, the analyst needs to evaluate the potential consequences, or failures, that a piping failure can initiate. This can be accomplished by performing a detailed walkdown of a nuclear power facility's piping network. The consequences of the postulated pipe segment failure include direct and indirect effects of the failure. Direct effects include the loss of a train or system and associated possible diversion of flow or an initiating event such as a loss of coolant accident (LOCA) or both. Indirect effects include the spatial effects of flood, spray, pipe whip, or jet impingement that may affect adjacent SSCs or depletion of water sources and loss of associated systems.

2.2 Probabilistic Risk Assessment In accordance with the Commission's policy on PRA, the risk-informed application process is intended not only to support reduction in the number of inspections, but also to identify areas where increased resources should be allocated to enhance safety. Therefore, an acceptable RI-ISI process should not focus exclusively on areas in which reduced inspection could be justified. This section addresses lSI-specific considerations in the PRA to support relaxation of inspections, enhancement of inspections, and validation of component operability.

DRAFT April 2003 16

DRAFT A set of PRA standards is being developed by the American Society for Mechanical Engineers (ASME) and the American Nuclear Society (ANS). ASME has published a PRA standard that addresses a Level 1 and limited Level 2 PRA for fUll-power operation for internal events (excluding internal fire) (Ref. 20). Other standards for external events (Le., seismic, wind and flood), low power and shutdown conditions and internal fires are under development by ANS.

The NRC staff is currently developing a regulatory guide to provide guidance to licensees in determining the technical adequacy of a PRA used in a risk-informed integrated decision making process, and to endorse standards and industry guidance. The NRC staff is continuing to evaluate PRAs submitted in support of specific applications using the guidelines given in Section 2.2.3 and Section 2.5 of Regulatory Guide 1.174 (Ref. 4), and Chapter 19 of the Standard Review Plan (Ref. 8).

The PRA can be used to categorize the piping segments into safety significant and low safety significant classification (or more classifications, if a finer graded approach is desired) and to confirm that the change in risk caused by the change in the lSI program is in accordance with the guidance of Regulatory Guide 1.174 (Ref. 4). The licensee's submittal should discuss measures used to ensure adequate quality, such as a report of a peer review, when performed, that addresses the appropriateness of the PRA model for supporting a risk assessment of the change under consideration. The submittal should address any limitations of the analysis that are expected to impact the conclusion regarding the acceptability of the proposed change. The licensee's resolution of the findings of the peer review, certification, or cross comparison, when performed, should also be submitted. This response could indicate whether the PRA was modified or justify why no change to the PRA was necessary to support decisionmaking for the change under consideration.

2.2.1 Modeling Piping Failures in a PRA Input from the traditional engineering analysis addressed in Regulatory Position 2.1 includes identification of piping segments from the point of view of the failure potential (degradation mechanisms) and consequences (resulting failure modes and consequential primary and secondary effects). The traditional analysis identifies both the primary and secondary effects that can result from a piping failure. The assessment of the primary and secondary failures identifies the portions of the PRA that are affected by the piping failure.

Each pipe segment failure may have one of three types of impacts on the plant.

1. Initiating event failures when the failure directly causes a transient and mayor may not also fail one or more plant trains or systems.

2. Standby failures are those failures that cause the loss of a train or system but which do not directly cause a transient. Standby failures are characterized by train or system unavailability that may require shutdown because of the technical specifications or limiting conditions for operation.

DRAFT April 2003 17

DRAFT

3. Demand failures are failures accompanying a demand for a train or system and are usually caused by the transient-induced loads on the segment during system startup.

The impact of the pipe segment failure on risk should be evaluated with the PRA. Evaluation may involve a quantitative estimate derived from the PRA, a systematic technique to categorize the consequence of the pipe failure on risk, or some combination of quantification and categorization. If a segment failure were to lead to plant transients and equipment failures that are not at all represented in the PRA (a new and specific initiating event, for example), the evaluation process should be expanded to assess these events.

PRAs normally do not include events that represent failure of individual piping segments nor the structural elements within the segments. A quantitative estimate of the impact of segment failures can be done by modifying the PRA logic to systematically and explicitly include the impact of the individual pipe segment failures. The impact of each segment's failure on risk can also be estimated without modifying the PRA's logic by identifying an initiating event, basic event, or group of events, already modeled in the PRA, whose failures capture the effects of the piping segment's failure (referred to as the surrogate approach). In either case, to assess the impact of a particular segment failure, the analyst sets the appropriate events to a failed state in the PRA and requantifies the PRA or the appropriate parts of the PRA as needed. The analysis shall appropriately incorporate segment failures that only cause an initiating event, that only degrade or fail a mitigating system required to respond to an independent initiating event and that simultaneously cause an initiating event and degrade or fail a mitigating system responding to the initiating event. The requantification should explicitly address truncation errors, since cut set or truncated sequences may not fully capture the impact of multiple failure events.

If a systematic technique is used to categorize the consequence of pipe failures, it should also be based on PRA results. In this case, however, the categories may be represented by ranges of conditional results, and instead of quantifying the impact of each segment failure, the process should provide for determining the range within which each segment's failure would lie.

In general, the consequences would range from high, for those segments whose failure would have a high likelihood of leading to core damage or large early release, to low for those segments whose failure would likely not lead to core damage or large early release. The licensee should provide a discussion and justification of the ranges selected. The use of ranges instead of individual results estimates may require fewer calculations, but the categorization process and decision criteria should be justified, well defined, and repeatable.

2.2.1.1 Dependencies and Common Cause Failures The effects of dependencies and common cause failures (CCFs) for lSI components need to be considered carefully because of the significance they can have on CDF. Generally, data are insufficient to produce plant-specific estimates based solely on plant-specific data. For CCFs, data from generic sources may be required.

DRAFT April 2003 18

DRAFT 2.2.1.2 Human Reliability Analyses To Isolate Piping Breaks For lSI-specific analyses, the human reliability analysis methodology used in the PRA must account for the impact that the piping segment break would have on the operator's ability to respond to the event. In addition, the reliability of the inspection program (including both operator and equipment qualification), which factors into the probability of detection, should also be addressed.

2.2.2 Use of PRA for Categorizing Piping Segments Once the impact of each segment's failure on plant risk metrics has been determined, the safety significance of the segments is developed. The method of categorizing a piping segment can vary. For example, if the pipe failure event frequency or probability is estimated and the events are incorporated into the PRA logic model, importance measure calculations and the determination of safety significance, as discussed in Regulatory Guide 1.174 and SRP Chapter 19 (Refs. 4 and 8), may be performed. Alternatively, if a CCDF, CLERF, CCDP, or CLERP (depending on the impact the segment failure has on the plant) is estimated for each segment from the PRA, a CDF and LERF caused only by pipe failures may be developed by combining the conditional consequences and segment failure probabilities or frequencies external to the PRA logic model. Importance measures can also be developed using these results and these measures compared to appropriate threshold criteria to support the determination of the safety significance of each segment. The calculations used in such a process should yield well defined estimates of CDF, LERF, and importance measures. The licensee should provide a discussion of and justification for the threshold criteria used.

As discussed in Regulatory Position 2.2.1, the consequence of segment failures may be represented by categories of consequences instead of quantitative estimates for each segment.

In this case, the potential for pipe failure as discussed in Regulatory Position 2.1.5 would also be developed as categories ranging from high to low depending on the degradation mechanisms present and the corresponding likelihood that the segment will fail. These consequence and failure likelihood categories should be systematically combined to develop categories of safety significance. The licensee should provide a discussion and justification relating the consequence and failure likelihood categories to the safety significant category assigned to each combination.

The safety significance category of the pipe segment will help determine the level of inspection effort devoted to the segment. In general, safety significant segments will receive more inspections and more demanding inspections than low safety significant segments. In any integrated categorization process, the principles in Regulatory Guide 1.174 need to be addressed. Irrespective of the method used in the analysis, the licensee needs to justify the final categorization process as being robust and reasonable with respect to the analysis uncertainties.

DRAFT April 2003 19

DRAFT 2.2.3 Demonstrate Change in Risk Resulting from Change in lSI Program Any change in the lSI program has an associated risk impact. Evaluation of the change in risk may be a detailed calculation or it may be a bounding estimate supported by sensitivity studies as appropriate. The change may be a risk increase, a risk decrease, or risk neutral. The change is evaluated and compared with the guidelines presented in Regulatory Guide 1.174 (Ref. 4). The staff expects that a RI-ISI program would lead to both risk reduction and reduction in radiation exposure to plant personnel.

The change in risk estimate should appropriately account for the change in the number of elements inspected and the effects of enhanced inspection. The methods used to determine the piping failure potential, the piping failure consequence, and the impact of the change in the number of inspections should together provide confidence that any increase in core damage frequency or risk is small and acceptable in accordance with RG 1.174 (Ref. 4) guidelines and consistent with the intent of the Commission's Safety Goal Policy Statement (Ref. 1).

2.3 Integrated Decisionmaking Regulatory Positions 2.1 and 2.2 address the elements of traditional analysis and PRA analysis of a RI-ISI program. These elements are part of an integrated decisionmaking process that assesses the acceptability of the program. The key principles of Regulatory Guide 1.174 (Ref.

4), are systematically addressed. Technical and operations personnel at the plant review the information and render a finding of the safety significance category for each piping segment under review. Detailed guidelines for the categorization of piping segments should be developed and discussed with the group responsible for the determination (typically performed by the plant's expert panel).

The method for selecting the number of piping elements to be inspected should be justified.

3. ELEMENT 3: IMPLEMENTATION, PERFORMANCE MONITORING, AND CORRECTIVE ACTION STRATEGIES Integrating the information obtained from Elements 1 and 2 of the RI-ISI process (as described in Regulatory Positions 1 and 2 of this guide), the licensee develops proposed RI-ISI implementation, performance monitoring, and corrective action strategies. The RI-ISI program should identify piping segments whose inspection strategy (Le., frequency, number of inspections, methods, or all three) should be increased as well as piping segments whose inspection strategies might be relaxed. The number of required inspections should be a product of the systematic application of the risk-informed process. The program should be self-correcting as experience dictates. The program should contain performance measures used to confirm the safety insights gained from the risk analyses.

DRAFT April 2003 20

DRAFT 3.1 Program Implementation A licensee should have in place a schedule for inspecting all segments categorized as safety significant in its RI-ISI program. This schedule should include inspection strategies and inspection frequencies, inspection methods, the sampling program (the number of elements/areas to be inspected, the acceptance criteria, etc.) for the safety signi'ficant piping that is within the scope of the lSI program, including piping segments identified as safety significant that are not currently in the lSI program.

The analysis for a RI-ISI program will, in most cases, confirm the appropriateness of the inspection interval and scope requirements of the ASME Boiler and Pressure Vessel Code (B&PVC)Section XI Edition and Addenda committed to by a licensee in accordance with 10 CFR 50.55a. The requirements for these intervals are contained in Section XI of the B&PVC.

However, should active degradation mechanisms surface, the inspection interval would be modified as appropriate. Updates to the RI-ISI program should be performed at least periodically to coincide with the inspection program requirements contained in Section XI under Inspection Program B. The RI-ISI program should be evaluated periodically as new information becomes available that could impact the lSI program. For example, if changes to the PRA impact the decisions made for the RI-ISI program, if plant design and operations change such that they impact the RI-ISI program, if inspection results identify unexpected flaws, or if replacement activities impact the failure potential of piping, the effects of the new information should be assessed. The periodic evaluation may result in updates to the RI-ISI program that are more restrictive than required by Section XI. As plant design feature changes are implemented, changes to the input associated with the RI-ISI program segment definition and element selections should be reviewed and modified as needed. Changes to piping performance, the plant procedures that can affect system operating parameters, piping inspection, component and valve lineups, equipment operating modes, or the ability of the plant personnel to perform actions associated with accident mitigation should be reviewed in any RI-ISI program update. Leakage and flaws identified during scheduled inspections should be evaluated as part of the RI-ISI update.

Piping segments categorized as safety significant that are not in the licensee's current lSI program should (wherever appropriate and practical) be inspected in accordance with applicable ASME Code Cases (or revised ASME Code), including compliance with all administrative requirements. Where ASME Section XI inspection is not practical or appropriate, or does not conform to the key principles identi'fied in this document, alternative inspection intervals, scope, and methods should be developed by the licensee to ensure piping integrity and to detect piping degradation. A summary of the piping segments and their proposed inspection intervals and scope should be provided to the NRC prior to implementation of the RI-ISI program at the plant.

For piping segments categorized as safety significant that were the subject of a previous NRC-approved relief request or were exempt under existing Section XI criteria, the licensee DRAFT April 2003 21

DRAFT should assess the appropriateness of the relief or exemption in light of the risk significance of the piping segment.

3.2 Performance Monitoring 3.2.1 Periodic Updates The RI-ISI program should be updated at least on the basis of periods that coincide with the inspection program requirements contained in Section XI under Inspection Program B. These updates should be performed more frequently if dictated by any plant procedures to update the PRA (Which may be more restrictive than a Section XI period type update) or as new degradation mechanisms are identified.

3.2.2 Changes to Plant Design Features As changes to plant design are implemented, changes to the inputs associated with RI-ISI program segment definition and element selections may occur. It is important to address these changes to the inputs used in any assessment that may affect resultant pipe failure potentials used to support the RI-ISI segment definition and element selection. Some examples of these inputs would include:

• Operating characteristics (e.g., changes in water chemistry control)

• Material and configuration changes

• Welding techniques and procedures

• Construction and preservice examination results

• Stress data (operating modes, pressure, and temperature changes)

In addition, plant design changes could result in significant changes to a plant's CDF or LERF, which in turn could result in a change in consequence of failure for system piping segments.

3.2.3 Changes to Plant Procedures Changes to plant procedures that affect lSI, such as system operating parameters, test intervals, or the ability of plant operations personnel to perform actions associated with accident mitigation, should be included for review in any RI-ISI program update. Additionally, changes in those procedures that affect component inspection intervals, valve lineups, or operational modes of equipment should also be assessed for their impact on changes in postulated failure mechanism initiation or CDF/LERF contribution.

DRAFT April 2003 22

DRAFT 3.2.4 Equipment Performance Changes Equipment performance changes should be reviewed with system engineers and maintenance personnel to ensure that changes in performance parameters such as valve leakage, increased pump testing, or identification of vibration problems is included in the periodic evaluation of the RI-ISI program update. Specific attention should be paid to these conditions if they were not previously assessed in the qualitative inputs to the element selections of the RI-ISI program.

3.2.5 Examination Results When scheduled RI-ISI program NDE examinations, pressure tests, and corresponding VT-2 visual examinations for leakage have been completed, and if unacceptable flaws, evidence of service related degradation, or indications of leakage have been identified, the existence of these conditions should be evaluated. This update of the RI-ISI program should follow the applicable elements of Appendix B to 10 CFR Part 50 to determine the adequacy of the scope of the inspection program.

3.2.6 Information on Individual Plant and Industry Failures Review of individual plant maintenance activities associated with repairs or replacements, including identified flaw evaluations, is an important part of any periodic update, regardless of whether the activity is the result of a RI-ISI program examination. Evaluating this information as it relates to a licensee's plant provides failure information and trending information that may have a profound effect on the element locations currently being examined under a RI-ISI program. Industry failure data is just as important to the overall program as the owner's information. During the periodic update, industry data bases (including available international data bases) should be reviewed for applicability to the owner's plant.

3.3 Corrective Action Programs Each licensee of a nuclear power plant is responsible for having a corrective action program, consistent with Regulatory Guide 1.174 (Ref. 4). Measures are to be established to ensure that conditions adverse to quality, such as failures, malfunctions, deficiencies, deviations, defective material and equipment, and nonconformances, are promptly identified and corrected. In the case of significant conditions adverse to quality, the measures must ensure that the cause of the condition is determined and corrective action is taken to preclude repetition. The identification of the significant condition adverse to quality, the cause of the condition, and the corrective action are to be documented and reported to appropriate levels of management.

For Code piping categorized as safety significant, this corrective action program should be consistent with applicable Section XI provisions. For non-Code and Code-exempt piping categorized as safety signi'ficant, appropriate Section XI provisions should also be used, or the licensee should submit an alternative program based on the risk significance of the piping.

DRAFT April 2003 23

DRAFT 3.4 Acceptance Guidelines These acceptance guidelines are for the implementation, monitoring, and corrective action programs for the accepted RI-ISI program plan.

1. The evaluation of the implementation program will be based on the attributes presented in Regulatory Positions 3.1 through 3.3 of this Regulatory Guide 1.178.

2. The corrective action program should provide reasonable assurance that a nonconforming component will be brought back into conformance in a timely fashion.

The corrective actions required in ASME Section XI should continue to be followed.

3. Evaluations within the corrective action program may also include:

• Ensuring that the root cause of the condition is determined and that corrective actions are taken to preclude repetition. The identification of the significant condition adverse to quality, the cause of the condition, and the corrective action are to be documented and reported to appropriate levels of management.

• Determining the impact of the failure or nonconformance on system or train operability since the previous inspection.

• Assessing the applicability of the failure or nonconforming condition to other components in the RI-ISI program.

• Correcting other susceptible RI-ISI components as necessary.

• Incorporating the lessons in the plant data base and computer models, if appropriate.

• Assessing the validity of the failure rate and unavailability assumptions that can result from piping failures used in the PRA or in support of the PRA, and

• Considering the effectiveness of the component's inspection strategy in detecting the failure or nonconforming condition. The inspection interval would be reduced or the inspection methods adjusted, as appropriate, when the component (or group of components) experiences repeated failures or nonconforming conditions.

4. The corrective action evaluation should be provided to the licensee's PRA and AI-lSI groups so that any necessary model changes and regrouping are done, as appropriate.

5. The AI-lSI program documents should be revised to document any RI-ISI program changes resulting from the corrective actions taken.

DAAFT April 2003 24

DRAFT

6. A program is in place that monitors industry findings.

7. Piping is subject to examination. The examination requirements include all piping evaluated by the risk-informed process and categorized as safety significant.

8. The inspection program is to be completed during each ten-year inspection interval with the following exceptions.

8.1 If, during the interval, a reevaluation using the RI-ISI process is conducted and scheduled items are no longer required to be examined, these items may be eliminated.

8.2 If, during the interval, a reevaluation using the RI-ISI process is conducted and items must be added to the examination program, those items will be added.

9. If additional examinations are needed following the identification of an unacceptable flaws, additional examinations will be performed on those elements with the same root cause or degradation mechanisms as the identified flaw or relevant condition. The number of additional examinations shall be equivalent to the number of elements required to be inspected during the current outage. If unacceptable flaws or relevant conditions are again found similar to the initial problem, the remaining elements identified as susceptible will be examined. All additional examinations shall be performed during the current outage.

10. Examination and Pressure Test Requirements. Pressure testing and VT-2 visual examinations are to be performed on Class 1,2, and 3 piping systems in accordance with Section XI, as specified in the licensee's lSI program. The pressure testing and VT-2 examinations are also to be performed on non-Code safety significant piping.

The non-Code safety significant piping will be treated as ASME Code Class piping for the purposes of examination and pressure testing.

Examination methods, equipment qualification, personnel qualification, and procedure qualification are to be in accordance with the edition and addenda endorsed by the NRC through 10 CFR 50.55a, "Codes and Standards."

11. Acceptance standards for identified flaws and repair or replacement activities are to be performed in accordance with the B&PVC Section XI requirements.

12. Records and reports should be prepared and maintained in accordance with the B&PVC Section XI Edition and Addenda as specified in the licensee's lSI program.

DRAFT April 2003 25

DRAFT

4. ELEMENT 4: DOCUMENTATION The recommended contents for a plant-specific risk-informed lSI submittal are presented here.

This guidance will help ensure the completeness of the information provided and aid in minimizing the time needed for the review process.

4.1 Documentation that Should Be Included in a Licensee's RI-ISI Submittal References to NRC-approved generic topical reports that address the methodology and issues requested in a submittal are acceptable. Documentation guidelines specified in approved topical reports may be used instead of the following guidelines when the methodology from an approved topical report is used. Since topical reports could cover more issues than applied by a licensee or the licensee may elect to deviate from the full body of issues addressed in the topical report, such distinctions should be clearly stated.

The following items should be included in the application to implement a RI-ISI program.

• A request to implement a RI-ISI program as an authorized alternative to the current NRC endorsed ASME Code pursuant to 10 CFR 50.55a(a)(3)(i). The licensee should also provide a description of how the proposed change impacts any commitments made to the NRC.

• Discussions on each of the following five key principles of risk-informed regulations (see Section 2 of Regulatory Guide 1.174 (Ref. 4) for more details).

1. The proposed change meets the current regulations unless it is explicitly related to an alternative requested under 10 CFR 50.55a(a)(3)(i), a requested exemption, or a rule change.

2. The proposed change is consistent with the defense-in-depth philosophy (see detailed discussions in Section 2.2.1.1 of Regulatory Guide 1.174).

3. The proposed change maintains sufficient safety margins (see detailed discussions in Section 2.2.1.2 in Regulatory Guide 1.174).

4. When proposed changes result in an increase in core damage frequency and/or risk, the increases should be small and consistent with the guidance in Regulatory Guide 1.174.

5. The impact of the proposed change should be monitored using performance measurement strategies.

DRAFT April 2003 26

DRAFT

• Identi'fication of the aspects of the plant's current requirements that would be affected by the proposed RI-ISI program. This identification should include all commitments and augmented programs (for example, the IGSCC inspections and other commitments arising 'from generic letters affecting piping integrity) that the licensee intends to change or terminate as part of the RI-ISI program. The application of the RI-ISI methodology to incorporate and change the augmented program should be justified.

• Identification of the specific revisions to eXisting inspection schedules, locations, and methods that would result from implementation of the proposed program.

• Plant procedures or documentation containing the guidelines for all phases of evaluating and implementing a change in the lSI program based on probabilistic and traditional insights. These should include a description of the integrated decisionmaking process and criteria used for categorizing the safety significance of piping segments, a description of how the integrated decisionmaking was performed, a description and justification of the number of elements to be inspected in a piping segment, the qualifications of the individuals making the decisions, and the guidelines for making those decisions.

• The results of the licensee's lSI-specific analyses used to support the program change with enough detail to be clearly understandable to the reviewers of the program. These results should include the following information.

A list of the piping systems reviewed.

A list of each segment, including the number of welds, weld type and properties of the welding material and base metal, the failure potential, CDF, CCDF/CCDP, LERF, CLERF, importance measure results (RAW, F-V, etc.) and justification of the associated threshold values, degradation mechanism, test and inspection intervals used in or in support of the PRA, etc. Results from other methods used to develop the consequences and categorization of each segment (or weld) should be documented in a similar level of detail.

The degradation mechanisms for each segment (if segments contain welds exposed to different degradation mechanism, for each weld) used to develop the failure potential of each segment. For the selected limiting locations, provide examples of the failure mode, failure potential, failure mechanism, weld type, weld location, and properties of the welding material and base metal.

A detailed description and justification for the number of elements to be inspected.

Equipment assumed to fail as a direct or indirect consequence of each segment's failure (if segments contain welds with different failure consequences, for each weld).

DRAFT April 2003 27

DRAFT A description of how the impact of the change between the current Section XI and the proposed RI-ISI programs is evaluated or bounded, and how this impact compares with the risk guidelines in Section 2.2.2.2 of Regulatory Guide 1.174.

• The means by which failure probabilities or frequencies or potential were determined.

• A description of the PRA used for the categorization process and for the determination of risk impact, in terms of the process to ensure quality, scope, and level of detail, and how limitations in quality, scope, and level of detail are compensated for in the integrated decisionmaking process supporting the lSI submittal. At a minimum, The submittal should include the following information.

The CDF and LERF estimates and the version, calculation or other reference number that identifies which version of the PRA was used.

A description of the process used to up-date the PRA to ensure that the PRA analyses adequately represent the current design, construction, operational practices, and operational experience of the plant and its operator.

A description of the staff and industry reviews performed on the PRA3

• Limitations, weakness, or improvements identified by the reviewers that could change the results of the PRA should be discussed. The resolution of the reviewer comments, or an explanation of the insensitivity of the analysis used to support the submittal to the comment, should be provided.

• If the submittal includes modified inspection intervals, the methodology and results of the analysis should be submitted.

• A description of the implementation, performance monitoring, and corrective action strategies and programs in sufficient detail for the staff to understand the new lSI program and its implications.

3In April 2000, the Nuclear Energy Institute submitted a process (Ref. 22) for peer review of licensee PRAs. It was submitted for staff review in the context of its use in categorizing SSCs with respect to special treatment requirements (Le., supporting NRC's risk-informed Proposed Rulemaking to Add New Section 10 CFR 50.69, "Risk-Informed Categorization and Treatment of Structures, Systems, and Components""Option 2" work (SECY-02-0176, Ref. 23)). This process when endorsed by the NRC may also be of use in making licensing basis changes (as well as other regulatory activities not addressed here); if so, future revisions of this regulatory guide may endorse this certification process for this purpose.

DRAFT April 2003 28

DRAFT

• Applicable documentation discussed under the Cumulative Risk documentation for submittal in Section 1.3 of Regulatory Guide 1.174 (Ref. 4).

• Reference to NRC-approved topical reports on implementing a RI-ISI and supporting documents. Variations from the topical reports and supporting documents should be clearly identified.

4.2 Documentation that Should Be Available Onsite for Inspection The licensee should maintain at its facility the technical and administrative records used in support of its submittal, or should be able to generate the information on request. This information should be available for NRC review and audit. If changes are planned to the lSI program based on internal procedures and without prior NRC approval, the following information should also be placed in the plant's document control system so that the analyses for any given change can be identified and reviewed. The record should include, but not be limited to, the following information:

• All the documentation discussed in 4.1. Although the documentation requirements in a submittal may be reduced when referring to NRC-approved topical reports, all the documentation included under 4.1 should be available for onsite inspection.

• Plant and applicable industry data used in support of the RI-ISI program. All analyses and assumptions used in support of the RI-ISI program and communications with outside organizations supporting the RI-ISI program (e.g., use of peer and independent reviews, use of expert contractors).

• Detailed procedures and analyses performed by an expert panel, or other technical groups, if relied upon for the RI-ISI program, including a record of deliberations, recommendations, and findings.

• Documentation of the plant's baseline PRA used to support the lSI submittal should be of sufficient detail to allow an independent reviewer to ascertain whether the PRA reflects the current plant configuration and operational practices commensurate with the role the PRA results play in the integrated decisionmaking process. In addition to documentation on the PRA itself, analyses performed in support of the lSI submittal should be documented in a manner consistent with the baseline documentation. Such analyses may include:

The process used to identify initiating events developed in support of the RI-ISI submittal and the results from the process.

Any event and fault trees developed during the RI-ISI submittal preparation.

DRAFT April 2003 29

DRAFT Documentation of the methods and techniques used to identify and quantify the impact of pipe failures using the PRA, or in support of the PRA, if different from those used during the development of the baseline PRA.

The techniques used to identify and quantify human actions.

The data used in any uncertainty calculations or sensitivity calculations, consistent with the guidance provided in Regulatory Guide 1.174.

How uncertainty was accounted for in the segment categorization, and the sensitivity studies performed to ensure the robustness of the categorization.

• Detailed results of the inspection program corresponding to the lSI inspection records described in the implementation, performance monitoring, and corrective action program accompanying the RI-ISI submittal.

• For each piping segment, information on weld type, weld location, and properties of welding material and base metal.

• For each piping segment, information regarding the process and assumptions used to develop failure mode and failure potential (frequency/probability), in addition to the identification of the failure mechanism.

DRAFT April 2003 30

DRAFT REFERENCES

1. USNRC, "Use of Probabilistic Risk Assessment Methods in Nuclear Regulatory Activities; Final Policy Statement," Federal Register, Vol. 60, p 42622, August 16,1995.

2. USNRC, "Framework for Applying Probabilistic Risk Analysis in Reactor Regulation,"

SECY-95-280, November 27,1995.

3. USNRC, "Standard Review Plan for the Review of Risk-Informed Inservice Inspection of Piping," NUREG-0800, Section 3.9.8, September 1998.

4. USNRC, "An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Current Licensing Basis," Regulatory Guide 1.174, Revision 1, November 2002.

5. USNRC, "An Approach for Plant-Specific, Risk-Informed Decisionmaking: Inservice Testing," Regulatory Guide 1.175, August 1998.

6. USt\lRC, "An Approach for Plant-Specific, Risk-Informed Decisionmaking: Graded Quality Assurance," Regulatory Guide 1.176, August 1998.

7. USNRC, "An Approach for Plant-Specific, Risk-Informed Decisionmaking: Technical Specifications," Regulatory Guide 1.177, August 1998.

8. USNRC, "Standard Review Plan for Risk-Informed Decision Making," Standard Review Plan, NUREG-0800, Chapter 19, Revision 1, November 2002.

9. USNRC, "Standard Review Plan for Risk-Informed Decision Making: Inservice Testing,"

Standard Review Plan, NUREG-0800, Revision 1 Chapter 3.9.7, April 2003.

10. USNRC, "Standard Review Plan for Risk-Informed Decision Making: Technical Specifications," Standard Review Plan, NUREG-0800, Chapter 16.1, August 1998.

11. Electric Power Research Institute, "Risk-Informed Inservice Inspection Evaluation Procedure," EPRI TR-106706, June 1996.

12. Westinghouse Energy Systems, "Westinghouse Owners Group Application of Risk Informed Methods to Piping Inservice Inspection Topical Report," WCAP-14572, Revision 1, October 1997.

13. Westinghouse Energy Systems, "Westinghouse Structural Reliability and Risk Assessment (SRRA) Model for Piping Risk-Informed Inservice Inspection,"

WCAP-14572, Revision 1, Supplement 1, October 1997.

DRAFT April 2003 31

DRAFT

14. American Society of Mechanical Engineers, "Rules for Inservice Inspection of Nuclear Power Plant Components," ASME Boiler and Pressure Vessel Code,Section XI, 1989 Edition, New York.

15. USNRC, "Design and Fabrication Code Case Acceptability, ASME Section ,", Division I," Regulatory Guide 1.84, Revision 30, October 1994.

16. USNRC, "Materials Code Case Acceptability, ASME Section III, Division 1," Regulatory Guide 1.85, Revision 30, October 1994.

17. USNRC, "Inservice Inspection Code Case Acceptability, ASME Section XI, Division 1,"

Regulatory Guide 1.147, Revision 11, October 1994.

18. M.A. Meyer and J.A. Booker, "Eliciting and Analyzing Expert Judgement,"

NUREG/CR-5424 (Prepared for the NRC by Los Alamos National Laboratory), USNRC, January 1990.

19. J.P. Kotra et aI., "Branch Technical Position on the Use of Expert Elicitation in the High Level Radioactive Waste Program," NUREG-1563, USNRC, November 1996.

20. The American Society of Mechanical Engineers, "Standard for Probabilistic Risk Assessment for Nuclear Power Plant Applications," ASME RA-S-2002, AprilS, 2002.

21. USNRC, "Addressing PRA Quality in Risk-Informed Activities," SECY-00-0162, July 28, 2000.

22. Letter to Samuel J. Collins, NRC, from Ralph E. Beedle, NEI, with attached "Probabilistic Risk Analysis (PRA) Peer Review Guidance," Rev. A3, NEI 00-02, Prepared for NEI Risk-Based Applications Task Force by WOGlWestinghouse Electric Co., and B&WOG/Framatome Technologies, Inc., April 24, 2000.

23. Proposed Rulemaking to Add New Section 10 CFR 50.69, "Risk-Informed Categorization and Treatment of Structures, Systems, and Components" SECY-02 0176, September 30, 2002.

DRAFT April 2003 32

DRAFT REGULATORY ANALYSIS A draft regulatory analysis was published with the draft of this guide when it was published for public comment (Task DG-1 063, October 1997). No changes were necessary, so a separate regulatory analysis for Regulatory Guide 1.178 has not been prepared. A copy of the draft regulatory analysis is available for inspection or copying for a fee in the NRC's Public Document Room at 2120 L Street NW., Washington, D.C., under Task DG-1063.

DRAFT April 2003 33

UNITED STATES NUCLEAR REGULATORY COMMISSION STANDARD REVIEW PLAN OFFICE OF NUCLEAR :REACTOR REGULATION Standard Review Plan For the Review of Risk-Informed Inservice Inspection of Piping SRP Chapter 3.9.8 April 21,2003 Contacts: S. A. Ali (301) 415-5704 (RES)

S. Dinsmore (301) 415-8482 (NRR)

A. Keirn (301) 415-1671 (NRR)

Draft April 2003

Standard Review Plan For the Review of Risk-Informed Inservice Inspection of Piping FOREWORD The U.S. Nuclear Regulatory Commission's (NRC) policy statement on probabilistic risk assessment (PRA) (Ref. 1) encourages greater use of this analysis technique to improve safety decisionmaking and improve regulatory efficiency. The NRC staff's Risk~lnformed Regulation Implementation Plan (Ref. 2) describes activities now under way or planned to expand this use.

These activities include, for example, providing guidance for NRC inspectors on focusing inspection resources on risk-important equipment.

This Standard Review Plan (SRP) chapter describes review procedures and acceptance guidelines for NRC staff reviews of proposed plant-specific, risk-informed changes to a licensee's inservice inspection (lSI) program for piping. The review procedures contained in this SRP are consistent with the approach for using probabilistic risk assessment in risk-informed decisions on plant-specific changes to the licensing basis described in Regulatory Guide 1.174 (Ref. 3) and acceptable methods for implementing a risk-informed lSI (RI-ISI) program described in RG 1.178 (Ref.4). Licensees may propose RI-ISI programs consistent with the guidance provided in RG 1.178 (Ref. 4), propose an approach consistent with the methodologies approved by the NRC staff (Ref. 5 and 6) or maintain their lSI program in accordance with the American Society of Mechanical Engineers (ASME) Code as referenced in 10 CFR 50.55a.

It is the NRC staff's intention to initiate rulemaking as necessary to permit licensees to implement RI-ISI programs, consistent with this SRP chapter, without having to get NRC approval of an alternative to the ASME Code requirements pursuant to 10 CFR 50.55a(a)(3). Until the

, completion of such rulemaking, the staff anticipates reviewing and approving each licensee's

. RI-IS/program as an alternative to the current Code reqUired lSI program. As such, the licensee's RI-ISI program will be enforceable under 10 CFR 50.55a.

The current ASME Code inservice inspection requirements, as endorsed in 10 CFR 50.55a, have been determined to provide reasonable assurance that public health and safety will be maintained. The individual ASME Code committees concerned with inservice inspection continually review these inspection strategies to develop improvements to the existing Code requirements. Changes to the ASME Code, either as new Code editions or Code Cases, are subject to review and approval by the NRC to ensure that the new inspection requirements maintain an adequate level public health and safety. A risk-informed inservice inspection program, if properly constructed, will also provide an acceptable level of quality and safety by evaluating and possibly improving the inspection effectiveness for the safety significant piping (as identified by the licensee's integrated decision making process) in conjunction with the relaxation Draft April 2003

of inspection requirements for the remaining piping.

Draft April 2003 ii

Standard Review Plan For the Review of Risk-Informed Inservice Inspection Applications TABLE OF CONTENTS 3.9.8 RISK-INFORMED INSERVICE INSPECTION OF PIPING Page REVIEW RESPONSIBILITIES 1 I. AREA OF REVIEW 1 1.1 Element 1: Define the Proposed Changes to lSI Program 2 1.2 Element 2: Engineering Analysis 3 1.2.1 Traditional Analysis 3 1.2.2 Probabilistic Risk Assessment 3 1.2.2.1 Scope of Piping Systems 4 1.2.2.2 Piping Segments 4 1.2.2.3 Evaluating Pipe Failures with PRA 4 1.2.2.4 Piping Failure Potential 4 1.2.2.5 Consequences of Failure 5 1.2.2.6 Risk Impact of lSI Changes 6 1.2.3 Integrated Decisionmaking 6

. 1.3 Element 3: Implementation and Monitoring Programs 6 II. ACCEPTANCE CRITERIA 7 11.1 Element 1: Define the Proposed Changes to lSI Program 8 11.2 Element 2: Engineering Analysis 8 11.2.1 Traditional Analysis 8 11.2.2 Probabilistic Risk Assessment 9 11.2.2.1 Scope of Piping Systems 9 Draft April 2003 iii

11.2.2.2 Piping Segments 9 11.2.2.3 Evaluating Pipe Failures with PRA 10 11.2.2.4 Piping Failure Potential 10 11.2.2.5 Consequences of Failure 11 11.2.2.6 Risk Impact of lSI Changes 12 11.2.3 Integrated Decisionmaking 12 11.3 Element 3: Implementation and Monitoring Programs 13 III. REVIEW PROCEDURES 15 111.1 Element 1: Define the Proposed Changes to lSI Program 16 111.2 Element 2: Engineering Analysis 16 111.2.1 TraditionaIAnalysis 16 111.2.2 Probabilistic Risk Assessment 16 111.2.2.1 Scope of Piping Systems 17 111.2.2.2 Piping Segments 17 111.2.2.3 Evaluating Pipe Failures with PRA 17 111.2.2.4 Piping Failure Potential 17 111.2.2.5 Consequences of Failure 18 111.2.2.6 Risk Impact of lSI Changes 18 111.2.3 Integrated Decisionmaking 18 111.3 Element 3: Implementation and Monitoring Programs 19 IV. ELEMENT 4: DOCUMENTATION 19 V. EVALUATION FINDINGS 19 VI. IMPLEMENTATION 21 VII. REFERENCES 21 Draft April 2003 iv

Standard Review Plan For the Review of Risk-Informed Inservice Inspection Applications 3.9.8 RISK-INFORMED INSERVICE INSPECTION REVIEW RESPONSIBILITIES Primary: Materials and Chemical Engineering Branch (EMCB)

Secondary: Probabilistic Safety Assessment Branch (SPSB)

I. AREAS OF REVIEW The purpose of this standard review plan is to describe the procedure that the NRC staff will utilize to review risk-informed inservice inspection programs for piping that are different from the current lSI programs at a nuclear power facility. In implementing risk-informed decision making, the licensee must ensure that any proposed change to the lSI program or the regulation meets the following key principles:

1. The proposed change meets the current regulations unless it is explicitly related to the request for alternatives under 10 CFR 50.55a(a)(3) or a requested exemption or rule change, Le., a "specific exemption" under 10 CFR 50.12 or a "petition for rulemaking" under 10 CFR 2.802.

2. The proposed change is consistent with the defense-in-depth philosophy.

3. The proposed change maintains sufficient safety margins.

4. When proposed changes result in an increase in core damage frequency or risk, the increases should be small and consistent with the intent of the Commission's Safety Goal Policy Statement (Ref. 7).

5. The impact of the proposed change should be monitored using performance measurement strategies.

Each of these principles should be considered in the risk-informed, integrated decisionmaking process. Given these principles of risk-informed decision making, the staff has identified a four element approach that forms the basis for evaluating proposed changes to a plant's lSI program based on risk-informed methods. These are: define the change, perform an engineering analysis, define the implementation and monitoring program, and submit the proposed change.

Draft April 2003 3.9.8-1

of inspection requirements for the remaining piping.

Draft April 2003 ii

Standard Review Plan For the Review of Risk-Informed Inservice Inspection Applications TABLE OF CONTENTS 3.9.8 RISK-INFORMED INSERVICE INSPECTION OF PIPING Page REVIEW RESPONSIBILITIES 1 I. AREA OF REVIEW 1 1.1 Element 1: Define the Proposed Changes to lSI Program 2 1.2 Element 2: Engineering Analysis 3 1.2.1 Traditional Analysis 3 1.2.2 Probabilistic Risk Assessment 3 1.2.2.1 Scope of Piping Systems 4 1.2.2.2 Piping Segments 4 1.2.2.3 Evaluating Pipe Failures with PRA 4 1.2.2.4 Piping Failure Potential 4 1.2.2.5 Consequences of Failure 5 1.2.2.6 Risk Impact of lSI Changes 6 1.2.3 Integrated Decisionmaking 6

. 1.3 Element 3: Implementation and Monitoring Programs 6 II. ACCEPTANCE CRITERIA 7 11.1 Element 1: Define the Proposed Changes to lSI Program 8 11.2 Element 2: Engineering Analysis 8 11.2.1 Traditional Analysis 8 11.2.2 Probabilistic Risk Assessment 9 11.2.2.1 Scope of Piping Systems 9 Draft April 2003 iii

11.2.2.2 Piping Segments 9 11.2.2.3 Evaluating Pipe Failures with PRA 10 11.2.2.4 Piping Failure Potential 10 11.2.2.5 Consequences of Failure 11 11.2.2.6 Risk Impact of lSI Changes 12 11.2.3 Integrated Decisionmaking 12 11.3 Element 3: Implementation and Monitoring Programs 13 III. REVIEW PROCEDURES 15 111.1 Element 1: Define the Proposed Changes to lSI Program 16 111.2 Element 2: Engineering Analysis 16 111.2.1 Traditional Analysis 16 111.2.2 Probabilistic Risk Assessment 16 111.2.2.1 Scope of Piping Systems 17 111.2.2.2 Piping Segments 17 111.2.2.3 Evaluating Pipe Failures with PRA 17 111.2.2.4 Piping Failure Potential 17 111.2.2.5 Consequences of Failure 18 111.2.2.6 Risk Impact of lSI Changes 18 111.2.3 Integrated Decisionmaking 18 111.3 Element 3: Implementation and Monitoring Programs 19 IV. ELEMENT 4: DOCUMENTATION 19 V. EVALUA1"ION FINDINGS 19 VI. IMPLEMENTATION 21 VII. REFERENCES 21 Draft April 2003 iv .

Standard Review Plan For the Review of Risk-Informed Inservice Inspection Applications 3.9.8 RISK-INFORMED INSERVICE INSPECTION REVIEW RESPONSIBILITIES Primary: Materials and Chemical Engineering Branch (EMCB)

Secondary: Probabilistic Safety Assessment Branch (SPSB)

I. AREAS OF REVIEW The purpose of this standard review plan is to describe the procedure that the NRC staff will utilize to review risk-informed inservice inspection programs for piping that are different from the current lSI programs at a nuclear power facility. In implementing risk-informed decision making, the licensee must ensure that any proposed change to the lSI program or the regulation meets the following key principles:

1. The proposed change meets the current regulations unless it is explicitly related to the request for alternatives under 10 CFR 50.55a(a)(3) or a requested exemption or rule change, Le., a "specific exemption" under 10 CFR 50.12 or a "petition for rulemaking n under 10 CFR 2.802.

2. The proposed change is consistent with the defense-in-depth philosophy.

3. The proposed change maintains sufficient safety margins.

4. When proposed changes result in an increase in core damage frequency or risk, the increases should be small and consistent with the intent of the Commission's Safety Goal Policy Statement (Ref. 7).

5. The impact of the proposed change should be monitored using performance measurement strategies.

Each of these principles should be considered in the risk-informed, integrated decisionmaking process. Given these principles of risk-informed decision making, the staff has identified a four element approach that forms the basis for evaluating proposed changes to a plant's lSI program based on risk-informed methods. These are: define the change, perform an engineering analysis, define the implementation and monitoring program, and submit the proposed change.

Draft April 2003 3.9.8-1

The first element involves the characterization of the proposed change. "rhe licensee should identify those aspects of the plant's licensing bases that may be affected by the proposed change in lSI requirements, including, but not limited to, rules and regulations, final safety analysis report (FSAR), technical specifications, licensing conditions, and licensing commitments. The licensee should also identify all aspects and elements of the lSI program that it intends to modify in future evaluations without prior NRC approval of the change. Piping systems, segments, and welds that are affected by the change in lSI program should be identified. Plant systems and functions that rely on the affected piping should also be identified. Industry and plant specific information applicable to the piping degradation mechanisms that characterizes the relative effectiveness of past inspections should be documented.

As part of the second element, the licensee should evaluate the proposed change with regard to the principles that the proposed change is consistent with the defense-in-depth philosophy, that sufficient margins are maintained, and that proposed increases in core damage frequency and risk are small and are consistent with the intent of the Commission's Safety Goal Policy Statement as discussed in RG 1.174 (Ref. 3). This element consists of engineering evaluations, including traditional engineering analyses as well as PRAs. The PRA-based assessment of the proposed change should explicitly consider the affected piping segments and assess the impact on the core damage frequency (CDF) and large early release frequency (LERF) caused by changing the licensee's current lSI program. The results of the complementary traditional and PRA methods should be used in an integrated decisionmaking process.

The third element involves developing implementation and monitoring programs. The primary goal for this element is to assess the performance of piping under the proposed change by establishing performance-monitoring strategies to confirm the assumptions and analyses that were conducted to justify the change. Inspection scope, intervals, and techniques should be clearly defined. The inspection scope and techniques should address all relevant failure mechanisms that could significantly impact the reliability and integrity of the piping.

The fourth element involves documenting the analyses and submitting the request for NRC review and approval. The submittal is reviewed by NRC in accordance with this standard review plan.

The following areas related to the use of AI-lSI program for piping are reviewed.

1.1 Element 1: Define the Proposed Change to lSI Program The licensee's RI-ISI submittal is reviewed to verify that the proposed changes to the lSI program have been defined in general terms. Those aspects of the plant's licensing bases that may be affected by the proposed change, including, but not limited to, rules and regulations, FSAA, technical specifications. and licensing conditions are reviewed. In addition, licensing commitments are reviewed. Particular piping systems and welds that are affected by the change in inspection practices are reviewed. Specific revisions to inspection scope, schedules, locations, and techniques are reviewed. The licensee's program and procedures guiding the evaluations leading to future changes to the lSI program without prior NRC approval are reviewed.

Plant systems and functions that rely on the affected piping are also reviewed. The staff reviews available engineering studies, methods, codes, applicable plant-specific and industry data and operational experience, PRA findings. and research and analysis results relevant to the proposed Draft April 2003 3.9.8-2

change. Plant-specific experience with inspection program results is reviewed and characterization relative to the effectiveness of past inspections of the piping and the flaws that have been observed is reviewed.

l2. Element 2: Engineering Analysis As part of the second element, the staff will review the licensee's engineering analysis of the proposed changes. The purpose of the review is to determine whether defense-in-depth is maintained, sufficient safety margins are maintained, and that proposed increases in risk, and their cumulative effect, are small and do not cause the NRC Safety Goals to be exceeded. RG 1.174 (Ref. 3) and RG 1.178 (Ref. 4) prOVide guidance for the performance of this evaluation.

1.2.1 Traditional Analysis The engineering analyses are reviewed to determine whether the impact of the proposed lSI changes is consistent with the principles that defense-in-depth and adequate safety margins are maintained.

The primary regulations governing 151 of piping are 10 CFR 50.55a and Appendix A to 10 CFR Part 50. The regulations reference other codes and requirements that define the elements of defense-in-depth and safety margins to ensure that structural integrity of piping is maintained.

The staff reviews the licensee's assessment of whether the proposed changes meet the regUlations.

10 CFR 50.55a references ASME Boiler and Pressure Vessel Code (BPVC)Section XI for the detailed requirements regarding piping 151. Inspections required by ASME BPVC Section XI are performed on a sample basis with additional inspections, in terms of locations as well as frequency, mandated in response to the detection of flaws. The objective of lSI is to identify conditions, such as flaw indications, that are precursors to leaks and ruptures in pressure boundaries that may impact plant safety. The staff reviews the licensee's bases for the assessment that the proposed change meets the intent of the ASME Code requirements.

Additional augmented inspection programs to address generic piping degradation problems have been recommended by the NRC to preclude piping failure and implemented by the industry.

Notable examples of augmented programs for piping inspections are to address intergrannular stress corrosion cracking (IGSCC) of stainless steel piping in boiling water reactors (BWR) (NRC Generic Letter 88-01), thermal fatigue (NRC Bulletin 88-08, NRC Bulletins 88-11, NRC Information Notice 93-020), stress corrosion cracking in pressurized water reactors (PWR) (IE Bulletin 79-17), Service Water Integrity Program (NRC Generic Letter 89-13) and flow accelerated corrosion (FAG) in the balance of plant for both PWRs and BWRs (NRC Generic Letter 89-08).

The manner in which the augmented inspection programs for piping are addressed is reviewed.

1.2.2 Probabilistic Risk Assessment The scope, level of detail, and quality required of the PRA is commensurate with the emphasis that is put on the risk insights and on the role the PRA results play in the integrated decision making process. If the justification for the change is based on well founded traditional arguments supported by PRA insights, a limited PRA review may be warranted. However, if the justi'fication Draft April 2003 3.9.8-3

for change is based on complex PRA arguments, then the breadth and depth of the PRA review will be substantially greater. Only those parts of the PRA which are used to support the lSi change application need to be reviewed.

1.2.2.1 Scope of Piping Systems The scope of piping included in the proposed RI-ISI program is reviewed. The current lSI requirements for nuclear power plant piping are specified in 10 CFR 50.55a which incorporates, by reference, the requirements of ASME BPVC Section XI. The extent to which the RI-ISI program scope incorporates ASME Class 1, 2 and 3 piping systems currently included in ASME BPVC Section XI program and any balance of plant piping is reviewed. The process to select the scope of piping, justification for the scope, and the specific choice of piping selected is reviewed.

1.2.2.2 Piping Segments The procedure for defining piping segments within the piping systems for the purpose of modeling a run of a pipe in a PRA or to define its lSI requirements is reviewed. The methods by which the failure consequences such as an initiating event. loss of a train, loss of a system, or a combination thereof, is incorporated in the definition of segments are reviewed. In addition to the failure consequences, the procedure and criteria used to identify and document the degradation mechanisms that can be present in piping within the selected systems boundaries is reviewed.

The procedure by which the location of the piping in the plant, and whether inside or outside the containment, is taken into account in defining piping segments is reviewed. The selection of piping segments within the piping system boundaries is an iterative process which may be affected by degradation as well as consequence evaluation which is not completed at the time of initial selection of piping segments within the selected piping systems. The procedure by which degradation mechanisms and consequences of piping segment failures are incorporated in the iterative process is reviewed.

1.2.2.3 Evaluating Pipe Failures with PRA Pipe ruptures are traditionally modeled as initiators and the failure of individual pipe segments or structural elements are not modeled in PRAs. The manner in which PRA, or the PRA results, is modified so that a more detailed treatment of the potential (or probability) of pipe failures and the influence of suc'"' failures on other systems is incorporated in the PRA is reviewed.

1.2.2.4 Piping Failure Potential Segment failure potential may be a quantitative estimate for each segment, or segments may be categorized into groups based on similar degradation mechanism, environment, and failure modes. There are three failure modes:

1. Initiating event failures where the failure directly causes a transient and mayor may not also fail one or more plant trains or systems. Initiating event failures are characterized by failure frequency.

2. Standby failures are those failures that cause the loss of a train or system but which do Draft April 2003 3.9.8-4

not directly cause a transient. Standby failures are characterized by train or system unavailability which may require shutdown due to technical specifications or limiting conditions for operation. Unavailability is a combination of failure frequency and exposure time.

3. Demand failures are failures accompanying a demand for a train or system and usually caused by the transient induced loads on the segment during system startup. Demand failures are characterized by a probability per demand.

The approach used for the determination of failure potential of piping segments is reviewed. The manner in which past failure data, expert opinion and probabilistic fracture mechanics is considered in determining the piping failure potential is reviewed. The determination of exposure time appropriate to standby failures is reviewed. It is expected that inspections will be performed in accordance with the schedule of Inspection Program A or Program B as specified in ASME XI.

When data analysis is utilized, appropriateness and completeness of data and whether data is taken over time is evaluated.

Probabilistic structural analysis techniques may be used to estimate a numerical frequency or probability of piping segment failure. This method utilizes conventional structural analysis techniques, such as fracture mechanics analysis, in combination with probabilistic methods, such as Monte-Carlo simulation. These techniques are implemented by computer codes to estimate failure probabilities as a function of time. The probabilistic structural analysis methodology for the determination of piping failure probabilities is reviewed to determine the appropriate application of fracture mechanics analysis and Monte-Carlo simulation techniques. Benchmarking of computer codes based on comparison with industry standard codes as well as operating experience is also reviewed. The applicant should demonstrate that the methodology is able to identify significant differences in failure frequencies or probabilities arising from differences in material properties and environmental influences such as the presence of known degradation mechanisms.

Alternatively, expert opinion or categorization based on degradation mechanisms may be used in conjunction with, or in lieu of fracture mechanics analysis to assign each element into a small number of failure potential categories; high, medium, or low for example. In such cases, the process and basis of failure potential determination is reviewed.

For both quantitative estimates and classification into similar groups, the manner in which failure modes, applicable industry experience, piping material, degradation mechanisms, and various other parameters are identified and considered is evaluated. There are numerous uncertainties involved in performing an assessment of segment failure potential. The procedures for addressing these uncertainties when predicting failure potential are reviewed.

1.2.2.5 Consequences of Failure Direct effects of piping failures include loss of coolant accidents (LOCA) or other flow diversions resulting in an initiator, or a consequential loss of systems because of the inability to deliver sufficient flow because of the failed piping. Indirect effects include consequential failures of additional equipment, including equipment in other systems, because of effects such as pipe whip, jet impingement. flooding, or temperature. The procedure by which direct and indirect effects are characterized and documented is reviewed to verify that appropriate failure Draft April 2003 3.9.8-5

mechanisms and dependencies will be evaluated in the risk analysis.

1.2.2.6 Risk Impact of lSI Changes The methodology used to characterize the change in risk due to the proposed change in the lSI program is reviewed. Part of the basis for the acceptability of any RI*ISI program is a demonstration that established risk measures are not significantly increased by the proposed reduction in the number of inspections for selected piping. To demonstrate this, the process and methodology used to appropriately account for the change in the number of elements inspected and the effects of an enhanced inspection method are reviewed.

1.2.3 Integrated Decisionmaking Acceptability of the impact of the proposed change in the lSI program is determined based on the review of the adequacy of the licensee's ful'fillment of the five key principles as listed in Section I and discussed in detail in RG 1.174 (Ref. 3). The licensee's processes, procedures, and decision criteria to integrate, and to iterate on the integration as necessary, the different elements of the engineering analysis discussed in Sections 1.2.1 and 1.2.2 and the key principles are reviewed.

The assignment of pipe elements into safety significant categories is an integral part of the risk informed lSI process. Consequently, the categorization process and all qualitative and quantitative guidelines used to support the categorization are also reviewed.

Risk measures utilized to characterize and differentiate the risk contributions from the individual piping segments are reviewed. The techniques. criteria, and the documentation used to develop and describe the risk measures are reviewed. The criteria for utilizing these risk measures to categorize the safety significance of each pipe segment are reviewed. Consideration of absolute and relative figures of merit is reviewed. Review is focused on the criteria for risk significance determination for lSI at the pipe segment and structural element levels that are used to prioritize inspection locations. The procedure used to perform review of piping segments and piping structural elements to ensure that segments are appropriately ranked is reviewed.

The criteria and procedure used to define the number and location of structural elements within the piping segments that will be subject to lSI is reviewed. The comparison between the lSI program for piping under ASME XI and the requested RI-ISI program is reviewed.

1.3 Element 3: Implementation and Monitoring Programs The adequacy of the implementation and monitoring plans is reviewed. Inspection strategies are reviewed to ensure that failure mechanisms of concern have been addressed and there is a sufficiently high probability of detecting damage before structural integrity is impacted. The process by which the safety significance of piping segments is taken into account in defining the scope of the inspection program is reviewed. Inspection scope, examination methods, and methods of evaluation of examination results are reviewed with the objective of establishing whether the RI-ISI inspection program provides an acceptable level of quality and safety.

Draft April 2003 3.9.8-6

The criteria for selecting areas and volumes of safety significant piping structural elements for inspection are reviewed to ensure that the applicable degradation mechanisms are addressed.

The methods by which the degradation mechanisms, postulated failure modes, and configuration of piping structural elements are incorporated in the inspection scope and inspection locations are reviewed. The manner in which significant stress concentration, geometric discontinuities, and generic as well as plant-specific pipe cracking experience is considered in selecting inspection locations is reviewed. Alternate methods to ensure structural integrity in cases where examination methods cannot be applied due to limitations, such as inaccessibility or radiation exposure hazards are reviewed.

In the context of the RI-ISI program, the sampling strategy is defined by the selection of structural elements that are proposed by the licensee for inclusion in the inspection. The reviewer will determine if the criteria for the expansion of the sample size are acceptable and that sequential sampling is based on lSI findings and other evidence of structural degradation.

Inspection methods and acceptance standards utilized in the implementation of the RI-ISI program are reviewed. Inspection methods selected by the licensee should address the degradation mechanisms, pipe sizes. and materials of concern. The manner in which the degradation mechanism is taken into consideration in determining the suitability of examination methods such as visual, surface, and volumetric examination is reviewed. The extent to which the RI-ISI program incorporates inspection intervals, examination methods and acceptance standards currently specified in the ASME BPVC Section XI program is reviewed.

The reliability of any NDE method is dependent on the qualification of the inspection personnel.

The RI-ISI program is reviewed to verify that inspection teams will meet industry codes and standards, and use accepted methods and procedures.

Implementation plan for the RI-ISI program is reviewed to ensure that appropriate modifications of the lSI plan are developed if new or unexpected degradation mechanisms occur. The reviewer will ensure that the adequacy of the reliability of the implemented NDE methods is monitored.

II. ACCEPTANCE CRITERIA The acceptance criteria for the areas of review described in subsection I of this SRP are given below. Other approaches that can be justified to be equivalent to the stated acceptance criteria may be used. The staff accepts the risk-informed development of an inspection plan if the relevant requirements of 10 CFR 50.55a concerning lSI are complied with. The relevant requirements of 10 CFR 50.55a are:

1. Proposed alternatives to the lSI requirements of paragraphs of 10 CFR 50.55a, which requires compliance with ASME XI for ASME Code Class 1, 2, and 3 components, may be used when authorized by the Director of the Office of Nuclear Reactor Regulation.

2. The applicant shall demon$trate that the proposed alternatives would provide an acceptable level of quality and safety.

General guidelines on judging the acceptability of the engineering evaluations and PRA used to Draft April 2003 3.9.8-7

support risk informed applications are provided in RG 1.174 (Ref. 3) and SRP Chapter 19.0 (Ref.

8). A summary of acceptance guidelines for engineering evaluations and selected PRA issues specific to 151 is provided in RG 1.178 (Ref. 4).

111 Element 1: Define the Proposed Change to 151 Program The licensee's RI-ISI submittal should have defined the proposed changes to the 151 program in general terms. The licensee should have confirmed that the plant is designed and operated in accordance with the currently approved requirements and that the PRA used in support of their RI-ISI program submittal reflects the actual plant. The licensee should identify those aspects of the plant's licensing bases that may be affected by the proposed change, including, but not limited to, rules and regulations, FSAR, technical specifications, and licensing conditions. In addition, the licensee should identify any changes to commitments. The programs and procedures in place guiding future changes to the 151 program without prior NRC approval should provide for engineering analyses, internal reviews, and degree of traceability consistent with the magnitude of the changes the licensee intends to make.

The particular piping systems, segments, and welds that are affected by the change in the 151 program should be identified. Specific revisions to inspection scope, schedules, locations, and techniques should also be identified. In addition, plant systems and functions that rely on the affected piping should be identified. Industry and plant-specific experience with inspection program results should be obtained and characterization relative to the effectiveness of past inspections of the piping and the flaws that have been observed should be described.

~ Element 2: Engineering Analysis After the proposed changes to the licensee's 151 program have been defined, the licensee should conduct an engineering analysis of the proposed changes using a combination of traditional engineering analysis with supporting insights from a PRA. RGs 1.174 (Ref. 3) and 1.178 (Ref. 4) provide guidance for the performance of this evaluation.

11.2.1 Traditional Analysis The traditional engineering analyses conducted should assess whether the impact of the proposed 151 changes (individually and cumulatively) is consistent with the principles that defense-in-depth and adequate safety margins are maintained.

10 CFR 50.55a and Appendix A to 10 CFR Part 50 are the primary regulations governing 151 of piping. The intent of these documents is to maintain the structural integrity of piping in a nuclear power plant. The regulations reference other codes and requirements that define the elements of a defense-in-depth philosophy to ensure structural integrity of piping. For each of the regulations and licensing bases relevant to the 151 of piping, the licensee should ensure that the proposed changes to the 151 program do not deviate from the regulations and licensing bases.

10 CFR 50.55a references ASME BPVC Section XI for the detailed requirements regarding piping 151. The objective of the 151 requirements of the ASME Code has been to identify conditions, such Draft April 2003 3.9.8-8

as flaw indications, that are precursors to leaks and ruptures in pressure boundaries that may impact plant safety. The licensee should verify that the proposed changes to the 151 program meet or exceed the intent of the ASME BPVC Section XI to identify conditions that are precursors to leaks and ruptures and to provide plans for additional and more frequent inspections in response to detection of flaws and degradation mechanisms. The plans for additional inspections following detection of a flaw should be targeted toward locations with the same degradation mechanism that may have contributed to the unacceptable flaw development.

The nuclear industry has implemented augmented inspection programs to address generic industry wide piping degradation problems such as IGSCC and FAC. The licensee should identify whether the proposed changes in the 151 program affect previous licensee commitments for augmented inspection programs for piping degradation problems such as IGSCC and FAC.

11.2.2 Probabilistic Risk Assessment The quality of the PRA should be compatible with the safety implications of the 151 change being requested and the degree that the justification of the change request depends on the PRA analysis. Guidance relating the acceptable scope, level of detail, and quality of the PRA analysis based on the anticipated change in risk can be found in RG 1.174 (Ref. 3), Section 2.2.3, "Quality of PRA Analysis," and SRP Chapter 19.0 (Ref. 8), Section 111.2.2.4, "Quality of a PRA for Use in Risk-I nformed Regulation."

The PRA performed should realistically reflect the actual design, construction, and operational practices and reflect the impact of previous changes made to the approved requirements. All calculations using the PRA model should be performed correctly, and in a manner that is consistent with accepted practices. Limitations and approximations in the PRA and the PRA techniques which can influence the interpretation of the results required to support the 151 application should be clearly described and appropriately addressed. Parameter uncertainty, model uncertainty, and completeness uncertainty should be addressed in accordance with the guidelines of RG 1.174 (Ref. 3).

The programs and procedures regarding the long term maintenance, update, and use of the PRA should be sufficient to ensure that any anticipated changes in the 151 program which do not require NRC notification or approval will always be based on an appropriately generated set of risk insights.

11.2.2.1 Scope of Piping Systems The piping systems included in the RI-ISI program for the purpose of evaluating the impact of the proposed changes in the 151 program on total plant risk and for the purpose of screening to classify the safety significance of piping systems should be such that any proposed increases in core damage frequency and risk are small and are consistent with the intent of the Commission's Safety Goal Policy Statement.

11.2.2.2 Piping Segments An acceptable method for modeling a run of a pipe in a PRA or to define its 151 requirements is to divide the pipe run into segments. Portions of piping within the piping systems having the same Draft April 2003 3.9.8-9

consequences of failure should be systematically identified. Consequences of failure include an initiating event, loss of a particular train, loss of a system, or a combination thereof. The location of the piping in the plant, and whether inside or outside the containment, should be taken into account in defining piping segments.

Piping sections subjected to the same degradation mechanism should be systematically identified. Most of the degradation mechanisms present in nuclear power plant piping are dependent on a combination of design characteristics, fabrication processes and practices, operating conditions, and service experience. The degradation mechanisms to be considered include, but may not be limited to, vibration fatigue, thermal fatigue, corrosion cracking, primary water stress corrosion cracking (PWSCC), IGSCC, microbiologically induced corrosion (MIC),

erosion, cavitation, and FAC.

Piping segments should be defined taking into account potential degradation mechanism and consequence of failure at any point in the segment. Segments with the same consequences but a different degradation mechanism may be combined for consequence characterization, but the development of the inspection program should explicitly address the different degradation mechanisms within such segments. In addition, consideration should be given to identifying distinct segment boundaries at branching points such as flow splits or flow joining points, locations of size changes, isolation valve, motor operated valves (MOV) and air operated valves (AOV) locations. Distinct segment boundaries should be defined if the break potential is expected to be significantly different for various portions of piping.

11.2.2.3 Evaluating Pipe Failures with PRA The licensee's methodology should systematically utilize risk insights from the PRA and PRA results to characterize the impact of each segment's failure on the plant's risk. The characterization should allow for the determination of the relative safety-significance of the different pipe segments, and should also support the final determination regarding the impact of implementing the program on plant risk.

Generally, three or four primary system lOCA sizes and two steam line rupture locations representing the spectrum of demands on the mitigating systems are modeled in PRAs. An internal events 'flooding analysis is also included in most PRAs performed in response to Generic letter 88-20. Much of this analysis will be used as a basis for determining the consequence of pipe failures. The review should focus on the robustness of the above models and methods in the baseline PRA, and appropriate use of this information to investigate the impact of the change in risk due to RI-ISI implementation.

One acceptable approach is to investigate the change in risk due to an lSI program change is based on developing the pipe elements' failure potentials into probabilities, and integrating these probabilities into the existing quantitative PRA framework. The contribution to risk from each piping elements may be ranked and the safety significance of the element determined.

An alternative acceptable approach is based on categorizing each segment's failure potential and the consequences of each segment's failures. These two elements of risk, failure potential and consequences, are then systematically combined to determine the safety significance of each segment.

Draft April 2003 3.9.8-10

11.2.2.4 Piping Failure Potential The determination of the degradation mechanisms present at each weld within all pipe runs included in the scope of the submittal is central to the success of the lSI application. The process used to identify the degradation mechanism at each weld should be well defined, systematic and applied to all welds within the scope. The documentation and engineering evaluations upon which the process is based should be capable of supporting the identification of all applicable degradation mechanisms.

The determination of failure potential of piping segments, either as a quantitative estimate or a categorization into groups, should be based on appropriate design, operational, and inspection parameters in conjunction with the identified degradation mechanisms. The evaluation should include a determination of whether the potential failure of each segment is best characterized as a demand failure while responding to a plant transient or an operational failure which causes a plant transient.

When data analysis is utilized to develop a quantitative estimate, the data should be appropriate and complete. When elicitation of expert opinion is used in conjunction with, or in lieu of probabilistic fracture mechanics or data analysis, a systematic procedure should be developed for conducting such elicitation and a suitable team of experts should be selected and trained. When categorization based on the degradation mechanism is used, the justification for the relationship between the degradation mechanism and the assigned category should be appropriate and complete.

The assessment of piping failure potential should take into account uncertainties. These uncertainties include, but are not limited to, design versus fabrication differences; variation in material properties and strength; effect of various degradation and aging mechanisms; variation in steady-state and transient loads; availability and accuracy of plant operating history; availability of inspection and maintenance program data; and capabilities of analytical methods and models to predict realistic results.

The methodology, process, and rationale used to determine the failure potential of piping segments should be reviewed and approved by the plant expert panel as part of its deliberations during the final classification of the safety significance of each segment. This process should be justified, documented. and included in the submittal. When computer codes are used to develop quantitative estimates, the techniques should be verified and validated against established industry codes.

11.2.2.5 Consequences of Failure The impact on risk due to piping pressure boundary failure should consider both direct and indirect effects. Consideration of direct effects should include failures that cause initiating events, disable single or mUltiple components, trains or systems, or a combination of these effects.

Indirect effects of pressure boundary failures affecting other systems, components and/or piping segments. also referred to as spatial effects such as pipe whip, jet impingement, flooding, or consequential initiation of fire protection systems should also be considered.

The direct and indirect effects of pipe failures should be characterized to incorporate appropriate Draft April 2003 3.9.8-11

failure mechanisms and dependencies into the PRA model. The possibility of different leak sizes ranging from minor leaks to full rupture should be considered. In general, the leak size resulting in the most severe consequence should be selected to characterize the consequence for each segment.

An acceptable method of incorporating pipe failures is to classify pipe failures as leaks, disabling leaks, and breaks. Each of these failure modes may be characterized with a different failure probability or potential and a corresponding potential for degrading system performance through direct and/or indirect effects. The time available for operator actions also depends on the break size, and this timing dependence should be recognized and incorporated into the analysis as appropriate.

11.2.2.6 Risk Impact of lSI Changes The guidelines discussed in RG 1.174 (Ref. 3), Section 2.2.5, "Comparison of PRA Results with Acceptance Guidelines" are applicable to lSI change requests. General gUidance for reviewing the risk impact from changes to the current licensing basis can be found in SRP Chapter 19.0 (Ref. 8), Section 111.2.2.5 "Evaluation of Risk Impact."

The methods used to determine the piping failure potential, the piping failure consequence, and the impact of the change in the number of inspections should together provide confidence that any increase in core damage frequency or risk is small and acceptable in accordance with RG 1.114 (Ref. 4) guidelines and consistent with the intent of the Commission's Safety Goal Policy Statement (Ref. 1)." Increase in risk caused by changes in the lSI program could arise from a decrease in the number of welds inspected, reduced efficiency from simplified weld inspections, or both. Decreases in risk could arise from inspecting welds not currently being inspected in the program, improved weld inspections, or both. The greater the potential risk increase due to the proposed change in the lSI program (e.g., the larger the reduction in the number of welds to be inspected and of replacements of detailed inspections with simplified inspections) the more rigorous and detailed the risk analyses needed.

The licensee should demonstrate that principle four in RG 1.174 (Ref. 3) and RG 1.178 (Ref. 4) is met. Principle four states that proposed increases in core damage frequency and risk are small and are consistent with the intent of the Commission's Safety Goal Policy Statement. A direct evaluation of the fulfillment of principle four may be based on:

• risk importance measures or bounding estimates capable of characterizing plant specific pipe element failure potential and consequences categories,

• a systematic process to combine failure potential and consequence to determine pipe element safety-significance.

• pipe segmentation and element inspection selection process which provides for changes in the lSI program based on the safety-significance of the pipe element, and

• a discussion and evaluation of the aggregate risk impact of the set of changes requested in the lSI program including an evaluation of uncertainty indicating that the uncertainties do not invalidate the conclusions.

Draft April 2003 3.9.8-12

Alternatively, principle four may be shown to be met by calculating the expected change in CDF and LERF. The expected change can be calculated using the baseline PRA and before change versus after change piping failure potential expressed as failure probabilities. An evaluation of the uncertainty in the results should be performed indicating that the uncertainties do not invalidate the conclusions.

11.2.3 Integrated Decisionmaking The integrated decisionmaking must address all five key safety principles presented in Section I, "Areas of Review," in this SRP and should address each of the expectations discussed in Section 2, "An Acceptable Approach to Risk-Informed Decisionmaking" of RG 1.174 (Ref. 3). The integrated decision making should also ensure that the proposed lSI program is consistent with the intent of each of the elements related to defense-in-depth and safety margins discussed in 2.2.1.1, "Defense-in-Depth," and 2.2.1.2, "Safety Margins" of RG 1.174 (Ref. 3). The results of the different elements of the engineering analysis discussed in Sections 1.2.1 and 1.2.2 must be considered in an integrated decisionmaking process.

For lSI application, traditional requirements are outlined in 10 CFR 50.55a and the General Design Criteria in Appendix A to 10 CFR Part 50. To be acceptable, the traditional engineering analysis should address all of the relevant regulations and the licensing bases of the plant.

Acceptability of impact of the proposed change in the lSI program is based on the adequacy of the traditional engineering analysis, acceptable change in plant risk relative to the criteria, and the adequacy of the proposed implementation and performance monitoring plan. The intent of the ASME BPVC to maintain integrity of reactor coolant system boundary by lSI should be preserved under the RI-ISI program.

An acceptable approach for the risk ranking of piping segments and elements is the use of risk reduction worth (RRW), risk achievement worth (RAW), conditional core damage probability (CCDP), conditional large early release probability (CLERP), or other importance measures.

RRW is a measure of the maximum possible reduction in total CDF or LERF due to pressure boundary failures in plant piping systems that can result from making a component perfectly reliable. RAW, CLERP, and CCDP characterize the increase in risk associated with the pressure boundary failure. The risk ranking methodology must be able to systematically identify all safety significant pipe segments within the scope of the RI-ISI program. Guidelines for using risk importance measures to categorize SSCs with respect to safety significance can be found in Appendix A, "Use Of Risk-Importance Measures to Categorize Structures, Systems, and Components with Respect to Safety Significance," of RG 1.174 (Ref. 3).

The classification of piping segments should be evaluated to determine if any piping segment is inappropriately classified. Considerations shoUld be given to the limitations resulting from the PRA structure, PRA scope, and risk importance measures. Operational insights from previous inspection results, industry data on pipe failures, and Maintenance Rule impacts should also be taken into account. Piping that are subject to lSI under ASME XI requirements but have no segments exceeding the piping segment screening criteria should be further reviewed. Each ASME Class coded system should have some segments inspected for defense-in-depth considerations.

The criteria for determining how many structural elements should be selected for inspection Draft April 2003 3.9.8-13

should be based on the safety significance of the segment and the failure potential within that segment. The potential for pipe failure directly drives the need for selecting elements for inspection and the location within a segment to be inspected. The sampling program for the selection of number of elements to be inspected should be fully justified. Guidelines for an acceptable methodology for selection of structural elements for inspection within pipe segments are provided in the RG 1.178 (Ref. 4).

The intent of the ASME BPVC to maintain integrity of the reactor coolant system boundary by lSI should be preserved under the RI-ISI program. Appropriate consideration should be given to implementation and performance monitoring strategies so that piping performance can be assessed under the proposed lSI program change to confirm the assumptions and analyses that were conducted to justify the lSI program change.

1.1.& Element 3: Implementation and Monitoring Programs Careful consideration should be given to implementation and performance-monitoring strategies.

The primary goal of this element is to assess piping performance under the proposed RI-ISI program by establishing performance-monitoring strategies to confirm the assumptions and analyses that were conducted to justify the changes in the lSI program. As discussed in AG 1.178 (Ref. 4), performance monitoring encompasses feedback and modification of the AI-lSI program resulting from changes in plant design features, plant procedures, equipment performance, examination results, and individual plant and industry failure information.

Inspection scope and examination methods for the AI-lSI program should provide an acceptable level of quality and safety as stipulated in 10 CFR 50.55a(a)(3)(i). Inspection strategies should ensure that failure mechanisms of concern have been addressed and there is a sufficiently high probability of detecting damage before structural integrity is impacted. Safety significance of piping segments should be taken into account in defining the inspection scope for the RI-ISI program.

Degradation mechanisms, postulated failure modes, and con'figuration of piping structural elements should be incorporated in the definition of the inspection scope and inspection locations.

For piping segments that are included in the existing plant FAC or IGSCC (Category B-G) inspection programs, the inspection locations should be the same as in the existing programs.

For segments not in these programs, inspection locations should be mainly based on specific degradation mechanism and industry as well as plant-specific cracking experience.

Determination of inspection locations for segments with no known degradation mechanism but high failure consequence should be based on sensitized weld locations, stress concentration, geometric discontinuities, and terminal ends. Plant-specific pipe cracking experience should be considered in selecting inspection locations. To be acceptable, alternate examination methods should be specified to ensure structural integrity in cases where examination methods cannot be applied due to limitations, such as inaccessibility or radiation exposure hazards. System pressure tests and visual examination of ASME piping structural elements should continue to be performed regardless of whether the segments contain locations that have been classified as safety significant or low safety significant. Safety significant non-Code piping should be treated as ASME Code Class piping for purposes of examination and pressure testing.

The qualifications of NDE personnel, processes, and equipment should be demonstrated to be in Draft April 2003 3.9.8-14

compliance with ASME BPVC Section XI. The acceptance criteria for flaw evaluation should meet the requirements of ASME BPVC Section XI. For inspections outside the scope of Section XI, the acceptance criteria should meet eXisting regulatory guidance applicable to those programs.

The risk-informed inspection program should specify appropriate inspection intervals consistent with the relevant degradation rate if the data on the degradation mechanism suggests that an inspection interval shorter than that stated in the ASME Section XI is required. In such cases, inspection intervals should be sufficiently short so that degradation too small to be detected during one inspection does not grow to an unacceptable size before the next inspection is performed.

Updates to the RI-ISI program should be performed at least on a 10-year interval basis to coincide with the lSI requirements in ASME Section XI. Significant changes to the PRA model, plant design feature changes, plant procedure changes, and equipment performance changes should be included for review in the RI-ISI program update if needed to support the update. Leakage, flaws, or indications identified during scheduled RI-ISI program NDE examinations and system pressure tests should be evaluated as part of the RI-ISI program update. Periodic updates of RI lSI programs should include individual plant as well as industry failure information.

Appropriate modifications of the lSI plan should be developed if new or unexpected degradation mechanisms occur. The adequacy of the reliability of the implemented NDE methods should be monitored. The adequacy of NDE performance levels and inspection intervals along with the appropriateness of the selected lSI locations should be considered valid only if the lSI program is successful in detecting degradation before it leads to leakage or rupture of piping.

III. REVIEW PROCEDURES The staff reviews the licensees proposed RI-ISI program to determine if it appropriately describes the types of changes that the licensee can make without prior NRC approval and the types of changes that require NRC approval before implementation. The reviewer ensures that all changes are evaluated using the change mechanisms described in existing applicable regulations (e.g., 10 CFR 50.55a, 10 CFR 50.59. 10 CFR 50. Appendix Bfor safety-related SSC) to determine if NRC review and approval is required prior to implementation. Licensees may request a variety of lSI programs supported by various levels of analyses and evaluations. In general, the degree of freedom the licensee receives to make future changes to the lSI program without prior NRC approval depends on the level of sophistication of the plant practices and procedures supporting the change to RI-ISI. Some general guidance on determining which future changes are appropriate is given below.

• Changes to segment groupings. inspection intervals. and inspection methods that do not involve a change to the overall RI-ISI approach where the overall RI-ISI approach was reviewed and approved by the NRC do not require specific review and approval prior to implementation provided that the effect of the changes on plant risk increase is insignificant. The overall lSI submittal should specify what types of changes without prior NRC approval are anticipated and describe how such changes will be developed.

reviewed by plant personnel. documented, and implemented.

• Segment inspection method changes which involve the implementation of an NRC Draft April 2003 3.9.8-15

endorsed ASME Code, NRC-endorsed Code Case, or pUblished NRC guidance approved as part of the RI-ISI program do not require prior NRC approval.

• Inspection method changes that involve deviation from the NRC-endorsed Code requirements require NRC approval prior to implementation.

• Changes to the RI-ISI program that involve programmatic changes (e.g., changes to the categorization criteria or figure of merit used to categorize components, and changes in the Acceptance Guidelines used for the licensee's integrated decision-making process) require NRC approval prior to implementation.

Piping inspection method changes will typically involve the implementation of an applicable ASME Code, Code Case, or other requirements approved by the NRC. Changes to the piping inspection methods for these situations do not require NRC approval. However, inspection method changes that involve deviation from the NRC approved Code requirements require NRC approval prior to implementation.

For each area of review, the following review procedure is followed to ensure consistency in review so as to satisfy the requirements of acceptance criteria stated in subsection II.

l!L..1 Element 1: Define the Proposed Change to lSI Program The staff reviewer verifies that the licensee's RI-ISI submittal defines the proposed changes to the lSI program in general terms. The reviewer ensures that the licensee has confirmed that the plant is designed and operated in accordance with the approved requirements and that the PRA used in support of their RI-ISI program submittal reflects the actual plant. The reviewer verifies that the licensee has identified regulations and licensing commitments that impact the current lSI requirements. This includes, but is not limited to, rules and regulations, FSAR, technical specifications, licensing conditions, and licensing commitments. The reviewer also verifies that the piping systems, segments, and welds that are affected by the change in lSI program are identified. In addition, description of the proposed change is reviewed to verify that plant systems and functions that rely on the affected piping have been identified. The characterization of the proposed change in the lSI program is reviewed to verify that the industry and plant specific information relevant to the piping degradation mechanisms has been considered. The description of the proposed change is also reviewed to verify that information that characterizes the relative effectiveness of past inspections and the types of flaws that have been identified has been considered. In addition, the reviewer verifies that specific revisions to existing inspection schedules, locations, and techniques have been described.

111.2 Element 2: Engineering Analysis In the second element, the staff reviewer verifies that the licensee's engineering analysis of the proposed changes uses a combination of traditional engineering analysis with supporting insights from a PRA. To be acceptable, the licensee should have verified that defense-in-depth is maintained, sufficient safety margins are maintained, and that proposed increases in risk, and their cumulative effect, are small and do not cause the NRC Safety Goals to be exceeded. RGs Draft April 2003 3.9.8-16

1.174 (Ref. 3) and 1.178 (Ref. 4) provide guidance for the performance of this evaluation.

111.2.1 Traditional Analysis The engineering analyses are reviewed to ensure that the impact of the proposed lSI changes is consistent with the principles that defense-in-depth and adequate safety margins are maintained in accordance with the acceptance criteria in subsection 11.2.1.

The reviewer verifies that the proposed changes to the lSI program meet or exceed the intent of the ASME BPVC Section XI to identify conditions that are precursors to leaks and ruptures and that the lSI program provides plans for additional and more frequent inspections in response to detection of flaws and degradation mechanisms. The reviewer ensures that the licensee has demonstrated that there is no impact of the proposed changes in the lSI program on the augmented inspection programs for IGSCC (Category B-G) and FAC.

111.2.2 Probabilistic Risk Assessment The PRA performed is reviewed in accordance with the acceptance criteria in subsection 11.2.2 to confirm that it realistically reflects the actual design, construction, and operational practices and reflects the impact of previous changes made to the approved requirements. The staff reviewer verifies that the following information is included in the submittal.

• The CDF and LERF estimates and the version, calculation or other reference number that identifies which version of the PRA was used.

• A description of the process used to up-date the PRA to ensure that the PRA analyses adequately represent the current design, construction, operational practices, and operational experience of the plant and its owner.

• A description of the staff and industry reviews performed on the PRA 1. Limitations, weakness, or improvements identified by the reviewers that could change the results of the PRA should be discussed. The resolution of the reviewer comments or an explanation of the insensitivity of the analysis used to support the submittal to the comment should be provided.

The reviewer verifies that the PRA version used to support the analysis is appropriately specified and that the licensee's process to up-date the PRA provides reasonable assurance that the results developed from the PRA appropriately reflect the current state of the plant. The reviewer 1In April 2000, the Nuclear Energy Institute submitted a process (Ref. 9) for peer review of licensee PRAs. It was submitted for staff review in the context of its use in categorizing SSCs with respect to special treatment requirements (i.e., supporting NRC's risk-infonned Proposed Rulemaking to Add New Section 10 CFR 50.69, "Risk-Infonned Categorization and Treatment of Structures, Systems, and Components'Option 2" work (SECY-02-0176, Ref. 10>>. This process when endorsed by the NRC may also be of use in LB changes (as well as otherregulatory activities not addressed here); if so, future revisions of this Standard Review Plan chapter may endorse this certification process for this purpose.

Draft April 2003 3.9.8-17

should ensure that any prior review findings which may influence those parts of the PRA model or results supporting the lSI change request have been adequately addressed. If necessary to support the change request, a focused scope or a more detailed PRA review should be undertaken. General guidance for focused scope and more detailed PRA quality reviews is presented in Draft Regulatory Guide DG*1122 (Ref. 11).

111.2.2.1 Scope of Piping Systems Scope of piping systems included in the RI-ISI program is reviewed in accordance with the acceptance criteria in subsection 11.2.2.1.

111.2.2.2 Piping Segments Criteria and procedures used to establish piping segments within the piping systems are reviewed to determine whether consequences of failure, degradation mechanisms, and segment boundaries are properly considered for defining piping segments in accordance with the acceptance criteria given in subsection 11.2.2.3 of this SRP section.

111.2.2.3 Evaluating Pipe Failures with PRA Acceptable approaches for evaluating pipe failures with PRA are provided in subsection 11.2.2.3.

The approach used is reviewed to verify whether the sequence of events from new initiators is appropriately developed if piping segment failure introduce new initiating events. If the pipe segment failure yields the same consequences as some other initiator already included in the PRA, the reviewer verifies that the risk from the original initiating event is appropriately represented in the lSI analysis.

If pipe failures are characterized by a set of PRA basic events used as surrogates representing the equivalent impact of the pipe failure, the basic events are reviewed to insure that the surrogate is an adequate representation of the pipe segment failure, and that the resulting risk insights are reflected in the lSI analysis. If surrogate basic events cannot be found, the analysis used to characterize the new failure events using the PRA models or results and extract representative risk insights is reviewed.

111.2.2.4 Piping Failure Potential The processes and documentation used to identify the degradation mechanisms is reviewed to verify that they are sufficient and were systematically applied. The identified degradation mechanisms are reviewed to determine that the results are an appropriate characterization and were developed at a level of detail consistent with the use of the information to support the change request. These detailed results are also compared to the reported inspection locations to determine the relationship between the inspection location, strategies, and degradation mechanisms. The procedures used to determine the failure potential of piping segments are reviewed in accordance with the acceptance criteria in subsection 11.2.2.4 to verify that the appropriate failure frequency, demand failure, or unavailability mode was used to characterize the impact of failure, and that the determination of the quantitative estimate or group classification is appropriate to the failure mode. The licensee's treatment of uncertainties in failure potential determination and all conclusions are reviewed. The incorporation of the findings of the Draft April 2003 3.9.8-18

uncertainty analyses into the final decision making process is reviewed.

When a computer code is used to develop a quantitative estimate, verification and validation of the computer code that implements the probabilistic fracture mechanics techniques is reviewed.

When expert elicitation is used, the selection and training of the experts and the elicitation process is reviewed. When the failure potential is determined by classifying the failures into groups, the applicability of the classification scheme is reviewed.

111.2.2.5 Consequences of Failure The reviewer verifies that the licensee has considered both direct and indirect effects of each segment failure. The guidelines for determining the direct and, in particular, the indirect effects of pipe failure on plant equipment should be reviewed. The reviewer should verify that these guidelines have been consistently applied and that the results of the analysis are well documented. Guidelines for evaluating the consequence of different leak sizes and selecting the most severe consequence should also be reviewed if applicable.

111.2.2.6 Risk Impact of lSI Changes The risk impact of the proposed change in the lSI program is reviewed for compliance with the acceptance criteria in subsection 11.2.2 of this SRP section. The assessed change in risk due to lSI implementation should be evaluated in accordance with the gUidelines in Section 2.2.2, "Evaluation of Risk Impact, Including Treatment of Uncertainties," of RG 1.174 (Ref. 3). The licensee's risk assessment is reviewed to verify that any proposed increases in core damage frequency and risk are small and are consistent with the intent of the Commission's Safety Goal Policy Statement. Selection of piping segments is reviewed to ensure that assumption guiding the spatial effects of pipe failures are applied consistently. It should reflect the current plant lSI program, and risk insights developed should arise from comparing the baseline with the proposed RI-ISI program implementation plant risk. Risk insights are reviewed to ensure that they appropriately account for the change in the number of elements inspected, and when feasible, the effects of an enhanced inspection method. The emphasis put on the risk insights and on the PRA results in the decisionmaking process is determined. The PRA is reviewed to verify that the scope, level of detail, and the quality of the PRA is commensurate with the role the risk and the change in risk results play in determining the acceptability of the requested lSI program.

111.2.3** integrated Decisionmaking Acceptance criteria for integrated decisionmaking process is given in subsection 11.2.3. The process by which the traditional engineering analysis addresses the relevant regulations and the currently approved requirements of the plant is reviewed to confirm that the regulation is met and the intent of the ASME BPVC to maintain integrity of reactor coolant system boundary by lSI is preserved under the RI-ISI program. The documentation providing input to the integrated decision making process is reviewed to ensure that all applicable risk insights, key principles, and supporting elements were addressed and communicated to the final decision making panel. The documentation of the panel deliberations, recommendations, and finding should be reviewed to ensure that all relevant risk informed insights were incorporated into the final program description.

After the RI-ISI program is approved and initiated, plant performance should be supported by inspection and analysis and maintained by programmatic activities goals by comparison against Draft April 2003 3.9.8-19

specific performance goals.

Acceptability of selection of locations to be inspected is reviewed for compliance with the acceptance criteria in subsection 11.2.3 of this SRP. Risk measures used are reviewed to determine that appropriate thresholds are used to rank the safety significance of the piping segments. The risk ranking process is reviewed to ensure that it is capable of systematically identifying all safety significant pipe segments, including those that are not included under ASME Section XI as appropriate.

The procedure used to further review piping segments and piping structural elements that may be inappropriately identified as low safety significant is reviewed to verify that the PRA limitations, operational insights, industry pipe failure data, and Maintenance Rule insights are taken into consideration. In addition, the procedure used to determine the lSI program for piping that are subject to lSI under ASME XI requirements but have no segments or piping structural elements exceeding the screening criteria is reviewed to ensure that it is in accordance with the acceptance criteria of subsection 11.2.3 of this SRP.

111.3 Element 3: Implementation and Monitoring Programs The reviewer verifies that the inspection strategies address failure mechanisms of concern and there is a sufficiently high probability of detecting damage before structural integrity is compromised. The reviewer verifies that the degradation mechanisms, postulated failure modes, and configuration of piping structural elements are incorporated in the definition of the inspection scope and inspection locations. Selected inspection locations are reviewed to confirm that stress concentration, geometric discontinuities, and terminal ends are considered in establishing the inspection locations. In addition, the reviewer verifies that plant-specific pipe cracking experience has been considered in selecting inspection locations. The reviewer also determines if alternate examination methods are specified to ensure structural integrity in cases where examination methods cannot be applied due to limitations, such as inaccessibility or radiation exposure hazard. The RI-ISI program is reviewed to ensure that system pressure tests and visual examination of piping structural elements is to be performed on all Class 1, 2, and 3 systems in accordance with ASME BPVC Section XI Program regardless of whether the segments contain locations that have been classified as safety significant or low safety signi'ficant. The RI-ISI program is reviewed to ensure that safety significant non-Code Class piping is treated as ASME Code Class piping for purposes of examination and pressure testing.

Sample selection process is examined to verify that expansion of the sample size is in accordance with the acceptance criteria of subsection 11.2.1 of this SRP. Also, the additional examinations shall be performed in accordance with the ASME Code. Currently, the ASME Code directs users to perform additional examinations during the current outage. Inspection methods selected by the licensee are examined to verify that they address the degradation mechanisms, pipe sizes, and materials of concern. The RI-ISI inspection program is reviewed to confirm that appropriate examination methods and intervals are used and acceptance standards meet the requirements of ASME BPVC Section XI or existing regulatory guidance applicable to the piping system.

Draft April 2003 3.9.8-20

IV ELEMENT 4: DOCUMENTATION The reviewer will review the licensee's submittal to ensure that it contains the documentation necessary to conduct the review described in this SRP (i.e., the documentation described in RG 1.178). The RI-ISI program and its updates should be maintained on site and available for NRC inspection consistent with the requirements of 10 CFR 50, Appendix B.

V EVALUATION FINDINGS The reviewer verifies that sufficient information has been provided and that the evaluation is sufficiently complete and adequate to support conclusions of the following type, to be included in the staff's safety evaluation report.

The staff concludes that the licensee's proposed RI-ISI program, as described in its submittal, will provide an acceptable level of quality and safety pursuant to 10 CFR 50.55a(a)(3)(i) with regard to the number of inspections, locations of inspections, and methods of inspections. This conclusion is based on the following findings.

The staff finds that the results of the different elements of the engineering analysis are considered in an integrated decisionmaking process. The impact of the proposed change in the lSI program is founded on the adequacy of the engineering analysis and acceptable change in plant risk in accordance with RG 1.174 and 1.178 guidelines.

The licensee's methodology also considers implementation and performance monitoring strategies. Inspection strategies ensure that failure mechanisms of concern have been addressed and there is adequate assurance of detecting damage before structural integrity is affected. The risk significance of piping segments is taken into account in defining the inspection scope for the RI-ISI program.

System pressure tests and visual examination of piping structural elements will continue to be performed on all Class 1, 2, and 3 systems in accordance with the ASME Code Section XI program. The RI-ISI program applies the same performance measurement strategies as existing ASME Code requirements and, in addition, increases the inspection volumes at weld locations that are exposed to thermal fatigue.

The licensee's methodology provides for conducting an engineering analysis of the proposed changes using a combination of engineering analysis with supporting insights from a PRA.

Defense-in-depth and quality are not degraded in that the methodology provides reasonable confidence that any reduction in existing inspections will not lead to degraded piping performance when compared to existing performance levels. Inspections are focused on locations with active degradation mechanisms as well as selected locations that monitor the performance of system piping.

The staff's review of the licensee's proposed RI-ISI program concludes that the program is an acceptable alternative to the current lSI program for Class 1 and Class 2 piping welds, which is based on ASME Code,Section XI, requirements for Class 1 and Class 2 welds. Therefore, the licensee's request for relief is authorized pursuant to 10 CFR 50.55a(a)(3)(i) on the basis that Draft April 2003 3.9.8-21

the request provides an acceptable level of quality and safety.

This safety evaluation authorizes application of the proposed RI-ISI program during the second ten-year lSI interval for licensee's Unit 1 and Unit 2.

VI IMPLEMENTATION The following is intended to provide guidance to applicants and licensees regarding the NRC staff's plans for using this SRP section.

Except in those cases in which the applicant or licensee proposes an acceptable alternative method for complying with specified portions of the Commission's regulations, the method described herein will be used by the staff in its evaluation of conformance with Commission regulations.

VII. REFERENCES

1. USNRC, "Use of Probabilistic Risk Assessment Methods in Nuclear Activities:

Final Policy Statement," Federal Register, Vol. 60, p. 42622 (60 FR 42622), August 16,1995.

2. USNRC, "Risk-Informed Regulation Implementation Plan," SECY-00-0213, October 16, 2000; updated December 5,2001 (SECY-01-0218)2

3. Regulatory Guide RG 1.174, "An Approach for Using Probabilistic Risk Assessment In Risk-Informed Decisions On Plant-Specific Changes to the Licensing Basis," Revision 1, November 20023 *

4. Regulatory Guide 1.178, "An Approach for Plant-Specific, Risk-Informed Decisionmaking:

Inservice Inspection of Piping," Revision 1, April 2003.

5. Westinghouse Owners Group Topical Report WCAP-14572, Revision 1-NP-A, "Application of Risk-Informed Methods to Piping Inservice Inspection," February 1999.

2 USNRC SECY papers are available electronically on the NRC's web page at <www.nrc.gov> under Commission's Activities.

3 Single copies of regulatory guides, both active and draft, and draft NUREG documents may be obtained free of charge by writing the Reproduction and Distribution Services Section, OCIO, USNRC, Washington, DC 20555-0001, or by fax to (301 )415-2289, or by email to <DISTRIBUTION@NRC.GOV>. Active guides may also be purchased from the National Technical Information Service on a standing order basis. Details on this service may be obtained by writing NTIS, 5285 Port Royal Road, Springfield, VA 22161; telephone (703)487-4650; online

<http://www.ntis.gov/ordernow>. Copies of active and draft guides are available for inspection or copying for a fee from the NRC Public Document Room at 11555 Rockville Pike, Rockville, MD; the PDR's mailing address is USNRC PDR, Washington. DC 20555; telephone (301)4154737 or (800)397-4209; fax (301)415-3548; email

<PDR@NRC.GOV>.

Draft April 2003 3.9.8-22

.. ,'" k

6. EPRI Report TR-112657, Revision B-A, "Risk-Informed Inservice Inspection Evaluation Procedure," December 1999.

7. USNRC, "Safety Goals for the Operations of Nuclear Power Plants; Policy Statement,"

Federal Register, Vol. 51, p. 30028 (51 FR 30028), August 4, 1986.

8. USNRC, "Use of Probabilistic Risk Assessment in Plant-Specific, Risk-Informed Decisionmaking: General Guidance," Revision 1 of Chapter 19.0 of the Standard Review Plan, NUREG-0800, November 2002.

9. Letter to Samuel J. Collins, NRC, from Ralph E. Beedle, NEI, with attached "Probabilistic Risk Analysis (PRA) Peer Review Guidance," Rev. A3, NEI 00-02, Prepared for NEI Risk-Based Applications Task Force by WOGlWestinghouse Electric Co., and B&WOG/Framatome Technologies, Inc., April 24, 2000.

10. Proposed Rulemaking to Add New Section 10 CFR 50.69, "Risk-Informed Categorization and Treatment of Structures, Systems, and Components" SECY-02 0176, September 30, 2002.

11. Draft Regulatory Guide DG-112, "An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities," November 2002.

Draft April 2003 3.9.8-23

List of changes in the RI-ISI RG and SRP

1) A number of references to specific sections of the updated RG 1.174 and SRP Chapter 19 were added.

2) All the discussion about pilot applications and issuing the RG and SRP for trial use are no longer relevant and have been removed.

3) All the discussions in the RG and SRP regarding the multiple ASME Section XI risk-informed code cases were removed. The two approved Topical Reports used by industry for RI-ISI are referenced in the RG and SRP. There are as yet no NRC endorsed ASME Chapters or Code Cases for RI-ISI of piping. ASME efforts in this area are directed toward developing guidance that comports with the approved topical reports. When the ASME guidance is complete and endorsed by the NRC, these references can be inserted into future revisions of the guidance as needed.

4) All reference to high-, medium-, and low- safety-significance in the RG and SRP have been removed. The original text used primarily high- and low-safety-significance while acknowledging that finer graduations may be used. The current text uses the proposed 50.69 rule's "safety-significant" to replace high-safety-significant and low safety significant consistent with the revised RG 1.174

5) All figures and tables in the RG were removed, and the SRP had none. Most figures were drawn from RG 1.174, and the figures and the tables did not expand upon or simplify the text.

6) Discussions related to three break sizes (leak, disabling leak, and break) and maintaining leak frequency in the RG were removed. The current text in both the RG and SAP state that all direct and indirect effects from pipe failures need to be evaluated and included. The use of a methodology that uses multiple break sizes comports with the the RG and SRP (as does the use of a single break size) as long as the frequency and consequence estimates are consistent with each other and bound or include all anticipated consequences.

7) All text in Section 2.1.7, "Probabilistic Fracture Mechanics Evaluation," was moved to Section 2.1.5, " Assess[ing] Piping Failure Potential."

8) The original text in the RG on the change in risk evaluation stated simply that an estimated change in risk needed to be developed. Text was added to the RG and the SRP to emphasize that acceptable methodologies for these relatively complex analyses exist in an integrated collection of assumptions, specific techniques, and guidelines.

9) As in Section XI, additional lSI examinations are required following the discovery of a unacceptable flaw during the base line RI-ISI examinations. The text in the original documents (and in the topical reports) generally referred to the ASME guidelines and was otherwise quite general. Text was added in the RG clearly specifying the expansion criteria being approved in RI-ISI programs (that is similar but not the same as the ASME). Text was also added to the SRP directing the staff's review of the expansion plans consistent with the current staff RI-ISI review process.

10) Modification on submittal guidance to reflect the use of current template format. The modification left the original general (and extensive) submittal requirements, but notes that the documentation requirements in approved topical reports may supercede the detailed RG/SRP req uirements.

11) Text was added to the RG discussing the acceptability of incorporating augmented programs into RI-ISI, but requiring explicit staff review and approval of how the augmented programs are incorporated in the analyses (SRP had such text).

12) The PRA quality discussions were modified and expanded.

The documentation requirements in the RG and reviewer directions in the SRP were expanded to include submittal of, and review of, specific PRA related information routinely submitted and evaluated in current staff RI-ISI reviews.

References to generally PRA quality and peer reviews were taken from RG 1.174 and SRP Chapter 19, and a reference to DG-1122 was added.

13) Text was added to the RG and SRP to clarify that safety-significant non-Code Class piping is treated as ASME Code Class piping for the purpose of examination and pressure testing.