ML18151A649

Forwards Revised Responses to Questions Provided in RAI on risk-informed (Ri) ISI Pilot Program.Updated Ri ISI Plan, Encl.W/Comparison of Differences Between Current ASME Section XI Insps & Proposed Ri ISIs

ML18151A649
Person / Time
Site:	Surry
Issue date:	08/13/1998
From:	Hartz L VIRGINIA POWER (VIRGINIA ELECTRIC & POWER CO.)
To:	NRC OFFICE OF INFORMATION RESOURCES MANAGEMENT (IRM)
Shared Package
ML18151A650	List: ML18151A649 ML18151A723
References
98-421, NUDOCS 9808180173
Download: ML18151A649 (56)

Text

e VIRGINIA ELECTRIC AND POWER COMPANY RICHMOND, VIRGINIA 23261 August 13, 1998 United States Nuclear Regulatory Commission Serial No.98-421 Attention: Document Control Desk NL&OS/GDM RO' Washington, D.C. 20005 Docket No. 50-280 License No. DPR-32 Gentlemen:

VIRGINIA ELECTRIC AND POWER COMPANY SURRY POWER STATION UNIT 1 REQUEST FOR ADDITIONAL INFORMATION (RAI)

RISK-INFORMED INSERVICE INSPECTION PILOT PROGRAM In a letter dated October 31, 1997 (Serial No.97-640), Virginia Electric and Power Company submitted a Risk-Informed lnservice Inspection (RI-ISi) Pilot Program for NRC review and approval. Additional information was provided in a subsequent letter dated June 18, 1998 (Serial No.98-001 ). The proposed program is an alternative to current ASME Section XI inspection requirements for piping. In a letter dated July 10, 1998, the NRC requested additional information based on their ongoing review of the program submittal. Our proposed responses to the questions provided in the request for additional information were discussed at length during a meeting with the NRC on July 23, 1998. These responses have been revised as appropriate based on the meeting discussion and are provided in Enclosure 1.

In addition, an updated RI-ISi Inspection Plan is provided in Enclosure 2, and a comparison of the differences between the current ASME Section XI inspections and the proposed RI-ISi inspections is provided in Enclosure 3.

For those weld locations that cannot be inspected to the extent required by the updated RI-ISi Inspection Plan (e.g., welds that cannot be completely accessed due to field interferences/obstructions, socket welds), relief requests will be submitted for NRC review and approval at a later date.

If you have any questions or require-additional information, please contact us.

Very truly yours, L. N. Hartz Vice President - Nuclear Engineering and Services 9808180173 980813 PDR ADOCK 05000280 Q PDR

s:. .. *

.. * :'I- '-

Enclosures cc: U.S. Nuclear Regulatory Commission Region II Atlanta Federal Center 61 Forsyth Street, SW, Suite 23T85 Atlanta, Georgia 30303 Mr. R. A. Musser NRC Senior Resident Inspector Surry Power Station Mr. Donnie W. Whitehead Risk Assessment and Systems Modeling Department 6412 Sandia National Laboratories Albuquerque, New Mexico 87185-0747 Dr. Fredric A. Simonen Theoretical & Applied Mech. Group Battelle Pacific Northwest National Laboratories P.O. Box 999 Richland, WA 99352-0999 Commitment Summary

1. For those weld locations that cannot be inspected to the extent required by the updated RI-ISi Inspection Plan (e.g., welds that cannot be completely accessed due to field interferences/obstructions, socket welds), relief requests will be submitted for NRC review and approval at a later date.

RESPONSE TO REQUEST FOR ADDITIONAL INFO RISK-INFORMED INSERVICE INSPECTION PILOT PROGRAM REC'D W?LTR OTO 08/13/98 .... 9808180173

-NOTICE-THE ATTACHED FILES ARE OFFICAL RECORDS OF THE OCIO/INFORMATION MANAGEMENT DIVISION.-THEY HAVE BEEN CHARGED TO YOU FOR A LIMITED TIME PERIOD AND MUST BE RETURNED TO THE RECORDSANDARCHN~S SERVICES SECTION, T-*5C3. PLEASE DO NOT SEND DOCUMENTS CHARGED OUT THROUGH THE MAIL REMOVAL *oF ANY PAGE(S) ,

• FROM DOCUMENTS FOR REPRODUCTION MUST BE REFERRED TO FILE PERSONNEL.

-NOTICE-

ENCLOSURE1 RESPONSE TO REQUEST FOR ADDITIONAL INFORMATION ON RISK-INFORMED INSERVICE INSPECTION PROGRAM SURRY POWER STATION UNIT 1

• ENCLOSURE1 RESPONSES TO REQUEST FOR ADDITIONAL INFORMATION ON RISK-INFORMED INSERVICE INSPECTION PROGRAM SURRY POWER STATION UNIT 1 NRC Question No. 1 The risk-informed inservice inspection program (RI-ISi) for Surry relies on topical report WCAP-14572 for guidance on process and methodology. Thus the licensee's submittal contains only brief explanations and summaries of sample analysis results of the program. A separate staff review of the WCAP report is proceeding which will affect final conclusions on acceptability and adequacy of the Surry RI-ISi program. However, the WCAP does not provide the plant specific analyses and documentation that will allow verification of the applied process and methodology in support of the Surry program. Provide supporting analyses, calculations, and documentation to allow Surry program results to be verified as noted below.

a) In Section 3.1 of the submittal, an expert panel was used to arrive at the system selections to be included in the scope of the RI-ISi program. Provide minutes from the panel's meeting to illustrate how the final system selections were derived.

b) Piping failure potential was determined based on failure probability estimates from the SRRA software program (WCAP-14572, Supplement 1). Provide documentation regarding the expert opinion that was formed by a subpanel to define the appropriate input data required by the SRRA code to determine piping failure potential for the segments.

c) The selection of pipe segments to be inspected was performed by the expert panel using the results of the risk rankings and other operational considerations.

Provide documentation of the criteria and rationale used in this process that resulted in the identification of each of the high safety significant segments.

Virginia Power Response 1(a) The system selection for the Surry pilot application was initially researched by the Virginia Power/Westinghouse team for presentation to the Expert Panel.

WCAP-14572, Revision 1, Section 3.2 (page 51) states the scope should be based on three criteria: * * *

1. Class 1, 2, and 3 systems currently within the ASME section XI program,

2. Piping systems modeled in the Probabilistic Safety Assessment (PSA), or 2

• 3. Various balance of plant fluid systems determined to be of importance (mainly based on Maintenance Rule ranking).

Additionally, the indirect effects analysis evaluated two segments on auxiliary steam due to its proximity to a class system. (See response to question 2.)

It is noted that the criteria above are more conservative than Code Case N-577 section 1-3.1 boundary scope. The Code Case only mandates inclusion of piping within the Section XI Class 1, 2, or 3 examination boundaries (current examination scope, e.g., RT/UT, PT/MT, VT-3) and within the PSA boundary, and Section XI Class 1, 2, or 3 piping known to* have high consequence contribution from PSA insights (current examination exempt piping included).

Piping outside the existing Section XI Class 1, 2, or 3 boundaries may be included at the Owner's option.

The pilot schedule required that the preliminary segment work (i.e., segment definition, failure estimation, consequence evaluation, and segment risk ranking) be conducted on the systems scoped by the Virginia Power/Westinghouse team prior to the system review by the expert panel. These systems are listed in Table 3.1-1 of our October 31, 1997 submittal. The formation of the required expert panel came after the preliminary work. The systems were reviewed during the initial Expert Panel session. (The meeting minutes were previously provided during our July 23, 1998 meeting with the NRC). The Expert Panel requested that a review of the Maintenance Rule safety functions be conducted since the Maintenance Rule program had been recently updated, and the update may have identified safety functions not considered previously. The review requested by the Expert Panel will be completed as part of our normal update process as indicated on page 11 of our October 31, 1997 submittal.

1(b) Enclosure 1 of our June 18, 1998 response to a previous NRC RAI, contains Engineering Transmittal ET No. MAT-97-0014, Estimated Failure Probabilities for Risk-Based ISi, Surry Unit 1, Rev. 0. The document contains the guidance used by the subpanel in determining the various inputs to the SRRA software program. Enclosure 2 of the same response contains the support information and data sheets for the estimates.

1(c) The Risk-Informed Expert Panel. G.uidance Document (provided during our July 23, 1998 meeting with the NRC) provides the guidance used by the Expert Panel in making decisions. The expert panel reviewed the segments on a system basis. At the expert panel's request, a briefing of the system overview was given either in writing or orally prior to segment classification for each system. An example of the overview for the CVCS (Charging System) is provided in Attachment 3 following the sample minutes of our October 31, 1997 3

submittal. Additionally each segment had a corresponding data sheet containing probabilistic and deterministic insights to aid the Expert Panel (see WCAP-14572, Revision 1, pages 8-22 through 8-40 for Surry examples).

NRC Question No. 2 In accordance with the SRP acceptance criteria, plant systems and safety functions that rely on piping affected by the risk-informed program should be identified. Provide Section 3.1 a list of plant safety functions, the systems that perform those functions, and associated success criteria for leaks, disabling leaks, and full breaks.

Virginia Power Response The Expert Panel considered the risk significant functions documented for the Maintenance Rule in Engineering Transmittal ET No. CEP-97-0019, Rev. 0. These were presented to the Expert Panel in the written or oral system overviews. Additionally the Expert Panel was briefed in general on the functions of the system as described in the UFSAR.

The success criteria for leaks, disabling leaks, and full breaks were based upon the indirect and direct effects analysis for each segment. No changes were made to the PSA system or accident sequence success criteria for this application of RI-ISi. Leaks were associated with jet impingement and/or spray indirect effects on other equipment.

Segments requiring leak consideration utilized the failure estimate from the SRRA for a through-wall crack. Disabling leaks were considered for direct effects and flooding indirect effects. The failure estimate for a disabling leak was calculated for each segment. The leak rate used in the estimate was an input by the SRRA subpanel and is documented on the input sheets provided to you in the SRRA supporting information (enclosure 2) in our June 18, 1998 RAI response. The full break failure probability was used only in pipe whip indirect effects situations, when pipe whip was postulated.

A summary of the risk significant Maintenance Rule functions considered is provided in Table 2-1 below .

• 4

Table 2-1 RISK SIGNIFICANT MAINTENANCE RULE FUNCTIONS CONSIDERED System Function(s)

Auxiliary Feedwater (AFW) 1) The AFW System provides a safety-related source of feedwater to steam generators (SIG) during transients and accidents to prevent core damage and system overpressurization and provides a means of plant cooldown following the events.

2) The AFW System provides minimum AFW flow in the event of a feedwater line break (FWLB) or main steam line I

break (MSLB) in the Main Steam Valve House (MSVH) via

' the cross-connect line to the intact SIG of the affected unit.

3) The AFW System via cross-tie supplies water to the opposite unit when AFW pumps on the accident unit are not available for any reason.

4) The AFW System provides the capability to isolate AFW to a SIG during a tube rupture.

Slowdown (BD) 1) None risk significant.

Component Cooling (CC) 1) The CC system provides cooling water for RHR.

2) The CC system provides cooling water to the reactor coolant pump (RCP) thermal barrier coolers to prevent failure of the RCP seals in the event the charging (CH) system seal injection is lost.

Chemical & Volume Control (CH) 1) The CH system provides auxiliary means to spray the pressurizer.

5

Table 2-1 RISK SIGNIFICANT MAINTENANCE RULE FUNCTIONS CONSIDERED System Function(s)

2) The CH system provides high head safety injection (HHSI).

3) The system suction auto swaps to refueling water storage tank (RWST) on low volume control tank (VCT) level & safety injection (SI).

4) The CH system provides flow to the opposite unit CH system.

5) The CH system provides RCP seal injection flow & return flow.

l Condensate (CN) 1) None risk significant.

Containment Spray (CS) 1) The cs system is used in conjunction with the recirculation spray (RS) system to maintain containment temperature and pressure at values less than their design and to depressurize the containment to sub-atmospheric conditions.

2) The CS system provides a source of cool, borated water to the safety injection (SI) system in support of initial core cooling (RWST).

3) The CS system initiates the realignment of the low head safety injection (LHSI) pump suction from the RWST to the containment sump.

6

Table 2-1 RISK SIGNIFICANT MAINTENANCE RULE FUNCTIONS CONSIDERED System Function(s)

Circulating Water (CW) 1) The cw system provides isolation and prevents siphoning of the intake canal so that the intake canal level is maintained to support the service water (SW) system safety-related functions & prevent flooding in the turbine building. (Passive anti-siphon breakers, CW motor operated valves (MOVs) & system integrity)

2) Provides canal level input to reactor protection system I (RPS). (Canal level probes)

Emergency Diesel Fuel Oil (EE) 1) The emergency diesel generator system provides a reliable source of emergency power for the required safety and shutdown loads in the event of a loss of offsite power or degraded bus condition.

2) The emergency diesel generator system stores and transfers fuel oil from the underground tanks to the emergency diesel generators.

Fuel Pit Cooling (FC) 1) None risk significant.

Feedwater (FW) 1) The FW system provides a flow path for the auxiliary feedwater system.

2) The FW system provides via valve closure & FW pump tripping redundant isolation of FW flow to S/Gs during "Excessive Heat Removal due to FW system malfunction" (Condition II) & "Rupture of MS pipe" (Condition IV) events.

3) The FW system delivers FW to S/Gs for accident mitigation.

7

Table 2-1 RISK SIGNIFICANT MAINTENANCE RULE FUNCTIONS CONSIDERED System Function(s)

4) The FW system provides SIG level instrumentation.

Main Steam (MS) 1) The MS system, in conjunction with the secondary side of the steam generators (S/Gs), provides and maintains secondary heat sink during normal and accident conditions.

2) The MS system provides pressure relief to prevent over-pressurization of the secondary side of the S/Gs and MS system components.  :

l.

3) The MS system prevents uncontrolled blowdown of more than one SG in order to ensure the integrity of the reactor heat sink, containment building, and ensure that core protection margins are maintained.

4) The MS system provides steam to the turbine driven AFWpump.

5) The MS system provides pressure and flow signals to be used in conjunction with the RPS system to initiate steam

/

line break protection and to generate a safety injection signal.

6) The MS system provides input to AMSAC.

7) The MS system provides the means to isolate a faulted/ruptured SIG.

8

Table 2-1 RISK SIGNIFICANT MAINTENANCE RULE FUNCTIONS CONSIDERED System Function(s)

Reactor Coolant (RC) 1) The RC system provides a closed pressure boundary that limits the leakage or discharge of radioactive coolant into the containment, into the turbine cycle (e.g., the steam and feedwater systems), and into interconnecting supporting and supported systems.

2) The RC system provides system over-pressure protection, including both normal operating & low temperature conditions.

3) The RC system reliably transfers core-generated nuclear heat and work input by the RCPs into the MS system for generating electrical power during normal power operation.

4) The RC system provides a means to depressurize in an accident using power-operated relief valves (PORVs).

5) The RC system provides pressurizer spray for depressurization in an accident.

6) The cavity seal ring provides fluid boundary to maintain reactor cavity water level during refueling operations (RFO).

7) The fuel assemblies provide fission product barrier.

Residual Heat Removal (RH) 1) The RH system provides isolation valves so that the low pressure RH system can be isolated from the high pressure RC System when the RH system is not in service to ensure that the integrity of the reactor coolant pressure boundary is maintained.

9

• Table 2-1 RISK SIGNIFICANT MAINTENANCE RULE FUNCTIONS CONSIDERED System Function(s)

2) The RH system provides post accident cooldown capability for a steam generator tube rupture (SGTR).

Recirculation Spray (RS) 1) The RS system in conjunction with the CS system maintains containment temperature & pressure at values less than their design & depressurizes containment to sub-atmospheric conditions to minimize containment leakage.

2) The RS system maintains containment at sub-atmospheric conditions to minimize leakage during an accident.

3) The RS system removes heat via the RS heat exchangers (RSHX) for long term core cooling.

Safety Injection (SI) 1) The SI system provides cooling water to the reactor coolant (RC) system so that the reactor core is re-flooded and decay heat is removed following a loss of coolant accident (LOCA) event.

2) The SI system provides boric acid solution to the RC system so that the reactor is shut down and maintained shut down following a LOCA.

3) The SI system provides a passive means of injecting borated water from the accumulators.

4) The SI system provides the ability to recirculate containment sump water after depleting the RWST.

10

• Table 2-1 RISK SIGNIFICANT MAINTENANCE RULE FUNCTIONS CONSIDERED System Function(s)

5) The SI system provides a means to cross-tie the RWST to the opposite units charging pump suction.

Service Water (SW) 1) The SW system provides a source of cooling water to the

' recirculation spray (RS) system.*

i 2) The SW system provides a source of cooling water to the component cooling water (CC) system.

l 3) The service water system provides a source of cooling water to the charging pump CC, and lube oil coolers.

Includes cross tie capability.

I

4) The SW system maintains the intake canal with sufficient inventory to provide cooling water for safety-related functions before, during, and after plant design basis I

events (including abnormal environmental conditions).

5) The SW system provides a means of isolating leakage to mitigate flooding.

Ventilation (VS) 1) Cools air to maintain ambient temperature in ESGRs below equipment limits.

Auxiliary Steam (AS) 1) None risk significant (considered for indirect effects).

11

NRC Question 3 As stated in Section 3.2 of the licensee's submittal, segment definition is an iterative process that includes determining if the postulated pipe failure can be isolated through automatic isolation or by operator action. However, it is not clear what credit was given for automatic closure of isolation valves and whether the probability of isolation failure was considered in determining segment boundaries. Similarly, it is not clear why human error probabilities were not considered for operator actions to isolate a pipe failure since the consequences and subsequent impact on piping GDF for that segment would be impacted as well as the associated risk rankings. Provide sufficient information on the analysis relating to segment definition to allow determination of what valves and operator actions were credited.

Virginia Power Response Piping segments are defined by identifying the consequences of the piping segment with and without operator action to isolate the piping failure. The "with operator action" case includes operator action only when the time available was assumed to be sufficient to take an action and the operator action can be performed from the control room. The "with operator action" case also includes credit for automatic closure of isolation valves. The RI ISi quantification process was simplified by assuming perfect operator action in one case and no operator action in the base case. If the piping segment ranks high in either case, it is considered a high safety significant piping segment. The "no operator action" cases are the same as assuming a human error probability of one. The "with operator action" cases are the same as assuming a human error probability of zero. Therefore, the actual piping GDF is expected to lie somewhere between these two results. Given the large number of piping segments involved, it was decided to not require the calculation of the human error probabilities for the piping segments in the calculations. We do not believe that including the human error probabilities would change the results of the ranking.

Recovery actions modeled in the Surry PSA model were reviewed during the selection of the surrogate basic events as part of the RI-ISi process. If the recovery action was determined to be inappropriate for the postulated consequence given a piping failure, the recovery action basic event was also failed with a probability of 1.0. For example, for a piping segment in which a piping failure in the segment was assessed to result in the loss of RWST outside containment in addition to the loss of the Unit 2's RWST and charging pump cross connects, t~e reco_v~ry action a,ssoqiated Vl(iJh _cross _connecting to the Unit 2 RWST was also failed (basic event REG-XTIE-RWST) (Failure of recovery by using Unit 2 RWST).

The piping segment definitions were included in the June 18, 1998 response (Virginia Power calculation note SM-1124). The "with operator action" column provides a description of the valves that are assumed to be closed to isolate the piping failure.

12

• NRC Question No. 4 Clarify if the correct surrogate components were modeled for segment BD-008B as noted in Table 3.3-3. The description relates to piping between Valves 1ODE and 1OOF but the surrogate components refer to 1OOA/B which corresponds to segments BD-01 and BD-02B, according to Drawing 1-BD-01A in Attachment 2.

Virginia Power Response The PSA model considers only one loop as vulnerable to a tube rupture. This type of simplification was necessary when the model was created because of the limitations of personal computers. As a result, isolation of the steam generators is only defined for the one loop. Therefore, surrogates for failure of a segment of blowdown piping are the same since the effect would be the same on each generator.

NRC Question No. 5 In Table 3.4-2, example pipe failure probabilities are calculated for various pipe segments as small leaks and large leaks. Clarify if these two leak categories correspond, respectively, to a through-wall flaw and system-disabling leak. If so, were full break probabilities calculated for segments subject to pipe whip? In addition, clarify how to interpret multiple entries for some segments, e.g., RC-016, for small, medium, and large LOCA due to a small leak, all with the same failure probability.

Virginia Power Response Small leak does correspond to a through-wall flaw and large leak does correspond to system-disabling leak. Full break probability was calculated if required for pipe whip consideration. In most cases pipe whip was determined to be an insignificant addition to the total GDF of a segment due to the comparatively small failure probability when combined with the small leak and large leak terms of a segment (consequence remaining the same). (See WCAP-14572, Rev. 1, page 92.)

The RC system considered the effects of each possible LOCA event for a given pipe size. The large loop piping could probabilistically have a small break LOCA, or a medium break LOCA, or a large break LOCA during the plant life. Failure probabilities were calculated based upon the LOCA size (5001 gpm for large LOCA, 1501 gpm for medium. LQCA and-1 QQ .. gpm -for--small**LOCA~. ,.These .failure -probabilities are located in the large leak column of the failure probability estimates provided in our June 18, 1998 submittal (note small leak or through-wall crack is not affected by the leak assumed for the LOCA size and is the same for each LOCA size.) These failure probabilities were combined with the consequence values calculated for the LOCAs. The terms were then added for the total segment GDF. (See WCAP-14572, Rev. 1, page 103, and also

• response to question 22.)

13

• NRC Question No. 6 From Table 3.5-1, in general, system pipe segment CDF with operator action is either the same or less than the CDF when no operator action is considered, which is expected. In Table 3.5-3, RRW values are reported for the CDF with operator action case for most segments. Clarify under what conditions or scenarios, where the no operator action case would result in higher RRW values.

Virginia Power Response RRW values for certain segments would be higher for the "no operator action" case when the consequences are more severe than the "with operator action" case. For example, piping segments that, if not isolated, would result in the total loss of a system instead of just one train would have higher RRW values in the "no operator action case." This is primarily the case for several AFW and SW piping segments.

NRC Question No. 7 In section 3.7, it is noted that several piping segments were identified to be higher safety significance but were determined by the panel to either have a lesser consequence or inappropriate failure mechanism resulting in a change in the

• categorization of the segment, and similarly, low safety significant segments were assigned high safety significance due to more severe consequences. Provide the meeting minutes or information other than given in Footnote 5 of Table 3.7-3 that was used for these determinations.

Virginia Power Response The minutes of the Expert Panel meetings were provided during the July 23, 1998 meeting with the NRC. The minutes contain the requested information.

NRC Question No. 8 In section 3.10, the "Criteria for Evaluation of Results" is presented. Provide the basis for the evaluation criteria described in this section.

Virginia Power Response .

The criteria for evaluation of results in section 3.10 are also presented in WCAP-14572, section 4.4.2, page 207. The basis for the evaluation criteria is summarized below. As stated, the criteria will provide added assurance that the risk from moving from the RI-ISi program has been addressed.

14

• a) The total change in piping risk should be risk neutral or a risk reduction in moving from the current Section XI program to RI-ISi. The basis for this criterion was the original NRC direction of no increase in risk. In addition, the objective of the RI-ISi program was to improve plant safety and this is shown through either a risk neutral or risk reduction objective.

b) Evaluation of dominant system contributors to the total risk for RI-ISi. This criterion is similar to the evaluation of results conducted for PSAs. The evaluation considers the dominant risk contributors in an attempt to identify potential changes that would improve the risk profile.

c) Any systems in which there is a risk increase in moving from the current Section XI program to RI-ISi. This criterion was again developed to ensure that the RI-ISi program improved plant safety and did not provide for a significant risk increase in one system which was overshadowed in the overall total risk. The guidelines suggested were developed based on the guidance contained in draft DG-1061 (for a risk increase) and tailored specifically to the RI-ISi process. This was performed in conjunction with a review of the piping segment risk calculations specifically for Surry which, in general, are expected to be representative of the results for other plants. (Also, see response to question 31.)

NRC Question No. 9 The submittal does not clearly define the proposed alternative, but refers to guidance from other documents such as Code Case N-577 and WCAP-14572, Revision 1. In Section 2, "Proposed Alternative to ASME Section XI lnservice Inspection Program".

The submittal also stated that "other non-related portions of the Code will not be affected by the proposed alternative." Specify the related and non-related portions of the Code. Code Case N-577, which has been referenced by the submittal, provides a more thorough alternative and better defines the implementation of the RI-ISi program.

Is the proposed alternative to use Code Case N-577? If not, the licensee needs to provide the details regarding the implementation of the proposed alternative, including deviations from Code requirements. In addition, address any changes in the current licensing basis (CLB) and confirmation that existing augmented examinations will not be impacted.

Virginia Power Response The alternative per 10 CFR 50.55a(a)(3)(i) proposed for Surry Unit 1 is_ to follow Code Case N-577 and the more detailed provisions given in WCAP-14572, Rev. 1. Specific exceptions to the documents such as referenced Code Case usage in the WCAP are 15

• discussed in our June 18, 1998 RAI response. Note that augmented programs and our current licensing basis are unaffected by this submittal.

NRC Question No. 10 Qualification of nondestructive examination (NOE) systems (personnel, procedure and equipment) is an important element of the RI-ISi program. The reliability of examinations must be established to achieve the desired confidence levels for the risk informed inspection *process. Provide the technical basis for the inspection reliability inputs used in structural reliability calculations of estimated failure probabilities. Such a basis can be provided by NOE performance demonstration programs. In addition, clarify how NOE methods, procedures and personnel will be qualified at Surry, Unit 1, and provide a detailed technical discussion describing how the reliability of NOE performed in the RI-ISi program will be qualified.

Virginia Power Response The use of inspection in the structural reliability calculation during the segment ranking process was limited to segments with existing augmented programs. Segments without augmented programs used failure probabilities without inservice inspection in the segment ranking process (see WCAP-14572, Rev. 1, page 104). The inspection inputs in the segment ranking process would therefore only have a minor impact, as the intent of the process was to affect the Section XI inspection program only.

In the piping SRRA model, Monte-Carlo simulation is used to calculate the failure probability at a given time as the approximate ratio of the number of failures at that time to the total number of simulated trials. For pre-service and in-service inspections (ISi),

this ratio is modified to reflect the fact that only those cracks that are not detected will continue on to failure. That is, a component with a detected crack is assumed to be repaired or replaced returning it to a good-as-new condition. The non-detection probability varies as a function of time and depends upon the size of the crack at the time the ISi is performed. That is, the larger the crack size, the lower the probability of not detecting it (non-detection). The equation for probability of non-detection that is used for the effect of ISi is the same as that used in the pc-PRAISE Code (Harris and Oedhia, 1992).

The SRRA input variables that are used to specify the selected ISi program are the frequency of the inspections and the ratio of crack depth to wall thickness for 50%

probability of non-detection~ the* other va'riables th-atare-*needed for the non-detection probability as a function of crack size for both carbon and stainless steel are also taken from the pc-PRAISE Code (Harris and Oedhia 1992). The actual equations, input parameters and typical non-detection probability curves for both carbon and stainless steel were provided to NRG previously (Westinghouse, 1996).

16

The change in risk calculation (see WCAP-15472, Rev. 1, page 206) uses the structural reliability value for inspection, but credits the Section XI and RI-ISi inspections with the same inspection failure probability. No "better" inspection is credited to the RI-ISi process. As such, it was shown that with the same inspection basis, risk improvement would be obtained using the RI-ISi process (better selection alone). The use of performance demonstration programs would again improve the risk addressed by inspection (improved detection). However, these improvements would be in addition to those gained by the improved selection.

Code Case N-577, -2500(c) states that the examination qualification and methods and personnel qualification shall be in accordance with the Edition and Addenda of Section XI specified in the Owner's lnservice Inspection Program. Currently, the examination qualification and methods and personnel qualification for Surry Unit 1 are to the 1989 Edition of ASME Section XI, IWA-2300 and SNT-TC-1A as amended by Appendix VII of ASME Section XI. Additionally, an in-house program for performance demonstration of UT detection and sizing has been implemented at Surry for the more recent past outages. However, Surry remains committed to the current ASME code of reference previously indicated. Changes from our current practice will be added as part of the normal interval update when required by 10 CFR 50.55a(g)(4)(ii).

Upon implementation of the RI-ISi program at Surry, the necessary UT procedures will be revised to address expanded examination volumes and particular damage mechanisms. Additionally, training will be given on the new program, the revised procedures, and the damage mechanisms being evaluated. The new UT procedures will not preclude the examiners from identifying other damage mechanisms that may exist.

The inputs used for Surry are discussed in engineering transmittal ET No.

MAT-97-0014, Rev. 0. The document was submitted to the NRG as part of the June 18, 1998 RAI response. Additionally, Enclosure 2 of the same response included the segment data sheets and the corresponding inspection parameters used for each segment.

References:

• D. 0. Harris and D. D. Dedhia, 1992, Theoretical and User's Manual for pc-PRAISE, A Probabilistic Fracture Mechanics Computer Code for Piping Reliability Analysis, Lawrence Livermore National Laboratory, U.S. NRG Report NUREG/CR 5864.

• Westinghouse Energy Systems, Westinghouse Owners Group - Requested Information on SRRA Models for Risk-Based ISi Program (MUHP-5092), Letter ESBU/WOG=96-234*dated *July *3;**1-996:)

NRC Question No. 11 Examination methods should be selected to address the degradation mechanisms, pipe sizes, and materials of concern. The methods selected should be capable of detecting 17

the targeted degradation mechanism before structural integrity is impacted. Provide a technical discussion describing how examination methods were selected for each targeted type of degradation and the basis for these selections.

Virginia Power Response The examination method selected for each targeted type of degradation was based upon Code Case N-577 Table 1. In some instances a surface examination was added by the Surry subpanel in addition to the table requirements. These additions by the subpanel are considered augmented and not required by either the Code Case or WCAP-14572, Rev. 1. A new RI-ISi inspection plan has been developed and is included as Enclosure 2 to this letter. The plan was corrected to address previous omissions and for conformance with Code Case N-577. Examiner qualification, procedure qualification and methods to be used were discussed in our response to Question 10.

Susceptible locations in Region 1A (see WCAP-14572 Rev. 1, Figure 3.7-1, page 163) were examined for the postulated mechanism selected for the segment failure estimate.

Region 1B and Region 2 locations were usually examined for thermal fatigue (exceptions exist for augmented programs where credit was taken, e.g., FAC). The thermal fatigue failure mechanism was used in all situations where the failure mechanism was 1) thermal fatigue, 2) where no failure mechanism was identified by the panel, or 3) when examinations were required by the statistical sampling program (default failure mechanism).

NRC Question No. 12 Pursuant to 10 CFR 50.55a(a)(3)(i), the licensee has submitted a proposed alternative to Section XI requirements for the examination of piping. The alternative includes Examination Categories B-F, B-J, C-F-1 and C-F-2. In later editions of the Code (1989 Addenda), Examination Category B-F is specifically for "Pressure Retaining Dissimilar Metal Welds in Vessel Nozzles". Considering that the trend of the Code is to classify B-F welds as part of vessel nozzles, provide justification for including these welds in the RI-ISi program for piping?

Virginia Power Response Code Case N-577, -1000 Scope and WCAP-14572, Rev. 1, provide risk-informed ISi requirements-for.Class 1.**2, *and_°3.p1ping-thafare-iiiternaffve_s,-fo-Categories B~F. s*-J, C-F-1, and C-F-2 for a broad range of Code Editions and Addenda. The specified examination volume and area requirements under the current applicable Code Editions and Addenda for this Case (i.e.,Section XI, 1977 Edition up to and including the 1996 Addenda) are the same for all dissimilar metal circumferential or butt welds regardless of whether they are labeled vessel type nozzle-to-safe end welds or not. All the item numbers for dissimilar metal butt or circumferential welds in Category B-F or Category 18

• B-J require the same volume and area to be examined that is depicted in Fig. IWB-2500-8. Code Case N-577 expands the requirements associated with Fig. IWB-2500-8 based on postulated degradation mechanisms listed in the Case under "Table 1 Examination Categories" and the table's notes. Surry has applied the alternative scope requirements from the Code Case in the selection of their RI ISi program. This selection includes all Category B-F and Category B-J dissimilar metal welds and has resulted in a comprehensive program which has included an evaluation of all welds subject to the same Code examination volume and area requirements. The ASME correction of nomenclature used in Category B-F that has been incorporated into the Code beyond the 1989 Edition has no technical bearing on the content or the use of Code Case N-577.

As a result of discussions with the NRC staff, the revised risk-based ISi examination plan (Enclosure 2) provides additional samples of B-F welds by adding two B-F welds for a steam generator and adding one B-F pressurizer weld associated with the pressurizer safety valve line. These additions expand our defense-in-depth proposal for the Surry RI-ISi program, which had already included the reactor vessel nozzle dissimilar metal (B-F) welds. It should be noted that these additional locations are in excess of those identified as -risk significant by the RI-ISi process and are not specifically required by the Code Case or WCAP-14572, Revision 1.

NRC Question No. 13 Section 3.4, "Failure Probability Assessment", addresses failure mechanisms which are listed generically in Table 3.4-1. Examples of how failure mechanisms were applied are contained in Table 3.4-2. Recognizing and assigning potential mechanisms is crucial in identifying susceptible locations and applying effective examination methods.

Therefore, a comprehensive evaluation of industry failures is imperative. To help the staff assess the proposed alternative as it relates to potential degradation mechanisms, provide the following information:

a) Provide the basis for the degradation mechanisms considered for estimating failure probability. In addition, provide a detailed description of the industry component failure data and plant history records that were considered, including the scope of the records assessed.

b) As_stated.in . the_submittal,__actualJnputs.and.assumptions-made .are.specified in the SRRA worksheets. Provide a comprehensive discussion regarding these inputs, or provide a copy of the SRRA worksheets. Did the SRRA allow the input of multiple degradation mechanisms for a given element?

19

• c) Clarify how the degradation mechanisms were evaluated for each pipe element and provide rationale relating to why an element was considered to be susceptible or not susceptible to a given mechanism.

d) Describe how the data for snubber malfunctions was used in the SRRA piping probabilities (i.e., for which degradation mechanisms was it considered appropriate to reduce piping failure probabilities?)

e) In the initial RI-ISi Program included in Attachment 4, examinations are limited to Items R1.11, R 1.12, R1.13 and R1.16. The degradation mechanisms that correspond to these items are thermal fatigue, high-cycle mechanical fatigue, erosion/corrosion and cavitation, and intergranular stress corrosion cracking (IGSCC), respectively. Are these the only postulated degradation mechanisms that warrant examination at Surry, Unit 1?

Virginia Power Response 13(a) Engineering Transmittal ET No. MAT-97-0014, Estimated Failure Probabilities for Risk-Based ISi, Surry Unit 1, Rev. 0, documents the failure estimation process and degradation mechanisms considered. The ET and supporting information was supplied in our June 18, 1998 RAI response. The engineering panel performed the failure estimate by reviewing the industry experience available (e.g., NPRDS data), the system engineer's experience with the system and the normal _operating conditions of the system. The failure mode was selected based upon these inputs by the panel. Thermal fatigue was selected, if no other mechanism was identified or if thermal fatigue was the failure mechanism identified.

13(b) Supporting information including the SRRA worksheets were supplied in our June 18, 1998 RAI response. In some instances multiple failure mechanisms were considered if the secondary failure mechanism again produced a failure probability close to the primary estimate and the failure mechanism required a different type of examination. A secondary mechanism was considered for the blowdown and feedwater systems. The primary mechanism was identified as flow accelerated corrosion (FAC). The analysis also identified that thermal fatigue would provide a high failure estimate. Examinations were scheduled for both failure mechanisms on these systems.

13(c) Element by element failure probabilities were not calculated. Instead an estimate based upon most limiting conditions was obtained for the segment from the SRRA code model. The extent of the elements of a segment considered susceptible to the postulated failure mechanism, which corresponds to Region 1A (Figure 3.7-1, WCAP-14572, Rev. 1), was determined subjectively by 20

• the panel. The panel utilized insights associated with the postulated failure mechanism, the operating conditions associated with the segment, known failure information and the panel experience to determine the extent. The elements in the segment in Region 18 were evaluated statistically with thermal fatigue *(no other_ mechanism identified) as the considered failure mechanism. Region 2 elements/segments were treated the same as Region 18.

13(d) Engineering Transmittal ET No. MAT-97-0014, Estimated Failure Probabilities for Risk-Based ISi Surry Unit 1, Rev. 0, submitted previously in our June 18, 1998 RAI response documents snubber malfunction treatment. The snubber evaluation impacted failure mechanisms and estimates, which were affected by changes to either the fatigue stress range or the design limiting stress in the SRRA model. For example the thermal fatigue failure mechanism failure estimate is affected by changes to both inputs, where as the flow accelerated corrosion estimate is not affected by changes to either parameter. In general, snubber malfunctions affected segments with very low failure estimates by increasing the estimated failure probability for the segment.

13(e) The selected postulated failure mechanisms from Code Case N-577 represent the most likely degradation mechanism to be found in a particular segment at Surry. The selection of the mechanisms was heavily based upon industry and plant experience, and plant conditions. Consideration was also given to on-going maintenance activities, such as the plant's maintenance of coatings, to prevent or mitigate certain failure mechanisms such as microbiologically induced corrosion (MIC) (R 1.17). If the omitted Table 1 failure mechanisms become more evident in the industry for a similar design plant, then these other mechanisms will be considered as part of the normal plant update of the RI-ISi program.

NRC Question No. 14 In Table 5-1, some components require VT-2 at specific locations per Note b, while others require VT-2 of the entire segment per Note e. Describe the difference between these examinations. In addition, the VT-2 is considered part of the Code-required pressure ..testing-that ..will --be .. performed-on -all--pr-essure-retaining--systems. -However, VT-2 is specified as a "method" in th_e tables in Attachment 4 (RI-ISi Program Examinations). Describe how the VT-2 visual examinations are being applied. If VT-2 examinations are credited as nondestructive examinations, provide a technical discussion justifying the use of a VT-2 examination in lieu of conventional nondestructive examinations .

• 21

• Virginia Power Response The VT-2 examination required by Code Case N-577, Table 1, Item Nos. R1 .12 and R1 .15. are required to be performed each refueling outage. The required frequency is the same as currently required for Class 1 components but is an increased frequency over the current period requirements for Class 2 and Class 3 components. Note 11 states the VT-2 examination may be conducted during a system pressure test or a pressure test specific to that component or element. The use of a VT-2 examination in lieu of conventional nondestructive examinations for these item numbers should be more appropriately addressed by the ASME organization.

Specific locations (componenUelement) were identified for VT-2 examination if the panel determined that a specific location was more susceptible to the postulated failure mechanism. The entire segment was identified if the area of concern could not be localized. The RI-ISi examinations (VT-2) will be performed each refueling outage, as reflected in Enclosure 2 to this letter. Attachment 4 of our October 31, 1997 submittal has been revised to clarify the every refueling outage requirement of Code Case N-577 for RI-ISi VT-2 examinations and is included as Enclosure 2 to this letter. The ASME Class 1, 2, and 3 pressure test program will remain in place and is unaffected (Class 1 each refueling, Class 2 & 3 each period).

NRC Question No. 15 Section 3.8 of the submittal, "Structural Element and NOE Selection", states that the number of locations to be inspected was determined using a Westinghouse Statistical model as described in section 3.7 of WCAP-14572. However, the explanation following figure 3.7-1 in the WCAP states that 100% of all susceptible locations in Region 1 will be examined. Susceptible locations are defined as structural elements likely to be affected by a known or postulated failure mechanism. Further down in the WCAP explanation it seems to imply that only some of the susceptible locations will be inspected. The last sentence in the WCAP is similar to the above submittal statement, e.g., an acceptable statistical evaluation process may be used to determine how many examination locations are needed. Finally, page 166 of the WCAP cautions that, 'the

[statistical] model is intended to be used for highly reliable piping ... "

a) Please provide a concise description as to how the number of locations is selected, and how specific locations are selected. Include in the description

- definitions-ofexamination'1--and-'!inspection".

b) Provide a summary that lists the total number of structural elements for each segment, the number of elements subject to examination under the proposed program, and the source of the examinations (e.g., susceptible location, selected due to need to fulfill statistical sampling requirements, etc.) .

22

Virginia Power Response 15(a) In general, "inspection" is* used to refer to the overall ISi program and "examination" is used to refer to the actual NOE technique used to examine the weld. There may, however, be exceptions to these general definitions in the text of the submittal and in WCAP-14572, Revision 1.

The locations and the number of locations were determined as described in the following steps. For additional information on each of the steps, WCAP-14572, Revision 1, section references are provided in parentheses.

1. The Surry expert panel determined the high safety significant (HSS) and low safety significant (LSS) segments (3.6.3, 3.6.5).

2. The Surry engineering subpanel classified each segment in the RI-ISi program according to the Structural Element Selection Matrix, WCAP-14572, Figure 3.7-1. As part of this classification, segments classified in Region 1 of the figure were further subdivided. For each segment in Region 1, the piping segment was further subdivided into those locations which are susceptible to the postulated or known failure mechanism (classified in Region 1A). All of these locations will receive an appropriate examination (3.7.1). The remaining locations in each segment were classified as Region 1B, and the

• Perdue Model was used to determine the number of the remaining locations in each segment which will receive an appropriate examination (3.7.2). For the segments in Region 2, the Perdue Model was used to determine the number of locations for each segment which will receive an appropriate examination (3.7.2). For segments classified in Region 3, if a Surry defined augmented inspection program applied to the segment, then it remains in place but no RI ISi examinations were defined. The segments classified in Region 4 only receive pressure tests and visual examinations if they are currently ASME Class 1, 2, or 3 (3.7.1). Note that system pressure tests and visual examinations will also be performed for Class 1, 2, and 3 piping in Regions 1, 2,and 3 (4.3).

3. The locations for the examinations were determined by the Surry engineering subpanel to be the most susceptible failure locations based on the information in WCAP-14572, Section 3.7.3, and described by examples in Section 3.7.5.

4. Changes in risk calculations were performed to compare the current Section XI piping ISi program to the RI. piping ISi program. The criteria on page 207 of WCAP-14572 were applied and 10 additional segments were selected for examination of one location per segment. This is described in Section 3.10 of the Surry RI-ISi Pilot Submittal (4.4.2).

5. For defense in depth considerations and because new information was identified, an additional 7 segments were added to the program for 23

examination of one location in each. This is discussed in Section 3.10 of the Surry RI-ISi Pilot Submittal and summarized in Submittal Table 3.10-2.

15(b) Th~ table 15-1 provides the requested information for the segments for which the req*uested information was generated during the pilot program. Note that because segments classified in Regions 3 and 4 of WCAP-14572, Figure 3.7-1, are not part of the RI piping ISi inspection program, the requested information was not collected and is not presented.

Table 15-1 Segments Selected for Examination Segment Number of Number of Reason for Element Selection Elements Elements for Examination AFW-004 ** 1 area Low point - Thickness exam AFW-005 ** 1 area Low point - Thickness exam AFW-006 ** 1 area Low point - Thickness exam AFW-015 30 1 Augmented Program/Statistical sampling requirement for secondary mechanism AFW-016 28 1 Augmented Program/Statistical sampling requirement for secondary mechanism AFW-017 12 1 Augmented Program/Statistical sampling requirement for secondary mechanism AFW-018 13 1 Augmented Program/Statistical sampling requirement for secondary mechanism AFW-019 12 1 Augmented Program/Statistical sampling requirement for secondary mechanism AFW-30 ** 1 area Low point-thickness examNT-2

. - . ... **- ., .- ~ . - *-

entire segment AFW-31 ** 1 area Low point-thickness examNT-2 entire segment AFW-32 ** 1 area Low point-thickness examNT-2 entire segment AS-001 ** 1 Location based upon indirect effect 24

Table 15-1 Segments Selected for Examination Segment Number of Number of Reason for Element Selection Elements Elements for Examination AS-002 ** 1 Location based upon indirect effect 80-0028 8 1 Augmented Program/Statistical sampling requirement for secondary mechanism 80-003 39 1 Augmented Program/Statistical sampling requirement for secondary mechanism 80-0058 17 1 Augmented Program/Statistical sampling requirement for secondary mechanism 80-006 47 1 Augmented Program/Statistical sampling requirement for secondary mechanism 80-0088 12 1 Augmented Program/Statistical sampling requirement for secondary mechanism 80-009 49 1 Augmented Program/Statistical sampling requirement for secondary mechanism CC-025 ** 2 VT-2 Required/ Subpanel augmented with NOE CC-028A ** 2 VT-2 Required/ Subpanel augmented with NOE CC-0288 ** 1 Susceptible location CC-029 ** 1 Susceptible location CC-030 ** 2 VT-2 Required/ Subpanel augmented with NOE CC-033 ** 3 VT-2 Required/ Subpanel augmented with NOE CH-005 16 1 Statistical sampling requirement CH-007A ..

• • ~r:itire _s~grn_~nt.. . --- ... H§S.~~?.9n:ie.nt w~ing VT-:2.

-* 7 - -

CH-008 ** 3 VT-2 Required/ Subpanel augmented with NOE CH-009 ** 3 VT-2 Required/ Subpanel augmented with NOE CH-010 ** 4 VT-2 Required/ Subpanel augmented with NOE 25

Table 15-1 Segments Selected for Examination Segment Number of Number of Reason for Element Selection Elements Elements for Examination CH-011 ** 1 VT-2 Required / Subpanel augmented with NOE CH-012 ** 1 VT-2 Required/ Subpanel augmented with NOE CH-013 ** 1 VT-2 Required/ Subpanel augmented with NOE CS-001 ** 1 Change in risk considerations CS-002 ** 1 Change in risk considerations CW-005 ** NA Maintain coatings CW-006 ** NA Maintain coatings CW-007 ** NA Maintain coatings CW-008 ** NA Maintain coatings ECC-000 57 1 Statistical sampling requirement ECC-001 9 2 Susceptible location (1) / Statistical sampling requirement (1)

ECC-002 9 2 Susceptible location (1) / Statistical sampling requirement (1)

ECC-003 7 2 Susceptible location (1) / Statistical sampling requirement (1)

ECC-005 2 2 Susceptible location (1) / Statistical sampling requirement (1)

ECC-006 2 2 Susceptible location (1) / Statistical sampling requirement (1)

ECC-007 2 2 Susceptible location (1) / Statistical sampling requirement (1)

FW-001 ** 1 Augmented Program / Sample location for secondary failure mechanism FW-002 ** 1 Augmented Program / Sample location for secondary failure mechanism FW-003 ** 1 Augmented Program / Sample location

-* -**-- .. . . ... .... .for.secondary.failure mechanism FW-004 ** 1 Augmented Program / Sample location for secondary failure mechanism FW-005 ** 1 Augmented Program / Sample location for secondary failure mechanism FW-006 ** 1 Augmented Program / Sample location for secondary failure mechanism 26

Table 15-1 Segments Selected for Examination Segment Number of Number of Reason for Element Selection Elements Elements for Examination FW-007 ** 1 Augmented Program / Sample location for secondary failure mechanism FW-012 **

• Augmented Programs for primary and secondary failure mechanisms FW-013 **

• Augmented Programs for primary and secondary failure mechanisms FW-014 **

• Augmented Programs for primary and secondary failure mechanisms FW-015 **

• Augmented Programs for primary and secondary failure mechanisms FW-016 **

• Augmented Programs for primary and secondary failure mechanisms FW-017 **

• Augmented Programs for primary and secondary failure mechanisms HHl-001 9 1 Statistical sampling requirement HHl-002 22 1 Statistical sampling requirement HHl-003 50 1 Statistical sampling requirement HHl-004C 9 1 Statistical sampling requirement HHl-005A ** 1 Change in risk considerations HHl-005C 9 1 Statistical sampling requirement HHl-006A ** 1 Change in risk considerations HHl-006C 21 1 Statistical sampling requirement HHl-008 107 1 Statistical sampling requirement HHl-009 82 1 Statistical sampling requirement HHl-010 20 1 Statistical sampling requirement HHl-011 1 1 Only one weld HHl-012A 38 (butt welds) 1 Statistical sampling requirement HHl-012A 33 (socket welds) 1 Statistical sampling requirement HHl-013 19 1 Statistical sampling requirement HHl-015 26 1 Statistical sampling requirement HHl-017 -15 -*- .... --1 . - * *~>> ... -Statistical-sampling- requirement LHl-001 ** 1 Change in risk considerations LHl-002 ** 1 Change in risk considerations LHl-003 2 1 Statistical sampling requirement LHl-004 2 1 Statistical sampling requirement LHl-007 77 1 Statistical sampling requirement LHl-008 78 1 Statistical sampling requirement 27

Table 15-1 Segments Selected for Examination Segment Number of Number of Reason for Element Selection Elements Elements for Examination LHl-009 16 1 Statistical sampling requirement LHl-010 102 1 Statistical sampling requirement LHl-018 20 4 VT-2 Susceptible location (3) /

Statistical sampling requirement (1)

MS-010 7 1 Augmented Program/ Statistical sampling requirement/ added with new information MS-032 ** 1 Augmented Program / Sample location for secondary failure mechanism MS-033 ** 1 Augmented Program / Sample location for secondary failure mechanism MS-034 ** Entire segment Augmented Program/ HSS segment using VT-2 RC-001 ** 1 Defense-in-depth consideration RC-002 ** 1 Defense-in-depth consideration RC-003 ** 1 Defense-in-depth consideration RC-013 ** 1 Defense-in-depth consideration RC-014 ** 1 Defense-in-depth consideration RC-015 ** 1 Defense-in-depth consideration RC-016 8 2 Susceptible location (1) / Statistical sampling requirement (1)

RC-017 8 2 Susceptible location (1) / Statistical sampling requirement (1)

RC-018 8 2 Susceptible location (1) / Statistical sampling requirement (1)

RC-027 ** 1 Change in risk considerations RC-028 ** 1 Change in risk considerations RC-029 ** 1 Change in risk considerations RC-037 ** 2 VT-2 Segment I Subpanel augmented with NOE RC-038 .. . ** 1 * ** ~ - 1*. * - *

- ****-- . ******--2---** .... *---~-- -VT-2-Segment./~Subpanel--augmented with NOE RC-039 ** 2 VT-2 Segment I Subpanel augmented with NOE RC-041 4 2 Susceptible location (1) / Statistical sampling requirement (1)

RC-042 4 2 Susceptible location (1) / Statistical 28

Table 15-1 Segments Selected for Examination Segment Number of Number of Reason for Element Selection Elements Elements for Examination sampling requirement (1)

RC-043 3 2 Susceptible location (1) I Statistical sampling requirement (1)

RC-058 4 1 Statistical sampling requirement RC-059 4 1 Statistical sampling requirement RC-060A ** 1 Change in risk considerations RH-002 5 1 Statistical sampling requirement RH-003 169 1 Statistical sampling requirement RH-0038 1 1 Only one weld RH-011 ** 2 Currently exempt piping, Selected two sample locations RS-003A 1 1 Only one weld RS-004A 1 1 Only one weld SW-044 ** 1 CuNi piping, Selected one sample location SW-045 ** 1 CuNi piping, Selected one sample location SW-046 ** 1 CuNi piping, Selected one sample location SW-047 ** 1 CuNi piping, Selected one sample location SW-054 ** 1 CuNi piping, Selected one sample location VS-001 ** 1 Sample location VS-002 ** 1 VT-2 entire segment required/

Subpanel augmented with NOE

(*) Augmented program already in place.

(**) Perdue Model not used.

A revised risk::basedJSI ._inspectior:1-.plan.-(Enclosur:e-2) .. has been .provided detailing the examinations that will be performed and the location .

• 29

• NRC Question No. 16 In Section 3.9, "Program Relief Requests", it states that "Relief requests for piping are no longer required as our program is being submitted as an alternative (10 CFR 50.55a(a)(3)(i))". It also stated that examinations that do not meet >90%

examination coverage criteria * (per Code Case N-460) will be evaluated for acceptability. The basis, including a statement of how the risk will be addressed, will be documented and maintained as a record. Draft Standard Review Plan (SRP) 3.9.8 states that "To be acceptable, alternate methods should be specified to ensure structural integrity in cases where examination methods cannot be applied due to limitations such as inaccessibility or radiation exposure hazard." Considering that the implementation of the proposed RI-program will significantly reduce the number of examinations, limited examinations could have a significant impact on the risk. Provide details of limited examinations and specify alternative examination techniques that will ensure structural integrity in the case of limited examinations.

Virginia Power Response The strategy to be applied with regard to examination coverage is as follows:

1. Attempt to provide a minimum of >90% coverage. Volumetrically this will be done using ultrasonic (UT) techniques with the >90% requirement being met in all Code required directions (averaged). The examination will be considered complete if the >90% coverage is obtained using the specified technique in the plan or combinations of techniques if limitations are encountered. Some limitations will not be known until the examination is performed, since some locations will be examined for the first time by the specified techniques.

2. If >90% coverage is not obtained, the coverage obtained will be documented as well as the reason for the coverage limitation. If the coverage is limited by an obstruction, which is removable, then an evaluation will be performed to either allow removal of the obstruction or justify why the obstruction cannot be removed.

3. If the obstruction is required to remain, then consideration will be given to the structural elements on either side of the selected structural element, which is limited. If either of these structural elements can be examined to the coverage requirements, then an examination will be performed there in addition to the limited coverage exam already performed. This may be the only examination performed in situations where the selected element was selected for statistical salTJpling alone. Selecting another location would meet the statistical requirements for the segment, and the original site does not need to be examined. Additionally, the substitution (statistically) would not necessarily be limited to the elements on either side of the element originally selected.

4. If the area or volume of concern still remains insufficiently addressed, consideration will be given to leakage monitoring options such as more frequent pressure testing and VT-2 examinations or operator walkdowns.

30

5. The coverage obtained, limitations encountered, alternative provisions, and an assessment of how the risk is being addressed will be documented. The information will be formally submitted as a relief request.

It should be noted that if a current Section XI examination is a partial examination, and it continues to be a partial examination in the RI-ISi process, the amount of risk addressed by examination remains the same for that location. If a new location is going to be examined by RI-ISi and it is a partial examination, but it was not previously required to be examined by Section XI, then the new examination would still increase the amount of risk addressed by examination for that location. It is not necessarily true that because you -reduce examination totals, that a complete examination must be performed at the RI-ISi selected locations to maintain risk neutrality or improvement in the program. The impact of locations being removed on overall risk contribution would need to be assessed (i.e., usually the segment risk contribution was negligible) in an analysis. Additionally, the sampling requirements necessary to maintain assurance of structural integrity would need to be accounted for in the analysis. These type evaluations would be included in how the risk is being addressed in a partial examination situation.

NRC Question No. 17 The inservice inspection strategy used in the RI-ISi program must define when the inspections are to be performed. Specified inspection intervals must be consistent with relevant degradation rates. Inspection intervals should be sufficiently short such that degradation too small to be detected during one inspection does not grow to an unacceptable size before the next inspection is performed. Provide a discussion regarding the inspection intervals contained in the RI-ISi program and confirm that the proposed examination frequency will not result in exceeding the current Section XI inspection interval of ten years.

Virginia Power Response Code Case N-577 defines the inspection frequency to be used at Surry in Table 1.

Specified examinations in Table 1 each have an interval (10 year) requirement. The table also allows use of the Owner's FAC program (Note 9). ASME Section XI does not currently address FAC programs and associated inspection frequencies.

NRC Question No. 18 Provide technical justification for performing outside diameter (OD) surface examinations for structural elements subject to thermal fatigue .

• 31

Virginia Power Response A revised RI-ISi inspection plan has been provided that conforms to Code Case N-577 (thermal fatigue volumetric examinations). Locations that are a socket weld and required to be volumetrically examined by the Code Case were identified with a note (1) in the exam method. A relief request will be submitted for these locations at a later date for NRC review and approval. In some instances the subpanel required a surface exam in addition to the Code required volumetric examination in order to address outside diameter originating damage mechanisms. (See response to question 11.)

NRC Question No. 19 Please discuss your process to determine if, and when, plant procedural or hardware changes should be incorporated into the PRA or, at least, into the risk insights used to support the conclusions of the RI-ISi submittal. Please provide a copy of the administrative procedures used to guide and control the PRA update process. Are sequential versions of the PRA model and documentation maintained as retrievable site records?

Virginia Power Response PSA model updates are scheduled for 18-month intervals to coincide with the refueling outages. The administrative guidance for this activity is contained in the Nuclear Safety Analysis Manual, Part IV, Chapter A. A copy of the procedure is provided as Attachment 1.

The PSA model is documented using calculations in accordance with Nuclear Implementing Procedure NAF-100 entitled "Engineering Calculations." These calculations are retained as retrievable site records. Sufficient information is maintained in paper form that superceded models could be reused if necessary. The current model is maintained on the department file-server in a protected location.

NRC Question No. 20 The ISi submittal states that the submittal was based on the, "latest PSA model."

Please specify a calculation number, a revision number, a date, or some other reference-identifying*-which version -*of-the**model*-was *used.* **were the modifications outlined in corporate Potential Problem Report (PPR)97-017, "PSA Model Concerns &

Enhancements Based on MRule Expert Panel Input Surry Power Station," incorporated into the model used to support the ISi submittal? If not, were the proposed modifications reviewed to ensure that the risk insights used to support the submittal are still valid? Please confirm that all plant and procedural changes which could impact the 32

risk insights used to support the conclusions of the submittal have been evaluated and incorporated if necessary.

Virginia Power Response The Surry RI-ISi submittal was based on the current PRA model at the time the submittal was made. In June of 1997, the subject potential problem report was issued.

Upon review of the potential problem report it was concluded that the majority of the items mentioned in the. report would reduce the core damage frequency and large early release frequency. It could not be determined a priori what the impact would be at the component level. Since components were used as surrogates for pipe segments the impact on individual segments also could not be determined a priori. As a result, the relevant information from the PPR was presented to the expert panel for each system as part of the background information. The members of the panel were able to qualitatively determine the impact at the segment level.

The PPR items were evaluated and implemented in a revised model that was completed at the end of June 1998. The procedural guidance presented in Attachment 1 defines how the model update impacts the PSA products.

NRC Question No. 21 The relationship between the IPE internal flooding, subsequent flooding re-analysis of the IPE dated November 1991, and the analyses developed to support the ISi submittal is unclear. The flooding CDF in the re-analysis is 5.1 E-5 per year, while the flooding CDF reported on page 2 of the ISi submittal is 2.5E-5 per year. Finally, depending on operator action credited, the ISi submittal CDF results, which includes LOCAs, range from 3E-6 to 6E-5 per year. Based on the response to RAI G-22, some conservative assumptions of flooding IPE analyses are eliminated while the impact of indirect effects is expanded.

• a) Please identify the ISi submittal analysis guidelines used to determine what equipment fails due to the indirect effects. For example, are drains credited, are the failure open or closed of doors credited, how high must the water be to fail motor control centers, must electro-mechanical equipment be submerged, etc.

b) Using the* assumption and results from the* flooding* re-analysis, please explain, providing the quantitative results in the intermediate stages, how the flooding reanalysis has been modified to arrive at the results used in the ISi submittal.

Please include some pipe segments which were initially important (from Table 3.4-2 of the flooding re-analysis for example) but which are now considered LSS, and some which may have initially been unimportant but which are currently classified as HSS.

33

c) If operator action in a flooding situation has resulted in categorization of certain segments as LSS, please identify those segments and the associated operator actions. Please also note if these operator actions are currently under plant procedures for which operators are trained.

Virginia Power Response 21(a) The IPE analysis is the basis for determining what equipment would fail due to flooding. The screening portion of the IPE internal flooding analysis generally assumed that any .equipment .located in the area failed. This approach provided a list of equipment vulnerable to flooding that was included as part of the walkdown package. For pipe whip and jet impingement the UFSAR was used to define where high energy piping was located. Expert judgement from the walkdown team was used to determine which components were potentially subject to failure as a result of high energy pipe failure. It should be noted that in some instances conservative assumptions were made because of the complex layout. If an area was particularly congested, it was assumed that all of the equipment in the area failed. In summary, no detailed calculations of critical flood height were performed. Rather, components were assumed to fail based solely on being located in the area.

21 (b) The flooding reanalysis and the RI-ISi analysis are two different analyses, and the results cannot be compared. Although the IPE report was used as input, the piping CDF is not integrated into the PSA model. The IPE flooding analysis was initially performed to identify vulnerabilities to severe accidents. The RI-ISi submittal provides an improved method for doing ISi inspections. The RI-ISi model is based on the relative risk importance of individual piping segments but does not represent an additional contribution to overall core damage frequency.

Rather, a conditional piping core damage frequency is calculated as the sum of the piping segment conditional core damage frequency. The total piping core damage frequency is only used to relate the pipe segments to each other.

21 (c) For the "without operator action cases, no credit for operator action has been explicitly applied in the RI-ISi submittal analysis. The cases that were run with assumed operator action were a means of identifying additional HSS segments.

No s~g111ents. were. cba11ged from. HSS to .. L$S b~se.d .. on assumed operator action. Even for the "with operator action cases, no credit for operator action was taken to preclude spray / jet impingement impacts .

• 34

• NRC Question No. 22 Please describe several representative "Special Cases" calculations (defined on page 102 of the WCAP) which had to be performed at Surry. Since every pipe failure that could cause an initiating event, could also fail after an unrelated initiating event occurred, why is it not necessary to apply this analysis to every pipe failure that could cause an initiating event? How many such calculations were necessary?

Virginia Power Response The calculations for each piping segment were provided in the June 18, 1998 response.

In general, these special cases were used when a piping segment had multiple impacts such as when:

• the type of piping failure (through-wall flaw, disabling leak, etc.) leads to different direct consequences, such as a large LOCA, medium LOCA or small LOCA depending on the piping failure size

• the type of piping failure (through-wall flaw, disabling leak, etc.) leads to different direct and indirect consequences, such as loss of adjacent equipment due to jet impingement only without system failure OR the loss of the adjacent equipment AND system failure

• the timing of the piping failure is different (failure occurs as an initiating event OR failure occurs after an unrelated initiating event in which the system that experienced the piping failure is demanded to prevent core damage). (This case is applied to piping segments that are required to respond to the unrelated initiating event in order to prevent core damage.) This is similar to inclusion of special initiating events into the plant PSA.

The piping segment CDF is calculated using Boolean algebra.

An example of the first case is for RCS-1, the CDF if the piping failure results in a large LOCA is 3.58E-09/year, the CDF if the piping failure results in a medium LOCA is 2.04E-09/year and the CDF if the piping failure results in a small LOCA is 2.97E-10/year, the total piping segment CDF is calculated as:

CDF segment = CDF IE LLOCA + CDF IE MLOCA + CDF IE SLOCA

= * *3 :58E:-Q91year:+ 2:*04E:Q9/year + '2. 97E~10/year

= 5.91 E-09/year For piping segment CC-001A, the system can fail and cause an initiating event (loss of CCW) or it could fail in response to an unrelated initiating event. The CDF for the

• system portion is 7 .11 E-12/year and the CDF for the initiating event portion is 35

1.40E-12/year. Using this information, the total piping CDF for that piping segment is calculated as:

CDFsegment = CDF IE+ CDF SYS - Uoint probability= CDF,E *CDFsys)

= 1.40E-12/year + 7.11 E-12/year - (1.40E-12

• 7.11 E-12)

= 8.50E-12/year NRC Question No. 23 The WCAP describes a statistical method on page 165 used to assist in selecting the minimum number of locations to be examined. The methodology uses the probability of a flaw, the conditional probability of leak/year/weld, and a target leak rate/year/weld to develop a minimum number of welds to inspect to assure that the target rate is met with a stated level of confidence.

a) How are these three input parameters related to the parameter values used to support the determination of safety significance? For example, the target frequencies suggested in Table 3.7-1 are on the order of 1E-6 per year per weld.

Is this the frequency of very small leaks (on the order of gallons per minute), or, if not, what is the magnitude of these observed leaks?

b) Page 170 indicates that the model is only applied to highly reliable piping. It is our understanding that "highly reliable" is used to describe segments where no degradation mechanism are present. Furthermore, if no degradation mechanisms are present a pipe break frequency of 1E-08 per 40 years per weld (e.g., 2.5E-10 per year per weld) is used to develop the safety significance of the segments. Is this correct? If not, please provide a discussion of the magnitude of the pipe break frequencies characterizing highly reliable piping.

c) Meeting risk informed target values should provide confidence that the values used to characterize the equipment reliability while determining the safety significance of the equipment is maintained. Please provide an analysis showing that the number of welds requiring inspection to meet a target leak rate of 1E-6 per year per weld provides an equivalent confidence that a break target frequency of 2.5E-10 per year per weld is met (or that break frequency characterizing the risk driving failure mode of highly reliable piping if not 2.5E-10 per*year perweld). - -- - - -

d) Page 166 of the WCAP mentions "lots." Were lots used in the Surry analysis? If so, what guidelines were used to determine when to combine segments into lots? How many lots were eventually used and how many segments were included in these lots?

36

• e) Please characterize the results of the Perdue calculations. That is, how many segments needed 0, 1, 2, etc. welds inspected based on the calculations? Do not include the "minimum of one location" discussed on page 170 in the characterization of the results. How many of the total weld inspections in the submitted program are based on the results of this statistical evaluation?

f) The Perdue method yields a given confidence of maintaining an acceptable leak rate per segment. How do these evaluations address the leak rate at the system and plant level?

Virginia Power Response 23(a) The probability of a flaw used in the Perdue Model is from the SRRA run used for the safety significance determination. The conditional probability of leak/year/weld is calculated from the SRRA code run used for the safety significance determination for those segments classified as category 2 in WCAP-14572, Revision 1, Figure 3.7-1. For the segments with remaining locations classified as category 18, the SRRA code is run to model the secondary failure mechanism and the conditional probability of leak/year/weld is calculated from that SRRA code run. The target leak rate is not used by the SRRA code to determine_ piping failure probabilities, nor is it used in safety significance considerations. Note that the leak frequencies are expressed as the presence of a through-wall flaw, not a leak expressed in gallons per minute. The target frequencies in WCAP-14572, Revision 1, Table 3.7-1 were based on suggested preliminary values from the NRC and are consistent with, or conservative compared to, the values provided in Table A2.8 in Appendix 1 of Draft Regulatory Guide DG-1063, October 1997.

23(b) A generic pipe break frequency of 1.0E-08 per 40 years was not used for the Surry RI-ISi study for highly reliable pipe. This value had been used for the Millstone 3 RI-ISi program, however, the methodology was enhanced for the Surry study which accounted for pipe leaks and breaks. If used for the risk determination to model pipe whip, the pipe break frequency was determined using the SRRA code. Large leak frequencies, rather than break frequencies are used to characterize pipe failure likelihood. Page 164 of WCAP-14572, Revision 1, provides a large leak probability range of 1.0E-03 to 1.0E-04 per 40 years for considering a segment to have a high failure importance (these values" _are ___based __p.rimarilY-- on_Jhe".-expected ....dominant. failure . mechanism probabilities). Large leak frequencies below this range would be considered characteristic of highly reliable pipe .

• 37

• 23(c) As mentioned in the response to part a, the leak frequency is expressed as the presence of a through-wall flaw given the existence of a flaw with a/t > 10%. The Perdue Model estimates the likelihood of detecting this condition. For the types of degradation mechanisms evaluated with the Perdue Model, the existence of a detectable flaw is a precursor to a pipe through-wall flaw, a large leak and break.

For most cases of highly reliable piping, the progression of the events is as follows:

detectable flaw (a/t > 10%) => through-wall flaw=> large leak=> break where:

• detectable flaw (alt> 10%) - focus of NOE inspection

• through-wall flaw - focus of leak detection/pressure testing Oet impingemenUspray consequences, does not disable system function)

• large leak- disable system function

• break - disable system function and possible pipe whip The RI-ISi program leads to the selection of the appropriate examination technique for the degradation mechanism to detect flaws. Therefore, achieving a high confidence level that the target leak frequency will be met directly correlates to a high confidence of low large leak and break frequencies. For highly reliable piping, the probability of the potential flaw growing from a through-wall flaw to one large enough for a disabling leak or break is very small.

Typically, the probabilities of the more severe events (large leaks or breaks) are several orders of magnitude smaller than the probability of a through-wall flaw when calculated with the same SRRA input. Therefore, the ratio between the break probability and a target probability is expected to be similar to the ratio between the leak frequency and the target leak frequency, and the confidence derived from the Perdue Model analysis is applicable to the more severe events.

The use of target leak rates in the Perdue Model, and the actual NOE inspections required in the RI-ISi program can be likened to condition monitoring as part of the development of performance criteria under the Maintenance Rule.

As stated in NUMARC 93-01, Revision 2, "The monitoring of individual components (e.g., unacceptable performance) when setting goals may include the monitoring of condition. Condition typically includes vibration, flow, temperature and other similar parameters." Inspections to identify flaws and through-wall flaw leakage are precursors to or conditions indicative of potential failure of the piping pressure boundary. * - * ** *

• 23(d) Segments were not combined into lots for the Surry RI-ISi program. The number of welds analyzed with the Perdue Model represented those in a single segment.

• 38

23(e) All of the segments analyzed with the Perdue Model resulted in confidence levels of 95% or greater of not exceeding the target leak frequency for the pre-ISi (i.e., no ISi) case. The various sampling plans had confidence levels at least as high, so one location was selected for examination in each segment. Table 15-1 in the response to question 15 lists the bases for the number of examination locations chosen.

23(f) The evaluations do not specifically address the leak frequency at the system or plant level. .At the time the WOG RI-ISi methodology was revised to include the Perdue Model, only suggested NRC leak frequencies per weld were available.

The Perdue Model was developed to address segment leak frequencies based on a per weld target value. A system confidence that any one segment will not exhibit a leak frequency above a certain value can be determined from the Perdue Model results, however, that was not the intent for using the Perdue Model. In addition, the Perdue Model was only used for segments in category 1 and 2 (WCAP Figure 3.7-1), which does not cover all segments in a system.

NRC Question No. 24

• On page 103 of the WCAP, there is an equation were the CDF is developed as the sum of large, medium, and small leak frequencies; each multiplied by the conditional CDP associated with the appropriate leak magnitude. Were all these terms developed for each segment? If not, how many segments were characterized with all 3, and what guidelines were used to determine when all 3 were not necessary?

Virginia Power Response The equation on page 103 of WCAP-14572, Revision 1 is developed to capture the different LOCA sizes that could potentially occur depending on the piping failure size.

These terms for the LOCAs were developed for the RCS and other system segments in which a potential LOCA could occur. The guidelines used to determine what sizes of LOCA would potentially occur were based on the piping diameter. If for example, the piping segment contained piping that was 4 inches in diameter, then a medium LOCA and a small LOCA would be postulated. If the piping segment contained piping that was 29 inches in diameter, then a large LOCA, medium LOCA, and small LOCA would be postulated. If the piping segment was less than 2 inches in diameter, a small LOCA would be-postulated. ---This*-is-consistent*with-*-the-1:0GA-sizes-assumed *in the Surry PSA. The failure probabilities used in the LOCA equations are all based on disabling leak failure probability with different leak size inputs based on the LOCA size. Also see the example provided in the response to question 22 .

• 39

• The equation contained on page 92 of the WCAP is the more generalized calculation for a given piping segment. For a given segment, the general piping CDF/LERF calculation would be:

P(CDF/LERF) = P(leak)*C(leak) + P(disabling leak)*C(disabling leak) +

P(break)*C(break) where P is the probability or failure rate and C is the consequences. Depending on the piping failure consequences postulated, one or more terms of this equation may be used for a given piping segment. The consequences postulated from the piping failure for a given segment, and the associated failure probabilities to use are shown below:

Consequence Which Failure Probability to Use Jet Impingement/Spray Leak probability Loss of system function Disabling Leak or Full Break*

Initiating Event Disabling Leak (causes plant trip) or Full Break*

Flooding Disabling Leak or Full Break*

Pipe Whip Full Break

• (*) Whichever is the higher failure probability.

In summary, the postulated consequences determine how many of the terms are used in the above equation. This can be seen from the calculations provided in the June 18, 1998 response.

NRC Question No. 25 The WCAP recommends characterizing the failure probability of a segment with the failure potential (probability or frequency as appropriate) of a single selected weld in each segment as calculated by the SRRA code. This is an approximation. Given that the failure potential of a segment appears in both axis of the decision matrix in Figure 3.7-1, the categorization of segment can be very sensitive to the quantitative value selected. The reported justification for the approximation (consequences of all weld breaks in the segment is the same and only one weld rupture *is needed) clearly indicates that correct estimate is the sum of the failure potentials of all welds (minus the cross terms if necessary) and does not support use of the approximation.

a) At a meeting, a justification was given that one weld's failure potential is much greater than all others, and that selection of this weld is easily done. Is this 40 I

justification still suggested? This justification would be acceptable when its applicability has been established.

b) What are the guidelines for selecting the weld assumed to have the highest failure potential?

c) Is it necessary to determine the degradation mechanism to which all welds are exposed before selecting that with the highest failure potential? If not, why not?

d) How many segments had no identified degradation mechanism? How many welds were in these segments? How was a weld selected in these segments? If the segment has 40 or 50 welds, what is the justification for using a failure potential 40 or 50 times lower than the sum of the potentials which is the correct solution (for the no ISi calculation used to develop the safety significance)?

e) How many segments had more than one weld subjected to one or more degradation mechanism? How was a weld selected in these segments? Were any confirming calculations done to ensure that the failure potential of the selected weld was actually much higher than that of the other welds? If a number of welds are subjected to the same degradation mechanism, what is the justification for using a failure potential value of just one of the welds?

• Virginia Power Response The intent of the failure probability estimation is to postulate the potential failure mechanism(s) for a given piping segment and then, based on the specific conditions for the given piping segment (not an individual weld in the piping segment) to provide an estimate of the failure probability for the piping segment, in order to differentiate the piping segments based on potential failure mechanism and postulated consequences.

The objective of RI-ISi is to perform an inspection for cause (failure mechanism) and the intent is to show that the quantity of random inspections is less beneficial than fewer quality inspections focused on piping locations that have the highest likelihood of failure.

Further, the safety significance of a piping segment is determined by the plant expert panel who evaluates the SRRA input and output, the risk calculations, and other deterministic information in order to make the decision. Once, the safety significance of the piping segment is determined, Figure 3.7-1 is used to assist in defining where focused.- inspections--should--be-placed.-------Figure--3;7-1--uses -the -safety -significance determined by the plant expert panel on the x-axis and the failure potential determined primarily by the postulated failure mechanism (not necessarily failure probability) on the y-axis. This in combination with the Perdue model defines how many inspections should be performed for a specific piping segment.

• 41

25(a) The failure probability of a segment is characterized by the failure potential (probability or frequency as appropriate) of the worst case situation in each segment (not a single selected weld in each segment). This is calculated by the SRRA code by inputting the conditions (typically, the most limiting or bounding) for. the entire piping segment. Essentially, the piping failure probability is a representation or characterization of the piping segment.

Failures in a piping segment due to the dominating mechanisms are correlated, not independent,

• and the dependencies can not be specifically identified quantitatively. Piping welds in a segment are typically fabricated with the same materials and processes and subjected to the same types of operating conditions, such as flow medium, pressure, temperature, seismic loading. Since the types of potential degradation mechanisms would therefore be similar for the limiting welds in a segment, the weld failures would more correctly be characterized as correlated. Correlated means they would all have comparable trends, such as all being relatively high or low, but not both. The combining of all significant degradation mechanisms for the segment probability would be even more correlated than the individual locations with those mechanisms. As an example, for degradation due to stress corrosion cracking, potential fabrication flaws due to welding, high residual stresses due to welding restraint, and sensitized material due to lack of proper heat treating and a corrosive environment would all be required to produce a failure, such as a through wall leak. The chance of all welds being equally susceptible to failure is in reality very small. Physically, the weld with the highest failure probability at a given time would be the one expected to fail first (either on demand or in response to a loading) and thus result in a piping failure in the segment. Since its probability is typically several orders of magnitude higher than those without the dominating mechanisms, which are more independent probabilities that are primarily controlled by the random combination of uncertainties, adding all of the lower valued but more independent probabilities would not significantly change the numerical value for the segment. Although there may be several candidate locations, the failure experience to date indicates that only one structural weld fails at a time and it is generally the weld subjected to the most severe conditions. Therefore, we believe that the sum of the failure probabilities of all welds is not appropriate for the determination of the segment safety significance.

The differences in the WOG and RAI approaches to estimating the failure probability for the piping segment can best. be __ illustrated by. the following example.

Suppose Segment A contains one (1) weld and the failure mechanism postulated is stress corrosion cracking (SCC), and this results in a failure probability FP= 1E-03. Suppose Segment B contains 100 welds with the default

• failure mechanism of thermal fatigue and this results in a failure probability FP=1 E-04). Both segments have similar consequences. By the proposed RAI 42

method, Segment B may be ranked as HSSC (segment FP = 1E-02) and Segment A may be ranked as LSSC (segment FP = 1E-03). In the ranking proposed by WOG, Segment A may be ranked as HSSC and Segment B as LSSC.

Based on the Perdue Model results, under the proposed RAI approach, Segment B may need only 1 weld to be inspected with a default failure mechanism (low probability that a significant flaw exists) and in which an inspection would not be expected to be useful . Under WOG approach, Segment A would have 1 weld inspected with a dominant degradation mechanism present (p"robability of a significant flaw is higher than for thermal fatigue) and in which an inspection would be expected to be useful. That is, the probability of finding something during the inspection would be at least ten times higher in segment A relative to segment B.

The objective of RI-ISi to inspect based on safety significance and dominant piping failure mechanisms is satisfied using the WOG method at Surry. The proposed RAI approach does not focus specifically on failure mechanism but more on the number of welds.

25(b) The SRRA inputs used for a segment failure probability were limiting conditions associated with the segment as a whole. The SRRA failure probability would then be a conservative value for any selected point location (e.g., highest stresses, highest stress corrosion potential, highest vibration, highest wastage, etc.). In general, the approach allowed the subpanel to focus on one or two locations.

25(c) It is necessary to identify the potential degradation mechanisms to which the piping segment is exposed before selecting the conditions with the highest failure potential. The more severe parameters of the various elements within the piping segment were used to estimate the failure potential for the segment.

25(d) The segments all had a degradation mechanism assigned. The default failure mechanism, if no other mechanism was identified, was thermal fatigue.

A discussion of the failure estimate methodology is provided in the response to 25(a).

25(e) The segment failure probability was determined initially with all appropriate inputs. If a concern existed on the segment for FAC and thermal fatigue, each mechanism was appropriately represented in the SRRA code. The failure probability for the segment was determined by the SRRA code and represented the dominant mechanism (FAC). The dominant mechanism was used in the 43

• ranking process. The failure probability for the lesser mechanism can be obtained for information by eliminating the dominant mechanism's inputs appropriately. Again no point location was compared to another on a segment when determining failure probability. The failure probability value used for the segment was determined using the most limiting input regardless of location within the segment.

NRC Question No. 26 The characterization of a segments failure potential by one weld's failure potential may have a substantial impact of the delta CDF and delta LERF calculations used to characterize the change in these metrics arising from the change from Section IX to RI-ISi. It appears that if one or more welds in the segment was being inspected under Section XI, and one or more welds will be inspected under RI, then the delta failure potential will be O and thus both delta CDF and delta LERF from that segment will be 0.

Is this correct? There are some configurations where application of this approximation clearly produces questionable results at the segment level. Several configurations that illustrate questionable approximations are listed below. Please describe how the delta failure potential is calculated for the following configurations .

• a) A selected weld is the only weld that is exposed to degradation mechanisms and

. thus dominates the failure potential. It was not being inspected under Section XI but will be inspected under RI-ISi. Ten other welds that were inspected under Section XI will not be inspected under RI-ISi. How many segments at Surry had segments where only one weld was exposed to a degradation mechanism.

b) No welds are exposed to degradation mechanisms. Ten welds were being inspected under Section XI. One weld will be inspected under RI-ISi. How many segments at Surry had no welds exposed to degradation mechanisms?

c) Five welds are exposed to a variety of degradation mechanisms. Two of these five and three other welds were being inspected under Section XI. Which welds would be inspected under RI-ISi if the segment was in Region 1 (of Figure 3.7-1) and how would the delta failure potential be calculated? What if the segment was in Region 2, Region 3, and Region 4? How many segments at Surry had multiple welds exposed to one or more degradation mechanisms?

d) When segment "lots" are formed, how does this influence the delta failure potential calculation?

e) The last bullet on page 206 mentions lowering a segments failure potential by a factor of 3 when "additional or more stringent examinations" are implemented 44

• under RI-ISi. Why is there no corresponding increase in the failure potential for segments which have fewer or less stringent examinations under RI-ISi?

Virginia Power Response For the change in risk calculations, if one or more welds in the segment was being inspected under Section XI, and one or more welds will be inspected under the proposed RI-ISi program, then the delta failure potential will be zero, and thus both delta GDF and delta LERF from that segment will be zero. This is correct. The process applied in the delta GDF is a simplified process that uses the representative segment failure probability and the projected improvement in the representative failure probability based on the required inspection. The process actually gives more credit to the current Section XI program than may be warranted in some cases because the Section XI inspection is not targeted to a specific failure mechanism other than fatigue. When an inspector knows the failure mechanism he is looking for, there is a higher probability of finding an indication.

In WGAP-14572, Revision 1, page 200, qualitative arguments are provided regarding the change in risk for each region of the structural element selection matrix (Figure 3.7-1). The change in risk evaluation results shows that the benefits of RI-ISi are primarily driven by high consequence piping segments that are not currently inspected by ASME Section XI. The piping segments with known failure mechanisms are generally inspected currently under ASME or an augmented program. If new susceptible locations are identified, then inspection should have a beneficial impact on risk.

26(a) For this case, the delta GDF and delta LERF would be zero for that segment. A damage mechanism is assumed for all welds with thermal fatigue being the default failure mechanism. (See response to 13(c).)

26(b) For this case, the delta GDF and delta LERF would be zero for that segment.

26(c) All five welds would be inspected if the segment was in Region 1. For this case, the delta GDF and delta LERF would be zero for that segment. If the segment was in Region 2, then a sampling of the total number of welds in the piping segment would be determined using the Perdue model. If the piping segment was in Region 3 or 4, then no welds would be inspected under the RI-ISi program. Multiple failure mechanisms were only considered in a few segments.

The inspection for cause was for the m6st part limited to the dominant failure mechanism. (See response to question 13(b).)

26(d) For Surry, each segment was treated as an individual "lot" and segments were not combined into larger "lots". This does not influence the change in risk calculations .

45

• 26(e) The factor of three improvement was only considered when additional RI-ISi exams were placed on top of an already existing augmented program. Under the RI-ISi program, even though there may be fewer exams, they are concentrated at identifying the failure mechanism and thus are not expected to increase the failure potential. The suggested RI-ISi exams are not considered to be less stringent. In some cases for the current Section XI program, an inspection that is part of the augmented program is just credited to the Section XI program also.

NRC Question No. 27 The purpose of the delta CDF and LERF calculations is to ensure that the change in risk arising from the implementation of the change conforms to the guidelines laid out in RG 1.174. The aggregate impact of the approximations discussed in question 26 needs further evaluation since the potential for large differences between the approximate and the more accurate results exists for specific configurations. The frequency and importance of these configurations must be quantitatively investigated. Please provide an estimate of the aggregate impact of the approximation discussed in question 26 on the delta CDF and LERF calculations.

Virginia Power Response As stated in the . response to question 25, we believe that the current approach performed for Surry is appropriate and accurate. We do not plan any further investigation. A further discussion of the change in risk is provided in the response to question 26.

NRC Question No. 28 Decision supported by quantitative risks insights must be made based on a full understanding of the impacts of uncertainties. The staff is aware of the analysis on page 123 of the WCAP, but is awaiting the requested detailed results to continue its review of the impact of uncertainties on the safety significance determination process.

Please also provide an analysis of the impact of uncertainties on the delta CDF and LERF calculations. This analysis should also be performed using the more accurate evaluation of the delta CDF and LERF requested i~_gue~tio_n _27.

Virginia Power Response The uncertainty analyses discussion was provided in the June 18, 1998 response. As stated in the response to question 25, we believe that the current approach performed for Surry is appropriate .

46

• NRC Question No. 29 The treatment of piping segments that cross-connects Surry Units 1 and 2 is not explicitly discussed in the submittal. Since these segments have the potential to affect both the units they may need separate consideration. The example of such segment will be the service water system supply header cross-connect piping (identified as PS4 in the IPE submittal). Please discuss how these types of cross-connect piping have been treated in the submittal, and what additional considerations were given because of their potential impacts on both units. If no additional consideration was included, please provide a discussion justifying the approach.

Virginia Power Response There are several common or shared systems at Surry. The PSA model includes these systems as appropriate. However, only the loss of the ESGR room has been identified as resulting in core damage at both units as a result of flooding. The loss of individual sections of piping in cross-connected systems does not result in the loss of the system function on both units because the design of the systems includes check valves to prevent flow diversions.

NRC Question No. 30 In defining the pipe segments into HSS and LSS, and subsequently for ISi in a risk informed approach, the results of risk-based evaluation is supplemented with traditional engineering consideration to account for equipment and events not adequately addressed by risk analyses. For example, there appears to be a common service water header to the control room and the relay room air conditioning chiller condenser. The control room is not modeled in the PRA, but control room heating and ventilation is considered risk significant from traditional engineering consideration. Please describe how these, or other similar segments were placed into a safety significance category.

Virginia Power Response The expert panel provides the traditional engineering consideration for the RI-ISi process. The RI-ISi team provided the expert panel with worksheets for each segment that provides a summary of all input for the segment. Section 5 of these sheets is titled "Other Considerations" to incorporate any traditional engineering concerns. The expert panel contained a member who is a qualified senior reactor operator and supervisory staff from the system-engineering -organization:* *These-individuals used -the worksheets and more importantly personal knowledge to address these issues. The expert panel did change the PSA recommended risk ranking to HSS for some segments based on these considerations. (See question 2 and 7 responses.)

47

• NRC Question No. 31 Were CDF/LERF with/without operator action calculated for all segments which could be isolated? How is the RRW > 1.005 and > 1.001 threshold applied to each of these 4 results? If the value of any one of the 4 results is above the thresholds should the segment be placed in the HSS or increased scrutiny category?

Imposed on these 4 results are "with ISi" and "without ISi" which are eventually used to characterize the risk associated with the current Section XI-ISi and the proposed RI-ISi yielding a total of 12 results. In addition to use of the quantitative results to categorize segments, criteria. for. identifying additional segments for additional examinations include "a review to identify any system in which there is a risk increase in moving from current Section XI program to the RI-ISi program." Please provide some details (including an explanation of how the 12 results are used) of this evaluation including the following aspects:

a) Identify the systems for which the evaluation identified that a move from the current Section XI program to the RI-ISi program will result in a risk increase, providing a discussion of the evaluation performed and the results used in the identification.

b) For the systems in which a risk increase was identified, please identify the segments that were included in the RI-ISi program for additional examination.

Please provide an explanation of the process for selecting these segments (i.e., how the criteria defined in the submittal was specifically followed), and the evaluation conducted showing that the inclusion of the segments will result in no risk increase for the system.

c) Which result should be used to characterize the change in risk associated with the change from Section XI-ISi to RI-ISi?

Virginia Power Response The CDF/LERF with/without operator action was calculated for all segments that could be isolated. If the RRW value was greater than 1.005 for any one of the 4 results, the segment was suggested to be placed in the HSS category as input to the plant expert panel. If the RRW value was above 1.001, the piping segment was suggested to receive increased scrutiny during the expert panel evaluations.

31 (a) lnitially,.Jhe . segments .proposed-for.inspection.for_ Rl-,JSl.were .identified through the expert panel evaluation as shown in Table 3.7-2 and 3.7-3 of the Surry submittal. It was assumed that a RI-ISi exam would be performed on those segments that would reduce the failure probability and therefore the "with ISi" SRRA value was used. This calculation was performed for both the Section XI program and the proposed RI-ISi program. The calculation identified several

• 48

• systems and the related segments that showed a risk increase under a RI-ISi program. These are shown in Table 31-1.

31 (b) The segments for the systems where an increase in risk was identified are shown in Table 31-1.

31 (c) The result which would best characterize the change in risk associated with the change from Section XI-ISi to RI-ISi, we believe, is the "with operator action" cases.

Table 31-1 System Risk Increase Evaluation Case Systems Where Risk Increase Allowable Segments Where, Occurs (from Section XI to RI-ISi) Increase without Risk Increase Occurs Being Significant (from Section XI to RI-ISi) if Significant Increase CDF/No ACC (increase of 1E-11) 1E-08 N/A Operator CS (increase of 9E-09) 1E-08 CS-1,2 ction HHI (an increase of 6E-08) 1E-08 HHl-4A, 5A and 6A LHI (an increase of 1E-08) 1E-08 LHl-1,2 MS (an increase of 1E-08) 1E-08 MS-4,5,6, 19,20,21 RC (an increase of 3E-08) 1E-08 RC-27,28,29 and 60A RS (an increase of 2E-09) 1E-08 N/A CDF/With CS (an increase of 9E-09) 1E-08 CS-1,2 Operator MS (an increase of 1E-08) 1E-08 MS-4,5,6, 19,20,21 Action RC (an increase of 3E-08) 1E-09 RC-27,28,29, 60A LERF/No ACC (an increase of 1E-11) 1E-09 Operator CS (an increase of 7E-10) 1E-09 CS-1,2 Action HHI (an increase of 5E-09) 1E-09 HHl-4A, 5A, 6A LHI (an increase of 8E-10) 1E-09 LHl-1,2 MS (an increase of 3E-10) 1E-09 RC (an increase of 7E-11) 1E-09 RS (an increase of 6E-12) 1E-09 LERF/ ACC (an increase of 2E-11) 1E-09 None With Operator CS ( an increase of 7E-10) 1E-09 Action HHI (an increase of 1E-10) 1E-09 MS (an increase of 3E-10) 1E-09 RC (an increase of 7E-11) 1E-09 49

• NRC Question No. 32 Please present a comparison of the dominant accident sequences (top 20) before and after the RI-ISi implementation. To explain and understand the relative changes observed, please present a list of the top 10 cutsets for each of the sequences.

Virginia Power Response The RI-ISi calculations were performed using the existing PSA model. For each pipe segment, a surrogate component was assumed to fail and the model was solved to provide a conditional core damage frequency with the surrogate component failed.

Hence, we have about 100 different PSA solutions. The more rigorous approach would have been to include a passive failure probability for each pipe segment in the PSA model. However, this is beyond the state-of-the-art for existing PSA codes because the number of cut sets becomes immense. Therefore, there is no before and after comparison of accident sequences or cut sets to provide. Also, the approach chosen by the WOG involves an estimate of the change in core damage frequency as a result of a pipe segment failure. Therefore, any question about overall model uncertainty and over-reliance on an exact CDF number is avoided.

As an alternative to the information requested, Table 32-1 has been developed to show the top 10 piping segments for the case with Section XI inspections, while Table 32-2 presents the top 1O piping segments for the case with the proposed RI-ISi program.

Both tables present the information for the CDF case with operator action. As can be seen, the dominant piping segments in each case are the same. This is mainly due to the fact that some of these piping segments are already part of an augmented program or have a vibration fatigue failure mechanism and inspection does not improve the failure probability.

50

• Table 32-1 Top 10 Piping Segments for Current Section XI Program (CDF with Operator Action Case)

Piping Segment Description Piping Segment ID CDF MS-33,34 Common main steam supply header to 1.60E-07 turbine driven AFW pump line failure results in a main steam line break outside containment, loss of main steam to the turbine driven AFW pump, and damage to all components in the main steam valve house from jet impingement; part of augmented program; wastage failure mechanism FW-12, 13, 1 4 Feedwater header to steam generators 1.38E-07 line; failure results in a loss of main feedwater; part of augmented program; wastage failure mechanism CH-08, 09, 10 RCP bypass seal return line failure 8.60E-08 results in small LOCA; vibratory fatigue failure mechanism BD-028, 03, 58, Containment penetration to containment 7.66E-08 06,88,09 isolation valve, piping beyond outside containment isolation valves; part of augmented program; wastage/vibration fatigue failure mechanisms 51

Table 32-2 Top 10 Piping Segments for Proposed RI-ISi Program (CDF with Operator Action Case)

Piping Segment Description Piping Segment ID CDF MS-33,34 Common main steam supply header to 1.60E-07 turbine driven AFW pump line failure results in a main steam line break outside containment, loss of main steam to the turbine driven AFW pump, and damage to all components in the main steam valve house from jet impingement; part of augmented program; wastage failure mechanism FW-12, 13,1 4 Feedwater header to steam generators 1.38E-07 line; failure results in a loss of main feedwater; part of augmented program; wastage failure mechanism CH-08, 09, 10 RCP bypass seal return line failure 8.60E-08

• BD-02B, 03, 58, 06,8B,09 results.in small LOCA; vibratory fatigue failure mechanism Containment penetration to containment isolation valve, piping beyond outside containment isolation valves; part of 2.55E-08 augmented program; wastage/vibration fatigue failure mechanisms 52

Attachment 1 Procedure Containing PRA Update Guidance