ML18152B590

Safety Evaluation Authorizing Request to Use Code Case N-577 as Alternative to Requirements of ASME Code Section XI for Surry Power Station,Unit 1

ML18152B590
Person / Time
Site:	Surry
Issue date:	12/16/1998
From:	NRC (Affiliation Not Assigned)
To:
Shared Package
ML18152B588	List: ML18152B587 ML18152B590
References
FACA, NUDOCS 9812280276
Download: ML18152B590 (20)

Text

e UNITED STATES NUCLEAR REGULATORY COMMISSION WASHINGTON, D.C. 20555-0001 SAFETY EVALUATION BY THE OFFICE OF NUCLEAR REACTOR REGULATION RELATED TO THE RISK-INFORMED INSERVICE INSPECTION PROGRAM PROPOSED BY VIRGINIA ELECTRIC AND POWER COMPANY FOR SURRY POWER STATION, UNIT N0.1 DOCKET NO. 50-280

1.0 INTRODUCTION

Current inservice inspection (ISi) requirements for commercial nuclear power plants are contained in the 1989 Edition of Section XI, Division 1 of the American Society of Mechanical Engineers (ASME) Boiler and Pressure Vessel Code, entitled Rules for lnservice Inspection of Nuclear Power Plant Components (hereinafter called the Code). In a letter dated October 31, 1997, 1 the licensee, Virginia Electric and Power Company (VEPCO) proposed a new approach in its submitted report entitled The Virginia Electric Power Company, Surry Power Station, Unit 1, Risk-Informed lnservice Inspection Pilot Program as an alternative to the current inspection requirements for the examination of Class 1 and 2 piping welds at Surry Power Station, Unit 1.

In the proposed risk-informed inservice inspection (RI-ISi) program, piping systems in addition to those included in the current ISi program were considered if they were found to be important to safety.* Piping failure was determined based on estimated failure probability by considering various susceptible environments, and a probabilistic risk assessment (PRA) was performed.

Then safety ranking of piping segments was established for determining new inspection locations. The proposed program maintains the fundamental requirements of ASME Code Section XI, such as the examination technology, examination frequency, and acceptance criteria. However, the proposed program reduces the required examination locations significantly and at the same time is able to demonstrate that an acceptable level of quality and safety is maintained. The licensee claims that the proposed alternative approach is in conformance with 1 O CFR 50.55a(a)(3)(i).

The Nuclear Regulatory Commission (NRC) prepared and forwarded two requests for additional information (RAls) in letters dated December 23, 19972 and July 10, 1998. 3 The licensee responded to the preliminary RAI on June 18, 1998.4 NRC staff met with the licensee on July 23, 1998, to discuss the second NRC RAI and the licensee's resolution of open items identified in the RAI. The licensee submitted the requested information in a letter dated August 13, 1998. 5 9812280276 9812i6 - ~

PDR ADOCK 05000280 P

PDR

• The NRC staff and its consultants, the Idaho National Engineering and Environmental Laboratory (INEEL) and the Brookhaven National Laboratory (BNL) reviewed the licensee's proposed alternative to the ISi program for Surry Power Station Unit 1, and applicable portions of the Westinghouse Owners Group risk-informed topical report WCAP-'14572, based on guidance stated in the NRC documents.6*7 Our evaluation is provided below. A concurrent review of WCAP-14572 is being performed separately.

2.0

SUMMARY

OF PROPOSED APPROACH The licensee is required to perform ISi of ASME Code Category B-J and C-F piping welds during successive 120-month (10-year) intervals. Currently, 25% of all Category B-J piping welds greater than 1-inch nominal diameter are selected for volumetric and/or surface examination based on existing stress analyses. For Category C-F piping welds, 7.5% of nonexempt welds are selected for surface and/or volumetric examination.

Pursuant to 10 CFR 50.55a(a)(3)(i), the licensee has proposed to-implement Code Case N-577, Risk-Informed Requirements for Class 1, 2, and 3 Piping, Method A, 8 with the more detailed provisions provided in WCAP-14572, as an alternative to the Code examination requirements for piping system~ for Surry Unit 1. The licensee provided the Surry Power Station Unit 1, Risk-Informed lnservice Inspection Program Plan, containing details on how the proposed risk-informed program was developed and how it would be implemented. The proposed RI-ISi program is based on (1) ASME Code Case N-577, (2) Westinghouse Owners Group WCAP-14572, Revision 1, 9 Westinghouse Owners Group Application of Risk-Informed Methods to Piping lnservice Inspection Topical Report, and (3) WCAP-14572, Revision 1, Supplement 1, 10 Westinghouse Structural Reliability and Risk Assessment (SRRA) Model for Piping Risk-Informed lnservice Inspection. Included in the program submittal is a general description of the proposed alternative with examples of how the risk-informed process was applied at Surry Unit 1. In addition, a preliminary inspection plan was submitted listing the component, examination method, and schedule. The inspection plan was revised and resubmitted on August 13, 1998. The licensee confirmed that augmented examination programs and the current licensing basis other than this proposed alternative to the ISi program are unaffected, and that the Code Class 1, 2, and 3 pressure test programs are also unaffected by the RI-ISi program.

Although Code Case N-577 has not been reviewed by the NRC for this plant"'specific application, the following major items in the Code case are found not consistent with either the Regulatory Guide 1.178, 6 or the RI-ISi methodology in WCAP-14572: (1) The scope has. no requirement to include non-ASME piping as a part of an integrated risk assessment. (2) No guidance is provided on major parameters for risk evaluation. Parameters such as core damage frequency and large early release frequency are not specified. (3) Elimination criteria for conducting ISi are based on risk reduction (or achievement) worth, but no quantitative guidance is provided to define high, medium, and low safety significance of piping elements.

The licensee requested approval of this alternative for implementation during the October 1998, Unit 1 refueling outage. Surry Unit 1 is currently in its third 10-year ISi interval, which began on October 14, 1993, and is scheduled to end on October 13, 2003.

e 3.0 EVALUATION The staff reviewed the licensee's submittal with respect to criteria contail')ed in the Draft Standard Review Plan Section 3.9.8 (SAP), " Review of Risk-Informed lnservice Inspection of Piping." The SAP describes the review process and acceptance guidelines for NRC staff reviews of proposed plant-specific, risk-informed changes to a licensee's ISi program for piping.

Further guidance in defining acceptable methods for implementing a risk-informed ISi program is described in Draft Regulatory Guide DG-1063 (now Draft RG-1.178), which is consistent with the review procedures in the SAP.

3.1 Proposed _Changes to ISi Program Pursuant to 10 CFR 50.55a(a)(3)(i); the licensee has proposed to implement Code Case N-sn, Risk-Informed Requirements for Class 1, 2, and 3 Piping, Method A, with the more detailed provisions in WCAP-14572, as an alternative to the Code examination requirements for piping systems for Surry Unit 1. A general description of the proposed changes to the ISi program was provided in Section 2 of the licensee's submittal. Details of the proposed changes involving the specific pipe systems, segments, welds, and revisions to inspection scope, schedule, locations, and techniques are given in Section 5 and Attachment 4 of the program submittal.

The current ISi program is limited to ASME Class 1 and Class 2 piping. The licensee proposed to replace the element selection process in the ASME Code Section XI with a risk-informed selection process. Utilizing a process described in Code Case N-577 augmented with more detailed descriptions in WCAP-14572, and further augmented with the commitments described in a September 30, 1998, letter from Westinghouse, 11 the licensee's panel of experts selected elements to be inspected based primarily on the safety significance of the segments containing the elements and the degradation mechanisms to which the elements are exposed. Although the total number of inspection locations is reduced, Surry 1 will examine several piping elements currently not required to be examined by the ASME Code Section XI, including (1) some non-Code class piping segments, which consist of auxiliary steam, steam generator blowdown, and feedwater piping, (2) ASME Code Class 3 piping segments, which consist of auxiliary feedwater, and component cooling water piping, and (3) volumetric and surface examination to be performed on some ASME Code Class 2 piping segments with less than 3/8-inch wall thickness and greater than 4-inch in nominal pipe size, which consist of suction lines to the charging pumps. A comprehensive list of elements to be inspected and the basis for selecting each element was provided in the submittal. The degradation mechanisms for which each location is to be inspected are also included in the submittal. The staff finds that the information submitted adequately defines the proposed changes to the current ISi program with respect to the implementation of Code Case N-577 as an alternative method. However, this evaluation does not endorse the use of Code Case N-sn without NRC review and approval.

3.2 Engineering Analysis An engineering analysis of the proposed changes is required using a combination of traditional engineering analysis with supporting insights from the PAA. As noted in the August 13, 1998, submittal, the licensee confirmed that its Expert Panel considered traditional engineering concerns during the worksheet review of the risk-based information for each pipe segment. In

e addition, in the June 18, 1998, submittal, the licensee discussed how traditional engineering analyses are used to ensure that the impacts of the proposed ISi changes are consistent with the principles of defense-in-depth. Further details about the engineering analyses and risk evaluations are discussed below.

3.2.1 Scope of Piping Systems The scope of the piping systems considered in the licens*ee's RI-ISi program was based upon guidance in the WCAP topical report which states that the scope should include the following:

1) Class 1, 2, and 3 systems currently within the ASME Code Section XI program,

2) Piping systems modeled in the probabilistic safety assessment (PSA) for Surry, and

3) Various balance-of-plant (BOP) fluid systems determined to be of importance (maintenance rule-based).

In its August 13, 1998, submittal, the licensee stated that the scope was originally defined by a joint VEPCO Westinghouse team and was subsequently-reviewed by the Expert Panel as documented in meeting minutes given to the NRC during the July 23, 1998, meeting. The licensee also noted that the WCAP guidance is more conservative than that required by Code Case N-577. The Code case mandates inclusion of piping within the Section XI Class 1, 2, and 3 examination boundaries and within the PSA boundary, and Section XI Class 1, 2, and 3 piping known to have high-consequence contributions from PSA insights. However, the Code case allows for piping outside the existing Section XI Class 1, 2, and 3 boundaries to be included at the owner's option. The scope of the piping systems that were included in the RI-ISi program goes beyond the requirements of Code Case N-577, and includes high safety significant piping at Surry Unit 1.

3.2.2 Piping Segments Piping systems defined by the scope of the RI-ISi program were divided into piping segments based on the consequences of the pipe failure as noted in Section 3.2 and Attachment 2 of the submittal. Distinct segment boundaries were identified primarily at flow branching and joining points where isolation can be accomplished by check valves or other isolation valves.

In response to questions in the RAI, the licensee provided in its June 18, 1998, submittal more supporting information (calculation note SM-1124) that documents the process by which pipe segments were defined. The rationale was also provided for defining segments on the basis of the bounding cases that consider (1) no operator action to isolate the break, and (2) perfect operator action. Meeting minutes that document the Expert Panel's review of this information were given by the licensee at the July 23, 1998, meeting. Considering the supporting information provided by the licensee, the basis for defining piping segments is in conformance with the SAP guidelines and has been adequately justified.

3.2.3 Piping Failure Potential Piping failure potential was determined in accordance with failure probability estimates from the SARA software program (WCAP-14572, Supplement 1:. As recommended in the SRP, expert opinion was provided by a subpanel to define the appropriate input data required by the SARA code. This process is described in Sections 3.3 and 3.4, and Attachment 3 of the program

• submittal. Details regarding the methodology, process, and rationale were provided by the licensee in Enclosure 1 (ET No. MAT-97-0014) of its June 18, 1998, submittal, which contains the guidance used by the engineering subpanel in determining the various inputs to the SRRA program, and Enclosure 2, which contains the SRRA data sheets for the failure estimates.

Further detail regarding the failure probability assessment was also provided by the licensee in the August 13, 1998, submittal.

The SRRA program has been benchmarked by Westinghouse on the basis of favorable comparisons of calculated piping failure probabilities with those results using the pc-PRAISE program, which is a program independently developed by the Lawrence Livermore National Laboratory for the NRC. A range of input parameters was used in benchmarking the small leak, large leak, and full break probabilities. Westinghouse conducted sensitivity studies on parameter uncertainties, and found that the range of uncertainties of the SARA-calculated piping failure probabilities is about 2 to 5 orders of magnitude around the best-estimate value.

Generic acceptance of the SRRA program is under the separate review of WCAP-14572. In the application to the Surry RI-ISi pilot program, plant-specific Surry data were used as input to the SRRA. It is noted that, although the use of the SARA Code has been found acceptable for this plant-specific application, the use of the SARA Code requires analyst's judgment, and its methodological application is addressed in the NRC review of WCAP-14572.

The WCAP methodology involves postulating the potential degradation mechanisms for a given segment, and imposing the operating characteristics and environment on a single weld within the segment. The failure probability developed from the Monte Carlo simulation of the weld for these conditions is subsequently used to represent the failure probability of the segment, regard-less of the number of welds in the segment. The licensee reported that the output of the SRRA code is best described as a quantitative estimate illustrating the susceptibility of a pipe segment to failure as determined by the weld material and environmental conditions within the segment. In light of the magnitude of uncertainties, the staff feels that the output of the SRRA may better be recognized as relative values of susceptibility of piping segments to failure. In addition, the acceptability of an estimate is dependent on how it is used. The licensee primarily uses an estimate to 1) be combined with quantitative estimates from the PRA to support the Expert Panel's classification of segments into Low and High safety significance, and

2) provide guidance on the susceptibility of failure for each segment during the sub-panel's selection of welds to be inspected under the RI-ISi program.

This estimate is a reasonable indication of the relative material and environmental properties of each segment so that, subject to final review and approval of the weld selection process and results by an Expert Panel, the estimates are acceptable for use to support an RI-ISi change request.

3.2.4 Consequence of Failure The consequences of the postulated pipe segment failure include both direct and indirect effects of each segment's failure. Direct effects always include a diversion of flow large enough to disable a train, disable a system, trip the reactor, or any combination of these.

Indirect effects include the spatial effects of flooding, jet impingement spray, high environmental

... temperatures, and flooding.

• The licensee's individual plantexamination (IPE) included an extensive flooding analysis submitted as Appendix E to the IPE. The analysis contained a determination of flood sources and flooding rates, guidelines on what constitutes flood barriers and how these barriers can fail, and guidelines identifying the effects of flooding and spray on electro-mechanical and electrical equipment. Preparation for the ISi walkdown was based on the IPE flooding evaluation.

Walkdown documentation sheets were developed to guide and subsequently document the walkdown, judgments, and conclusions to develop spatial effects. The Updated Final Safety Analysis Report (UFSAR) was used to define where high-energy piping was located for pipe whip and jet impingement consideration. Expert judgment from the walkdown team was used to decide which components were potentially subject to failure because of high-:energy pipe failure. Occasionally, conservative assumptions were made because of the complex layout. If an area was particularly congested, it was assumed that all of the equipment in the area failed.

The staff finds acceptable the process to determine the direct and indirect consequences of segment failure, as described by the licensee, because the process is systematic and should produce a traceable analysis.

Segments are defined by runs of piping in which a failure at any point would result in nominally identical consequences in terms of impact on plant equipment. The consequence of failure assumes that check valves and other automatic isolation valves operate properly. In some situations, such as containment"isolation valves, failure of a valve to close can lead to much higher probabilities of core damage or large early release than if the valve closes. During the Expert* Panel's deliberations, containment isolation valve failures that might lead to containment bypass were reviewed and the segment boundary or safety significance was adjusted if.

appropriate. The staff finds acceptable the licensee's technique of addressing containment isolation failure, because the two components of risk, likelihood, and consequence are systematically evaluated and used to support the final outcome of the RI-ISi analysis.

The licensee considered a spectrum of different size breaks (e.g., failure modes) for every.

segment. Piping failure modes considered are smal_l leak, disabling leak, and full break, as discussed in Section 3 of the WCAP report. The licensee first considered the spray effects of a small leak, and systematically added the more severe effects for increasing break size. That is, disabling leak includes spray failures plus loss of train function, and large break includes all effects plus pipe whip as applicable. The staff finds the licensee's characterization of the different break sizes acceptable since they include the different spatial effects of the various break sizes.

The staff finds that the direct and indirect effects of pipe failures were modeled in accordance with the SAP by use of surrogate components in the Surry PAA models to calculate the conditional core damage and large early release frequencies. Supporting documentation of these calculations was provided in Enclosure 2 (Tables 3.3-3 and 3.3'-4) of the June 18, 1998, submittal.

3.3 Probabilistic Risk Assessment The Surry IPE was submitted on August 30, 1996. Excluding internal floods, the IPE estimated a CDF (core damage frequency) of 7.4E-5/yr and a LEAF (large early release frequency) of 1.3E-5/yr. The IPE flooding analysis identified a design feature of the Surry plant whereby the

• rupture of several pipe segments in the service water and circulating water systems could cause extensive flooding in the BOP that would most likely lead to core damage. After some

e plant modifications, which made operator intervention more likely and effective, and after reductions in some analysis conservatism, the licensee submitted a flooding re-analysis on November 26, 1996, that estimated the internal flooding contribution to CDF as 5.1 E-5/yr.

The licensee reported that PAA used in the submittal had an internal events (excluding internal flooding) CDF and LEAF of 7.2E-5/yr and 1.1 E-5/yr respectively. The difference in the values between the August 1996, IPE and the RI-ISi submittal reflects a plant modification that added two more chillers in an electrical distribution room. Modifications to the PAA arising from a January 1997, maintenance rule baseline inspection and a VEPCO internal report dated June 1997, were not incorporated into the PAA in time to support the October 31, 1997, submittal. The RI-ISi Expert Panel was, however, advised of the suggested modifications through written descriptions in their worksheets and thus incorporated this information into their deliberations. VEPCO has a Nuclear Safety Analysis Manual Chapter (Part IV, Chapter A,

. Revision 1) dated July 1997, discussing the m_aintenance of the PAA models. All suggested modifications have been incorporated in.to a June 1998, PAA model update. The staff recognizes that the periodic update and modifications of PRA are an integral part of risk-informed regulation, and that these updates may be made while a submittal is under review. The staff finds that VEPCO has a program in place to maintain the models in its PAA as current as practicable and finds the use of an older version of the PAA, coupled with the documented consideration of the suggested changes, acceptable until the next periodic update of the RI-ISi program.

Quality of IPE The IPE was developed under the technical direction and responsibility of a consultant.

Licensee personnel were, however, included in each of the ten technical teams performing the analysis. All aspects of the study were reviewed by two independent review teams c.omposed primarily of licensee personnel. Each review team included a corporate nuclear safety representative. Corporate Nuclear Safety is an organization independent of engineering and it is always involved in reviews of proposed changes at the site. Resolutions of the comments developed by the review teams were incorporated in the final IPE and documented.

The staff evaluation of the I PE noted that virtually all of the plant departments provided input to the IPE, and concluded that the peer review process provided reasonable assurance that the IPE analytic techniques had been correctly applied, and that the documentation was accurate.

The maintenance rule inspection found that the quality of the IPE appeared adequate to support risk ranking for the maintenance rule, but also noted that the licensee had not used an updated model. Based on the submittal and the results of the ISi evaluation reported by the licensee, several parts of the IPE used extensively to support the submittal were identified. A

• focused review by a contractor of those parts of the IPE most directly used to support the RI-ISi submittal identified no shortcomings that might invalidate the results of the evaluation used to support the submittal. In the August 13, 1998, submittal, the licensee stated that the RI-ISi expert panel was advised of the differences between the IPE model used and the current plant configuration during the deliberations at which the safety significance of the segments was finalized.

The staff did not review the PRA to assess the accuracy of the quantitative results.

. Quantitative results of the PRA are used, in combination with a quantitative characterization of the pipe segment failure likelihood, to support the development of broad safety significant

e categories reflecting the relative impact of pipe segment failures on CDF and LERF. The safety significant categories determined from*the PRA are considered together with system function information and, eventually, again with pipe segment failure likelihood to support the determination of the number of elements to inspect in each segment. lnacc"uracies in the IPE models or assumptions large enough to invalidate the broad categorizations developed to support RI-ISi should _have been identified in the licensee or the staff reviews. Therefore, the staff finds that there is reasonable assurance that the PRA quality is adequate to support the submittal because any minor errors or inappropriate assumptions that might remain in the models would only affect the consequence calculations of a few segments and should not invalidate the general results or conclusions.

Scope of PRA The IPE completed in August 1996 examined internal initiating events and internal flooding. An improved flooding analysis was submitted in November 1996. The licensee submitted its Individual Plant Examination of External Events (IPEEE) in November 1997. The IPEEE evaluated seismic, fire, high winds, external floods, and other external events. The worksheets provided to the Expert Panel during the RI-ISi submittal described the external event mitigating functions each segment supports. Shutdown functions were also included in the worksheets.

The staff finds the scope of the PRA acceptable because initiating events and operating modes outside the scope of the PRA were systematically identified and provided to the Expert Panel to support its deliberations.

3.3.1 Evaluating Piping Failures With PRA The licensee did not incorporate the segment failure events into the PRA model. Instead, depending on the impact of the segment failure on the operating plant, the conditional core damage frequency (CCDF), conditional core damage probability (CCDP), conditional large early release frequency (CLERF), or conditional large early release probability (CLERP) for each segment was determined by identifying an initiating event, basic events, or groups of events, already modeled in the PRA and whose failures capture the effects of the piping segment's failure. The analyst sets the appropriate events to a failed state in the PRA and requantifies the PRA or the appropriate parts of the PRA as needed. This process is referred to as the "surrogate event process." The licensee requantified the baseline models after setting the

• appropriate surrogate event failure probabilities to 1.0 and maintained the truncation value as in the baseline calculations. The calculated point estimates for each scenario are used to support the relative ranking of the segments. Operator actions modeled in the baseline PRA and contributing to the calculated CCDP, CCDF, CLERP, and CLERP, are not changed during the analysis to support ISi. During the development of the surrogate components used to characterize each segment failure in the PRA, however, human actions associated with the recovery of equipment failed due to the floods (or requiring access to the flooded area) are identified and removed if no longer feasible. The staff finds the calculations and use of these PRA results to be adequate to support the RI-ISi evaluatlon because the impact of failed,

equipment, and the loss of recovery potential, is appropriately imposed on the PRA model and reflected in the quantitative results.

Segment failure likelihood (probability of frequency as appropriate) is combined with the results of the risk calculation as described in Equations 3~1 to 3-10 in the WCAP report. The results

e are subsequently combined into total piping segment CDF (or LEAF). The staff recognizes that the equations do not model repair configurations following a segment failure whereby some equipment may be removed from service up to its allowed outage time (AOT). The methodology includes a review of the magnitude of the AOT and the application of a correction term to the unavailability when the quantitative impact is not negligible.

The staff finds that the methodology develops and uses relative quantitative consequence and quantitative segment failure likelihood so that the results can, after review by the Expert Panel where deterministic insights are also considered, be used to support the assignment of segments into broad safety significance categories.

3.3.2 Safety-Significance Determination Based on the quantitative results for each segment without credit for Section XI ISls, and the

. corresponding total pressure boundary failure risk (e.g., only the risk associated with segment failures), risk reduction worth (RAW) and risk achievement worth (RAW) measures are

• developed as described in Equations 3-11 and 3-12 of the WCAP report. All measures are developed for both CDF and LEAF. The use of the quantitative results without credit for ISi is appropriate to determine the safety significance of the segments because the goal of the RI-ISi program is to target inspection to those elements for which inspection is most efficient. If the segment has one or more welds inspected under the augmented inspection program, the representative weld failure probability is calculated assuming credit for the augmented program ISi. The use of quantitative results with credit for ISi to determine the safety significance for segments inspected under the augmented program is appropriate since the augmented program inspection will be maintained and, therefore, the result reflects the actual practices at the plant.

Operator action to isolate a break and mitigate the immediate consequences of the break are included in the RI-ISi analysis. For example, an operator closing a motor-operated valve (MOV) will stop the loss of water from a break downstream of the MOV. Instead of estimating an operator error probability for each scenario, a sensitivity study.is performed to ensure that the impact of possible operator recovery actions is appropriately included in the evaluation.

Specifically, two sets of core damage and two sets of large early release calculations are performed: one assuming all such actions are successful (failure probability of 0.0), and one assuming that all such actions fail (failure probability of 1.0). RAW and RAW measures are*

calculated for these different assumptions. The segment is assigned the safety-significance category corresponding to the highest of the four results. The staff finds that the use of success and failure bounding probabilities is acceptable because they systematically incorporate the full range of the potential impact of operator actions on the safety significance of the segments.

Each segment has a total of four RAW values, two for CDF (one with and one without credit for operator action) and two for LEAF. The RAW values are compared to quantitative guidelines to determine an initial safety significance category for consideration by the Expert Panel. The licensee used the RAW guidelines recommended in the WCAP report. That is, that segments with RAW > 1.005 are deemed High safety significant. Segments with medium RAW values between 1.001 and 1.004 are deemed worthy of special consideration by the Expert Panel.

(The licensee uses the medium RAW values but not the "medium" designation because the Expert Panel eventually places all segments in Low or High. The designation is used by the staff in this Safety Evaluation for convenience). Segments with RAW values below 1.001 are deemed to be Low safety significance.

Piping segments are very reliable, so RAW values, which are calculated based on setting the failure likelihood to 1.0, are usually high. Most RAW values reported in the submittal ranged from 200 to 1000. High quality segments exposed to no degradation mechanisms have the lowest failure likelihood and thus tend to have the higher RAW values.Section XI inspections are targeted at this type of piping, and the move to risk informed ISi is based on the recognition that excessive targeting of inspections to high quality segments exposed to no degradation mechanisms provides little safety benefit. Consequently, there is no RAW guideline, but the RAW values were calculated and provided to the Expert Panel for use in their deliberations.

The licensee also performed a sensitivity study where uncertainty distributions were assigned to the segment failure likelihoods and the PAA results. The aim of the study was to investigate the potential movement of segments from Low to High based on variation in the quantitative inputs and the guideline values defining the High, Medium, and Low RAW ranges. Point estimates were treated as medium values of a log normal distribution. Range factors (e.g., the 95%/medium) of 5 to 20 were assigned (the larger range factors to the smaller point estimates) and Monte Carlo simulation was used to propagate the uncertainties. Mean RRWs based on mean GDF and LEAF values were calculated. The licensee reports that the number of segments with RAW greater than 1.005 increased from 64 to 86. Further, the 22 segments whose RAW value moved above 1.005 had all originally had RAW values between 1.001 and 1.004. The staff finds use of these guideline values for the licensee's plant appropriate because only segments in the medium area moved above the RAW greater then 1.005 guideline when reasonable variations in the parameter are considered, and segments in the medium range are characterized for the Expert Panel as segments which are not clearly Low and which should be given special consideration.

The staff finds that the calculations and results developed by the licensee are sufficiently robust and well defined to provide the probabili$tic support to the safety significance categorization process. System level functional requirements for initiating events and operating conditions not evaluated in the PAA are identified and reported as such to the Expert Panel. The guideline values selected for the RAW are appropriate because no segments moved directly from the Low range to the High range when reasonable uncertainties in the PAA results and the pipe failure probabilities are propagated. Therefore, the staff finds that the results from the uncertainty evaluation indicate that the safety significance categories of the segments are not likely to be significantly changed by the rigorous propagation of uncertainty, and thus such

• calculation is not necessary.

The Expert Panel is responsible for developing the final decisions regarding the categorization of each segment and selects the elements to inspect in each segment. The licensee provided the Expert Panel with an extensive worksheet for each segment. In addition to the PAA results discussed above (e.g., the RAW and RAW and safety significance category characterized by the quantitative *results), the worksheets given to the Expert Panel identified the functions supported by the segment following internal transients, seismic, fires, and flood events.

Functions supported during shutdown and design basis accidents were also identified. The consequence in terms of (1) equipment lost with and without operator recovery actions and (2) the pipe failure likelihood and degradation mechanism are also included in the worksheets.

The staff finds that the Expert Panel is provided with the appropriate information because each

l e segment's contribution to the safe operation of the unit is described in sufficient detail to allow for deliberation and a reasoned judgment.

3.3.3 Determination of the Change in Risk Specific description of the methodology used to estimate the change in risk can be found in the WCAP report and is not repeated here. The staff also reviewed plant-specific calculation results and processes. In general, the WCAP methodology estimates any change in segment failure probability (and thus risk contribution) at the segment, not at the weld level. That is, if a segment is being inspected under Section XI, and it will continue to be inspected under RI-ISi, the failure probability of the segment will not change, regardless of any change in the number of welds being inspected. The staff recognizes that the change in risk calculation underestimates risk reductions arising from changing inspection locations from a weld subject to no degradation mechanism to another with a degradation mechanism. It also underestimates risk increases arising from the reduction in the number of welds inspected within each segment.

Targeting RI-ISi inspections to welds exposed to degradation mechanisms should yield relatively large risk reduction when the welds were not previously inspected under Section XI.

Discontinuing Section XI inspections on welds not exposed to degradation mechanisms should yield relatively small risk increases. There will be substantially more welds for which inspections are discontinued than for which new inspections are begun. The staff finds that the change in risk values developed by the WCAP technique are useful illustrations of the change in risk associated with the proposed change, but that a finding that implementation of the program decreases risk or is essentially risk neutral requires confidence that other guidelines and constraints in the WCAP methodology are appropriately applied.

One constraint arises from a statistical evaluation developed to determine the number of welds exposed to no degradation mechanisms that should be inspected in High safety significant segments to provide confidence that the frequency of leaks (e.g., through-wall flaws with a negligible but visible flow rate) within each segment does not increase above the currently observed leak frequency. The WCAP reported that an analysis of operational data indicates a current leak frequency of about 1 E-06/weld-year, and that the licensee used this value.

Although the safety significance of the segments is determined by the frequency of the more severe breaks (e.g., high flow rate events with disabling effects), the licensee stated that the ratio between the break probability and the leak probability is expected to be similar to the ratio between the break frequency and the leak frequency, and the confidence derived from the statistical analysis is applicable to the break frequency. When the statistical analysis indicates that no inspections are needed to maintain the confidence that the current leak frequency is not exceeded, the methodology retains one default inspection in the segment so at least one weld in each High safety significant segment is inspected. The staff recognizes that the statistical sampling evaluation in the submittal always resulted in the default to one inspection per segment. The staff finds that this evaluation is necessary and appropriate because it accounts for the change in the number of welds inspected in the High safety significant segments.

An additional constraint in the WCAP methodology is that the overall change in risk be risk neutral or risk negative. The licensee calculated four values illustrating the change in risk between the current Section XI and the proposed RI-ISi program, that is one GDF and LEAF change given the assumption of successful operator intervention, and a second GDF and LEAF

e change given the assumption that no recovery actions are successful. The change in CDF was.

estimated to range between -7E-6/yr to -6E-7/yr, and the change in LERF ranged from -SE-7/yr to -2E-7/yr. The staff finds that these results illustrate that the change in both CDF and LERF arising from implementing the RI-ISi program should be a risk decrease, which is robust with respect to operator actions that might be taken to mitigate the pipe ruptures.

The licensee also examined systems that contribute 10% or more to the total RI-ISi risk. The WCAP report recommends that the risk dominant segments within such systems should be reevaluated to identify where additional examinations may be needed so that the overall risk for these systems can be reduced. However, all dominant segments in these systems were either in the augmented program or were already being inspected, and the licensee did not report any new examinations due to this constraint.

The WCAP report also recommends establishing a risk decrease or risk neutrality at the system level or, failing that, ensuring that any positive CDF/ LERF change at the system level is reviewed and found minor*and acceptable. The licensee uses the WCAP definition of "minor and acceptable increase" as two orders of magnitude below the RI-ISi CDF/LERF for that system and to less than 1 E-8 CDF and 1 E-9 LERF increases. The licensee reported that 1 O elements were selected for inspection to ensure that these system level increases were not substantially greater than 1 E-8/yr for CDF and 1 E-9/yr for LERF. The maximum estimated risk increase was 6E-8/yr for CDF (high head injection system) and SE-9/yr for LERF (high head injection system). The staff finds that this process provides additional assurance that modeling and calculational assumptions are not used to support risk trade-offs between systems of greater magnitudes than the robustness of the estimates can support.

The licensee did not perform uncertainty calculations on the delta CDF/LERF estimates. Since the delta CDF/LERF results are only an illustration of the possible change in risk, and recognizing the other constraints in place to ensure that the change in risk is carefully evaluated and controlled, the staff finds that the degree of assurance of the safety benefit of the RI-ISi program implementation is not likely to be significantly changed by the propagation of parameter uncertainties.

The staff finds that the delta CDF/LERF calculations illustrate the potential change in risk. The calculations are performed for both CDF and LERF, and including operator action and excluding operator actions. Based on a negative value of the illustrative change in risk, the determination that the number of inspections provides confidence that.the break frequency driving the safety significant determination will not increase, that dominant risk contributing

• segments are being examined, and that individual system's risk indicator changes are maintained within small quantitative bands, the staff expects that implementation of the RI-ISi program as described in the submittal should be risk neutral or a risk de<?rease.

3.4 Integrated Decisionmaking The SRP provides that an integrated approach be utilized in determining the acceptability of the proposed RI-ISi program by considering in concert the traditional engineering analysis, risk evaluation, and the implementation and performance monitoring of piping under the program.

~I lntegrated decisionmaking is done, at the highest level, by the Expert Panel. The Expert Panel reviews and approves the selection of systems (Section 3.2.1) and the input to the SRRA code

. (Section 3.2.3). Expert Panel deliberations include the treatment of containment bypass isolation valves (Section 3.2.4), the safety significance of each segment as illustrated by the PRA output complimented by deterministic functional descriptions (Sections 3.3.1 and 3.3.2),

and the selection of locations to examine (Section 3.4.1 ).

The licensee's Expert Panel included personnel who had expertise in the following fields: PSA, inservice examination, nondestructive examination, stress and material consideration, plant operations, system design and operatbn, and plant and industry maintenance, repair, and failure history. The Expert Panel shall always have at least one representative from PSA, inservice examination, plant operations, and plant and industry maintenance, repair, and failure history. Minutes are taken at every meeting and are maintained as program records. The staff has reviewed the Expert Panel personnel composition, scope of responsibility, meeting minutes, and procedure guidance document. The staff finds that the licensee's expert panel had the appropriate expertise, input, and recordkeeping requirements to render and document a comprehensive, risk-informed selection of elements to inspect in the ISi program. This is in conformance with the guidance in SRP 3.9.8 and is, therefore, acceptable.

3.4.1 Selection of Examination Locations The selection of pipe segments to be inspected was performed by the Expert Panel as described in Section 3.6 of the Program submittal using the results of.the risk rankings and other operational considerations. The identification of the High safety significant segments are identified in Section 3.7 of the Program submittal. The criteria and methodology for this process are primarily provided in the WCAP topical report. The selection process was reiterated in the August 13, 1998, submittal, where the licensee provided an itemized listing (summarized in Table 15-1) of the segments selected for examination. In the submittal, the licensee stated that the segments listed in the table were limited to those of High safety significance with elements categorized in Region 1 (region of high failure importance) or Region 2 (region of low failure importance) of WCAP-14572, Figure 3.7-1. The licensee also stated that elements wme selected based on susceptible locations in Region 1 A (with known degradation mechanism), or by using the Perdue model to select the number of locations in Region 1 B (with no known degradation mechanisms) and in Region 2. The Purdue model is a computation model for performing statistical evaluation to assess reliability of a sampling-based inspection plan. To assure that a target leak rate is met with a stated level of confidence, the methodology of the model uses the probability of a flaw, the conditional probability of a leak, and a target leak rate to develop a minimum number of welds to inspect. The model also reflects the ASME Code Section XI requirements for expanding sample size if unacceptable flaw indications are found in selected samples. However, for many segments in Table 15-1, the number of elements were not indicated, and a note stating "Perdue model not used" was inserted. In a September 17, 1998, conference call, the licensee confirmed that the Perdue model could not be used on all segments contained in Regions 1 B. As stated by the licensee, the Perdue model is used on highly reliable piping to establish a statistically relevant sample size and verify the condition of the piping. In cases where an active degradation mechanism exists, particularly where there is an ongoing augmented program, it is inappropriate to use the Perdue model for element selection. In these cases, the Expert Panel applied other rationales for selecting the number of elements to examine. As documented in a letter dated October 20, 1998, the licensee selected certain elements to address a secondary degradation mechanism

e e and reduce the delta risk compared to current Section XI ISi. In other cases, elements were selected to address defense-in-depth considerations. Based on the rationale discussed in the September 17, 1998, conference call, and contained in the subsequently submitted letter, it is concluded that the licensee has adequately justified element selection and sample sizes. More detailed guidance on element selection and sample size determination will be included in WCAP-14572, which is the subject of a separate staff review.

Examination Category 8-F welds have been included in the scope of this alternative, as specified in Code Case N-577. Arguably, dissimilar metal safe-end welds to v~ssels could be considered part of the nozzle and not piping welds. This is supported by later editions of the Code, which have removed piping welds from Examination Category 8-F and limited welds within 8-F to "Pressure Retaining Dissimilar Metal Welds in Vessel Nozzles." For Surry Unit 1, the licensee has evaluated the risk associated with the reactor coolant (RC) system, including

• B-F welds, and determined that examination of the large-diameter RC piping was not necessary from a risk standpoint. However, the licensee did include the examination of all six reactor pressure vessel (RPV) nozzle-to-safe-end welds in its Program for defense-in-depth. The inclusion of 8-F welds in the scope of the RI-ISi Program was discussed further with the licensee at the July 23, 1998 meeting. As a result, the licensee added two steam generator nozzle-to-safe end welds and one pressurizer nozzle-to-safe end weld to the Inspection Plan (submitted on August 13, 1998) for defense-in-depth. With the addition of these welds, a sample from each major vessel will be obtained, which provides a reasonable sample for verifying the assumptions and conclusions of the risk-informed process. In addition, generic degradation that could occur in these welds should be detected. Therefore, the licensee has provided acceptable resolution regarding the examination of B-F welds at Surry Unit 1.

3.4.2 Examination Methods The objective of ISi and ASME Code Section XI is to identify conditions (i.e., flaw indications) that are precursors to leaks and ruptures in the pressure boundary that may affect plant safety.

Therefore, the RI-ISi Program must meet this objective to be found acceptable tor use.

Further, since the risk-informed program is based on inspection tor cause, element selection should target specific degradation mechanisms.

In general, the examination methods selected are based on Code Case N-577, Table 1.

However, in some cases, the Surry Expert Panel added surface examinations to Code case

• items requiring only VT-2 visual examination. In the case of elements subject to thermal fatigue (Code Case Item R1.11 ), the licensee is supplementing the Code case-required volumetric examination with a surface examination for elements in which outside surface degradation was of concern. In summary, the. examination requirements of Item R1.11 were assigned to segments of High safety significance when (1) the failure mechanism was thermal fatigue, (2) no failure mechanism was identified, or (3) examinations were required by the statistical sampling program. Based on review of the Code case and the examination methods specified in the licensee's Inspection Plan (August 13, 1998, revision), it appears that the examination methods selected are appropriate for the degradation mechanisms, pipe sizes, and materials of concern. However, this evaluation is plant-specific and does not endorse the generic use of Code Case N-577.

e 3.5 Implementation and Monitoring Implementation and performance monitoring strategies require careful consideration by the licensee, and are addressed in Element 3 of the SAP. The objective of Element 3 is to assess performance of the affected piping systems under the proposed RI-ISi program by implementing monitoring strategies that confirm the assumptions and analyses used in development of the RI-ISi program. To satisfy 1 O CFR 50.55a(a)(3)(i), implementation of the RI-ISi Program, including inspection scope, examination methods, and methods of evaluation of examination results, must provide an acceptable level of quality and safety.

In the August 13, 1998, submittal, the licensee confirmed that its proposed alternative is to implement Code Case N-577 with additional guidance from WCAP-14572. Therefore, a majority of the criteria included in Element 3 of the SAP have been addressed by the licensee as outlined in Appendix A of the submittal and as discussed below.

The proposed RI-ISi program addresses piping only and serves as an alternative to current ISi in accordance with ASME Code Section XI requirements. Thus, additional relief requests per 1 O CFR 50.55a(a)(3) for this 10-year inspection interval are not needed. However, the licensee indicated that a reevaluation will be performed periodically in the future on ttie basis of such possible changes as (1) plant design and operational changes, (2) industry experience, (3) plant ISi experience, and (4) plant PSA model changes. The staff found that this is in accordance with guidance in SAP* Section 3.9.8 and is acceptable. However, in accordance with 10 CFR 50.55a(g)(5)(iii) requirements, such changes, if needed, should be documented and submitted to the NRC for review and approval.

The Surry RI-ISi pilot program specifies inspection intervals consistent with relevant degradation rates. The licensee indicated that examination intervals will be scheduled and that inspection locations will be distributed among periods per each interval as specified in current

- ASME Code Section XI requirements; that is, once every 1 O years with elements distributed among the three periods. Unless the licensee identifies, in the future, a specific mechanism with a more rapid degradati9n rate, this frequency of inspection should be maintained. This is consistent with current licensing bases, and is acceptable.

The qualification of procedures and non-destructive examination (NDE) personnel is required to achieve the desired levels in failure probability. In accordance with SRP Section 3.9.8, NDE personnel, processes, and equipment should be qualified in compliance with ASME Code Section XI. As discussed in the August 13, 1998, submittal, the licensee will continue to meet the qualification requirements of the current ASME Code Section XI and ISi Program as amended by Appendix VII for qualification of ultrasonic testing (UT) examiners. In addition, the licensee has implemented an in-house.program for UT and sizing at Surry Unit 1, with procedure revisions and additional training to address expanded examination volumes and particular damage mechanisms. Therefore, the licensee has enhanced the qualification requirements of the Code and the Code case with its in-house training programs, and the reliability of examinations performed under the RI-ISi Program should be considered acceptable until performance demonstrations are mandated for the nuclear industry.

4.0 CONCLUSION

S In accordance with 10 CFR 50.55a(a)(3)(i), proposed alternatives to regulatory requirements may be used when authorized by the NRC if the applicant demonstrates that the alternative provides an acceptable level of quality and safety. In this case, the licensee's proposed alternative is to use the risk-informed process described in Westinghouse Owners Group Report WCAP-14572 and within the framework described in ASME Code Case N-577. _* It should be noted that conclusion of this review is solely based on staff evaluation of information presented in the Surry pilot program submittal and relevant portions of WCAP-14572 and Code Case N-577, as discussed in this report. Since WCAP--14572 is under a separate review, and some items in the Code Case are found inconsistent with Regulatory Guide 1.178, this acceptance of Surry RI-ISi shall not be considered as a generic acceptance of WCAP-14572 or Code Case-577, as discussed previously. The proposed alternative is documented in the licensee's RI-ISi Program, as revised as a result of the NRC's RAls. As indicated in Table 5-1 of the report (see attachment), a total of 385 NOE inspection locations currently required by ASME Code Section XI is reduced to 136 by the proposed RI-ISi program. However, the licensee reported that the corresponding changes in risk, if operator action is considered, are from 2.29E-6 to 1.67E-6 in GDF, and from 3.63E-7 to 1.54E-7 in LEAF. Comparable small changes in risk were also obtained if operator action is not considered.

Thus, the staff review concludes that the licensee's risk-informed approach should result in a risk-neutral to slight risk-reduction effect when compared to the current ASME Code Section XI ISi program, while achieving a significant reduction in the total number of examinations to be performed. This is accomplished by selection of locations to be examined and inclusion of risk-sensitive locations where no inspection was previously required. In addition, as summarized in Appendix A of the program submittal, the licensee has met the.applicable criteria in the Regulatory Guide 1.178 and the SRP Section 3.9.8. Based on this, pursuant to 1 O CFR 50.55a(a)(3)(i), the staff concludes that the licensee's proposed alternative is authorized for use at Surry Unit 1, because the proposed alternative will provide an acceptable level of quality and safety.

Principal Contributors: Shou-nien Hou S. Dinsmore Date:

December 16, 1998 REFERENCES

1.

Letter, dated October 31, 1997, R. F. Saunders (Virginia Electric and Power Company) to Document Control Desk (NRC), containing proposed alternative and the RI-ISi Program.

2.

Letter, dated December 23, 1997, G. E. Edison (NRC) to R. F. Saunders (VEPCO),

containing preliminary RAI.

3.

Letter, dated July 10, 1998, G. E. Edison (NRC) to J.P. O'Hanlon (VEPCO), containing second RAI.

4.

Letter, dated June 18, 1998, L. N. Hartz (VEPCO) to NRC Document Control Desk, containing response to NRC RAI dated December 23, 1997.

5.

Letter, dated August 13, 1998, L. N. Hartz (Virginia Electric and Power Company) to Document Control Desk (NRC), containing response to NRG RAI dated July 10, 1998.

6.

Draft NRG Regulatory Guide DG-1063 (now 1.178), An Approach for Plant-Specific,

-Risk-Informed Decision Making: lnservice Inspection ~f Piping, October 1997.

7.

Draft Standard Review Plan (SRP) Section 3.9.8, Review of Risk-Informed lnservice Inspection of Piping, October 1997.

8.

Code Case N-577, Risk-Informed Requirements for Class 1, 2, and 3 Piping, Method A, Approved (by ASME Code Committee) September 2, 1997;_

9.

WCAP-14572, Revision 1, Westinghouse Owners Group Application of Risk-Informed Methods to Piping lnservice Inspection Topical Report, October 1997

10.

WCAP-14572, Revision 1, Supplement 1, Westinghouse Structural Reliability and Risk Assessment (SRRA) Model for Piping Risk-Informed lnservice Inspection, October 1997.

11.

Letter from Louis F. Liberatori, Jr., Chairman, Westinghouse Owners Group, to Peter C..

We (NRG) "Transmittal of Responses to NRG Open Items on WOG RI-ISi Program and Reports WCAP-14572, Revision 1 and WCAP-14572, Revision 1, Supplement 1,"

September 30, 1998.

ACC - Safety Injection AFW - Auxiliary Feedwater AS - Auxiliary Steam BD - Slowdown (S/G)

CC - Component Cooling CH - Chemical and Volume Control CN - Condensate CS - Containment Spray CW - Circulating Water ECG - Emergency Core Cooling EE - Emergency Diesel Fuel Oil FC - Fuel Pit Cooling FW - Feedwater HHI - High Head Injection LHI - Low Head Injection MS - Main Steam RC - Reactor Coolant RH - Residual Heat Removal SW - Service Water VS - Ventilation System Description

ATTACHMENT SURRY UNIT 1 STRUCTURAL ELEMENT SELECTION RESULTS AND COMPARISON TO ASME SECTION XI 1989 EDITION REQUIREMENTS Number of High RI-ISi Program ASME Section XI ISi Program Total Number of Safely-Significant High Safely-Significant 1989 Edition Examination Segments

• segments (No. In Structural Elements*

Category Weld Selections Credited in System Augmented Program)

Augmented Programs CLASS 1 CLASS2 CLASS 3 NON-B-F B-J C-F-1 C-F-2 CODE ACC 0

9 0

0)

AFW 11 (5)

• s 3+3*

6 16 AS 2

2 0

B0° 6 (6) 3 3

12 cc 6

13+4*

0 CH 8

12+6b+4*

1+3*

39 3

CN° 0

8 cs 0

t' 9

2 cw 4

0 ECC 7

12 1

24 1

EE 0

0 FC 0

0 FW° 13 (13) 7 6

17 HH1° 14 (1) 15+2h 63 s

LH1° 7 (1) 7+3b+2h 23 1

MS 0

3 (3) 2+1U 18 23 RC 11 20+1oh*1+3b 18 148 3

SURRY UNIT 1 STRUCTURAL ELEMENT SELECTION RESULTS AND COMPARISON TO ASME SECTION XI 1989 EDITION REQUIREMENTS Number of High RI-ISi Program ASME Section XI ISi Program. Total Number of Safety-Significant High Safety-Significant 1989 Edition Examination Segments Segme'11S (No. In Structural Elements*

Category Weld Selections Credited In System Augmented Program)

Augmented Programs CLASS 1 CLASS2 CLASS3 NON-8-F B-J C-F-1 C-F-2 CODE RH 4

1 4

4 12 0

RS 2

2 4

0 sv-t 11 5+3*

0 vs 2

2 0

Total 108 68 53 33 12 18 202 49 118 89 Summary: Current ASME Section XI selects a total of 385 non-destructJv~ exams while the proposed RI-ISi program selects

• total of 136 exams (166-30 visual exams), which resuns In a 65% reduction.

Notes for Table 4.4-2

a. System pressure test requirements and VT-2 visual examinations shaU continue to be performed In an ASME Code Class 1, 2, and 3 systems.

b. VT-2 area exam al specific location.

c. Augmented programs for erosion-conoslon and/or high energy line break continue.

d. Pipe coatings program will be maintained.

e. VT-2 for entire segment.

f. UT thickness only.

g. Segment MS-34 has no weld; VT-2 for entire segment.

h. Ten examinations added for change In risk considerations.

I. Six examinations added for defense-In-depth at the reactor vessel o~lel nozzle to pipe welds.

_ _j