ML20154A027

Summary of 980909-10 Meeting with Entergy Operations,Inc Re Implementation of risk-informed Inservice Insp Program. List of Attendees & Rept Prepared by Structural Integrity Associates,Inc Encl

ML20154A027
Person / Time
Site:	Arkansas Nuclear
Issue date:	09/25/1998
From:	William Reckley NRC (Affiliation Not Assigned)
To:	NRC (Affiliation Not Assigned)
Shared Package
ML20154A031	List: ML20154A027 ML20154B750
References
NUDOCS 9810020151
Download: ML20154A027 (38)

Text

.__

k

• l

• • %3 ,Up ~ % P l

O UNITED STATES l  !* j 2

NUCLEAR REGULATORY COMMISSION WASHINGTON, D.C. 20656-0001

% # September 25, 1998 LICENSEE: ENTERGY OPERATIONS, INC.

FACILITY: ARKANSAS NUCLEAR ONE, UNIT 2 l

SUMMARY

OF SEPTEMBER 9 AND 10,1998, MEETING WITH ENTERGY OPERATIONS, INC., REGARDING IMPLEMENTATION OF A RISK-INFORMED INSERVICE INSPECTION PROGRAM FOR ARKANSAS NUCLEAR ONE, UNIT 2 (TAC NO. M99756) l A meeting was held on Wednesday and Thursday, September 9 and 10,1998, between the Nuclear Regulatory Commission (NRC) staff and Entergy Operations, Inc., (the licensee) to discuss the licensee's application to implement a risk-informed inservice inspection (RI-ISI) program for Arkansas Nuclear One, Unit 2 (ANO-2). The meeting was held at NRC headquarters in Rockville, Maryland. A notice of this meeting was issued on August 25,1998.

A list of attendees for the meeting is provided as Attachment 1.

To support a request to use RI-ISI for ANO-2, the results of evaluations for various plant systems were provided to the NRC staff by the licensee's submittals dated September 30, 1997, and March 31,1998. Based on a review of the information submitted by the licensee and review of supporting documents such as EPRI-TR-106706, " Risk-Informed inservice Inspection Evaluation Procedure," a topical report submitted by the Electric Power Research Institute (EPRI), and American Society of Mechanial Engineers (ASME) Code Case N-578," Risk-Based Rules for Class 1,2 and 3 Piping," the NRC staff developed a set of questions in preparation for the meeeting. The questions were informally sent to the licensee before the meeting and are provided as Attachment 2. The licensu prepared a preliminary response to the staff's questions and the draft responses were used to facilitate discussions during the meeting. The draft responses were either returned to the licensee or were discarded following the meeting.

Presentations that were given by or on behalf of the licensee during the meeting are provided as Attachments 3 and 4. A report prepared by Structural Integrity Associates, Inc.," Review of Degradation Mechanisms in EPRI Risk-Informed Inservice Evaluation Procedure," was referred to during the meeting and is provided as Attachment 5. At the end of the meeting, the licensee and NRC staff discussed what unresolved items were identified during the meeting and what additional information was necessary to support the staff's review of the application. The licensee faxed a summary of those items to the staff on September 14,1998, and the licensee's plans to address the staff's questions were discussed further during a telephone call on September 16,1998. The list of open issues compiled by the licensee is provided as l Attachment 6. As a follow-up to the meeting, the NRC staff provided clarifications to two questions by sending a facsimile to the licensee on September 15,1998. The staff's clarifications are provided as Attachment 7 and were also discussed during the conference call l on September 16,1998.

l 9810020151 980925 PDR ADOCK 05000368 h i

G PDR NGC RLE CENEB COPY l

- . - , . _ . ..- - .. - - _ . . . - - _ - _ - . - . _ _ . - ~ . - . . .

~ f i

i

' To support the NRC staff's plans to complete its review of the RI-ISI submittal for ANO-2 by December 30,1998, the licensee agreed to respond to the NRC staff's questions by (on or  !

about) September 25,1998. In addition to its status as a pilot application for RI-ISI, the review schedule is important because the licensee has incorporated the RI-ISI methodology into the

inservice inspection planning for the ANO-2 refueling outage scheduled for January 1999.-

Given that no insurmountable obstacles or major technical concerns were identified during the l meeting and assuming a timely response by the licensee, it appears (assuming no new .

technical issues arise) that the review can be completed by the current target date. Additional )

conference calls and meetings, if necessary, will be arranged to facilitate the completion of the l NRC staff's review by the target date.

ORIGINAL SIGNED BY:

William D. Reckley, Senior Project Manager Project Directorate IV-1  ;

Division of Reactor Projects Ill/IV Office of Nuclear Reactor Regulation Docket No. 50-368 i Attachments: As stated cc w/atts: See next page DISTRIBUTION:

Hard Coov E-Mail lleetnHlid SCollins/FMiraglia (SJC1/FJM) SDinsmore (SCD1)

PUBLIC BBoger (BAB2) MMarkley (MTM)

PD 4-1 r/f EAdensam (EGA1) TMcLellan (TKM)

OGC JHannon (JNH) SAli (SAA3) ,

ACRS TMartin (SLM3) GBagchi(GXB1)

WReckley DLange (DJL). CHawes (CMH2)

TGwynn (TPG)

Document Name: AR299756299756MTS ,j OFC PM/PD4-1, w

LA/PD4-1 D/dd "

tw NAME WReckley/vw CHawWg JHannon DATE T /%/98 912Y /98 ' 8 COPY YES/NO YES/NO YES/NO OFFICIAL RECORD COPY .

.--,.-o - - . ., ,.n.,

\

Entergy Operations, Inc. Arkansas Nuclear One, Units 1 & 2 cc:

Executive Vice President Vice President, Operations Support

& Chief Operating Officer Entergy Operations, Inc.

Entergy Operations, Inc. P. O. Box 31995 P. O. Box 31995 Jackson, MS 39286-1995 Jackson, MS 39286-1995 Director, Division of Radiation Wise, Carter, Child & Caraway Control and Emergency Management P. O. Box 651 Arkansas Department of Health Jackson, MS 39205 4815 West Markham Street, Slot 30 Little Rock, AR 72205-3867 Mr. C. Randy Hutchinson Vice President Operations, ANO Entergy Operations, Inc.

Winston & Strawn 1448 S. R. 333 1400 L Street, N.W. Russellville, AR 72801 Washington, DC 20005-3502 Manager, Rockville Nuclear Licensing Framatone Technologies 1700 Rockville Pike, Suite 525 Rockville, MD 20852 Senior Resident inspector U.S. Nuclear Regulatory Commission P. O. Box 310 London, AR 72847 Regional Administrator, Region IV U.S. Nuclear Regulatory Commission 611 Ryan Plaza Drive, Suite 400 Arlington, TX 76011-8064 County Judge of Pope County Pope County Courthouse Russellville, AR 72801

l l

MEETING WITH ENTERGY OPERATIONS. INC.

SEPTEMBER 9 AND 10.1998 RISK-INFORMED INSERVICE INSPECTION APPLICATION ATTENDANCE LIST l

Name Affiliation I

William Reckley NRC/NRR/DRPW/PD41 Stephen Dinsmore NRC/NRR/DSSA/SPSB i Mike Markley ACRS Tom McLellan NRC/NRR/DE/ECGB Syed Ali NRC/NRR/DE/ECGB Goutam Bagchi NRC/NRR/DE/ECGB Homayoon Derfuli Scientech (NRC Contractor)

Paul Guumer Scientech (NRC Contractor)

Mike Anderson INEEL (NRC Contractor)

Jack Trainer INEEL (NRC Contractor)

Mark Smith Entergy Mike Lloyd Entergy Mike Paterak Entergy John Dosa Entergy 1 Jim Moody Duke Engineering  ;

Vesna Dimitrijivic Duke Engineering  :

Pete Riccardella Structural Integrity Assoc.  !

Jeff Mitman EPRI Richard Fougerousse Inservice Engineering Karl Fleming Erin Engineering 4 Rupert Weston ABB-CE I

I ATTACHMENT 1

I To support the NRC staff's plans to complete its review of the RI-ISI submittal for ANO-2 by December 30,1998, the licensee agreed to respond to the NRC staff's questions by (on or 1 about) September 25,1998. In addition to its status as a pilot application for Rl-ISI, the review schedule is important because the licensee has incorporated the Rl-ISI methodology into the inservice inspection planning for the ANO-2 refueling outage scheduled for January 1999.

Given that no insurmountable obstacles or major technical concerns were identified during the meeting and assuming a timely response by the licensee, it appears (assuming no new l technical issues arise) that the review can be completed by the current target date. Additional conference calls and meetings, if necessary, will be arranged to facilitate the completion of the NRC staff's review by the target date. ,

I hb, e William D. Reckley, Senior Proj Manager Project Directorate IV-1 Division of Reactor Projects lil/IV Office of Nuclear Reactor Regulation Docket No. 50-368 Attachments: As stated cc w/atts: See next page I

i

s: $

RAI emailed to licensee - to be docketed via meeting summary RAI BASED ON ANO 2181 SUBMITTALS Questions 1.0 The licensee's submittal does not clearly define an overall basis for the proposed alternative, but instead provides discrete risk evaluations for separate systems, and refers to guidance from other documents such as Code Case N-578 and EPRI TR 106706 as bases for the methodology used for individual risk evaluations. The licensee should submit an overview that encompasses all system risk evaluations and includes or describes:

a. A comparison of the total number of examinations under the existing ASME

- XI program and the proposed alternative, categorized by ASME Class and plant system.

b. The extent of change to overall plant risk as a result of implementing the proposed alternative examinations, relative to existing ASME XI examination requirements. (Question 27.0provides more details on this subject)

c. A detailed technical justification that provides a basis for assuring the structuralintegrity of all piping components affected by the proposed alternative.

2.0 The licensee should provide documentation of the process for which systems were selected to be evaluated, and note which systems were reviewed and excluded from the Rl-ISI scope.

3.0 - Currently, it is unclear which portions of the Code are intended to be replaced by the licensee's proposed alternative, as the related and non-related portions of the Code have not been specified. Code Case N-578, referenced by the licensee, provides a more thorough alternative which better defines the implementation of a RI-ISI program, is the proposed alternative, in essence, to implement Code Case N 578? If so, this needs to be stated in the licensee's overview described in question 1.0. If not, the licensee needs to provide details regarding the implementation of the proposed alternative, including all deviations from Code requirements. In' addition, the licensee needs to address any changes in the current licensing basis (CLB) and confirmation that existing augmented examinations will not be impacted by the proposed alternative.

4.0 in the transmittalletter for RI-ISI submittals for ANO 2, the licensee stated that "The ANO-2 study was performed consistent with ASME Code Case N -578, Risk-based Rules for Class 1, 2, and 3 Piping , utilizing the EPRI risk-informed inservice inspection methodology." The licensee should describe where any differences between the EPRI methodology (Reference 12) and Code Case N -578 (Reference 13) guidance would have impacted the findings. For example, although ANO 2 did not identify any pipe segments belonging to Risk Category 1, N -578 would require inspection of 50% of the total number of elements in this category, and 25% of Risk Category 2 and 3 elements, while the EPRI methodology would 1

ATTACHMENT 2

,  : l require inspection of 25% of the total number elements in Risk Categories 1,2, and 3. Describe the statistical and/or technical bases for performing examinations on 25% of high risk (Category 1,2, and 3) segments,10% of medium risk l

(Category 4 and 5) segments, and no examinations on low risk (Category 6 and 7) segments.

5.0 In the licensee's October,1995 response to question 15 of the RAI regarding the IPE submittal, it was stated that, although the ACC EDG was not credited in the submittal, it would be credited in the "ANO-2 living PRA model". In the January, j 1997 response to Question 1 of the RAI regarding the AOT extension submittal, it I was indicated that the IPE PRA submitted in response to GL 88-20 was still the current model. The licensee's current risk informed (RI) ISI submittal refers to ANO-1 PRA 94-R-2005-01, Rev. O, August 1992. As discussed in RG 1.174, the engineering analyses used to support Rl applications should be based on the as-built and as-operated plant. Please; i

i l

a. Discuss the process used to determine if, and when, plant procedural or  !

hardware changes should be incorporated into the PRA or, at least, into the risk insights used to support the conclusions of the RI ISI submittal.

l

b. Confirm that all plant and procedural changes which could impact the risk insights used to support the conclusions of the submittal have been evaluated and incorporated if necessary.

l 6.0 Each system evaluation begins with a system boundary discussion. This discussion involves parts of the system "containing welds that were not entered in the data

l. base." One interpretation of the discussions in the sub -sections is that segments l l (containing the welds) are screened out of further evaluation based on a variety of  !'

} justifications:

l l a. Many segments in the screening analyses (e.g,3.2.4, EFW) are identified as  ;

belonging to category 7 and, "since no element selections are needed for low risk-significant segments, the welds for this line were not entered in the database." Are all category 7 welds excluded from the database? What are j the implications of not being entered into the data base? That is, are welds in the data base subject to a different level of review, controls, or other process than welds not in the data base? In particular, are welds included in the data base but aga selected for ISI inspections treated differently from welds excluded from the data base?

b. The justifications for screening segments out from further detailed evaluation is not clear. In most cases (for example the CS system), the screening evaluations seem very similar to the detailed evaluations in

" Consequence Information Report" sheets in the Appendices to each system.

That is, there is a consequence determination based on the risk significance i of the functions lost (including an occasional reference to the number of

! back-up trains remaining) and a statement that there are no degradation

mechanisms. The major difference between the screening evaluations and 4

,, , .v._ _ . , , . ,._, _ ~ - _ ._ ._ ,_, . ,

_____q

.. t i i

.. i the detailed evaluations seems to be the lack of secondary effect (e.g.

equipment failure arising from the special relationship between the equipment and the ruptured pipe) in the screening evaluation. Screening evaluations are usually based on conservative assumptions, however, not considering secondary effects does not appear to be conservative. Please provide the guidelines that were used to determine when segments could be screened out in the system boundary section and therefore not included in l- the detailed evaluation. l

c. One justification for screening out some major pipe runs (e.g, main stem l downstream of the MSIVs and feedwater lines upstream of 2CV-1073/23 -2) includes the statement that, " risk informed ISI does not support granting relief to elements within the plant FAC Program, the welds for these lines were not included in the database." This statement is uncl ear. Risk informed ISI is intended to identify areas which, based on risk considerations, should be subjected to increased inspections. Furthermore, both of these ruptures are stated to be risk benign yet both have the l potential to rapidly create severe environments in the auxiliary building unless automatic and planned operator actions are successful. Please re-evaluate these lines; l

L 1) without depending on the fact that the lines are in the FAC program,

2) identifying the secondary effects of a properly isolated break, and

3) including some evaluation of the likelihood and subsequent consequence l of the failure to properly isolate the break.

7.0 Reference 1, Section 3.3, item 3 states that motor operators are iudned to be a few feet higher than the valves themselves which appear to be close to the floor j (i.e. 2 feet above elev. 360'). It.is further stated that a number of HPSI valves and-

the containment spray valves are separated such that there should always be a l discharge path for these systems. Why is it necessary to make assumptions regarding position and number?

8.0 The staff has been unable to identify general guidelines used when performing the flooding and other secondary effects analysis. Some of the specific assumptions we have found are listed below along with an associated question. Does the j licensee have any general guidelines regarding secondary effect assumptions?

l The analysis assumes that the door into room 2073 will fail when the water level

! reaches 3 to 5 feet and presumably credits this failure as a means of limiting the spatialinteraction of a flooding event. Credit for a door failing open is also L included in HPSI C-27's consequence, and other studies, e.g., the Chemical Volume

! and Control system analysis, Section 4.0, item B, credit is taken for non -water tight doors being forced open in the event of flooding in that room, which prevents

water levels from reaching key electrical equipment in the room. Under what i conditions is it acceptable to assume that a door fails open? Reviewer's of the IPE flooding analyses have taken the position that failure of the door should not be credited as a means of relieving flood accumulation unless it is specifically designed to fail at a particular flood height or calculations have been performed with

. t sufficient margin to prove failure will indeed occur.

Reference 1, Section 3.3, item 4 states that MCCs at El 354 Room 2073 and El 335 (2040).are assumed to fail if water accumulates to a height of 6 " at the MCCs and that accumulation to 6" cannot occur at elevation 354 due to a large floor grating. Please indicate if and how the critical MCC flood height was confirmed.

While a steady state flood height of 6" on elevation 354 may not be possible, has consideration been given to wave effects? This may be particularly pertinent following the flood propagation from room 2084 after the intervening door fails with several feet of water behind it (as postulated in the analysis, see previous comment).

ANO-2's IPE only discounts damage to junction boxes if they are flood proof.

Reference 1, Section 3.3, item 6 states that damage to junction boxes is discounted in this analysis since most are at least a few feet off the floor and they appear to be tight and sealed. Why is the failure of junction boxes not systematically evaluated as a secondary effect based on their position and the potential environment? A general assumption should be supported in terms of

. applicable design standards.

9.0 Reference 1, Section 3.3, item 10. Please provide a sample hydraulic calculation to validate that the assumption regarding drainage rates via doors and floor drains

, is adequate to prevent flood accumulation following <4" service water line breaks.

10.0 Reference 1, Table 5-1. Please indicate why the consequence analysis for the first

- 10 pipe sections in this table do not address the "no isolation case." is this because failure to isolate does not result in additional damage to mitigating 1 systems?  ;

l 11.0 Some segment evaluations (HPSI C-27) include the statement," propagation from

! the General Access Area to the ECCS pump rooms is not a concern because the pathways are isolated by SAIS." Other evaluations (LPSI-C-11) include a statement I that the ventilation dampers close on SAIS isolating the propagation path to the ECCS pump rooms. Are these the same statements? Please explain this SAIS generated, flood propagation path isolation.

12.0 Reference 1, Figure 2-1 summarizes the ISI methodology including the effects of isolation. In this figure, and in Table 5 -1, the ability to isolate is always treated as the equivalent to one backup train. The licensee submittal departs from the EPRI methodology (Reference 12) by taking credit for the operators probability of failing to isolate a break in a pipe segment as being equivalent to having a " backup train" of a mitigating system for use in the consequen'ce ranking process. This is based i on a determination (Reference 14) that operator human error probability (HEP) for failing to perform corrective actions in response to adequate control room i- indications is ~ 1E-2, which is similar to the unreliability of an unaffected back up

~

train being less than or equal to 1E-2 (Reference 9, Section 4.1.16), it appears j that trains which are judged as not meeting this reliability criterion are treated as l 4

being equivalent to 0.5 trains (Reference 1, Table 3-1). l 1

i

. I i

, .. - , ,n , ,

t l.

Thus, while automatic isolation features will probably meet the reliability criterion for 1 back up train with some degree of confidence, isolation features requiring operator actions may not, if subjected to a detailed human reliability analysis. As noted in the submittals, less time is available for operator response and higher stress is placed on the operators in actual demand situations to detect the break and isolate the failure before the core uncovers. in the Service Water Analysis (Reference 1, Section 8), "Several ' low' and ' medium' consequence analysis results depend upon successful operator actions to identify the broken pipe and isolate it before additional impacts occur."

It is therefore requested that additional information be provided which justifies the l manual isolation events as being equivalent to 1 train (that is, unreliability less then O.01) in the context of this analysis. This information should be provided for all events for which isolation is credited, or bounding evaluation (s) may be performed and the characteristics of each action related to the boundary evaluation (s). This  !

information should include the usual data and analysis required to develop an unreliability for a human action. It was noted that items a. and b. below are often included in the current descriptions, and items c. and f. are sometimes given. )

Items d., e., and g. are generally not given in the current descriptions. l

a. Indication of event

b. Alarm Response Procedure (e.g. is investigation required before taking action)

c. Location of isolation action (i.e. control room or local)

d. Time available for isolation after investigation

e. Time to implement isolation

f. Procedural guidance l

g. Any possible dependencies between isolation action and actions credited in accident mitigation As noted in Section 8.0 of the Service Water analysis, the licensee states "It may be appropriate to utilize the training simulator and/or operator interviews to discuss some of the scenarios and confirm that the analysis is not too optimistic and/or to

, identify proceduralimprovement." The licensee should conduct these evaluations to ensure consequence rankings were appropriate, especially considering those cases where actual demands were postulated based on LOCA events.

l 13.0 As noted in the previous question, the licenses's submittal takes credit for the probability of isolation failure as being equivalent to having a backup mitigating l system train even when no actual system trains are available. For example, the l consequence analysis for HPSI pipe segment HPSI-C-01 (Reference 4) indicates l that for the case where the postulated failed segment remains unisolated, the HPSI would f ail and no backup systems to mitigate core damage are available. As noted in Section 4.0 of the submittal for the HPSI system," the Level 1 PRA success criteria requires that HPSI flow must be established within 44 minutes of LOCA occurrence to preclude core from being uncovered. Conservative estimates of operator response time to isolate the postulated line breaks during a LOCA demand is 30 to 35 minutes." Assuming f ailure to isolate as a backup train allows the subsequent consequence ranking to be " medium" rather than "high"in this case.

, t l In the Service Water analysis (Reference 1) for some segments, e.g., SW-C-08, credit is taken for two such independent operator actions to isolate the break (to prevent loss of all Service Water) and/or recover other plant systems.

Consideration of these operator actions as equivalent to two separate backup trains results in a " medium" consequence assessment for this pipe segment. A similar assessment is used to justify a medium consequence for Shutdo'un Cooling piping (Reference 5). The licensee should provide further analysis for these human actions '

to ensure that HEP's would not result in higher probability of failure than the 1E -2 (for the HPSI case noted above) and 1E-4 (for Service Water and SDC) values assumed by considering these actions as equivalent backup trains, fo each segment where probability of failure to isolate has been credited. Please address this in terms of the reliability of the individual actions and the potential dependencies between these actions.

14.0 Reference 1. The submittal uses the ANO-2 IPE model to predict CCDP for pipe ruptures causing only an initiating event. The IPE model makes several assumptions in developing SW logic model. For example, the following is assumed:

a. 2P4A and 2P4C are running and 2P4B is in standby,

b. 2P4A and 2P4B are aligned to loop I supplying Auxiliary Cooling Water (ACW), and

c. 2P4C is supplying loop 11 and isolated from loop I and ACW.

Please explain how these assumptions were factored in when predicting CCDP for SW pipe ruptures.

15.0 Reference 1. In Figure 3-1 A, "A Simplified Success Criteria for Transients", the operator's action to initiate once through cooling (feed and bleed) is credited as a train. The success criterion defined for the function of "RCS and Core Heat Removal" departs from the formulation presented in IPE's functional event tree structures. As noted in the SRP and in the EPRI guidance, systems should be evaluated for each plant safety function (e.g., reactivity control, RCS inventory, decay heat removal, etc.). Only the Service Water submittal provided an analysis of the critical plant safety functions and associated success criteria. A discussion of the critical safety functions and success criteria is necessary to allow determination of the number of available mitigating trains during the consequence evaluation. The following considerations or clarifications should be evaluated by the licensee in regard to plant safety functions and success criteria:

a. Is it fair to say that in the licensee's methodology, a backup train represents a success path? What is the definition of a backup train in the methodology? How does a backup train relate to the function of the train / system considered lost?

1 l b. Since each of the submittals are provided as stand-alone documents, each

! should contain a discussion of the pertinent critical safety functions and j success criteria with respect to the system being evaluated.

l

. f O

c. Simplified success criteria diagrams should be provided in each submittal similar to that provided by Figures 3-1 A and 3-1B in the Service Water analysis. The simplified success crlieria diagrams should more clearly define which critical safety functions arc being represented and how the block diagram redundant success paths relate to backup trains noted in Service Water Table 3-1 (Assumed System and Train Backup).  ;

d. Table 3-1 is confusing in that it contains system / function / trains that are noted as ng1 being used in the analysis, yet appear in the success criteria <

figures (e.g., SDBCS/Cond in Figure 3-1 A, and LPSI A & B and SDC recovery in Figure 3-18.)

e. Are two 0.5 trains, e.g., turbine EFW and AFW credited as equivalent to one backup train?

16.0 Reference 1. Has there been any activity to establish that the ranking results predicted by Tables 2-1 and 2-3 are internally consistent? The method of assigning consequence ranking is either purely quantitative (Table 2 -1) or qualitative (Table 2-3) as in the following:

a. If the impact of pipe failure results in one of the plant specific JEs, the consequence category is determined based in CCDP predicted by ANO-2 IPE (Table 2-1).

b. If the impact of pipe failure results in both IE, as well as loss of mitigating system (s), the rules defined in Table 2 -3 are used to determine the consequence category.

l Have the licensee attempted to predict the CCDP for case b, type events by re-quantifying the IPE model and comparing the results with those produced by application of Table 2-3?

- - . - - . - . - . _ ~ - - - - - - . . - - . - . - - -

.- f - i e 1 17.0 The Service Water submittal and the rest of the system submittals differ in use of the EPRI methodology for consequence rankings. Systems analyzed for other than I Service Water used EPRI Table 3.2 for assigning consequence categories while Service Water used a similar but derived table (Table 2-2). Rankings using either l table would be similar except that in Service Water Table 2 -2, the number of '

unaffected backup trains includes the consideration of 0.5 trains. Consideration of 0.5 trains would reduce the consequence ranking for some segments. For example, for an infrequent challenge (DB Cat lil), all year exposure, EPRI Table 3.2 would result in a medium ranking for two backup trains but a high ranking for only one backup train. Table 2-2 in the Service Water analysis would also produce these same rankings for the same number of available trains, but if 1.5 trains are credited, a medium ranking is obtained rather than a high ranking, which would be the case for less than two backup trains. The licensee should clarify why two separate approaches were necessary and provide a discussion of where 0.5 trains were credited, if any, which resulted in a lesser consequence ranking.

18.0 Table 2-1 in the Service Water analysis (Reference 1) differs from Table 1 in the other submittals for assigning consequence categories for ANO 2 pipe failures that result in an initiating event. In Table 2-1, a consequence range is provided but the first consequence shown in the range is assumed in the analysis. Using this assumption, the tables would agree except for initiating events T1, T4, and T6, where a low consequence is assumed in Table 2 -1 but a medium consequence is assumed in Table 1, for the same initiators. The licensee should verify that use of the low consequence ranking for the Service Water analysis did not result in low Risk Category rankings for seaments that might have ranked higher had the medium consequence ranking been used.

19.0 Reference 1. Based on the data presented in Reference 11, the baseline CDF for ANO-2 is 3.28E 5. The conditional CDF when one train of HPSI is unavailable is i 2.19E-4. This implies that by removing one HPSI train from the ANO -2 design, the CDF increases by a factor of almost 7 indicating the importance of the HPSI role in accident mitigation. Now consider transients T1 and T8. According to Table 2 -1 of Reference 1 we have the for ving data:

IE CCDP T1: Turbine trip 3.0E-6 i T8: Loss of SW train A 2.8E 6 i Ons expects the CCDP for T8 to be higher than that of T1. This is because; i a. T8 is a transient event with common cause impacts on one train of ECCS that includes a HPSI train and, ,

b. Operation of HPSI in feed and bleed mode is credited in the IPE for  !

mitigation of transient events.

3 Please explain why the CCDP associated with T8 is smaller than that of T1.

20.0 Related to the issue above: The IPE assumes that the HPSI pump cooling is only required in the re-circulation mode of operation following a LOCA. Please address

.. _ . _ _ _ _ _ _ ~ _ _ _ _ . _ _ ._. .

. f the validity of this assumption in relation to the data presented in Table 3-2 of Reference 1.

21.0 Reference 4. In Section 4.1.12, the unreliability of a typical equipment backup train is defined as 1.OE-2. The unreliability estimates for two and three backup trains are also provided. It appears that these estimates do not account for possible support system dependencies or for common cause failure of backup l trains. Please describe how support system dependencies and CCF's between I trains are identified and accounted for.

I 22.0 According to the IPE results summarized in Reference 1, Table 2-1, the CCDP for l SGTR is 9.8E-6. Since this value is less than 1.0E-4, the assigned consequence category is MEDIUM. Please address the following issues:

I

a. Is there any pipe rupture that affects the mitigation of SGTR events especially with respect to isolation of the affected SG?

l

b. The CCDP for SGTR is low because IPE assumes a very low probability (6.5E 6) for the event " failure to isolate affected SG ". The value is substantially lower than the representative isolation failure probability assumed in your analysis (i.e.,1.0E-2). The staff evaluation of your IPE noted that human error quantification was a " weakness" in your study. How is the impact of the IPE assumptions ascassed in your risk ranking?

23.0 To determine how often the mitigating function of the system / train, affected by a pipe rupture, is needed, Tab!ss 2-2 of the submittal requires mapping of the system / train to one of the three design basis IE categories:

Category 11 (anticipated operational occurrence)

Category lli (infrequent event)

Category IV (unexpected event)

For example: a postulated pipe failure in HPSI system is mapped to category IV events implying the function of HPSI is expected for mitigation of LOCAs only. It is common that PRA models take credit for systems beyond their intended design.

For example, ANO-2 IPE takes credit for HPSIin mitigation of transient events some of which belong to IE categories 11 and Ill. How does the licensee account for the credits taken for a system function in mitigation of multiple IE's categories?

24.0 in the consequence analysis of LPSI SDC pipes (reference 5), the submittal credits the ANO-2 procedures in maintaining adequate redundancy during the midloop operation. For example, in the analysis of pipe segment LPSt- C-02, the submittal assumes the existence of two backup trains to provide makeup during midloop operation. Please elaborate on the nature of backup systems during midloop operation.

25.0 Your analysis is based on the assumption of a single pipe f ailure. Please describe how you considered any degradation mechanism in conjunction with other events (such as water hammer) which might cause a common cause failure of several pipes, in addition, the EPRI methodology requires that licensee's elevate the risk ranking of piping segments where a potential for water hammer also exists. if the

. f a

determination for water hammer potentialis made as a result of administrative controls being applied versus engineered safety functions, then some probability for water hammer should be considered. This may impact the ultimate risk ranking of several piping segments. The licensee should describe what appropriate measures have been put in place to eliminate water hammer from consideration in applicable piping systems.

26.0 it is difficult to locate in the submittal any pipe failure which have been evaluated with regards to LERF. RG-1.174 requires that risk informed decisions include considerations of LERF. The EPRI methodology includes guidelines regarding LERF consideration through categorizing potential unisolated LOCAs outside of containment as described in Table 3.3 of EPRI TR-106706 (Reference 12). The staff is still reviewing this approach to determine its acceptability. Please describe how ANO-2 includes LERF considerations and identify those segments which have been evaluated with regards to LERF.

27.0 RG 1.174 requires that the change in risk resulting from a risk informed application i be assessed and meet Principle 4, "When proposed changes result in an increase in core damage fiequency and/or risk, the increases should be small and consistent with the intent of the Commission's Safety Goal Policy Statement ". Such an assessment should censider the aggregate impact of the requested change on the plant's risk. CDF and LERF could be used as a surrogate for the Safety Goals. A decrease in risk always meets the intent of Principle 4. A quantitative bounding analysis that shows that the acceptance guidelines are satisfied is acceptable, however the assessment need not be quantitative. Any assessment should discuss the specific changes requested, the potentialimpact of these changes on risk, and any compensatory measures that will be applied that might affect the risk impact, if the assessed change in risk is greater than approximately 1E-06/yr (CDF) or 1E-07/yr (LERF), the discussion of the acceptability of the change should include consideration of the current, baseline risk at the plant. In section 7 of the HPSI system submittal, the licensee makes reference to use of an a!gorithm to compute  !

failure probability to enable an assessment to be performed of the effectiveness of the risk-informed developed program as compared to the existing Code program, but the results of this assessment were not included. The licensee should provide this assessment as well as those for the other system evaluations so that overall risk impact of the RI-lSi proposed program could be compared with that for the existing Section XI program. Please provide a discussion on how the requested change in ANO 2's ISI program satisfies Principle 4 in RG 1.174.

my y . ~ . _ _ , _ . . -

, _ . . . , ._r _a - _

. f. -

l

=

28.0 RG 1.174 also discusses several other principles which should be addressed for each risk-informed application;

a. The proposed change is consistent with the defense-in-depth philosophy

b. The proposed change maintains sufficient safety margins,

c. The impact of the proposed change should be monitored using performance strategies.

l Please describe how ANO-2's proposed change in the ISI program meets each of these principles.

29.0 Please elaborate on the reason for the initiating event screening process mentioned in Reference 1, section 3.1.

30.0 Current plant wide risk informed applications (MRule, GOA, IST) all have an " expert l panel" generally composed of technical experts from each key functional area who l have the responsibility and authority for final review and approval of the findings.

l The expert panel may perform the work or only review the work, and meeting l l . minutes are usually kept. Is there any type of review process such as this involved I~

in the licensee's process? If not, how is the integrated analysis and result judged j j acceptable and this judgement documented? '

31.0 Qualification of r ondestructive examination (NDE) systems (personnel, procedures and equipment) is an important element of a Rl-ISI program, in the system risk evaluations, the licensee states: "An inspection for cause process shall be implemented utilizing examination methods and volumes defined specifically for the ,

degradation mechanism postulated to be active at the inspection location." As l with any " inspection for cause" methodology, the reliability of examinations should L be optimized to the desired confidence levels for the risk informed inspection l- process to be effective. Highly reliable NDE systems can be provided through the use of NDE performance demonstration programs. It is unclear how NDE methods, procedures and personnel will be qualified at ANO-2. Provide a detailed technical discussion describing how the NDE performed to support the RI-191 program will be qualified, and the reliability subsequently enhanced.

32.0 It appears that the licensee's alternative includes Examination Categories B -F, E-J, C-F-1 and C-F-2. In later editions of the Code (1989 Addenda), Examination Category B-F is specifically for " Pressure Retaining Dissimilar Metal Welds in Vessel l~

Nozzles". Considering that the trend of the Code is to classify B-F welds as part of vessel nozzles, what is the justification for including these welds in the RI-ISI program for piping?

33.0 The inspection for cause strategy used in the proposed alternative should define when the inspections are to be performed. Scheduled inspection frequencies should be consistent with relevant degradation' rates and should be sufficiently short such that degradation too small to be detected during one inspection does not grow to an unacceptable size before the next inspection is performed. it appears that examination frequencies are based on current Section XI scheduling

. f

=

requirements (once every ten years). The licensee should justify the inspection frequencies for the postulated degradation mechanisms contained in the proposed alternative.

34.0 The licensee has performed a Service History and Susceptibility Review , as detailed in Section 6.0 of each system risk evaluation for ANO-2. The results are listed in l tabular form as Table (s) 6. These tables show the databases searched and list a designation for the results, if any instances are found for a particular degradation mechanism. It is unclear how this plant-specific review is factored into the overall risk evaluation. Is the review intended to supplant the industry review performed by EPRI to enable assigning a degradation category, as described in TR- 106706, Section 4.O? Please clarify how this ANO 2 specific review is used to modify the methodology for categorizing segments according to degradation potential.

35.0 The EPRI methodology described in TR- 106706, Section 4.0, as used by the l licensee for categorizing degradation mechanisms into failure potential requires l clarification in the following areas:

a. The large pipe break potentials listed are "High", for a > 50gpm leak,

" Medium", for a 1-10gpm leak, and " Low", where no leakage is expected.

These translate into degradation categones of "Large break", "Smallleak",

and "None", respectively. There appears to be an area of potential leakage not covered by this categorization; specifically, leaks between 10 and 50gpm. Please describe how postulated leakage rates in the 10-50gpm range will be addressed.

l l b. The EPRI report cites the basis for degradation mechanism categories as a l review of industry service data that includes approximately 1,000 crack l and/or leak events, and 100 rupture events, although no degradation mechanism was identified in 48% of these events. Further, no leakage rate information was available, but the report states that it is believed these

events produced leakages much less than 50gpm. The data reviewed is very limited and does not appear to support this assumption, in addition, approximately 30% of the rupture events have been attributed to l flow-accelerated corrosion (FAC). The source material is from previous EPRI work l l (referenced in the report). The report's final assessment is that FAC is the only l mechanism likely to be detected by periodic inspections that has a large break l potential (> 50gpm); all other mechanisms will only result in small leaks (< 10gpm). ]

No justification is given for this contention. i l Provide the technical bases for these assumptions. Also, it is unclear whether the source material is up-to-date and comprehensive; is the source considered to be a global consensus or industry standard for describing potential degradation mechanisms in light water commercial nuclear facilities?

j 36.0 Several issues pertaining to the manner in which the licensee has performed the j degradation mechanisms evaluation in all system risk evaluations need to be clarified:

-,~ ,- n- - -. - ,.

_ _ _ ~ _ . _ _ _ _ . _ _ _ . _ - _ _ _ . . . . _ _ _ _ . _ .

e

a. For example, in Section 5.0 of the Containment Spray System evaluation, j the licensee states, "The results (of the evaluation) indicate that no degradation mechanisms are potentia //ypresent." Does the licensee intend to state that no mechanisms are currently active? Or that the evaluation concludes that no mechanisms are potentially applicable? Please clarify

what is meant by the preceding statement in this as well as other system evaluations.

b. For the system example cited above, the licensee has qualitatively determined that the potential for microbiologically influenced corrosion (MIC) and pitting attack (PIT) is considered low. However, even a small potential implies that some probability exists that the degradation may be manifested during the service life of the component. This determination carries forward to the segment risk rankings (Tables 7 in each system evaluation) where a degradation mechanism classified as "None" relates to no potential for small leak or large break, and ultimately lowers the overall risk ranking for that line segment. It appears that the licensee is approaching this ranking in a non conservative manner. For all system risk evaluations, the licensee should justify why, when any notential exists for a particular degradation mechanism to occur, a failure potential of "None" is assigned to the applicable line segments.

c. The attributes to be considered for degradation mechanisms, as listed by the licensee in Table 5 of each system evaluation, do not coincide with those in the referenced basis methodology documents (Code Case N-578 and EPRI TR-106706), it appears the licensee has developed several more attributes '

for consideration when determining if a particular degradation mechanism could be present. For the Containment Spray System example cited above, the licensee has considered ambient temperature (less than 200*F) as the basis for excluding intergranular stress corrosion cracking (IGSCC) from occurring. However, the references do not list temperature as a criteria for consideration, only sensitized material, stagnant flow, and oxygenated water. By using temperature as a basis, the licensee is able to eliminate IGSCC from consideration for this system. This is not consistent with the referenced documents. The licensee should show cause for not using the same criteria as that listed in the references.

37.0 in the licensee's submittal references are made to a software tool that was used to support the RI ISI evaluations. What are the capabilities of this software tool?

Which steps in each of the evaluations were automated by this software?

i . t.

l 1

o References

1. ANO 2 Pilot Plant Study: Risk-Informed inservice inspection Evaluation for the -

Service Water System, March 1998.

2. ANO-2 Pilot Plant Study: Risk-informed inservice Inspection Evaluation for the

!- ' Reactor Coolant System, September 1997.

3. ANO-2 Pilot Plant Study: Risk-Informed inservice inspection Evaluation for the Chemical and Volume Control System, September 1997.

l i 4. ANO-2 Pilot Plant Study: Risk-Informed Inservice Inspection Evaluation for the High

' Pressure Safety injection System, September 1997.

5. ANO 2 Pilot Plant Study: Risk-Informed inservice Inspection Evaluation for the Low l Pressure Safety injection System, September 1997.

6. ANO-2 Pilot Plant Study: Risk-Informed Inservice inspection Evaluation for the Containment Spray System, September 1997.

7. ANO-2 Pilot Plant Study: Risk-Informed Inservice inspection Evaluation for the Main Steam System, September 1997.

8. ANO-2 Pilot Plant Study: Risk Informed Inservice Inspection Evaluation for the Main Feedwater System, September 1997. .

9. ANO 2 Pilot Plant Study: Risk informed Inservice Inspection Evaluation for the Emergency Feedwater System, September 1997

10. ANO-2 IPE

11. Joint Application Report for HPSI System Technical Specification Modifications, CEOG, March 1998.

12. Risk-informed Inservice Inspection Evaluation Procedure, EPRI Report No. TR-106706, Interim Report, June 1996.

13. Code Case N 578, Risk-informed Requirements for Class 1,2, and 3 Piping, Method B,Section XI, Division 1.

14. Swain, A.D. and Guttmann, H.E.; " Handbook of Human Reliability Analysis with Emphasis on Nuclear Power Plant Operations", NUREG CR-1278, August 1983.

l l

l l

I' I

l l-

L m

I Arkansas Xuclear One E m. t 2 Risk Informed ISI Pilot Application a

Las

et

i f P b' i

Agenda i

+ Introduction Entergy - Mark Smith

+ General Risk Informed Issues Inservice Engineering - Rick Fougerousse

+ Failure Potential and XDE Structural Integrity - Pete Riccardella

+ Plant Specific PRA Entergy - Mike Lloyd

. -i

'Ntileisy Agenda

+ Consequence Evaluation Duke Engineering - Pat O'Regan i Vesna Dimitrijevic Jim Moody ABB-CE - Ruppert Weston

+ Detta Risk Erin Engineering - Karl Fleming

~

bh EPfal Arkansas Nuclear One-Unit 2 Risk Informed ISI Pilot Application Risk Impact of Proposed RIISI Inspection Strategy ,

~

by Karl Fleming ls Vice President ERIN Engineering and Research, Inc.

i

mas PRESESTATION TOPICE-Pral Response to RAI's regarding risk impacts of proposed changes to in-service inpsection strategy o RAI lb o RAI 27 Evaluation ofimpacts of proposed changes to inspection strategy on risk of severe accidents Quantitative assessment of CDF impacts Conclusions regarding CDF and LERF impacts.

- __ ___ _ ____-___________________ - ______________ -- __ _______ _ r

d J#4

~

EEPfd2l EPRI METHOD FOR RISK EVALUATION t DRAFT TOPICAL REPORT (EPRI TR-106706) '

o EPRI Risk Classification Matrix used to classify segments into High, Medium, and Low risk categories o

Element selection process designed to focus on segments and locations with greatest risk impact and potential for failure Inspection process geared to focus on damage mechanisms determined for each selected location Supporting research and additional analysis in pilot studies performed to confirm that risk impacts are acceptable

-l'

~

MS E Pl21

~

EPRI METHOD FOR RISK EVALL ATION Updated Topical Report (Preparation in Progress) o Experience gained on pilot studies o

Supporting research on piping system reliability completed in 1998 ( EPFd TR-110161 : Draft;)

o Impact ofISI changes on CDF evaluated for ANO-2 .

RCS system ( presented to NRC staffin Nov.'97) o RG 1.174, RG 1.178 and SRP Chapters 3.9.8 Issued I for risk informed RIISI applications o New step added to EPRI RIISI procedure to evaluate i risk impacts in finau. %g element selection process '

- - - - - - - - - - - - - - - - - - - - - _ - - - - - - - - - - - - - - - - - J

_l

. LDS T fM/AC EEE P l2 l RISK,EVAILATION PROCESS Qualitative evaluation i o

screens out segments where inspections are enhanced or segments classified as low risk Quantitative bounding Analysis o

Conservative estimate of CDF and LERF impacts of reduced inspections o No credit for any inspection enhancements Full quantitative analysis o

Realistic estimate of CDF and LERF impacts of all changes to inspection program

n filforp' N

insert slides on risk evalution criteria here j

'Pty 2,~ (  !

I i

i l

i i

H me f fA 6 E PI21 RISKyVATEATION PROCESS

~

Qualitative Evaluation i

Elimination of surface examinations has no quantifiable risk impact i o

Segments classified as Low risk have negligible risk impact with no credit for inspections x bounding estimates of rupture frequency x bounding estimates of CCDP

o Only segments in High or Medium risk regions with reduced locations have sufficient potential for risk increase to justify quantitative analysis

- - - - - _ _ - - _ - -- - --- _ - - -- -_ _- D

.i

$HPh' PIPING RELIABILITY APPROACH t Documented in EPRI TR-110161 : Draft Markov model of time dependent interactions between degradation processes, NDE inspections and leak detection Estimates of model parameters based on service experience and characteristics ofinspection and leak detection process; updated piping reliability database Explicit treatment of number ofinspections, inspection interval, NDE reliability, random or fixed locations, age of plant, and full uncertainty quantification Time dependent rupture frequency based on hazard rate of  ;

Markov model Methodology benchmarked ( via EdF) and independently reviewed ( University of Maryland)

- .Aa-+. ;-mea. a ha_,-4-.,, _-4 .-.A . Aa.6m+4 - e-n4 J---eme.-4---e-444m h4 44 -aeae5 ._amM M-ee-*44-%--42-- d--#2=4-mu-u.a4-A.AA.&- 4-A-e

. 6 4

4 mm.s 0

tu l

O W

D

,.C

\

c~ N MW c (Jt

i U

! D g

% cn<

\

o  %

~

D W c:1 e' o t re A C 4

.c . ~

i

.~

/NF/I?}'

UNCERTAINTY ANALYSIS FOR RCS  :

1.0 0.9

_.___.-t Prohnhility of >

CDF De e re as e = .83 -

0.8 0.7

• b d i m

0.6 4 m

O 0.5 E W

5 I

~ -~

0.4j l 3

m  !

3  !

W- s 0.3 0

( Man = -3.6E-07/yr 2

}  !

I l

O2

'E

- o.,

Y--- -y.._,......................- -

0.0

-4.0E-07 -3.5E-07 -3.0E-07 -2.5E-07 -2.0E-07 -1.5E-07 -1.0E-07 -5.0E-08 0.0E+00 5.0E-08 Change in CDF (EPRI RilSI - Section XI) i

6 m

m RESLLTS OF RISK EEPei EVALLATION For CSS, CVCS, and EFW qualitative evaluation concludes that ISI changes will reduce CDF and LERF For LPSI and SWS, qualitative evaluation and bounding quantitative estimates conclude that ISI changes will reduce CDF and LERF ,

t For MFW and MS (susceptible to FAC) bounding estimates conclude that ISI changes will have negligible impact on CDF and LERP For HPSI and RCS, detailed quantitative estimates conclude that ISI changes will reduce CDF and LERF Total impact ofISI changes for all systems found to result in a small decrease in CDF and LERF

bh EPf21 .

MARKOV MODEL FOR ALL PIPE FAILURE MECHANISMS WITH AGING EFFECTS i 1

Leaend f PIPE STATES:

/ + )x. S = NO DETECTABLE FLAWS t F = DETECTABLE FLAWS t p' p L = DETECTABLE LEAKAGE A(S)

-[m) R = RUPTURE A(F) STATE TRANSITIONS:

s yy / 4 = OCCURENCE OF A FLAW p(F)

( L )-

A(S) = OCCURENCE OF A LEAK GIVEN NO FLAW A(F) = OCCURENCE OF A LEAK GIVEN A FLAW p(L) p(S) = OCCURENCE OF A RUPTURE GIVEN NO FLAW p(F) = OCCURENCE OF A RUPTURE GIVEN A FLAW p(L) = OCCURENCE OF A RUPTURE GIVEN A LEAK ,

\

x AX e = INSPECTION AND REPAIR OF A FLAW 1h = DETECTION AND REPAIR OF A LEAK

E!! b 'lL'y WARKOV MODEL ASSEMPTIONS  !

Each piping element (weld or location) assigned four states i

-> No detectable flaws

- Detectable flaws or damage; no leaks

- Observable leak

- Rupture Failure transitions included:

-> Occurrence of observable flaw due to degradation

-> Occurrence ofleak due to degradation or severe loading

- Occurrence of rupture due to degradation or severe loadmg Repair transitions included

-* Inspection and repair of flaw per NDE inspection program

- Detection and repair ofleak from walkdowns, instrumentation, or other leak detection process

[

r,+mv E Pral ,

ROLE OF PROBABILITY OF DETECTION Estimation of m: the repair rate for flaws P,, Pyo m=< Y fl R) i where:

+P g = probability that segment element with flaw will be inspected

-+ Pgo = probability that flaw is detected given inspection

+T 7 = mean time between inspections

+T g = mean time to repair after detection

m ,

evicruy EPel ROLE OF INSPECTION FOR LEAKS Estimation of , the repair rate for leaks PD .

N 1 (TW q T)

R where:

-+ Po = probability that a leak will be detected in operator round or via leak indications

+and T77 = mean time between detection opportunities

• and Ty = mean time to repair leak 1

4 w seei Reviews and Benchmarks EdF Benchmark of Markov Model for Example Cases o

Verifies solution for time dependent state probabilities to 4 significant figures; contirms solution of differential equations Independent Review by Professor Mosleh .

o Quantitative verification of Bayes update and quantification i

ofuncertainty o

Appropriate and innovative application of Markov modeling approach; approach to estimation of parameters sound Suggested enhanced feature for EPRI model to treat inspections on a periodic discreet vs. continuous basis o

Resolution of review comments to be incorporated into final version of EPRI TR-110161

_ _ _ _ _ _ _ _ _ _ - _ _ _ _ - - _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ - . _ - _ _ _ _ _ _ _ .