ML20154S608

Reg Guide 01.178 (Draft Issued as DG-1063), Approach for Plant-Specific Risk-Informed Decisionmaking Inservice Insp of Piping. Issued for Trial Use

ML20154S608
Person / Time
Issue date:	09/30/1998
From:	NRC OFFICE OF NUCLEAR REGULATORY RESEARCH (RES)
To:
References
TASK-*****, TASK-RE REGGD-01.178, REGGD-1.178, NUDOCS 9810280034
Download: ML20154S608 (23)

Text

- _ _ _ _ _.

=

U.S. NUCLEAR REGULATORY COMMISSION September 1998

,e amuq\\

1. ([g***** )

OFFICE OF NUCLEAR REGULATORY RESEARCH REGULATORY GUIDE FOR TRIAL USE REGULATORY GUIDE 1.178 (Draft was issued as DG-1063)

AN APPROACH FOR PLANT-SPECIFIC RISK-INFORMED DECISIONMAKING INSERVICE INSPECTION OF PIPING A. INTRODUCTION tion of plant piping using risk insights. The Electric During the last several years, both the U.S. Nuclear Power Research Institute (EPRI) published its "PSA Applications Guide" (Ref.14) to provide utilities with Regulatory Commission (NRC) and the nuclear indus-try have recognized that probabilistic risk assessment guidance on the use of PRA information for both regu-latory and nonregulatory applications.The Nuclear En-(PRA) has evolved to be more useful in supplementing traditional engineering approaches in reactor regula-ergy Institute (NEI) has been developing guidelines on risk-based ISI and submitted two methods, one devel-tion. After the publication ofits policy statement (Ref.

1) on the use of PRA in nuclear regulatory activities, the oped by EPRI (Ref.15) and the other developed by the Commission directed the NRC staff to develop a regu-ASME research and the Westinghouse Owners Group latory framework that incorporated risk insights. That (Refs.16-17), for staff review and approval.

I framework was articulated in a November 27,1995, pa-Given the recent initiatives by the ASME in devel-per to the Commission (Ref. 2). This reg.ilatory guide, oping Code Cases N-560, N-577, and N-578, it is an-which addresses inservice inspection of piping (ISI),

with its companion Standard Review Plan, Section ticipated that licensees will request changes to their 3.9.8 of NUREG-0800 (Ref. 3), and other regulatory plant's design, operation, or other activities th'at require documents (Refs. 4-10), implement, in past, the Com-NRC approval to incorporate risk insights into their ISI mission's poh,ey statement and the staff s framework programs (known as risk-informed inservice inspec-forincorporating risk insights into the regulation of nu-tion programs, RI-ISI). Until the RI-ISI is approved clear power plants.

for generic use, the staff anticipates that licensees will request changes to their ISI programs by requesting In 1995 and 1996, the industry developed a number NRC approval cf alternative inspection programs that of documents addressing the increased use of PRA in meet the criteria of 10 CFR 50.55a(a)(3)(i) in Section nuclear plant regulation. The American Society of Me-50.55a, " Codes and Standards," of 10 CFR Part 50, chanical Engineers (ASME) initiated Code Cases

" Domestic Licensing of Production and Utilization Fa-N-560 (Ref.11), N-577 (Ref.12), and N-578 (Ref.13) cilities," providing an acceptable level of quality and that address the importance categorization and inspec-safety. As always, licensees should identify how the USNRC REGU1ATORY GUIDES The guxses are issued in the following ten twoad demmons:

on as methods to the RC s.aff for lho

1. Power Reactors 6 Products a ed and noodedt e in ne sw usts and ten aF Health registed Methodsandsolucons fr setout f des en Plant on 1 General utilbe acceptable if ihey pronde a bass for the fbndings rentaste to tie meuance or con.

Dnuana of a punM or W by the Connuseron Single copies of regulatory guides rney be obtened free of charge by untng the Repro.

Ttus guide was noeued after conaderanon of cornmorts romsved froan the public. Com-ductan and Distnbunon Senness Secnon, Ofrice of the Chief informaban othcar. U.S Nu-l-

monts and suggenbons forimprovements m those guides are encouraged et all kmee, and clear Regulatory Comm#emon, Washington DC 20555-0001, or by tax et (301)415 2289, h) mill be as appropriate, to accommodate comments and to reflect new in-or by e rnal to GRW1@NRC GOV l

E"u"uc. tem"Commia on Es*n"in"g'" " E*2osss' E E " "" " #

• " ~ * '

'oy j:

R ad d

V 9810280034 980930 17 PDR 45%Q

r-tory decisionmaking. In August.1995,,the NRC chosen approach, methods, data, and criteria are ap-adopted a policy statement regarding the expanded use propriate for the decisions they need to make.

@e

pan, p Hey sta emen s a es In October 1997, the Commission Published a draft that-*

of this regulatory guide for public comment. This The use of PRA technology should be in-guide's principal focus is on the use of PRA findings creased in all regulatory matters to the ex-and risk insights in support of proposed changes to a tent supported by the state-of-the-an in plant's design, operations, and other activities that re.

PRA methods and data and in a manner that quire NRC approval. Such changes include (but are not complements the deterministic approach limited to) license amendments under 10 CFR 50.90, and supports the NRC's traditional philoso-requests for the use of alternatives under 10 CFR phy of defense-in-depth.

50.55a, and exemptions under 10 CFR 50.12. This reg.

PRA and associated analyses (e.g., sensi-ulatory guide describes methods acceptable to the NRC tivity studies, uncertainty analyses, and im-staff for integrating insights from PRA techniques with portance measures) should be used in regu-traditional engineering analyses into ISI programs for latory matters, where practical within the piping.

1. ~""'

The draft guide, DG-1063, was discussed durinF 1 necessary conservatism associated with public workshop held on November 20-21,1997, and carent regulatory requirements, regulatory was peer reviewed. While the public comments and guides, license commitments, and staff peer review of the document were positive, the staff has pr ctices. Where appropriate, PRA should not had an opportunity to apply the guidance to indus-be used to support the proposal of adde try's pilot plants.Therefore, this regulatory guide is be-tmnal regulatory requirements in accor-ing issued for trial use on the pilot plants. This regula-dance with 10 CFR 50.109 (Backfit Rule).

tory guide does not establish any final staff positions' Appropriate procedures for including PRA and may be revised m response to experience with its in the process for changing regulatory re-use. As such, this trial regulatory guide does not estab-quirements should be developed and fol-lish a staff position for purposes of the Backfit Rule,10 lowed It is, of course, understood that the CFR 50.109, and any changes to this regulatory guide intent of this policy is that existing rules and prior to staff adoption m final form will not be consid-regulations shall be complied with unless ered to be backfits as defined in 10 CFR 50.109(a)(1).

these rules and regulations are revised.

This will ensure that the lessons learned from regulato-PRA evaluations in support of regulatory ry review of the pilot plants are adequately addressed in decisions should be as realistic as practica-this document and that the guidance is sufficient to en, ble and appropriate supporting data should hance regulatory stability in the review, approval, and be publicly available for review.

implementation of proposed RI-ISI programs.

The Commission's safety goals for nuclear In the interest of optimizing limited resources, the p wer plants and subsidiary numerical ob-appendices that were in DG-1063 will be incorporated jectives are to be used with appropriate con-ir$ a future NUREG report. The appendices have been sideration of uncertainties m making regu-deleted from this guide to focus the NRC staff's limited I tory judgments on the need for proposing resources on the review and approval of the pilot plant and backfitting new generic requirements applications and the topical reports submitted in sup-n nu e r p wer plant Heenses.

port of the pilot plant analyses. Staff positions on the In its approval of the policy statement, the Com-methodologies will be provided in the staff's safety mission articulated its expectation that implementation evaluation of the topical reports and pilot plant submit-of the policy statement will improve the regulatory pro-tals. This process would minimize resources needed to cess in three areas: foremost, through safety decision-update the RG to address the different methods pro.

making enhanced by the use of PRA insights; through posed by the industry.

more efficient use of agency resources; and through a reduction in unnecessary burdens on licensees.

Background

in parallel with the publication of the policy state-During recent years, both the NRC and the nuclear ment, the staff developed a regulatory framework that industry have recognized that PRA has evolved to the incorporates risk insights. That framework was articu-point that it can be used increasingly as a tool in regula-l 1.178 - 2

lated in a. November 27,1995, papei (SECY-95-280)

As a result of the above insights, more efficient and to the Commission. This regulatory guide, which ad-technically sound means for selecting and scheduling dresses lSi programs of piping at nuclear power plants, ISIS of piping are under development by the ASME D is part of the implementation of the Commission's (Refs.11-13).

policy statement and the staff's framework for incorpo-When categorizing piping segments in terms of ratmg nsk msights into the regulation of nuclear power plants. This document uses the knowledge base docu-their contribution to risk, it is the responsibility of a li-mented in Revision 1 of NUREG/CR-6181 (Ref.18),

censee to ensure that the categorization of piping seg-and it reflects the experience gained from the ASME ments and the resultinginspection programs are consis-initiatives (Code Case development and pilot plant ac-tent with the key principles and risk guidelines (e.g.,

tivities).

core damage frequency (CDF) and large early release frequency (LERF)) addressed in Regulatory Guide While the conventional regulatory framework, 1.174 (Ref. 4). This regulatory guide augments the based on traditional engineering criteria, continues to guidance presented in Regulatory Guide 1.174 by pro-serve its purpose in ensuring the protection of public viding guidance specific to mcorporatmg nsk m, sights health and safety, the current information base contains to mservice mspectmn programs of pipmg.

insights gained from over 2000 reactor-years of plant Purpose of the Guide operating experience and extensive research in the Consistent wit areas of matenal sciences, aging phenomena, and m-h %ulatory Guide 1.174 (Ref. 4),

spection techniques. This in formation, combined with

"* ' E"'."I W""E~

E E*E "'

• E*

E*

modern risk assessment techniques and associated es to meeu. '

1. 8 E

'm accep e appm ng data, can be used to develop a more effective approach the existing Sect. ion XI requirements for the scope and to ISI programs for piping.

frequency of inspection of ISI programs. Its use by h-The current ISI requirements for piping compo-censees is voluntarj. Its principal focus is the use of nents are found in 10 CFR 50.55a and the General De-PRA findings and nsk msights for decisions on D These requirements are throughout the General Design sign Criteria listed in Appendix A to 10 CFR Part 50.

changes proposed to a plant's mspection p'ogram for P ping. The current ISI programs are performed in com-i li P ance with the requirements of 10 CFR 50.55a and Criteria, such as in Criterion I, "Overall Require.

with Section XI of the ASME Boiler and Pressure Ves-ments," Criterion II, " Protection by Multiple Fission Product Barriers," Criterion III," Protection and Reac-sel Code, which are part of the plant's licensing basis.

tivity Control Systems," and Criterion IV," Fluid Sys-s appmach provides an acceptable level of quality tems.,,

and safety (per 10 CFR 50.55a(a)(3)(i)) by incorporat-ing insights from probabilistic risk and traditional anal-Section XI of the American Society of Mechanical ysis calculations, supplemented with operating reactor Engineers (ASME) Boiler and Pressure Vessel Code data. Licensees who propose to apply risk-informed ISI (BPVC) (Ref.19) is referenced by 10 CFR 50.55a, pmgr ms w uld amend their final safety analysis re-which addresses the codes and standards for design, p rt (FSAR, Sections 5.3.4 and 6.6) accordingly. A fabrication, testing, and inspection of piping systems.

Standard Review Plan (SRP)(Ref. 3) has been prepared The objective of the ISI program is to identify service-f r use by the NRC staffin reviewing RI-ISI applica-tions.

l induced degradation that might lead to pipe leaks and l

ruptures, thereby meeting, in part, the requirements set This document addresses risked-informed meth-in the General Design Criteria and 10 CFR 50.55a. ISI ods to develop, monitor, and update more efficient ISI programs are intended to address all piping locations programs for piping at a nuclear power facility. This that are subject to degradation. Incorporating risk in-guidance does not preclude other approaches for incor-sights into the programs can focus inspections on the porating risk insights into the ISI programs. Licensees more important locations and reduce personnel expo-may propose other approaches for NRC consideration, sure, while at the same time maintaining or improving it is intended that the methods presented in this guide be public health and safety. The justification for any re-regarded as examples of acceptable practices; licensees D duction in the number ofinspections should address the should have some flexibility in satisfying the regula-issue that an increase in leakage frequency or a loss of tions on the basis of their accumulated plant experience defense in depth should not result from decreases in the and knowledge. This document addresses risk-numbers ofinspections.

informed approaches that are consistent with the basic 1.178 - 3

All Class 1,2, and 31 piping within tl}e current elements identified in Regulatory Guide l.174 (Ref. 4).

In addition, this document provides guidance on the ASME Section XI programs, and All piping whose failure would compromise following for the purposes of RI-ISI.

Safety-related structures, systems, on compo-Estimating the probability of a leak, aleak that pre-vents the system from performing its function (dis-nents that are relied upon to remain f unctional abling leak), and a rupture for piping segments, during and following design basis events to en-sure the integrity of the reactor coolent pres-Identifym.g the structural elements for which ISI sure boundary, the capability to shut down the can be modified (reduced or increased), based on reactor and maintain it in a safe shutdown con-factors such as risk insights, defense in depth, re-dition, or the capability to prevent or mitigate t

duction of unnecessary radiation exposure to per-the consequences of accidents that could result s nnel, n potential offsite exposure comparable to 10 CFR Part 100 guidelines.

Determining the risk impact of changes to ISI pro-a Non-safety relatedstructures,systemsorcom-

grams, ponents Capturing deterministic considerations in the re-That are relied upon to mitigate accidents vised ISI program, and or transients or are used in plant emergen-Developing an inspection program that monitors cy operating procedures; or the perfqnnance of the piping elements for consis-Whose failure could prevent safety-related tency with the conclusica from the n,sk assess-or cge hm u

ment.

fulfilling their safety-related function; or Whose failure could cause a reactor scram Given the recent initiatives by the ASME in devel-or actuation of a safety-related system.

oping Code Cases N-560, N-577, and N-578 (Refs.

For both the partial and full scope evaluations, the 11-13), it is anticipated that licensees will request licensee is to demonstrate compliance with the accep-changes to their plant's design, operation, or other ac-tance guidelines and key pn,nciples of Regulatory tivities that require NRC approval to incorporate risk Guide 1.174 (Ref. 4).

insights in their ISI programs (RI-ISI). Until the RI-ISI The inspection locations of concern include all is approved for generic use, the staff anticipates that li-weld and base metal locations at which degradation censees will request changes to their ISI programs by requestingNRCapprovalof aproposedinspectionpro-may occur, although pipe welds are the usual point of gram that meets the criteria of 10 CFR 50.55a(a)(3)(i),

interest in the inspection program. Within this regula-tory guide, references to " welds" are intended in a providing an acceptable level of quality and safety. The broad sense to address inspections of critical structural licensee's RI-ISI program will be enforceable under 10 locations in general, including the base metal as well as CFR 50.55a.

weld metal. Inspections will often focus on welds be-cause detailed evaluations will often identify welds as Scope of the RI-ISI Program the locations most likely to experience degradation.

This regulatory guide only addresses changes t Welds are inost likely to have fabric stion defects, welds the ISI programs for inspection of piping. To adequate-are often at locations of high stress, and certain de-ly reflect the risk implications of piping failure, both gradation mechanisms (stress corrosion cracking) usu-partial and full-scope RI-ISI programs are acceptable ally occur at welds. Nevertheless, there are other degra-to the NRC staff.

dation mechanisms such as flow-assisted-corrosion (e.g., erosion-corrosion) and thermal fatigue that occur Partial Scope: Alicensee may elect to limit its RI-independent of welds.

ISI program to a subset of piping classes, for example, ASME Class-1 piping only, including piping exempt 1 Generally, ASME Code Class 1 includes all reactor pressure bound-from the current requirements.

ary (RCPB) components. ASME Code Class 2 generally includes sys-i J

tems or portions of systems important to safety that are designed for FullScope: AfullscopeRI-ISIprogramevaluates post accident containment and removalof heat and fission products.

AWE Code Class 3 generally includes those system components or the P P n8 n a P ant as bein8 either hi h or low safety portions of systems important to safety that are designed to provide ii i

l 8

cooling water and auxiliary feedwater for the front-kne systems.

significant. A full scope RI-ISI includes:

1.178 - 4 1

m PRA scope-internal and external event initiators, To ensure that the proposed RI-ISI program would at-power and shutdown modes of operation, con-p provide an acceptable level of quality and safety, the li-sideration of requirements for Level 1,2, and 32 censee should use the PRA to identify the appropriate analyses,.

- scope of the pipmg segments to be included in the pro--

=

~

gram. In addition, licensees implementing the risk-in- -

Risk metrics-core damage frequency, large early release frequency and importance measures, i

formed process may identify piping segments catego-

rized as high safety-significant (IISS) that are not Sensitivity and uncertainty analyses.

)

currently subject to the traditional Code requirements ~

To the extent that a licensee elects to use PRA as an (e.g., outside the Code boundaries, including Code ex-element to enhance or modify its implementation of ac-empt piping) or are not being inspected to a level that is tivities affecting the safety-related functions of SSCs commensurate with their risk significance. In this con-subject to the provisioris of Appendix B to 10 CFR l

text, HSS refers to a piping segment that has a relatively Part 50, the pertinent requirements of Appendix B are high contribution to risk. PRA' systematically takes applicable.

credit for systems with non-Code piping that provide The information collections contained in this doc-support, act as alternatives, and act as backups to those systems with piping that are within the scope of the cur-ument are covered by the requirements of 10 CFR rent "xtion XI of the Code.

Part 50, which were approved by the Office of Manage-ment and Budget (OMB), approval number 3150-0011.TheNRCma notconductorsponsor,and 6 pA "m and Content

~

a person is not required to respond to, a collection ofin-C.a o alatory guide is structured to follow the formation unless it displays a currently valid OMB con-general tour-element process.for risk-informed ap-trol number.

plications discussed in Regulatory Guide 1.174 (Ref.

4). The Discussion section summarizes the four.

Abbreviations and Definitions element process developed by the staff to evaluate pro-ASME American Society of Mechanical Engi-

. posed changes related to the development of a RI-ISI neers program. Regulatory Position 1 discusses an accept-BPVC Boiler and Pressure Vessel Code s

able approach for defining the proposed changes to an CCDF Conditional core damage frequency ISI program. Regulatory Position 2 addresses, in gen-CCF Common cause failure eral, the traditional and probabilistic engineering eval-CDF Core damage frequency uations performed to support RI-ISI programs and pre-CLERF Conditional large early release frequency sents the risk acceptance goals for determining the rt

(

acceptability of the proposed change. Regulatory Posi-p_on 3 presents one acceptable approach forimplement-M & @@ @

ing and monitoring corrective actions for RI-ISI pro-expert elicitation is a process used to esti-grams. The documentation the NRC will need to render mate failure rates or probabilities of pip-

- its safety decision is discussed in Regulatory Position ing when data and computer codes are un-available for the intended purpose. It is a 4.

process used to estimate the failure proba-bility and the associated uncertainties of j

Relationship to Other Guidance Documents the material in question under specified As stated above, this regulatory guide discusses ac-degradation mechanisms. For example, if cePtable approaches to incorporate risk insights into an a structural mechanics code is not quah-ISI program and directs the reader to Regulatory Guide fled to calculate the failure probability of 1.174 and SRP Chapters 19 and 3.9.8 for additional plastic piping and no data are available to i -

guidance, as appropriate. Regulatory Guide 1.174 dc-estimate its failure probability, experts in plastic piping and their failure may be scribes a general approach to risk-informed regulatory asked to estimate the failure probabilities.

decisionmaking and discusses specific topics common If applicable industry data are available, to all risk-informed regulatory applications. Topics ad-an expert elicitation process would not be dressed include:

i needed.

. PRA quality-data, assumptions, methods, peer 2 eve 11-accident sequence analysis. Level 2--accident progression L

review, and source term analysis, and Level 3--offsite consequence analysis.

l 1.178 - 5

RI-ISI Risk-informed inservice 4nspection Expert Panel Normally refers to plant personnel exper-Staff Refers to NRC employees ienced in operations, maintenance, PRA, Sensitivity ISI programs, and other related activities Studies Varying parameters to assess impact due and disciplines that impact the decision to uncertainties under consideration.

SRP Standard Review Plan FSAR Final Safety Analysis Report SRRA Structural reliability / risk assessment (re-HSS High safety significance fers to fracture mechanics analysis)

IGSCC Intergranular stress corrosion cracking SSCs Structures, systems and components Importance Measures Used in PRA to rank systems or compo-Tech Spec Technical specifications nents in terms of risk significance B. DISCUSSION ISI Inservice inspection IST Inservice testing When a licensee elects to incorporate risk insights LERF Large early release frequency into its ISI programs, it is anticipated that the licensee LSS Low safety significance will build upon its existing PRA activities. Figure 1 it-NDE Nondestructive examination lustrates the five key principles involved in the inte-NEI Nuclear Energy Institute grated decisionmaking process; they are desenoed in NRC Nuclear Regulatory Commission detail in Regulatory Guide 1.174 (Ref. 4). In addition, PRA Probabilistic risk assessment Regulatory Guide 1.174 describes a four-element pro-PSA Probabilistic safety assessment cess for evaluating proposed risk-informed changes as RCPB Reactor coolant pressure boundary illustrated in Figure 2.

G.

th%

h ums un$t

1. ~

3. Maintain sufficient se safety margins.

8%P ela to a b change.

V Integrated Decisionmaking 5 %",,8=,l;gaac*

WnN*a".""am'.$

my' -~

";'c'= mat, Ouel Poticy statament.

Figum 1 Principles of Risk-Informed Integrated Decisionmaking Tgaaf rax

\\

,. /

,/'

/./, /

/

,/

\\

\\/

3@8,

._ *l N k"='==ua' tsg

• • 8 Change Analysis p

Figure 2 Principal Elements of Risk Informed, Plant Speciile Decisionmaking 1.178 - 6 j

.=.

l t

The key principles and the section of this guide that scribing the scope of ISI piping that would be meerpo.

i addresses each of these principles for RI-ISI programs rated in the overall assessment and how the inspection of i

q are as follows, this piping would be changed. Also included it this ele-y

1. The proposed change meets the current regulations ment is identification of supporting information and a l

unless it is explicitly related to a requested exemp-Pr Posed plan for the licensee's interactions with the l

tion or rule change. (Regulatory Position 2.1.1)

NRC throughout the implementation of the RI-ISI.

2. The proposed change is consistent with the 1.1 Descdption of Pmposed Changes defense-in-depth philosophy. (Regulatory Positian A full description of the proposed changes in the ISI 2.1.2) program is to be prepared. This description should in-

3. The proposed change maintains sufficient safety clude:

margins. (Regulatory Position 2.1.3)

Identification of the plant's current requirements that 4.

When proposed changes result in an increase in would be affected t ; the proposed RI-ISI program.

l core damage frequency or risk, the increases should To provide a basis from which to evaluate the pro-l be small and consistent with the intent of the Com-posed changes, the licensee should also confirm that l

mission's Safety Goal Policy Statement. (Regula-the plant's design and operation is in accordance with l

tory Position 2.2) its current requirements and that engineering infor-

5. The impact of the proposed change should be mon-mation used to develop the proposed RI-ISI program l

itored by using performance measurement strate-is also consistent with the current requirements.

l gies. (Regulatory Position 3)

Identification of the elements of the ISI program to The individual principles are discussed in detail in be changed.

Regulatory Guide 1.174.

Identification of the piping in the plant that is both di-Section 2 of Regulatory Guide 1.174 describes a rectly and indirectly involved with the proposed four-element process for developing risk-informed reg-changes. Any piping not presently covered in the ulatory changes, An overview of this process is given plant's ISI program but categorized as high safety I

here and illustrated in Figure 2. The order in which the significant (e.g., through an integrated decisionmak-elements are performed may vary or they may occur in ing process using PRA insights) should be identified parallel, depending on the particular application and and appropriately addressed. In addition, the particu-the preference of the program developers. The process f ar systems that are affected by the proposed changes is highly iterative. Thus, the final description of the pro-should be identified since this information is an aid in P anning the supporting engineering analyses.

l posed change to the ISI program as defined in Element I depends on both the analysis performed in Element 2 Identification of the information that will be used to L

and the definition of the implementation of the ISI pro-support the changes. This could include performance gram performed in Element 3. While ISI is, by its na-data, traditional engineering analyses, and PRA in-ture, an inspection and monitoring program, it should formation.

be noted that the monitoring referred to,in Element 3 is A brief statement describing how the proposed

' associated with making sure that the assumptions made l

changes meet the intent of the Commission's PRA about the impact of the changes to the ISI program are Policy Statement.

not invalidated. For example, if the inspection intervals are based on an allowable margin to failure, the moni-1.2 Changes to Appmved RI-ISI Pmgrams toring is performed to make sure that these margins are This section provides guidance on the need for licen-not eroded. Element 4 involves preparing the documen' sees to report program activities and guidance on formal tation to be submitted to the NRC and to be maintained NRC review of changes made to RI-ISI programs.

by the licensee foi later reference.

l The licensee should implement a process for deter-I mining when RI-ISI program changes require formal C. REGULATORY POSITION NRC review and approval. Changes made to the NRC-approved RI-ISI program that could affect the process

]

1.

ELEMENT 1: DEFINE THE PROPOSED and results that were reviewed and approved by the NRC

]

CHANGES TO ISI PROGRAMS staff should be evaluated to ensure that the basis for the In this first element of the process, the proposed staff's approval has not been compromised. All changes changes to the ISI program are defined. This involves de-should be evaluated using the change mechanisms 1.178 - 7

described in the applicable regulations (e.g.,10 CFR the Commission's Safety Goal Policy Statement; 50.55a,10 CFR 50.59) to determine whether NRC re-and I

view and approval are required prior to implementation.

Support the integrated decisionmaking process.

If there is a question regarding this issue, the licensee The scope and quality of the engineering analyses should seek NRC review and approval prior to imple.

performed to justify the changes proposed to the ISI i

mentation.

programs should be appropriate for the nature and

2. ELEMENT 2: ENGINEERING ANALYSIS scope of the change. The decision criteria associated with each key principle identified above are presented As part of defining the proposed change to the licens-in the following subsections. Equivalent criteria can be ee's ISI program, the licensee should conduct an engi-pr p sed by the licensee if such criteria can be shown to neering evaluation of the proposed change, using and in-meet the key principles set forth in Section 2 of Regula-tegrating a combination of traditional engineering tory Guide 1.174.

methods and PRA. The major objective of this evaluation is to confirm that the proposed program change will not 2.1 Traditional Engineering Analysis compromise defense in depth, safety margins, and other This part of the evaluation is based on traditional key principles described in this guide and in Regulatory engineering methods. Areas to be evaluated from this Guide 1.174 (Ref. 4). Regulatory Guide 1.174 provides viewp int include meeting the regulations, defense-in-general guidance for performing this evaluation, which depth attributes, safety margins, assessment of failure is supplemented by the RI-ISI guidance herein.

potential of piping segments, and assessment of pn-mary and secondary effects (failures) that result from piping failures.

l The engineering analysis for a RI-ISI piping pro-

• g in

/

gram will achieve the following:

jI/

s

\\

/

j ff

1. Assess compliance with applicable regulations,

/

g 2.

Perform defense in-depth evaluation, W

3.

Perform safety margin evaluation, 4.

Define piping segments,

5. Assess failure potential for the piping segment Figuir 3 Element 2 (from leaks to breaks),

6.

Assess the cohsequences (both direct and indirect) of iping segment failure, The regulatory issues and engineering activities P

that should be considered for a risk-informed ISI pro-

7. Categorize the piping segments in terms of safety gram a:e summarized here. For simplicity, the discus-(risk) significance, sions are divided into traditional and PRA analyses (see 8.

Develop an inspection program, Figure 3). Regulatory Position 2.1 addresses the tradi-9.

Assess the impact of changing the ISI program on tional engineering analysis, Regulatory Position 2.2 CDF and LERF, and addresses the PRA-related analysis, and Regulatory Position 2.3 describes the integration of the traditional

10. Demonstrate conformance with the key principles and PRA analyses. In reality, many facets of the tradi-(e.g., maintaining sufficient safety margins, de-tional and PRA analyses are iterative, fense in depth consideration, Commission's Safety

'I'

• The engineering evaluations are to:

2.1.1 Assess Compliance with Applicable Demonstrate that the change is consistent with the Regulations defense-in-depth philosophy; The engineering evaluation should assess whether Demonstrate that the proposed change maintains the proposed changes to the ISI programs would com-I sufficient safety margins; promise compliance with the regulations. The evalua-Demonstrate that when proposed changes result in tion should consider the appropriate requirements in an increase in core damage frequency or risk, the the licensing basis and applicable regulatory guidance.

f increase is small and consistent with the intent of Specifically, the evaluation should consider:

1.178 - 8 I

i

C 10 GFR 50.55a vidually-and cumulatively) is consistent with the Appendix A to 10 CFR Part 50_

defense-in-depth philosophy. In this regard, the intent C

of this key principle is to ensure that the philosophy of Criterion I, "Overall Requirements" defense-in-depth is maintained, not to prevent changes Criterion II," Protection of Multiple Fission in the way defense in-depth is achieved. The defense-Product Barriers" in-depth philosophy has traditionally been applied in reactor design and operation to provide multiple means Criterion III," Protection and Reactivity Con-to accomplish safety functions and prevent the release

. trol Systems" of radioactive material. It has been and continues to be

- Criterion IV," Fluid Systems," etc an effective way to account for uncertainties in equip-ment and human performance. Where a comprehensive s ASME Boiler and Pressure Vessel Code, Section risk analysis can be done, it can be used to help deter-

XI(10 CFR Part 50.55a)-

mine the appropriate extent of defense-in-depth (e.g.,

' Regulatory Guide 1.84 (Ref. 20)

. balance among core damage prevention, containment failure, and consequence mitigation) to ensure protec-

• -- Regulatory Guide 1.85 (Ref. 21) tion of public health and safety. Where a comprehen-

)

Regulatory Guide 1.147 (Ref. 22) sive risk analysis is not or cannot be done, traditional Appendix B to 10 CFR Part 50.

defense-in-depth consideration should be used or main-tained to account for uncertainties. The evaluation In addition, the evaluation should consider wheth-should consider the intent of the general design criteria,

. er the proposed changes have affected license commit-national standards, and engineering principles such as ments. A broad review of the licensing requirements the single failure criterion. Further, the evaluation and commitments may be necessary because proposed should consider the impact of the proposed change on ISI program changes could affect issues not explicitly barriers (both preventive and mitigative) to core dam.

stated in the licensee's FSAR or ISI program documen-ige, containment failure or bypass, and the balance n

tation.

among defense-in-depth attributes. The licensee should The Director of the Office of Nuclear Regulation is select the engineering analysis techniques, whether s

allowed by 10 CFR 50.55a to authorize alternatives to quantitative or qualitative, appropriate to the proposed i

the specific requirements of this regulation provided change (see Regulatory Guide 1.174, Reference 4, for the proposed alternative will ensure an acceptable level addtional guidance).

of quality and safety. Thus, alternatives to the accept-An important element of defense in depth for RI-1 able RI-ISI approaches presented in this guide may be ISI is maintaining the reliability of independent barri-proposed by licensees so long as supporting informa-ers to fission product release. Class 1 piping (primary tion is provided that demonstrates that the key prin-coolant system)is the second boundary between the ra-

)

ciples discussed in this guide are maintained.

. dioactive fuel and the general public. If a RI-ISI pro-The licensee should include in its RI-ISI program gram categosed, for example, all the hot and cold legs submittal the necessary exemption requests, technical f the primary system piping as LSS and calculated specification amendment requests (if applicable), and that, with no inspections, the frequency of leaks would

- relief requests necessary to implement its RI-ISI pro-n tincreasebeyondexistingperformancehistoryof the ASME Code, the staff would continue to require some L

8'"* '

level of NDE inspection.

NRC-endorsed ASME Code Cases that apply risk-informed ISI programs will be consistent with this reg.

2.1.3 Safety Margins l

ulatory guide in that they encourage the use of risk in-In engineering programs that affect public health sights in the selection of inspection locations and the and safety, safety margins are applied to the design and use of appropriate and possibly enhanced inspection operation of a system. These safety margins and accom-techniques that are appropriate to the failure mecha-panying engineering assumptions are intended to ac-

. nisms that contribute most to risk.

count for uncertainties, but in some cases can lead to I

operational and design constraints that are excessive O

2.1.2 Defense-in Depth Evaluation and costly, or that could detract from safety (e.g., re, ult As stated in Regulatory Guide 1.174 (Ref. 4), the in unnecessary radiation exposure to plant personnel).

engineering analysis should evaluate whether the im-Insufficient safety margins may require additional pact of the proposed change in the ISI program (indi-attention. Prior to a request for relaxation of the existing 1.178 - 9

requirements, the licensee must ensure that the uncer-could encompass multiple criteria, as*long as.a sound j

tainties are adequately addressed. The quantification of engineering and accounting record is maintained and uncertainties would likely require supporting sensitiv.

can be applied to an engineering analysis in a consistent and sound process. Consequences of failure may be de-ity analyses, fined in terms of an initiating event, loss of a particular The engineering analyses should address whether I'*I"' I ss of a system, or combmations thereof. The the impacts of the changes proposed to the ISI program I cation of the p,piag m the plant, and whether mside or i

are consistent with the key principle that adequate utside the con'ainment or compartment, should be safety margins are maintained. The licensee is expected taken mto consideration when defining piping seg-to select the method of engineering analysis appropri-ments.

ate for evaluating whether sufficient safety margins would be maintained if the proposed change were im-The definition of a piping segment can vary with plemented. An acceptable set of guidelines for making the methodology. Defining piping segments can be an that assessment are summarized below. Other equiva-iterative process. In general, an analyst may need to lent decision criteria could also be found acceptable.

modify the description of the piping segments before they are finalized. This guide does not impose any spe-g Sufficient safety margins are maintained when:

cific definition of a piping segment, but the analysis Codes and standards (see Regulatory Position and the definition of a segment must be consistent and 2.1.1) or alternatives approved for use by the NRC technically sound.

are met, and 2.1.5 Assess Piping Failum Potential Safety analysis acceptance criteria in the licensing basis (e.g., updated FSAR, supporting analyses)

The engineering analysis includes evaluating the are met, or proposed revisions provide sufficient failure potential of a piping segment. Figure 4 identifies margin to account for analysis and data uncer-the three means for estimating the failure potential of a tainty.

piping segment: data, fracture mechanics computer codes, and the expert elicitation process. Determining 2.1.4 Piping Segments the failure potential of piping segments, either with a A systematic approach should be applied when quantitative estimate or by categorization into groups, analyzing piping systems. One acceptable approach is should be based on an understanding of degradation to divide or separate a piping system into segments; dif-mechanisms, operational characteristics, potential dy-ferent criteria or definitions can be applied to each pip-namic loads, flaw size, flaw distribution, inspection pa-ing segment. One acceptable method is to identify seg-rameters, experience data base, etc. The evaluation ments of piping within the piping systems that have the should state the appropriate definition of the failure same consequences of failure. Other methods could potential (e.g., failure on demand or operating failures subdivide a segment that exhibits a given consequence associated with the piping, with the basis for the defini-into segments with similar degradation mechanisms or tion) that will be needed to support the PRA or risk as-similar failure potential. The definition of a segment sessment. The failure potential used in or in support of ESTIMATING' FAILURE'POTENTTAI

@:h (FNACTUREO bN E C gDATAy MECHANICS i 7 PROCESS 1 Qf

%g CODESM l(IFNEEDED) 3

-qgy 4

Figum 4 Estimating Failure Potential of Piping Segments 1

1.178 - 10 i

i the analysis shobld be appropriate for the specific envi-for leaks, disabling leaks, and breaks, the failure poten-ronmental conditions, degradation mechanisms, and tial for all three break types should be addressed.

failure modes for each piping location and break size I(

(e.g., leak, disabling leak, break). When data are ana-2.1.6 Assess Consequences of Piping Segment

~

lyzed to develop a categorization process relating de.

Failums gradation mechanisms to failure potential, the data When evaluating the risk from piping failures, the should be appropriate and publicly available. When an analyst needs to evaluate the potential consequences, or elicitation of expert opinion is used in conjunction failures, that a piping failure can initiate.This can be ac-l_

with, or in lieu of, probabilistic fracture mechanics complished by performing a detailed walkdown of a analysis or operating data, a systematic process should nuclear power facility's piping network. Assessment of be developed for conducting such an elicitation. In such internal and external events, including resulting pri-cases, a suitable team of experts should be selected and mary and secondary effects of piping failures (e.g.,

trained (Ref. 23,24).

leaks, disabling leaks, and breaks) are important pa-rameters to the risk-informed program (see Figure 5).

To understand the impact of specific assumptions Leaks can result in failures of electrical components or models used to characterize the potential for piping caused by jet impingement. Disabling leaks and full failure, appropriate sensitivity or uncertainty studies breaks can lead to a loss of system function, flooding-should be performed. These uncertain @ Nelude, but induced damage, and initiating events. Full breaks can are not limited to, design versus fabrica'.Mn differences, lead to damage resulting from pipe whip, as well as variations in material properties and strengths, effects flooding and initiating events. Each of these break _

of various degradation and aging mechanisms, varia-types has its associated failure potential that is evalu-tion in steady-state and transient loads, availability and ated in Regulatory Position 2.1.5. A failure modes and accuracy of plant operating history, availability ofin-consequence assessment is performed to identify the spection and maintenance program data, applicability potential failures, from piping leaks to breaks. Internal and size of the data base to the specific degradation and flooding PRAs can identify the impact of jet impinge-p piping, and the capabilities of analytic methods and ment and flooding to the RI-ISI program. The failures

(

models to predict realistic results. Evaluation of these are used as input to the risk analysis. Alternative meth-uncertainties provides insights to the input parameters ods for evaluating consequences should be submitted that affect the failure potential, and therefore require to the NRC for review and approval. These evaluations careful consideration in the analysis.

are expected to provide information for the conse-quence analysis. They are not intended to be used in The methodology, process, and rationale used to lieu of the plant licensing basis, determine the likelihood of failure of piping segments 2.1.7 Probabilistic Fractum Mechanics Evaluation should be independently reviewed during the final clas-

' sification of the risk significance of each segment. Ref-When implementing probabilistic fracture me-erencing applicable generic topical reports approved by chanics computer programs that estimate structural the NRC is one acceptable means to standardize the reliability and are used in risk assessment of piping, or process. This review should be documented and a sum-other analytic methods Or estimating the failure poten-

- mary discussion of the review should be included in the tial of a piping segment, some of the important parame-submittal. When new computer codes are used to de-ters that need to be assessed in the analysis include the velop ouantitative estimates, the techniques should be identification of structural mechanics parameters, deg-verified and validated against established industry radation mechanisms, design limit considerations, op-codes and available data. When data are used to evalu-erating practices and environment, and the develop-ate the likelihood of piping failures, the data should be ment of a data base or analytic methods for predicting submitted to the NRC or referenced by an NRC ap-the reliability of piping systems. Design and opera-(

_ proved topical report. As stated in Regrlatory Guide tional stress or strain limits are assessed. This informa-1.174 (Ref. 4)," data, methods, and assessment criteria tion is available to the licensee in the design informa-used to support regulatory decisionmaking must be tion for the plant. The loading and resulting stresses or

[

scrutable and available for public review."It is the re-strains on the piping are needed as input to the calcula-sponsibility of the licensee to provide the data, meth-tions that predict the failure probability of a piping seg-

[

ods, and justification to support its estimation of the ment. The use of validated computer programs, with l

failure potential of piping segments. Since conse-appropriate input, is strongly recommended in a quanti-quences of and potential for piping failures could differ tative RI-ISI program because it may facilitate the 1.178 - 11 I

. m y

1

LEAKIBREAK CONSEQUENCES Leak Effects from Jet Impingement Disabling Leak or Full Bnak Loss of System Function Disabling Leak (plant trip) or Initiating Event Full Break Disabling Leak or Full Bnak Effects from Flooding Full Break Effects from Pipe Whip Figun 5 Mapping of Probabilities and Consequences for RI-ISI Analysis regulatory evaluation of a submittal. The analytic tant element in ensuring this quality. The licensee's method should be validated with applicable plant and submittal should discuss measures used to ensure ade-industry piping performance data, quate quality, such as a report of a peer review (when performed) that addresses the appropriateness of the PRA model for supporting a risk assessment of the 2.2 Probabilistic Risk Assessment change under consideration. The report should address In accordance with the Commission's policy on any limitations of the analysis that are expected to im-PRA, the risk-informed application process is intended pact the conclusion regarding the acceptability of the not only to support relaxation (number ofinspections, proposed change. The licensee's resolution of the find-inspection intervals and methods), but also to identify ings of the peer review, certification, or cross compari-areas where increased resources should be allocated t son, when performed, should also be submitted. This enhance safety. Therefore, an acceptable RI-ISI pro-response could indicate whether the P RA was modified cess should not focus exclusively on areas in which re-or could justify why no change to the PRA was neces-duced inspection could be j,ustified. This section ad-sary to supgrt decisionmaking for the change under dresses ISI-specific considerations in the PRA t consideration.

support relaxation of inspections, enhancement of in-spections, and validation of component operability.

2.2.1 Modeling Piping Failums in a PRA The scope of a RI-ISI program, therefore, should in-Input from the traditional engineering analysis ad-clude a review of Code-exempt piping for partial or dressed in Regulatory Position 2.1 includes identifica-full-scope programs and the review of non-Code piping tion of piping segments from the point of view of the for full-scope RI-ISI programs.

failure potential (degradation mechanisms) and conse-quences (resulting failure modes and consequential pri-The general methodology for using PRA in regula.

mary and secondary effects). The traditional analysis tory applications is discussed in Regulatory Guide identifies both the primary and secondary effects that 1.174. The PRA can be used to categorize the piping can result from a piping failure, such as a leak, disabling segments into HSS and LSS classification (or more leak, and a break. The assessment of the primary and classifications, if a finer graded approach is desired) secondary failures identifies the portions of the PRA and to confirm that the change in risk caused by the that are affected by the piping failure.

change in the ISI program is in accordance with the guidance of Regulatory Guide 1.174 (Ref. 4).

Each pipe segment failure may have one of three types ofimpacts on the plant.

If a licensee elects to use PRA to enhance or modify its activities affecting the safety-related functions of

1. Initiating event failures when the failure directly causes a transient and may or may not also fail one SSCs subject to the provisions of Appendix B to 10 CFR Part 50, the pertinent requirements of Appen.

or more plant trains or systems.

dix B will also apply to the PRA. In this context, there-

2. Standby failures are those failures that cause the j

fore, a licensee would be expected to control PRA ac-loss of a train or system but which do not directly tivity in a manner commensurate with its impact on the cause a transient. Standby failures are character-i facility's design and licensing basis and in accordance ized by train or system unavailability that may re-r with all applicable regulations and its QA prugram de-quire shutdown because of the technical specifica-scription. An independent peer review can be an impor-tions or limiting conditions for operation.

1.178 - 12

3.

Demand f tilures are failures accompanying a de-provide a discussion and justification of the ranges se-mand for a train or system and are usually caused lected. The use of ranges instead of individual results a

by the transient-induced loads on the segment dur-estimates may require fewer calculations, but the cate-ing system startup.

gorization process and decision criteria should be justi-The impact of the pipe segment failure on risk fled, well defined, and repeatable.

j should be evaluated with the PRA. Evaluation may in.

2.2.1.1 Dependencies and Common Cause Fall-l volve a quantitative estimate derived from the PRA, a ures. The effects of dependencies and common cause systematic technique to categorize the consequence of failures (CCFs) for ISI components need to be consid-the pipe failure on risk, or some combination of quanti.

ered carefully because of the significance they can have fication and categorization. If a segment failure were to on CDF. Generally, data are insufficient to produce l

lead to plant transients and equipment failures that are lP ant-specific estimates based solely on plant-specific not at all represented in the PRA (a new and specific ini-data. For CCFs, data from generic sources may be re-tiating event, for example), the evaluation process quired.

l should be expanded to assess these events.

2.2.1.2 Human Reliability Analyses To Isolate PRAs normally do not include events that repre-Piping Baraks. For ISI-specific tnalyses, the human sent failure ofindividual piping segments nor the struc-reliability analysis methodology used in the PRA must tural elements within the segments. A quantitative esti-account for the impact that the piping segment break mate of the impact of segment failures can be done by w uld have on the operator's ability to respond to the

{

modifying the PRA logic to systematically and ex-event. In addition, the reliability of the inspection pro-l plicitly include the impact of the individual pipe seg-gr m (including both operator and equipment qualifi-ment failures. The impact of each segment's failure on cation), which factors into the probability of detection, should also be addressed.

risk can also be estimated without modifying the PRA's logic by identifying an initiating event, basic event, or 2.2.2 Use of PRA for Categorizing Piping L

group of events, already modeled in the PRA, whose Segments y

failures capture the effects of the piping segment's fail-Once the impact of each segment's failure on plant ure (referred to as the surrogate approach). In either risk metrics has been determined, the safety signifi-A case, to assess the impact of a particular segment fail-cance of the segments is developed. The method of l

ure, the analyst sets the appropriate events to a failed categorizing a piping segment can vary. For example,if state in the PRA (by assigning them a frequency or the pipe failure event frequency or probability are esti.

probability of 1.0) and requantifies the PRA or the ap-mated by structural mechanics methods as discussed in propriate parts of the PRA as needed. The requantifica-Regulatory Position 2.1.5 and the events are incorpo-tion should explicitly address truncation errors, since rated into the PRA logic model, importance measure 1-cut set or truncated sequences may not fully capture the calculations and the determination of safety signifi-impact of multiple failure events. This yields condi-cance, as discussed in Regulatory Guide 1.174 and SRP l

tional CDF (CCDF) and conditional LERF (CLERF)

Chapter 19 (Refs. 4 and 8), may be performed. Alterna-estimates when the segment failure would trip the tively,if a CCDF, CLERF, CCDP, or CLERP (depend-plant, and conditional core damage probabilities ing on the impact the segment failure has on the plant)

(CCDP) and conditional large early release probabili-are estimated for each segment from the PRA, a CDF ties (CLERP) when the segment failure would not trip and LERF caused only by pipe failures may be devel-the plant-oped by combining the conditional consequences and If a systematic technique is used to categorize the segment failure probabilities or frequencies external to i

consequence of pipe failures, it should also be based on the PRA logic model. Importance measures can also be PRA results. In this case, however, the categories may developed using these results and these measures be represented by ranges of conditional results, and compared to appropriate threshold criten,a to support instead of quantifying the impact of each segment fail-the determination of the safety significance of each seg-ure, the process should provide for determining which ment. The calculations used in such a process should range L tch segment's failure would lie within. In gen-yield well defined estimates of CDF, LERF, and impor-i eral, the consequences would range from high, for those tance measures. The licensee should provide a discus-i

,s segments whose failure would have a high likelihood of si n of and justification for the threshold critena used.

leading to core damage or large early release, to low for As discussed in Regulatory Position 2.2.1, the con-those segments whose failure would likely not lead to sequence of segment failures may be represented by j

core damage or large early release. The licensee should categories of consequences instead of quantitative l

i 1.178 - 13

estimates for each segment. In this case, the potential The method for selecting the number of piping ele-I for pipe failure as discussed in Regulatory Position ments to be inspected should be justified.

2.1.5 would also be developed as categories ranging

3. ELEMENT 3: IMPLEMENTATION, from high to low depending on the degradation mecha-PERFORMANCE MONITORING, AND nisms present and the corresponding likelihood that the CORRECTIVE ACTION STRATEGIES segment will fail. These consequence and failure likelt-hood categories should be systematically combined to Integrating the information obtained from Ele-ments 1 and 2 of the RI-ISI process (as described in develop categories of safety significance. The licensee should provide a discussion and justification relating Regulatory Positions 1 and 20f this guide), the licensee the consequence and failure likelihood categories to the develops proposed RI-ISI implementation, perfor-safety-significant category assigned to each combina.

mance monitoring, and corrective action strategies.

The RI-ISI program should identify piping segments tion.

whose inspection strategy (i.e., frequency, number of The safety-significance category of the pipe seg-inspections, methods, or all three) should be increased ment will help determine the level of inspection effort as well as piping segments whose inspection strategies devoted to the segment. In general, higher safety-might be relaxed. The program should be self-correct-significant segments will receive more inspections and ing as experience dictates. The program should contain more demanding inspections than less significant seg-performance measures used to confirm the safety in-ments. In any integrated categorization process, the sights gained from the risk analyses.

principles in Regulatory Guide 1.174 need to be ad-Upon approval of the RI-ISI program, the licensee dressed. Irrespective of the method used in the analysis, should have in place a program for inspecting all HSS the licensee needs tojustify the final categorization pro-and LSS piping identified in its program. (Note that ref-cess as being robust and reasonable with respect to the erence to HSS piping is broadened when implementing analysis uncertainties.

a more detailed graded categorization process, such as low, medium, and high safety significant. For discus-2.2.3 Demonstrate Change in Risk Resulting from sion purposes, a two-category process (e.g., HSS and l

Change in ISI Program LSS) will be assumed. Requirements for medium and l

LSS piping will be addressed on a case-by-case basis.)

Any change in the ISI program has an associated The number of required inspections should be a product risk impact. Evaluation of the change in risk may be a f the systematic application of the risk-informed pro-detailed calculation or it may be a bounding estimate cess.

l supported by sensitivity studies as appropriate. The change may be a risk increase, a risk decrease, or risk 3.1 Program Implementation neutrality. The change is evaluated and compared with A licensee should have in place a schedule for in-the guidelines presente, in Regulatory Guide 1.174.

specting all segments categorized in its RI-ISI program The staff expects that a ll-ISI program would lead to

".s LSS and HSS. This schedule should include inspec-both risk reduction and reduction in radiation exposure ti n strategies and inspection frequencies, inspection to plant personnel.

methods, the sampling program (the number of ele-ments/ areas to be inspected, the accep.ance criteria, 2.3 Integrated Decisionmaking etc.) for the HSS piping that is within the scope of the ISI pr gr m, including piping segments identified as Regulatory Positions 2.1 and 2.2 address the ele-HSS that are not currently in the ISI program.

ments of traditional analysis and PRA analysir

.RI-ISI program. These elements are part of an integrated The analysis for a RI-ISI program will, in most decisionmaking process that assesses the acceptability cases, confirm the appropriateness of the inspection in-of the program. The key principles of Regulatory Guide terval and scope requirements of the ASME Boiler and 1.174 (Ref. 4), as highlighted in Figure 1, are systemat-Pressure Vessel Code (B&PVC)Section XI Edition ically addressed. Technical and operations personnel at and Addenda committed to by a licensee in accordance the plant review the infoimation and render a finding of with 10 CFR 50.55a. The requirements for these inter-l HSS or LSS categorization for each piping segment un-vals are contained in Section XI of the B&PVC. How-I der review. Detailed guidelines for the categorization of ever, should active degradation mechanisms surface, i

I piping segments should be developed and discussed the inspection interval would be modified as appropri-with the group responsible for the determination (typi-ate. Updates to the RI-ISI program should be per-cally performed by the plant's expert panel).

formed at least periodically to coincide with the 1

1.178-i i i

inspection program requirement.s contained in Section dures to update the PRA (which may be more restrictive XI under inspection Program B. The RI-ISI program than a Section XI period type update) or as new de-should be evaluated periodically as new information gradation mechanisms are identified.

A becomes available that could impact the ISI program.

For example, if changes to the PRA impact the deci-3.2.2 Changes to Plant Design Features sions made for the RI-ISI program, if plant design and As changes to plant design are implemented, operations change such that they impact the RI-ISI pro-changes to the inputs associated with RI-ISI program gram, if inspection results identify unexpected flaws, segment definition and element selections may occur. It or if replacement activities impact the failure potential is important to address these changes to the inputs used of piping, the effects of the new information should be in any assessment that may affect resultant pipe failure assessed. The periodic evaluation may result in updates Potentials used to support the RI-ISI segment defini-to the RI-ISI program that are more restrictive than re.

tion and element selection. Some examples of these in-quired by Section XI. As plant design feature changes puts would inchsde:

2 are mplemented, changes to the input associated with Operating characteristics (e.g., change ~ in water i

the RI-ISI program segment definition and element chemistry control) selections should be reviewed and modified as needed.

Changes to piping performance, the plant procedures Material and configuration changes Welding techniques and procedures that can affect system operating parameters, piping in-spection, component and valve lineups, equipment op-Construction and preservice examination results erating modes, or the ability of the plant personnel to perform actions associated with accident mitigation Stress data (operating modes, pressure, and tem-should be reviewed in any RI-IS! program update.

Perature changes) l Leakage and flaws identified during scheduled inspec.

In addition, plant design changes could result in i

tions should be evaluated as part of the RI-ISI update, significant changes to a plant's CDF or LERF, which in Piping segments categorized as HSS that are not in turn could result in a change in consequence of failure f r system pipmg segments.

D the licensee's current ISI program should (wherever ap-propriate and practical) be inspected in accordance wPh 3.2.3 Changes to Plant Pn>ceduns applicable ASME Code Cases (or revised A#ME Changes to plant procedures that affect ISI, such as Code), including comphance with all admtmstrative system operating parameters, test intervals, or the abil-requirements. Where ASME Section XI inspection is ity of plant operations personnel to perform actions as'-

not practical or appropriate, or does not conform to the sociated with accident mitigation, should be included key principles identified in this document, alternative for review in any RI-ISI program update. Additionally, inspection mtervals, scope, and methods should be de-changes in those procedures that affect component in-veloped by the licensee to ensure piping integrity and t spection intervals, valve lineups, or operational modes l

detect piping degradation. A summary of the piping of equipment should also be assessed for their impact l

segments and their proposed inspection intervals and on changes in postulated failure mechanism initiation scope should be provided to the NRC prior to imple-or CDF/LERF contribution.

i mentation of the RI-ISI program at the plant.

3.2.4 Equipment Performance Changes For piping segments categorized as IISS that were the subject of a previous NRC-approved relief request Equipment performance changes should be re-or were exempt under existing Section XI criteria, the viewed with system engineers and maintenance per-licensee should assess thc appropriateness of the relief sonnel to ensure that changes in performance parame-or exemption in light of the risk significance cf the pip.

ters such as valve leakage, increased pump testing, or ing segment, identification of vibration problems is included in the periodic evaluation of the RI-ISI program update. Spe-3.2 Performance Monitoring cific attention should be paid to these conditions if they were not previously assessed in the qualitative inputs to 3.2.1 Periodic Updates the element selections of the RI-ISI program, n

The RI-ISI program should be updated at least on i

the basis of periods that coincide with tbe inspection 3.2.5 Examination Results El program requirements contained in Section XI under When scheduled RI-ISI program NDE examina-Inspection Program B. These updates should be per-tions, pressure ' tests, and corresponding VT-2 visual l

formed more frequently if dictated by any plant proce-examinations for leakage have been completed, and if l

l 1.178 - 15 l

1

unacceptable flaws, evidence of service related degra-1.

The evaluation of the implementation program will dation, or indications of leakage have been identified, be based on the attributes presented in Regulatory the existence of these conditions should be evaluated.

Positions 3.1 through 3.3 of this Regulatory Guide 1.178.

This update of the RI-ISI program should follow the applicable elements of Appendix B to 10 CFR Part 50

2. The corrective action program should provide rea-

[

to determine the adequacy of the scope of the inspection sonable assurance that a nonconforming compo-nent will be brought back into conformance, in a l

program.

timely fashion. The corrective actions required in 3.2.6 Information on Individual Plant and ASME Section XI should continue to be fc.llowed.

Industry Failures

3. Evaluations within the corrective action program Review of individual plant maintenance activities may also include:

associated with repairs or replacements, including Ensuring that the root cause of the condi-identified flaw evaluations, is an important part of any tion is determined and that corrective ac-periodic update, regardless of whether the activity is the tions are taken to preclude repetition.The result of a RI-ISI prog:am examination. Evaluating identification of the significant condition this information as it relates to a licensee's plant pro-adverse to quality, the cause of the condi-vides failure information and trending information that tion, and the corrective action are to be may have a profound effect on the element locations documented and reported to appropriate currently being examined under a RI-ISI program. In-levels of management.

dustry failure data isjust as important to the overall pro-Determining the impact of the failure or gram as the owner's information. During the periodic nonconformance on system or train oper-update, industry data bases (including available inter-ability since the previous inspection.

national data bases) should be reviewed for applicabil.

Assessing the applicability of the failure ity to the owner's plant.

or nonconforming condition to other 3.3 Corrective Actioa Programs components in the RI-ISI program.

Correcting other susceptible RI-ISI com-Each licensee of a nuclear power plant is responsi-ble for having a corrective action program, consistent ponents as necessary, with Regulatory Guide 1.174 (Ref. 4). Measures are to Incorporating the lessons in the plant data be established to ensure that conditions adverse to qual-base and computer models,if appropriate.

ity, such as failures, malfunctions, deficiencies, devi-Assessing the validity of the failure rate ations, defective material and equipment, and noncon.

and unavailability assumptions that can formances, are promptly identified and corrected. In result from piping failures used in the the case of significant conditions adverse to quality, the PRA or in support of the PRA, and measures must ensure that the cause of the condition is Considering the effectiveness of the com-determined and corrective action is taken to preclude repetition. The identification of the significant condi-ponent's inspection strategy in detecting tion adverse to quality, the cause of the condition, and the failure or nonconforming condition, the corrective action are to be documented and reported The inspection interval would be reduced to appropriate levels of management.

or the inspection methods adjusted, as ap.

pr priate, when the component (or group For Code piping categorized as IISS, this correc-f C mPonents) experiences repeated fail-tive action program should be consistent with applica, ures r n neonforming conditions.

ble Section XI provisions. For non-Code and Code-4.

The corrective action evaluation should be pro-exempt piping categorized as llSS, appropriate Section vided to the licensee's PRA and RI-ISI groups so XI provisions should also be used, or the licensee that any necessary model changes and regrouping should submit an alternative program based on the risk are done, as appropriate.

I significance of the piping.

5. The RI-ISI program documents should be revised 3.4 Acceptance Guidelines to document any RI-ISI program changes resulting i

from the corrective actions taken.

These acceptance guidelines are for the imple, mentation, monitoring, and corrective action programs 6.

A program is in place that monitors industry find-for the accepted RI-ISI program plan.

ings.

l 1.178 - 16

7.

Piping is subject to examination. The examination tal. References to NRC-approved generic topical re-requirements include all piping evaluated by the ports that address the methodology and issues 7

risk-informed process and categorized as high requested'il a submittal are acceptable. Since topical j

safety significant, reports could cover more issues than applied by a li-8.

The inspection program is to be completed during censee or the licensee n x, elect to deviate from the full each ten-year inspection interval with the follow-body ofissues addressed in the topical report, such dis-ing exceptions.

tinctions should be clearly stated. If a licensee refer-ences a topical report that has not been approved by the 8.1 If, during the interval, a reevaluation using the NRC, the time required to review the submittal may be RI-ISI process is conducted and scheduled delayed.

items are no longer required to be examined, these items may be eliminated.

The following items should be included in the ap-P cation to implement a RI-ISI program.

li 8.2 If, during the interval, a reevaluation using the RI-ISI process is conducted and items must be added to the examination program, those items A request to implement a RI-ISI program as an au-thorized alternative to the current NRC endorsed will be added.

ASME Code pursuant to 10 CFR 50.55a(a)(3)(i).

9.

Locations selected for successive and additional The licensee should also provide a description of inspections should be subjected to successive and how the proposed change impacts any commit-additional examinations consistent with Section XI ments made to the NRC.

requirements at appropriate intervals.

10. Examination and Pressure Test Requirements.

Detailed discussions on each of the following five Pressure testing and VT-2 visual examinations are key principles of risk-informed regulations (see to be performed on Class 1,2, and 3 piping systems Section 2 of Regulatory Guide 1.174 (Ref. 4) for in accordance with Section XI, as specified in the more details).

licensee's ISI program. The pressure testing and

1. The proposed change meets the current regula-r3 VT-2 examinations are also to be performed on tions unless it is explicitly related to an alterna-

)

non-Code IISS piping and on non-Code LSS pip-tive requested under 10 CFR 50.55a(a)(3)(i), a

'O ing with high failure potential.

requested exemption, or a rule change.

Examination qualification and methods and per-

2. The proposed change is consistent with the de-sonnel qualification are to be in accordance with the edition and addenda endorsed by the NRC fense-in-depth philosophy (see detailed dis-through 10 CFR 50.55a," Codes and Standards."

cussions in Section 2.2.1.1 of Regulatory Guide L174).

11. Acceptance standards for identified flaws and re-pair or replacement activities are to be performed in

3. The proposed change mam. tams sufficient accordance with the B&PVC Section XI require-safety margins (see detailed discussions in ments.

Section 2.2.1.2 in Regulatory Guide 1.174).

12. Records and reports should be prepared and main-4.

When proposed changes result in an increase in tained in accordance with the B&PVC Section XI core damage frequency and/or risk, the in-Edition and Addenda as specified in the licensee's creases should be small and consistent with the ISI program, guidance in Regulatory Guide L174.

4.

ELEMENT 4: DOCUMENTATION

5. The impact of the proposed change should be monitored using performance measurement The recommended contents for a plant-specific strategies.

risk-informed ISI submittal are presented here. This guidance will help ensure the completeness of the infor-Identification of the aspects of the plant's current i

mation provided and aid in minimizing the time needed requirements that would be affected by the pro-for the review process.

posed RI-ISI program. This identification should include all commitments (for example, the IGSCC

]

4.1 Documentation that Should Be Included in a inspections and other commitments arising from Licensee's RI-ISI Submittal generic letters affecting piping integrity) that the li-Table 1 provides an overall summary of the infor-censee intends to change or terminate as part of the mr. tion needed to support a risk-informed ISI submit-RI-ISI program.

1.178 - 17

Tnble 1 Documentation Summary Table PRA Quality Address the adequacy of the PRA model used in the calculations.

Address the acceptance guidelines in Regulatory Position 2 of this document and in Regulatory Guide 1.174 (Ref. 4).

Failure Probability Calcula-Address the methods used to calculate or categorize the failure probability or tions frequency of a piping element. Any use of expert elicitation should be fully documented.

Changes in CDF and LERF Address the change in CDF and LERF resulting from changes to the ISI pro-gram ISI Systems Identify all the systems inspected based on the current ISI programs and compare the systems for the RI-ISI programs.

Segmentation Identify methods used to segment piping systems,if applicable.

Categorization Identify methods used to categorize piping segments and elements as HSS, LSS, high failure potential, and low failure potential.

Identify all the HSS-HFP and HSS-LFP elements (format may differ based on decision matrix employed).

Sampling Method Identify the method used to calculate the number of elements to be inspected.

Document the method used to establish elements within a lot. Address how this method provides an acceptable level of quality and safety per 10 CFR so.55a(a)(3)(i).

Locations of Inspections Provide a system / piping diagram or table that compares the existing ISI loca-tions of inspection with the RI-ISI location of inspection.

1 Address the reasons for the changes.

Failure Probabilities Identify the methods used to arrive at the failure probabilities for piping seg-ments.

Performance Monitoring Discuss the performance goals and corrective action programs.

Periodic Reviews Identify the frequency of performance monitoring and activities in support of the RI-ISI program. Address consistency with other RI programs (e.g.,

Mainterance Rule, IST, Tech Specs).

QA Program Describe the QA program used to ensure proper implementation of RI-ISI process and categorization and consistency with other RI programs.

Expert Elicitation Identify any use of the expert elicitation process to estimate a failure proba-bility for piping. Address the reasons why an expert elicitation was required, provide all supporting information used by the experts, document the conclu-

)

sions, and address how the results will be incorporated in an industry data base or computer code, or why it is not necessary to make the findings avail-able to the industry.

Each weld to be inspected Identify: 1.The inspection method to be used

2. The applicable degradation mechanism to be inspected, and

3. The frequency of inspection Address each of the key prin-Verify compliance with applicable regulations, defense-in-depth, safety mar-ciples and the integrated deci-gins, etc.

sionmaking guidelines (e.g.,

Regulatory Position 2.3)

Implementation and monitor-Address the acceptance guidelines outlined in Regulatory Position 3 of this ing program regulatory guide.

l 1.178 - 18

t A summary of events involving piping failures that justification for the number of elements to be j

have occurred at the plant or similar plants. Include inspected.

t b

in the summary any lessons learned from those events'and indicate actions taken to prevent or The degradation mechanisms for each seg.

\\

minimizs the potential for recurrence of the events.

ment (if segments contain welds exposed to different degradation mechanism, for each Identification of the specific revisions to existing weld) used to develop the failure potential of inspection schedules, locations, and methods that each segment.

L would result from implementation of the proposed i

program.

Equipment assumed to fail as a direct or indi.

j rect consequence of each segment's failure (if j

_ Plant procedures or documentation containing the.

segments contain welds with different failure C

guidelines for all phases of evaluating and imple-consequences, for each weld).

j.

menting a change in the ISI program based on pro-babilistic and traditional insights. These should

- A description of how the impact of the change L

include a description of the integrated decision.

between the current Section XI and the pro-making process and criteria used for categorizing posed RI-ISI programs is evaluated or n

the safety significance of piping segments, a de.

bounded, and how this impact compares with scription of how the integrated decisionmaking.

the risk guidelines in Section 2.2.2.2 of Regu-l was performed, a description and justification of latory Guide 1.174.

the number of elements to be inspected in a piping The means by which failure probabilities or fre-segment, the qualifications of the mdividuals mak-quencies or potential were determined. The data i

ing the decisions, and the guidelines for making those decisions' should be provided in the submittal for analyses that rely on operational data for determining failure The results of the licensee's ISI-specific analyses frequencies or potential. Reliance on fracture me-1 L

used to support the program change with enough chanics structural reliability and risk analysis detail to be clearly understandable to the reviewers codes should be documented and validated. Re-of the program. These results should include the liance on the expert elicitation process should be

- following information.

\\

fully documented. (NOTE: Expert elicitation is only used if data are not sufficient to estimate the

'Alist of the piping systems reviewed.

failure probability and frequency of a piping seg.

- - A list of each segment, including the number ment. Data assessment is not an expert elicitation of welds, weld type and properties of the weld-pr cess and can normally be performed by plant ing material and base metal, the failure poten-personnel.)

tial, CDF, CCDF/CCDP, LERF, CLERF, im-A description of the PRA used for the categoriza-g portance measure results (RAW, F-V, etc.) and tion process and for the determination of risk im-justification of the associated threshold val-pact, in terms _of the process to ensure quality, ues, degradation mechanism, test and inspec-scope, and level of detail, and how limitations in tion intervals used in orin support of the PRA, quality, scope, and level of detail are compensated etc. Results from other methods used to de-for in the integrated decisionmaking process sup-l velop the consequences and categorization of porting the ISI submittal. The key assumptions each segment (or weld) should be documented used in the PRA that impact the application (i.e.,

in a similar level of detail. (NOTE: Table 2 1 censee voluntary actions), elements of the moni-provides an example of a summary of possible toring program, and commitments made to support methods for obtaining failure probabilities the application should be addressed.

based on specified degradation mechanisms.

The staff recommends that licensees provide If the submittal includes modified inspection inter-

such a table with supporting discussions.)

vals, the methodology and results of the analysis 1

should be submitted.

' For the selected limiting locations, provide ex-OL amples of the failure mode, failure potendal, A description of the implementation, performance

(

failure mechanism, weld type, weld location, monitoring, and corrective action strategies and and properties of the welding material and programs in sufficient detail for the statf to under-base metal. Provide a detailed description and stand the new ISI program and its implications.

1.178 - 19

Applicable documentation discussed imder the with the role the PRA results play in the integrated Cumulative Risk documentation for submittalin decisionmaking process. In addition to documen.

Section 1.3 of Regulatory Guide 1.174 (Ref. 4).

tation on the PRA itself, analyses performed in support of the ISI submittal should be documented Reference to NRC-approved topical reports on im-in a m nner c nsistent with the baselme documen-plementing a RI-ISI and supporting documents.

tation. Such analyses may melude:

Variations from the topical reports and supporting documents should be clearly identified.

- The process used to identify initiating events developed in support of the RI-ISI submittal Detailed justification for the proposed regulatory and the results from the process.

action (e.g., how the proposed program meets the

- Any event and fault trees developed during the requirements set in 10 CFR 50.55a(a)(3)(i)),

RI-ISI submittal preparation.

4.2 Documentation That Should Be Available

- Documentation of the methods and techniques Onsite for inspection used to identify and quantify the impact ofpipe The licensee should maintain at its facility the tech-failures using the PRA, or in support of the nical and administrative records used in support of its PRA, if different from those used during the submittal, or should be able to generate the information development of the baseline PRA.

on request. This information should be available for

- The techniques used to identify and quantify NRC review and audit. If changes are planned to the ISI human actions.

program based on mternal procedures and without prior

- The data used in any uncertainty calculations NRC approval, the following information should also or sensitivity calculations, consistent with the be placed in the plant's document control system so that guidance provided in Regulatory Guide 1.174.

the analyses for any given change can be identified and reviewed. The record should include, but not be limited

- How uncertainty was accounted for in the seg-ment categorization, and the sensitivity stud-to, the following information.

ies performed to ensure the robustness of the Plant and applicable industry data used in support categorization.

of the RI-ISI program. All analyses and assump-Detailed results of the inspection program corre-tions used in support of the RI-ISI program and communications with outside organizations sup-sponding to the ISI inspection records described in porting the RI-ISI program (e.g., use of peer and the implementation, performance monitoring, and independent reviews, use of expert contractors).

corrective action program accompanying the RI-ISI submittal.

Detailed procedures and analyses performed by an For each piping segment, information on weld expert panel, or other technical groups, if relied upon for the RI-ISI program, including a record of type, weld location, and properties of welding ma-deliberations, recommendations, and findings.

terial and base metal.

For each piping segment, information regarding Documentation of the plant's baseline PRA used to support the ISI submittal should be of sufficient de-the process and assumptions used to develop fail-tail to allow an independent reviewer to ascertain ure mode and failure potential (frequency /proba-whether the PRA reflects the current plant configu-bility),in addition to the identification of the fail-ration and operational practices commensurate ure mechanism.

O t

1 1.178 - 20 1

~_

7. _ _

.~

= Table 2 Example of a Summary of Methods Used To Estimate Piping Failure Probabilities fbr Risk Categorization i

Failure Mechanism -

' Methods for Estimating Probability :

Name of Mechanism Contributing Factors Failure Mode -

_ Stainless Steel Carbon Steels Other Materials l

Thermal Striping.

Crack Code Name Code Name IIigh Cycle Flow Induced Vibration Initiation Failure

Fatigue Mechanical Vibration Crack Code Name.

Code Name Database j

Growth Thermal Stratification Crack.

Code Name Code Name i

low Cycle Heat-up and Cool-down Initiation Failure

. Fatigue Hermal Cycling Crack Code Name Code Name

. Database l

Growth -

Coolant Chemistry Crack

- Code :

Not j

Corrosion Crevice Corrosion Initiation Name

' Applicable Failure -

Cracking Susceptible Material Database Crack Code Not ~

. High Stresses Growth -

Name

. Applicable

[

U (Residual, Springing) oo r

y Flow Accelerated. Corrosion.

Wall Name of Name of -

_ Failure '

l i

Wastage Microbiologically Ind. Corr.

Thinning Code Code-Database -

l Pitting and/or Wear

}

Other Creep Damage Miscellaneous Failure -

Failure Failure

(

Mechanisms Hermal Aging _

Modes Database Database Database

.J Irrad. Embrittlement i

i 1

l t

I t

l i

i

'(

REFERENCES

1. USNRC, "Use of Probabilistic Risk Assessment

9. USNRC, " Standard Review Plan for Risk-Methods in Nuclear Regulatory Activities; Final Infonned Decision Making: Inservice Testing,"

Policy Statement," Federal Register, Vol. 60, p Standard Review Plan, NUREG-0800, Chapter 42622, August 16,1995.

3.9.7, August 1998.3

2. USNRC," Framework for Applying Probabilistic

10. USNRC, " Standard Review Plan for Risk-Risk Analysis in Reactor Regulation,"

Informed Decision Making: Technical Specifica-SECY-95-280, November 27,1995.1 tions," Standard Review Plan, NUREG-0800, Chapter 16.1, August 1998.3

3. USNRC," Standard Review Plan for the Review of Risk-Informed Inservice Inspection of Piping,"

11. American Society of Mechanical Engineers," Case NUREG-0800, Section 3.9.8, September 1998.2 N-560, Alternative Examination Requirements for 4.

USNRC, "An Approach for Using Probabihstic Class 1, Category B-J Piping WeldsSection XI, Division 1," August 9,1996.

Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Current Licensing

12. American Society of Mechanical Engineers," Case

]

Basis," Regulatory Guide 1.174, July 1998.2 N-577, Risk-Informed Requirements for Class 1, 2, and 3 Piping, Method A,Section XI, Divi-5.

USNRC,"An Approach for Plant-Specific, Risk-si n 1," September 2,1997.4 Informed Decisionmaking: Inservice Testing,"

Regulatory Guide 1.175, August 1998.2

13. American Society of Mechanical Engineers," Case N-578, Risk-Informed Requirements for Class {

6.

USNRC,"An Approach for Plant-Specific, Risk-2, and 3 Piping, Method B,Section XI, Divi-Informed Decisionmaking: Graded Quality Assur-sion 1," September 2,1997.4 ance," Regulatory Guide 1.176, August 1998.2

14. Electric Power Research Institute,"PSA Applica-7.

USNRC,"An Approach for Plant-Specific, Risk-tions Guide," EPRI TR-105396, August 1995.5

)

Informed Decisionmaking: Technical Specifica-tions," Regulatory Guide 1.177, August 1998.2

15. Electric Power Research Institute," Risk-Informed Inservice Inspection Evaluation Procedure," EPRI

8. USNRC, " Standard Review Plan for Risk-TR-106706, June 1996.5 Informed Decision Making," Standard Review Plan, NUREG-0800, Chapter 19, July 1998.3

16. Westinghouse Energy Systems, " Westinghouse Owners Group Application of Risk Informed Copies are available for inspection or copying for a fee from the NRC Methods to Piping inservice Inspection Topical I

Public Document Room at 2120 L Street NW., Washington. DC; the Report'" WCAP-14572' Revision 1, October PDR's mailing address is Mail Stop LL-6, Washington, DC 20555; 1997.g telephone (202) 634 -3273; f ax (202) 634 -3343.

2 Single copies of regulatory guides, both active and draft, and standard

17. Westinghouse Energy Systems, " Westinghouse review plans may be obtained free of charge by writing the Reproduc.

Structural Reliability and Risk Assessment tion and Distribution Services Section,0CIO, USNRC, Washington, DC 20555-0001, or by fax to (301) 41'2289, or by e-mail to (SRRA) Model for Piping Risk-Informed Inser-GRWi@NRC. GOV. Active guides maw also be purchased frem the vice inspection," WCAP-14572, Revision 1, Sup-National Technical Information Service on a standmg~ order basis.

Detads on this service may be obtained by writing NTlS,5285 Port plement 1, October 1997.1

/

Royal Road, Springfield, VA 22161. Copics of active and draf t guides

18. T.V. Vo et al., "A Pilot Application of Risk-in-are available for inspectiol or copying for a fee from the NRC Public Document Room at 2120 L Street NW., Washington, DC; the PDR's formed Methods To Establish Inservice Inspection mailing address is Mail Stop LL-6, Washington, DC 20555; tele.

Pn.onties for Nuclear Components at Surry Unit 1 phone (202) 634 -3273; fax (202) 634 -3343.

Nuclear Power Station," USNRC, NUREG/

3 opics are available at current rates from the U.S. Government CR-6181, Revision 1, February 1997.3 C

Pr inting Office, PO. Box 37082, Washington, DC 20402 -9328 (tele.

phone (202) 512-2249);or from the National Technicallnformation Service by writing NTIS at 5285 Port Royal Road, Springfield, VA 4 Copies may be obtained from the American Society of Mechanical 22161. Copies are avadable for inspection or copying for a fee from Engineers,345 East 47th Street, New York, NY 10017.

the NRC Public Document Room at 2120 LStreet Nw., Washington, j

DC; the PDR's mailing address is Mail Stop LL-6, Washington, DC 5 Copies may be o;.,tained from the EPRI Distribution Center,207 l

/

20555; telephone (202) 634 -3273; fax (202) 634 - 3343.

Coggins Drive, PO. Box 23205, Pleasant liill, CA 94523.

9 1.178 - 22

(

19. Anjerican iSociety of Mechanical Engineers,

22. USNRC," Inservice inspection Code Case Accept-

" Rules for Inservice Inspection of Nuclear Power ability, AS ME Section XI, Division ',," Re Plant Components," ASME Boiler and Pressure Guide 1.147, Revision 11, October 1994.gulato

)

Vessel Code,Section XI,1989 Edition, New

.. /

York.4

23. M.A. Meyer and J.A. Booker," Eliciting and Ana-lyzing Expert Judgement," NUREG/CR-5424

20. USNRC," Design and Fabrication Code Case Ac-(Prepared for the NRC by las Alamos National ceptability, ASME Section 111, Division 1," Regu-Laboratory), USNRC, January 1990.3 latory Guide 1.84, Revision 30, October 1994.

24. J.P. Kotra et al.," Branch Techm. cal Position on the

21. USNRC, " Materials Code Case Acceptability, Use of Expert Elicitation in the liigh-Level Radio-ASME Section 111, Division 1," Regulatory Guide active Waste Program," NUREG-1563, USNRC, 1.85, Revision 30, October 1994.2 November 1996.

REGULATORY ANALYSIS A draft regulatory analysis was published with the draft of this guide when it was published for public comment (Task DG-1063, October 1997). No changes D

were necessary, so a separate regulatory analysis for Regulatory Guide 1.178 has not been prepared. A copy of the draft regulatory analysis is available forinspec-tion or copying for a fee in the NRC's Public Document Room at 2120 L Street NW., Washington, DC, under Task DG-1063.

D l

1.178 - 23

ll l

llllll)f1llllIillllf>lil!jlllll N

UC WL E

P A

N S A E

A H R L

I r TO N! U Y F G E N FF T GI OIC OU T PL

,N L E RIA A D R B D TS I

OT VU AS C

TI RA E N 2YT E

US 0

E 5C S SS

,E 5O 5

M 3

0 0

0 M I

0 0 S 1

S ION W1DIU1 AWONS2 SFCF 0 HNUON5 I

MRR5 NPEMC5 G1NA 0

T TT06 O1 IC4 N7 COT 2 ONO1 N

5 T&

R OR LE 2 C

DO I ER S SD B KS 1 D

1 C

M S G

M 2

T 0

5 5

5 PO S

P TIF E

AR R

GS ET M U AC ITS N N NL R D A S

O. CFS G

EEM

-6 SA 7

l Pl AID

i D

NUREG-0800 (k.....)\\

UNITED STATES NUCLEAR REGULATORY COMMISSION STANDARD REVIEW PLAN OFFICE OF NUCLEAR REACTOR REGUI ATION 1

Standard Review Plan for Trial Use For the Review of Risk-informed Inservice inspection of Piping SRP Chapter 3.9.8 i

D September 1998 9

l Contacts:

S. A. Ali (301) 415-2776 (NRR)

J. Guttmann (301) 415-6561 (RES)

S. Dinsmore (301) 415-8482 (NRR)

D. Jackson (301) 415-5887 (RES)

Standard review plans are prepared for the guidance of the Office of Nuclear Regulation staf f responsible for the review of applications to construct and operate nuclear power plants. These documents are made available to the public as part of the Commission's policy to inform the nuclear industry and the general public of the regulatory procedures and policies. Standard review plans are not su,bstitutes for regulatory guides or the Commission's regulations, and compliance with them is not required. The standard review plan sections are keyed to the Standard l

Format and Content of Safety Analysis Reports for Nuclear Power Plants. Not all sections of the Standard Format l

have a corresponding review plan.

Published standard review plans will be revised periodically, as appropriate, to accommodate comments and to D

reflect new information and experience.

Comments and suggestions for improvement will be considered and should be sent to the U.S. Nuclear Regulatory l

Commission, Office of Nuclear Reactor Regulation, Washington, DC 20555.

, v,/ A '7 k re up.

(2

I Standard Review Plan for Trial Use For the Review of Risk-Informed inservice inspection of Piping FOREWORD The U.S. Nuclear Regulatory Commission's (NRC) Policy Statement on the use of probabilistic risk assessment (PRA) in nuclear regulatory activities encourages greater use of this analysis technique to improve safety decision making, reduce unnecessary burden and improve regulatory efficiency. A number of NRC staff and industry activities are ir progress to consider approaches for expanding the scope of PRA applications in regulatory activities.

Several activities are ongoing which consider appropriate uses of PRA in support of the modification of individual plant's design, operation or other activities that reauire NRC aooroval. This could include items such as exemption requests under to CFR 50.12 and I

license amendments under 10 CFR 50.90.

This Standard Review Plan (SRP) chapter describes review procedures and acceptance guidelines for NRC staff reviews of proposed plant-specific, risk-informed changes to a licensee's inservice inspection (ISI) program for piping. The review procedures contained in this SRP are consistent with the acceptable methods for implementing a risk-informed ISI (RI-ISI) program described in RG 1.178 (Reference 2). Licensees may propose RI ISI programs consistent with the guidance provided in RG 1.178, propose an alternative approach for implementing a RI ISI program (which must be demonstrated to be consistent with the fundamental principles identified in this standard review plan), or maintain their ISI programs in accordance with the American Society of Mechanical Engineers (ASME) Code as referenced in 10 CFR 50.55a.

It is the NRC staff's intention to initiate rulemaking as necessary to permit licensees to implement RI ISI programs, consistent with this SRP chapter, without having to get NRC approval of an alternative to the ASME Code requirements pursuant to 10 CFR SO.56a/al/3). Until the completion of such rulemaking, the staff anticipates reviewing and approving each licensee's Rl-ISI program as an altarnative to the current Code required ISI program. As such, the licensee's RI-ISI program Nill be enforceable under 10 CFR 50.55a.

The current ASME Code inservice inspection. requirements, as endorsed in 10 CFR SO.55a, have been determined to provide reasonable assurance that public health and safety will be maintained. The individual ASME Code committees concerned with inservice inspection continually review these inspection strategies to develop improvements to the existing i

Code requirements. Changes to the ASME Code, either as new Code editions or Code Cases, are subject to review and approval by the NRC to ensure that the new inspection requirements maintain an adequate level public health and safety. A risk-informed inservice inspection program, if properly constructed, will also provide an acceptable level of quality and safety by evaluating and possibly improving the inspection effectiveness for the high-safety significant piping (as identified by the licensee's integrated decision making process) in conjunction with the relaxation of inspection requirements for the low-safety significant piping.

r t

O 9

ii

I Standard Review Plan for Trial Use For the Review of Risk-informed Inservice inspection Applications TABLE OF CONidNTS 3.9.8 RISK-INFORMED INSERVICE INSPECTION OF PIPING Pa REVIEW RES PON SIBILITIES........................................ge 1

1.

AR EA O F R EVIEW.......................................... 1 1.1 Element 1: Define the Proposed Changes to ISI Program.............. 2 1.2 Element 2: Engineering Analysis............................... 3 l

1.2.1 Tradition al Analysis................................. 3 1.2.2 Probabilistic Risk Assessment.......................... 4 1.2.2.1 Scope of Piping Systems................... 4 1.2.2.2 Piping Segments......................... 4 1.2.2.3 Evaluating Pipe Failures with PRA............. 4 1.2.2.4 Piping Failure Potential...................... O l.2.2.5 Consequences of Failure.................... 6 1.2.2.6 Risk Impact of ISl Changes.................. 6 1.2.3 Integrated Decisionmaking

............................6 1.3 Element 3: Implementation and Monitoring Programs................ 7 ACCEPTANCE CRITERIA.................................... 8 n.

II.1 Element 1: Define the Proposed Changes to !SI Program.............. 8 11.2 Element 2: Engineering Analysis............................... 9

11. 2. 1 Tradition al Analysis................................. 9

11. 2. 2 F.obabilistic Risk Assessment......................... 10 iii i

A

11. 2. 2. 1 -

Scope of Piping Systems.................. 10

11. 2. 2. 2 Piping Segments

........................10

11. 2. 2. 3 Evaluating Pipe Failures with PRA............ 11

11. 2. 2. 4 Piping Failure Potential.................... 11

11. 2. 2. 5 Consequences of Failure.................... 12 II.2.2.6 Risk impact of ISI Changes................. 13

11. 2. 3 Integrated Decisionmaking

...........................14

........ 15 11.3 Element 3: Implementation and Monitoring Programs......

111.

REVIEW PRO CEDU RES..................................... 16 I

Define the Proposed Changes to ISI Program............. 17 111.1 Element 1:

111.2 Element 2: Engineering Analysis.............................. 18 111. 2. 1 Traditional Analysis

................................18 Probabilistic Risk Assessment......................... 18 111. 2. 2 111. 2. 2. 1 Scope o' Piping Systems.................. 19 Ill.2.2.2 Piping Segments

........................19 111. 2. 2. 3 Evaluating Pipe Failures with PRA............ 19 111. 2. 2. 4 Piping Failure Potential.................... 19 111. 2. 2. 5 Consequences of Failure................... 20 111. 2. 2. 6 Risk Impact of ISI Changes................. 20 111.2.3 Integrated Decisionmaking

...........................20 lit.3 Element 3: Implementation and Monitoring Programs............... 21 IV.

ELEMENT 4: D O CU M ENTATIO N............................ 21 V.

EVALUATION FINDINGS

.............................22 VI.

IMPLEM ENTATIO N........................................ 24 Vll.

R E F ER EN C ES............................................. 24 9

iv

I Standard Review Plan for Trial Use For the Review of Risk-Informed inservice inspection Applications 3.9.8 RISK-INFORMED INSERVICE INSPECTION REVIEW RESPONSIBILITIES Primary - Civil Engineering and Geosciences Branch (ECGB)

Secondary - Probabilistic Safety Assessment Branch (SPSB) for PRA, Materials and Chemical Engineering Branch (EMCB) for Fracture Mechanics I.

AREAS OF REVIEW j

The purpose of this standard review plan is to describe the procedure that the NRC staff will utilize to review the application of risk-informed methods to develop inservice inspection (ISI) programs for piping that are different from the current ISI programs at a nuclear power facility. In implementing risk-informed decision making, the licensee must ensure that any proposed change to the ISI program or the regulation meets the following key principles:

1.

The proposed change meets the current regulations unless it is explicitly related to the request for alternatives under 10 CFR 50.55a/al/3) or a requested exemption or rule change (i.e., a 50.12 " specific exemption" or a 2.802 " petition for rulemaking").

2.

The proposed change is consistent with the defense-in-depth philosophy.

3.

The proposed change maintains sufficient safety margins.

4.

Proposed increases in core damage frequency and risk are small and are consistent with the intent of the Commission's Safety Goal Policy Statement.

5.

The impact of the proposed change should be monitored using performance measurement strategies.

Each of these principles should be considered in the risk-informed, integrated D

decisionmaking process. Given these principles of risk-informed decision making, the staff has identified a four-element approaches that form the basis for evaluating proposed I

3.9.8-1

ages to a plant's ISI program based on risk-informed methods. This approach is not a Jential in nature; rather, it is iterative.

The first element involves the characterization of the proposed change. The licensee shouid identify those aspects of the plant's licensing bases tnat may be affected by the proposed change in ISI requirements, including, but not limited to, rules and regulations, final safety analysis report (FSAR), technical specifications, licensing conditions, and licensing commitments. The licensee should also identify all aspects and elements of the ISI program that it intends to modify in future evaluations without prior NRC approval of the change. Piping systems, segments, and welds that are affected by the change in ISI program should be identified. Plant systems and functions that rely on the affected piping should also be identified. Industry and plant specific information applicable to the piping I

degradation mechanisms that characterizes the relative effectiveness of past inspections should be documented.

As part of the second element, the licensee should evaluate the proposed change with regard to the principles that the proposed change is consistent with the defense-in-depth philosophy, that sufficient margins are maintained, and that proposed increases in core damage frequency and risk are small and are consistent with the intent of the Commission's Safety Goal Policy Statement as discussed in RG 1.174. This element consists of engineering evaluations, including traditional engineering analyses as well as PRAs. The PRA based assessment of the proposed change should explicitly consider the affected piping segments and assess the impact on the core damage frequency (CDF) and large early release frequency (LERF) caused by changing the licensee's current ISI program. The results of the complementary traditional and PRA methods should be used in an integrated decisionmaking process.

The third element involves developing implementation and monitoring programs. The primary goal for this element is to assess the performance of piping under the proposed change by establishing performance-monitoring strategies to confirm the assumptions and analyses that were conducted to justify the change. Inspection scope, intervals, and techniques should be clearly defined. The inspection scope and techniques should address all relevant failure mechanisms that could significantly impact the reliability and integrity of the piping.

The fourth element involves documenting the analyses and submitting the request for NRC review and approval. The submittalis reviewed by NRC in accordance with this standard review plan.

The following areas related to the use of RI-ISI program for Inservice Inspection (ISI) of piping are reviewed.

JJ Element 1: Define the Prooosed Chanae to ISI Proaram The licensee's RI-ISI submittal is reviewed to verify that the proposed changes to the ISI program have been defined in general terms. Those aspects of the plant's licensing bases that may be affected by the proposed change, including, but not limited to, rules and 3.9.8 2

I regulations, FSAR, technical specifications, and licensing conditions are reviewed, in addition, licensing commitments are reviewed. Particular piping systems and welds that are affected by the change in inspection practices are reviewed. Specific revisions to inspection scope, schedules, locations, and techniques are reviewed. The licensee's program and procedures guiding the evaluations leading to future changes tc the ISl program without prior NRC approval are reviewed.

Plant systems and functions that rely on the affected piping are also reviewed. The staff reviews available engineering studies, methods, codes, applicable plant-specific and industry data and operational experience, PRA findings, and research and analysis results relevant to the proposed change. Plant-specific experience with inspection program results is reviewed and characterization relative to the effectiveness of past inspections of the piping and the flaws that have been observed is reviewed.

L2 Element 2: Enaineerina Analvsis As part of the second element, the staff will review the licensee's engineering analysis of the proposed changes. The purpose of the review is to determine whether defense-in-depth is maintained, sufficient safety margins are maintained, and that proposed increases in risk, and their cumulative effect, are small and do not cause the NRC Safety Goals to be exceeded. Regulatory Guides (RG) 1.174 and RG 1.178 provide guidance for the performance of this evaluation.

I L2d Traditional Analvsis The engineering analyses are reviewed to determine whether the impact of the proposed ISI changes is consistent with the principles that defense-in depth and adequate safety margins are maintained.

The primary regulations governing ISI of piping are 10 CFR 50.55a and Appendix A to 10 CFR Part 50. The regulations reference other codes and requirements that define the elements of defense-in-depth and safety margins to ensure that structuralintegrity of piping is maintained. The staff reviews the licensee's assessment of whether the proposed changes meet the regulations.

10 CFR 50.55a references ASME Boiler and Pressure Vessel Code (BPVC)Section XI for the detailed requirements regarding piping ISI. Inspections required by ASME BPVC Section XI are performed on a sample basis with additional inspections, in terms of locations as well as frequency, mandated in response to detection of flaws. The objective of the ISI has been to identify conditions, such as flaw indications, that are precursors to leaks and ruptures in pressure boundaries that may impact plant safety. The staff reviews the licensee's bases for the assessment that the proposed change meets the intent of the ASME Code requirements.

Additional augmented inspection programs to address generic piping degradation problems have been recommended by the NRC to preclude piping failure and implemented by the j

industry. Notable examples of augmented programs for piping inspections are to address 3.9.8-3

l intergrannular stress corrosion cracking (IGSCC) of stainless steel piping at boiling water reactors (BWR) (Generic Letter 88-01, Re'srence 11) and erosion corrosion (EC) in the balance of plant for both pressurized water reactors (PWR) and BWRs (Generic Letter 89-08, Reference 12). The manner in which the augmented inspection programs for piping are addressed is reviewed.

L2.2 Probabilistic Risk Assessment The scope, level of detail, and quality required of the PRA is commensurate with the emphasis that is put on the risk insights and on the role the PRA results play in the integrated decision making process, if the justification for the change is based on well founded traditional arguments supported by PRA insights, a limited PRA review may be I

warranted. However, if the justification for change is based c,n complex PRA arguments, then the breadth and depth of the PRA review will be substantially greater. Only those parts of the PRA which are used to support the ISI change application need to be reviewed.

1.2.2.1 Scone of r'ioina Svstems The scope of piping included in the proposed RI-ISI program is reviewed. The current ISI requirements for nuclear power plant piping are specified in 10 CFR 50.55a which incorporates, by reference, the requirements of ASME BPVC Section XI. The extent to which the RI-ISI program scope incorporates ASME Class 1,2 and 3 piping systems currently included in ASME BPVC Section XI program and any balance of plant piping is reviewed. The process to select the scope of piping, justification for the scope, and the specific choice of piping selected is reviewed.

l.2.2.2 Pioina Seaments The procedure for defining piping segments within the piping systems for the purpose of modeling a run of a pipe in a PRA or to define its ISI requirements is reviewed. The methods by which the f ailure consequences such as an initiating event, loss of a train, loss of a system, or a combination thereof, is incorporated in the definition of segments are reviewed. In addition to the failure consequences, the procedure and criteria used to identify and document the degradation mechanisms that can be present in piping within the selected systems boundaries is reviewed.

The procedure by which the location of the piping in the plant, and whether inside or outside the containment, is taken into account in defining piping segments is reviewed.

The selection of piping segments within the piping system boundaries is an iterative pr' cess affected by degradation as well as consequence evaluation which is not completed at the time of initial selection of piping segments within the selected piping systems. The procedure by which degradatior, mechanisms and consequences of piping segment failures are incorporated in the iterative process is reviewed.

l.2.2.3 Evaluatina Pioe Failures with PRA Pipe ruptures are traditionally modeled as initiators and the failure of individual pipe.

3.9.8-4

segments or structural elements are not modeled in PRAs. The manner in which PRA, or the PRA results, is modified so that a more detailed treatment of the potential (or probability) of pipe failures and the influence of such failures on other systems is incorporated in the PRA is reviewed.

1.2.2.4 Pioino Failure Potential Segment failure potential may be a quantitative estimate for each segment, or segments may be categorized into groups based on similar degradation mechanism, environment, and failure modes. There are three failure modes:

1.

Initiating event failures where the failure directly causes a transient and may or may not also fail one or more plant trains or systems. Initiating event failures are characterized by failure frequency.

2.

Standby failures are those failures that cause the loss of a train or system but which do not directly cause a transient. Standby failures are characterized by train or system unavailability which may require shutdown due to technical specifications or limiting conditions for operation. Unavailability is a combination of failure frequency and exposure time.

3.

Demand failures are failures accompanying a demand for a train or system and usually caused by the transient induced loads on the segment during system startup.

Demand failures are characterized by a probability per demand.

The approach used for the determination of failure potential of piping segments is reviewed.

The manner in which past failure data, expert opinion and probabilistic fracture mechanics is considered in determining the piping failure potential is reviewed. The determination of exposure time appropriate to standby failures is reviewed. it is expected that inspections will be performed in accordance with the schedule of Inspection Program A or Program B as specified in ASME XI. When data analysis is utilized, appropriateness and completeness of data and whether data is taken over time is evaluated.

Probabilistic structural analysis techniques may be used to estimate a numerical frequency or probability of piping segment failure. This method utilizes conventional structural analysis techniques, such as fracture mechanics analysis, in combination with probabilistic methods, such as Monte-Carlo simulation. These techniques are implemented by computer codes to estimate failure probabilities as a function of time. The probabilistic structural analysis methodology for the determination of piping failure probabilities is reviewed to determine the appropriate application of fracture mechanics analysis and Monte-Carlo simulation techniques. Benchmarking of computer codes based on comparison with industry standard codes as well as operating experience is also reviewed. The applicant should demonstrate that the methodology is able to identify significant differences in failure frequencies or probabilities arising from differences in material properties and environmental influences such as the presence of known degradation mechanisms.

m Alternatively, expert opinion or categorization based on degradation mechanisms may be 3.9.8-5

used in conjunction with, or in lieu of fracture mechanics analysis to assign each element into a small number of f ailure potential categories; high, medium, or low for example, in such cases, the process and basis of f ailure potential determination is reviewed.

For both quantitativo estimates and classification into similar groups, the manner in which f ailure modes, applicable industry experience, piping material, degradation mechanisms, and various other parameters are identified and considered is evaluated. There are numerous uncertainties involved in performing an assessment of segment failure potential. The procedures for addressing these uncertainties when predicting failure potential are reviewed.

l.2.2.5 Conseauences of Failure f

Direct effects of piping f ailures include loss of coolant accidents (LOCA) or other flow diversions resulting in an initiator, or a consequential loss of systems because of the inability to deliver sufficient flow hecause of the f ailed piping. Indirect effects include consequential f ailures of additional equipment, including equipment in other systems, because of effects such as pipe whip, jet impingement, flooding, or temperature. The procedure by which direct and indirect effects are characterized and documented is reviewed to verify that appropriate f ailure mechanisms and dependencies will be evaluated in the risk analysis.

l.2.2.6 Risk Imoact of ISI Chanaes The methodology used to characterize the change in risk due to the proposed change in the ISI program is reviewed. Part of the basis for the acceptability of any RI-ISI program is a demonstration that established risk measures are not significantly increased by the proposed reduction in the number of inspections for selected piping. To demonstrate this, the process and methodology used to appropriately account for the change in the number of elements inspected, and when feesible, the effects of an enhanced inspection method are reviewed.

11 2 Intearated Decisionmakina Acceptability of the impact of the proposed change in the ISI program is determined based on the review of the adequacy of the licensees fulfillment of the five key principles as listed in Section I and discussed in detail in RG 1.174. The licensee's processes, procedures, and decision criteria to integrate, and to iterate on the integration as necessary, the different elements of the engineering analysis discussed in Sections 1.2.1 and 1.2.2 and the key principles are reviewed.

The assignment of pipe elements into safety-significant categories is an integral part of the risk-informed ISI process. Consequently, the categorization process and all qualitative and quantitative guidelines used to support the categorization are also reviewed.

Risk measures utilized to characterize and differentiate the risk contributions from the individual piping segments are reviewed. The techniques, criteria, and the documentation 3.9.8 6

l I

used to develop and describe the risk measures are reviewed. The criteria for utilizing these risk measures to categorize each pipe segment into groups of high and low-safety-significant are reviewed. Consideration of absolute and relative figures of merit is reviewed. Review is focused on the criteria for risk significance determination for ISI at the pipe segment and structural element levels that are used to prioritize inspection locations.

The procedure used to perform review of piping segments and piping structural elements to ensure that no segments are inappropriately ranked as low-safety-significant is reviewed.

The criteria and procedure used to define the number and location of structural elements within the piping segments that will be subject to ISI is reviewed. The comparison between the ISI program for piping under ASME XI and the requested RI-ISI program is reviewed.

L3 Element 3: Imolementation and Monitorina Proarams The adequacy of the implementation and monitoring plans is reviewed. Inspection strategies are reviewed to ensure that failure mechanisms of concern have been addressed and there is a sufficiently high probability of detecting damage before structuralintegrity is impacted. Inspection strategies for selected segments are reviewed to determine if leak / break risks from pressure boundary piping failures are maintained below appropriate threshold values. The process by which the safety significance of piping segments is taken into account in defining the scope of the inspection program is reviewed. Inspection scope, examination methods, and methods of evaluation of examination results are reviewed with I

the objective of establishing whether the RI-ISIinspection program provides an acceptable level of quality and safety.

The criteria for selecting areas and volumes of high-safety-significant as well as low-safety-significant piping structural elements for inspection are reviewed to ensure that the applicable degradation mechanisms are addressed. The methods by which the degradation mechanisms, postulated failure modes, and configuration of piping structural elements are incorporated in the inspection scope and inspection locations are reviewed. The manner in which significant stress concentration, geometric discontinuities, and generic as well as plant-specific pipe cracking experience is considered in selecting inspection locations is reviewed. Alternate methods to ensure structuralintegrity in cases where examination methods cannot be applied due to limitations, such as inaccessibility or radiation exposure hazard are reviewed.

In the context nf the RI-ISI program, the sampling strategy is defined by the selection of structural elements that are proposed by the licensee for inclusion in the inspection. The reviewer will determine if expansion of the sample size is in accordance with the ASME Section IX criteria, e.g., through sequential sampling based on ISI findings and other evidence of structural degradation.

Inspection methods and acceptance standards utilized in the implementation of the RI-ISI program are reviewed. Inspection methods selected by the licensee should address the degradation mechanisms, pipe sizes, and materials of concern. The manner in which the degradation mechanism is taken into consideration in determining the suitability of examination methods such as visual, surface, and volumetric examination is reviewed. The 3.9.8-7

extent to which the RI-ISI program incorporates inspection intervals, examination methods and acceptance standards currently specified in the ASME BPVC Section XI program is reviewed.

The reliability of any NDE method is dependent on the qualification of the inspection personnel. RI-ISI program is reviewed to verify that inspection teams will meet industry codes and standards, and use accepted methods and procedures, implementation plan for the RI-ISI program is reviewed to ensure that appropriate modifications of the ISI plan are developed if new or unexpected degradation mechanisms occur. The manner in which the adequacy of the reliability of the implemented NDE methods is monitored is reviawed.

r II.

ACCEPTANCE CRITERIA The acceptance criteria for the areas of review described in subsection I of this SRP are given below. Other approaches that can be justified to be equivalent to tha stated I

acceptance criteria may be used. The staff accepts the risk-informed development of an inspection plan if the relevant requirements of 10 CFR 50.55a concerning ISI are complied with. The relevant requirements of 10 CFR 50.55a are:

Propsed alternatives to the ISI requirements of paragraphs of 10 CFR 50.55a, 1.

which requires compliance with ASME XI for ASME Code Class 1,2, and 3 components, may be used when authorized by the Director of the Office of Nuclear Reactor Regulation.

The applicant shall demonstrate that the proposed alternatives would provide an 2.

acceptable level of quality and safety.

General guidelines on judging the acceptability of the engineering evaluations and PRA used to support risk informed applications are provided in RG 1.174 and SRP Chapter 19. A

\\ issues summary of acceptance guidelines for engineering evaluations and selected P specific to ISI is provided in RG 1.178.

))d Element 1: Define the Pronosed Chance to ISI Proaram The licensee's RI-ISI submittal should have defined the proposed changes to the !SI program in general terms. The licensee should have confirmed that the plant is designed and operated in accordance with the currently approved requirements and that the PRA used in support of their RI-ISI program submittal reflects the actual plant. The licensee should identify those aspects of the plant's licensing bases that may be affected by the proposed change, including, but not limited to, rules and regulations, FSAR, technical specifications, and licensing conditions. In addition, the licensee should identify any changes to commitments. The programs and procedures in place guiding future changes to the ISI program without prior NRC approval should provic% for engineering analyses, internal reviews, and degree of traceability consistent with 'he magnitude of the changes the licensee intends to make.

3. 9.13 - 8

l The particular piping systems, segments, and welds that are affected by the change in ISI program should be identified. Specific revisions to inspection scope, schedules, locations, and techniques should also be identified, in addition, plant systems and functions that rely on the affected piping should be identified. Industry and plant-specific experience with inspection program results should be obtained and characterization relative to the effectiveness of past inspections of the piping and the flaws that have been observed should be described.

IL2 Element 2: Enaineerina Analvsis After the proposed changes to the licensee's ISl program have been defined, the licensee should conduct an engineering analysis of the proposed changes using a combination of traditional engineering analysis with supporting insights from a PRA. Regulatory Guides 1.174 and 1.178 provide guidance for the performance of this evaluation.

11. 2. 1 Traditional Analvsis T5e traditional engineering analyses conducted should assess whether the impact of the proposed ISI changes (individually and cumulatively) is consistent with the principles that defense-in-depth and adequate safety margins are maintained.

10 CFR SO.55a and Appendix A to 10 CFR Part 50 are the primary regulations governing ISI of piping. The intent of these documents is to maintain the structuralintegrity of piping I

in a nuclear power plant. The regulations reference other codes and requirements that define the elements of a defense-in-depth philosophy to ensure structuralintegrity of piping. For each of the regulations and licensing bases relevant to the ISI of piping, the licensee should ensure that the proposed changes to the ISI program do not deviate from the regulations and licensing bases.

10 CFR 50.55a references ASME BPVC Section XI for the detailed requirements regarding piping ISI for safety significant systems. The objective of the ISI requirements of the ASME Code has been to identify conditions, such as flaw indications, that are precursors to leaks and ruptures in pressure boundaries that may impact plant safety. The licensee should verify that the proposed changes to the ISI program meet or exceed the intent of the ASME BPVC Section XI to identify conditions that are precursors to leaks and ruptures and to provide plans for additional and more frequent inspections in response to detection of flaws and degradation mechanisms.

The nuclear industry has implemented augmented inspection programs to address generic industry wide piping degradation problems such as IGSCC and EC. The licensee should identify whether the proposed changes in the ISI program affect previous licensee commitments for augmented inspection programs for piping degradation problems such as IGSCC and EC.

(

3.9.8-9

R2 Probabilistic Risk Assessment The quality of the PRA should be compatible with the safety implications of the ISI change being requested and the degree that the justification of the change request depends on the PRA analysis. Guidance relating the acceptable scope, ievel of detail, and quality of the PRA analysis based on the anticipated change in risk can be found in RG 1.174, Section 2.4.2, " Evaluation of Risk Impact, including Treatment of Uncertainties," and SRP Chapter 19.0, Section 111.2.2.4, " Quality of a PRA for Use in Risk-informed Regulation."

The PRA performed should realistically reflect the actual design, construction, and operational practices and reflect the impact of previous changes made to the approved requirements. All calculations using the PRA model should be performed correctly, and in a manner that is consistent with accepted practices. Limitations and approximations in the PRA and the PRA techniques which can influence the interpretation of the results required to support the ISI application should be clearly described and appropriately addressed.

Parameter uncertainty, model uncertainty, and completeness uncertainty should be l

addressed in accordance with the guidelines of RG 1.174.

The programs and procedures regarding the long term maintenance, update, and use of the PRA should be sufficient to ensure that any anticipated changes in the ISI program which do not require NRC notification or approval will always be based on an appropriately generated set of risk insights.

11. 2. 2. 1 Scone of Pioina Svstems The piping systems included in the RI-ISI program for the purpose of evaluating the impact of the proposed changes in the ISI program on total piant risk and for the purpose of screening to classify piping systems as high-safety-significant and low-safety-significant should be such that any proposed increases in core damage frequency and rak are small and are consistent with the intent of the Commission's Safety Goal Policy Statement.

11. 2. 2. 2 Picina Seaments An acceptable method for modeling a run of a pipe in a PRA or to define its ISI requirements is to divide the pipe run into segments. Portions of piping within the piping systen s having the same consequences of failure should be systematically identified.

Consequences of failure include an initiating event, loss of a particular train, loss of a system, or a combination thereof. The location of the piping in the plant, and whether in% or outside the containment, should be taken into account in defining piping segments.

1 Piping sections subjected to the same degradation mechanism should be systematically l

identified. Most of the degradation mechanisms present in nuclear power plant piping are dependent on a combination of design characteristics, fabrication processes and practices, operating conditions, and service experience. The degradation mechanisms to be considered include, but may not be limited to, vibration fatigue, thermal f atigue, corrosion cracking, primary water stress corrosion cracking (PWSCC), IGSCC, microbiologically i

3.9.8-10

{

J

}

induced corrosion (MIC), erosion, cavitation, and EC.

Piping segments should be defined taking into account potsntial degradation mechanism and consequence of failure at any point in the segment. Segments with the same consequences but a different degradation mechanism may be combined for consequence characterization, but the devdopment of the inspection program should explicitly address the different degradation mechanisms within such segments. In addition, consideration should be given to identifying distinct segment boundaries at branching points such as flow splits or flow joining points, locations of size changes, isolation valve, MOV and AOV locations. Distinct segment boundaries should be defined if the break potentialis expected to be significantly different for various portions of piping.

11. 2. 2. 3 Evaluatina Pioe Failures with PRA The licensee's methodology should systematically utilize risk insights from the PRA and PRA results tn characterize the impact of each segment's failure on the plant's risk. The characterization should allow for the determination of the relative safety-significance of the different pipe segments, and should also support the final determination regarding the impact of implementing the program on plant risk.

Generally, three or four primary system LOCA sizes and two steam line rupture locations representing the spectrum of demands on the mitigating systems are modeled in PRAs. An internal events flooding analysis is also included in most PRAs performed in response to l

Generic Letter 88-20. Much of this analysis will be used as a basis for determining the consequence of pipe failures. The review should focus on the robustness of the above models and methods in the baseline PRA, and appropriate use of this information to investigate the impact of the change in risk due to ISl implementation.

One acceptable approach is to investigate the change in risk due to an ISI program change is based on developing the pipe elements' failure potentials into probabilities, and integrating these probabilities into the existing quantitative PRA framework. The contribution to risk from each piping elements may be ranked and the safety significance of the element determined.

An alternative acceptable approach is based on categorizing each segment's failure potential and the consequences of each segment's failures. These two elements of risk, failure potential and consequences, are then systematically combined to determine the safety significance of each element,

11. 2. 2. 4 Pioina Failure Potential The determination of the degradation mechanisms present at each weld within all pipe runs included in the scope of the submittal is central to the success of the ISI application. The process used to identify the degradation mechanism at each weld should be well defined, systematic and applied to all welds within the scope. The documentation and engineering evaluations upon which the process is based should be capable of supporting the identification of all applicable degradation mechanisms.

3.9.8-11

The determination of failure potential of piping segments, either as a quantitative estimate or a categorization into groups, should be based on appropriate design, operational, and inspection parameters in conjunction with the identified degradation mechanisms. The evaluation should include a determination of whether the potential f ailure of each segment is best characterized as a demand failure while responding to a plant transient or an operational f ailure which causes a plant transient When data analysis is utilized to develop a quantitative estimate, the data should be appropriate and complete. When elicitation of expert opinion is used in conjunction with, or in lieu of probabilistic fracture mechanics analysis, to develop a quantitative estimate, a systematic procedure should be developed for conducting such elicitation and a suitable team of experts should be selected and trained. When categorization based on degradation mechanism is used, the justification for the relationship between the degradation mechanism and the arsir,ned category should be appropriate and complete.

The assessment of piping failure potential should take into account uncertainties. These uncertainties include, but are not limited to, design versus f abrication differences; variation in material properties and strength; effect of various degradation and aging mechanisms; variation in steady-state and transient loads; availability and accuracy of plant operating history; availability of inspection and maintenance program data; and capabilities of analytical methods and models to predict realistic results.

The methodology, process, and rationale used to determine the f ailure potential of piping segments should be reviewed and approved by the plant expert panel as part of its deliberations during the final classification of the safety significance of each segment. This process should be justified, documented, and included in the submittal. When computer codes are used to develop quantitative estimates, the techniques should be verified and validated against established industry codes.

Inspections performed in accordance with the schedule of Inspection Program A or Program B as specified in ASME XI are acceptable.

IllM Consecuences of Failure The impact on risk due to piping pressure boundary f ailure should consider both direct and indirect effects. Consideration of direct effects should include failures that cause initiating events, disable single or multiple components, trains or systems, or a combination of these effects. Indirect effects of pressure boundary failures affecting other systems, components and/or piping segments, also referred to as spatial effects such as pipe whip, jet impingement, flooding, or consequentialinitiation of fire protes. tion systems should also be considered.

The direct and indirect effects of pipe failures should be characterized to incorporate appropriate failure mechanisms and dependencies into the PRA model. The possibility of different leak sizes ranging from minor leaks to full rupture should be considered. In general, the leak size resulting in the most severe consequence should be selected to characterize the consequence for each segment.

3.9.8-12

(

^

L

)

An acceptable method of incorporating pipe failures is to classify pipe failures as leaks, W

disabling leaks, and breaks. Each of these failure modes may be charac+erized with a different f ailure probability or potential and a corresponding potential fo' degrading system performance through direct and/or indirect effects. The time available fce operator actions also depends on the break size, and this timing dependence should be recognized and incorporated into the analysis as appropriate.

The consideration of indirect effects given a barrier rupture, should include the potential for, and consequence of, leakage through other barriers relied upon to mitigate the resulting transient including pipes, penetrations, bellows, etc. The potential benefit of including inservice examination of such barriers should be evaluated. Leaks can result in moisture intrusion through jet impingement, flooding, and sprays. Disabling leaks (larger break area than for leaks) can result in initiating events and loss of system function in addition to indirect effects. Breaks can result in damage due to pipe whip in addition to all of the above-mentioned damages. The corresponding failure probability or potential decreases as the break area increases, j

11. 2. 2. 6 Risk Imoact of ISI Chanaes l

The guidelines discussed in RG 1.174, Section 2.4.2, " Evaluation of Risk Impact, including Treatment of Uncertainties" are applicable to ISI change requests. General guidance for reviewing the risk impact from changes to the current licensing basis can be found in SRP G

Chapter 19.0, Section 11.3.2.5 " Risk impact including Treatment of Uncertainty."

)

'~'

The licensee should demonstrate that principle four in RG 1.174 and Section I in the Regulatory Guide 1.178 is met. Principle four states that proposed increases in core damage frequency and risk are small and are consistent with the intent of the Commission's Safety Goal Policy Statement. Increase in risk caused by changes in ISI program could arise from a decrease in the number of welds inspected, reduced efficiency from simplified weld inspections, or both. Decreases in risk could arise from inspecting welds not currently being inspected in the program, improved weld inspections, or both.

The greater the potential risk increase due to the proposed change in the ISI program (e.g.,

the larger the reduction in the number of welds to be inspected and of replacements of detailed inspections with simplified inspections) the more rigorous and detailed the risk analyses needed.

A direct evaluation of the fulfillment of principle four may be based on risk importance measures or bounding satimates capable of characterizing plant l

l specific pipe element failure potential and consequences categories, a systematic process to combine failure potential and consequence to determine a

pipe element safety-significance, pipe segmentation and element inspection selection process which provides for e

H changes in the ISI program based on the safety-significance of the pipe element, and i

l 3.9.8-13 l

l

a discussion and evaluation of the aggregate risk impact of the set of changes requested in the ISI program including an evaluation of uncertainty indicating that the uncertainties do not invalidate the conclusions.

Alternatively, principle four may be shown to be met by calculating the expected change in CDF and LERF. The expected change can be calculated using the baseline PRA and before change versus after change piping f ailure potential expressed as failure probabilities.

An evaluation of the uncertainty in the results should be performed indicating that the uncertainties do not invalidate the conclusions.

11. 2. 3 Intearated Decisionmakina The integrated decision making must address all five key safety principles presented in Section I, " Areas of Review," in this SRP and should address each of the expectations discussed in Section 2.1, " Risk-informed Philosophy" of RG 1.174. The integrated decision making should also ensure that the proposed ISI program is consistent with the intent of each of the elements related to defense-in-depth and safety margins discussed in 2.4.1.1,

" Defense-in-Depth," and 2.4.1.2, " Safety Margins" of RG 1.174. The results of the different elements of the engineering analysis discussed in Sections 1.2.1 and 1.2.2 must be considered in an integrated decisionmaking process.

For ISI application, traditional requirements are outlined in to CFR 50.55a and the General Design Criteria in Appendix A to 10 CFR Part 50. To be acceptable, the traditional encineering analysis should address all of the relevant regulations and the licensing bases of the plant. Acceptability of impact of the proposed change in the ISI program is based on the adequacy of the traditional engineering analysis, acceptable change in plant risk relative to the criteria, and the adequacy of the proposed implementation and performance monitoring plan. The intent of the ASME BPVC to maintain integrity of reactor coolant system boundary by ISI should be preserved under the RI-ISI program.

An acceptable approach for the risk ranking of piping segments and elements is the use of risk reduction worth (RRW), risk achievement worth (RAW), conditional core damage probability (CCDP), conditional large early release probability (CLERP), or other importance measures. RRW is a measure of the maximum possible reduction in total CDF or LERF due to pressure boundary f ailures in plant piping systems that can result from making a component perfer:tly reliable. RAW, CLERP,'and CCDP characterize the increase in risk associated with the pressure boundary f ailure The risk ranking methodology must be able to systematically identify all high-safety-significant pipe segments within the scope of the RI-ISI program. Guidelines for using risk importance measures to categorire SSCs with respect to safety significance can be found in RG 1.174.

The classification of piping segments should be evaluated to determine if any piping segment is inappropriately classified. Considerations should be given to the limitations resulting from the PRA structure, PRA scope, and risk importance measures. Operational insights from previous inspection results, industry data on pipe failures, and Maintenance Rule impacts should also be taken into account. Piping that are subject to ISI under ASME XI requirements but have no segments exceeding the piping segment screening criteria 3.9.8-14

should be further reviewed. Each ASME Class coded system should have some segments inspected for defense-in-depth considerations.

The criteria for determining how many structural elements should be selected for inspection should be based on the safety significance of the segment and the f ailure potential within that segment. The potential for pipe failure directly drives the need for selecting elements for inspection and the location within a segment to be inspected. The sampling program for the selection of number of elements to be inspected should be fully justified. Guidelines for an acceptable methodology for selection of structural elements for inspection withiri pipe segments are provided in the RG 1.178.

The intent of the ASME BPVC to maintain integrity of reactor coolc.it system boundary by ISI should be preserved under the RI-ISI program. Appropriate consideration should be given to implementation and performance monitoring strategies so that piping performance can be assessed under the proposed ISI program change to confirm the assumptions and analyses that were conducted to justify the ISI program change.

lla Element 3: Imolementation and Monitorina Proarams Careful consideration should be given to implementation and performance-monitoring strategies. The primary goal of this element is to assess piping performance under the proposed RI ISI program by establishing performance-monitoring strategies to confirm the 9

As discussed in RG 1.178 (Reference 2), performance monitoring encompasses feedback assumptions and analyses that were conducted to justify the changes in the ISI program.

and modification of the RI-ISI program resulting from changes in plant design features, plant procedures, equipment performance, examination results, and individual plant and industry f ailure information, inspection scope and examination methods for the Rl-ISI program should provide an acceptable level of quality and safety as stipulated in 10 CFR 50.55ala)(3)//). Inspection strategies should ensure that failure mechanisms of concern have been addressed and there is a sufficiently high probability of detecting damage before structuralintegrity is impacted.

Safety significance of piping segments should be taken into account in defining the inspection scope for the RI-ISI program. The Rl-ISI program is reviewed to ensure that the inspection strategies for selected segments will maintain leak / break risks from pressure boundary piping failures below failure rates experienced by the industry in the past.

Degradation mechanisms, postulated failure modes, and configuration of piping structural elements should be incorporated in the definition of the inspection scope and inspection locations. For piping segments that are included in the existing plant EC or IGSCC inspection programs, the inspection locations should be the same as in the existing EC or IGSCC programs. For segments not in these programs, inspection locations should be mainly based on specific degradation mechanism and industry as well as plant-specific cracking experience. Determination of inspection locations for segments with no known degradation mechanism but high failure consequence should be based on sensitized weld locations, stress concentration, geometric discontinuities, and terminal ends. Plant-specific pipe cracking experience should be considered in selecting inspection locations. To be 3.9.8-15

acceptable, alternate examination methods should be specified to ensure structural integrity in cases where examination methods cannot be applied due to limitations, such as inaccessibility or radiation exposure hazard. System pressure tests and visual examination of ASME piping structural elements should continue to be performed regardless of whether the segments contain locations that have been classified as high or low-safety-significant.

The qualifications of NDE personnel, processes, and equipment should be demonstrated to be in compliance with ASME BPVC Section XI. The acceptance criteria for flaw evaluation should meet the requirements of ASME BPVC Section XI. For inspections outside the scope of Section XI (e.g., EC, IGSCC) the acceptance criteria should meet existing.

l l

regulatory guidance applicable to those programs.

1 The risk-infnrmed inspection program should specify appropriate inspection intervals consistent with the relevant degradation rate if the data on the degradation mechanism suggests that an inspection interval shorter than that stated in the ASME Section XI is required. in such cases, inspection intervals should be sufficiently short so that degradation too small to be detected during one inspection does not grow to an unacceptable size before the next inspection is performed.

Updates to the RI-ISI program should be performed at least on a 10-year periodic basis to coincide with the ISI requirements in ASME Section XI. Significant changes to the PRA model, plant design feature changes, plant procedure changes, and equipment performance changes should be included for review in the Rl-ISI program update if needed to support the update. L eakage, flaws, or indications identified during scheduled RI-ISI program NDE examinations and system pressure tests should be evaluated as part of the Al-ISI program update. Periodic updates of RI-ISI programs should include individual plant as well as industry f ailure information.

Appropriate modifications of the ISI plan should be developed if new or unexpected degradation mechanisms occur. The adequacy of the reliability of the implemented NDE methods should be monitored. The adequacy of NDE performance levels and inspection intervals along with the appropriateness of the selected ISI locations should be considered valid only if the ISI program is successful in detecting degradation before it leads to leakage or rupture of piping.

111.

REVIEW PROCEDURES The staff reviews the licensees proposed RI-ISI program to determine if it appropriately describes the types of changes that the licensee can make without prior NRC approval and the types of changes that require NRC approval before implementation The reviewer ensures that all changes are evaluated using the change mechanisms described in existing l

applicable regulations (e.g.,10 CFR 50.55a,10 CFR 50.59,10 CFR 50, Appendix B for l

safety related SSC) to determine if NRC review and approval is required prior to l

implementation. Licensees may request a variety of ISI programs supported by various levels of analyses and evaluations. In general, the degree of freedom the licensee receives Tj to make future changes to the ISI program without prior NRC approval depends on the level of sophistication of the plant practices and procedures supporting the change to Rl-ISI.

3.9.8-16

l Some general guidance on determining which future changes are appropriate is given below.

Changes to segment groupings, inspection intervals, and inspection methods that do not involve a change to the overall RI-ISI approach where the overall RI-ISI approach was reviewed and approved by the NRC do not require specific review and approval prior to implementation provided that the effect of the changes on plant risk increase is insignificant. The overall ISI submittal should specify what types of changes without prior NRC approval are anticipated and describe how such changes will be developed, reviewed by plant personnel, documented, and implemented.

Segment inspection method chges which involve the implementation of an NRC endorsed ASME Code, NRC-endorsed Code Case, or published NRC guidance approved as part of the RI-ISI program do not require prior NRC approval.

Inspection method changes that involve deviation from the NRC-endorsed Code requirements require NRC approval prior to implementation.

Changes to the RI-ISI progsam that involve programmatic changes (e.g., changes to the categorization criteria or figure of merit used to categorize components, and changes in the Acceptance Guidelines used for the licensee's integrated decision-making process) require NRC approval prior to implementation.

I Piping inspection method changes will typically involve the implementation of an applicable ASME Code, Code Case, or other requirements approved by the NRC. Changes to the piping inspection methods for these situations do not require NRC approval. However, inspection method changes that involve deviation from the NRC approved Code requirements require NRC approval prior to implementation.

For each area of review, the following review procedure is followed to ensure consistency in review so as to satisfy the requirements of acceptance criteria stated in subsection ll, llL1 Element 1: Define the Prooosed Chance to ISI Proaram The staff reviewer verifies that the licensee's RI-ISI submittal defines the proposed changes to the ISI program in general terms. The reviewer ensures that the licensee has confirmed that the plant is designed and operated in accordance with the approved requirements and that the PRA used in support of their RI-ISI program submittal reflects the actual plant. The reviewer verifies that the licensee has identified regulations and licensing commitments that impact the current ISI requirements. This includes, but is not limited to, rules and regulations, FSAR, technical specifications, licensing conditions, and licensing commitments. The reviewer also verifies that the piping systems, segments, and welds that are affected by the change in ISI program are identified. In addition, description of the proposed change is reviewed to verify that plant systems and functions that rely on the affected piping have been identified. The characterization of the proposed change in the ISI program is reviewed to verify that detailed description of the industry and plant specific information applicable to the piping degradation mechanisms has been provided. The 3.9.8-17

description of the proposed change is also reviewed to verify that information that characterizes the relative effectiveness of past inspections and the types of flaws that have been identified has been provided. In addition, the reviewer verifies that specific revisions to existing inspection schedules, locations, and techniques have been described, llL2 Element 2: Enaineerina Analvsis In the second element, the staff reviewer verifies that the licensee's engineering analysis of the proposed changes uses a combination of traditional engineering analysis with supporting insights from a PRA. To be acceptable, the licensee should have verified that defense-in-depth is maintained, sufficient safety margins are maintained, and that proposed increases in risk, and their cumulative effect, are small and do not cause the NRC Safety l

Goals to be exceeded. RGs 1.174 and 1.178 provide guidance for the performance of this evaluation.

ll1.2.1 Traditional Analvsis-The engineering analyses are reviewed to ensure that the impact of the proposed ISI changes is consistent with the principles that defense-in-depth and adequate safety margins are maintained in accordance with the acceptance criteria in subsection 11.2.1.

The reviewer verifies that the proposed changes to the ISI program meet or exceed the intent of the ASME BPVC Section XI to identify conditions that are precursorc to leaks and ruptures and that the ISI program provides plans for additional and more frequent inspections in response to detection of flaws and degradation mechanisms. The reviewer ensures that the licensee has demonstrated that there is no adverse impact of the proposed changes in the ISI program on the augmented inspection programs such as IGSCC and EC.

Ill.2.2 Probabilistic Risk Assessment The PRA performed is reviewed in accordance with the acceptance criteria in subsection 11.2.2 to confirm that it realistically reflects the actual design, construction, and operational practices and reflects the impact of previous changes made to the approved requirements.

The reviewer should identify those parts of the PRA model which support the char:ge application. All previous staff and utility reviews (such as the IPE and IPEEE staff evaluation reports, the maintenance rule inspection report, industry peer or certification reviews) should be obtained. The reviewer should ensure that any prior review findings which may influence those parts of the PRA model or results supporting the ISI change request have been adequately addressed. If necessary to support the change request, a focused scope or a more detailed PRA review should be undertaken. The assessed change in risk due to ISI implementation should be evaluated in accordance with the guidelines in Section 2.4.2 of RG 1.174. General guidance for focused scope and more detailed PRA quality reviews is presented in SRP Chapter 19.

111. 2. 2. 1 Scoce of Pioino Systems Scope of piping systems included in the RI-ISI program is reviewed in accordance with the 3.9.8-18

l-acceptance criteria in subsection 11.2.2.1.

111.2.2.2 Pioino Seoments Criteria and procedures used to establish piping segnients within the piping systems are reviewed to determine whether consequences of failure, degradation mechanisms, and segment boundaries are properly considered for defining piping segments in accordance with the acceptance criteria given in subsection 11.2.2.3 of this SRP section.

111. 2. 2. 3 Evaluatina Pine Failures with PRA Acceptable approaches for evaluating pipe failures with PRA are provided in subsection 11.2.2.3. The approach used is reviewed to verify whether the sequence of events from new initiators is appropriately developed if piping segment' failure introduce new initiating events. If the pipe segment failure yields the same consequences as some other initiator already included in the PRA, the reviewer verifies that the risk from the original initiating event is appropriately represented in the ISI analysis.

If pipe failures are characterized by a set of PRA basic events used as surrogates representing the equivalent impact of the pipe failure, the basic events are reviewed to insure that the surrogate is an adequate representation of the pipe segment failure, and that the resulting risk insights are reflected in the ISI analysis. If surrogate basic events cannot be found, the analysis used to characterize the new failure events using the PRA models or I

results and extract representative risk insights is reviewed.

Ill.2.2A Pioina Failure Potential The processes and documentation used to identify the degradation mechanisms is reviewed to verify that they are sufficient and were systematically applied. The identified degradation mechanisms are reviewed to determine that the results are an appropriate characterization and were developed at a level of detail consistent with the use of the information to support the change request. These detailed results are also compared to the reported inspection locations to determine the relationship between the inspection location, strategies, and degradation mechanisms. The procedures used to determine the failure potential of piping segments are reviewed in accordance with the acceptance criteria in subsection l1.2.2.4 to verify that the appropriate failure frequency, demand f ailure, or unavailability mode was used to characterize the impact of failure, and that the determination of the quantitative estimate or group classification is appropriate to the failure mode. The licensee's treatment of uncertainties in failure potential determination and all conclusions are reviewed. The incorporation of the findings of the uncertainty analyses into the final decision making process is reviewed.

When a computer code is used to develop a quantitative estimate, verification and validation of the computer code that implements the probabilistic fracture mechanics techniques is reviewed. When expert elicitation is used, the selection and training of the experts and the elicitation process is reviewed. When the failure potentialis determined by classifying the failures into groups, the applicability of the classification scheme is 3.9.8-19

reviewed.

Ill.2.2.5 Consecuences of Failure The reviewer verifies that the licensee has considered both direct and indirect effects of each segment failure The guidelines for determining the direct and, in particular, the indirect ef fects of pipe failure on plant equipment should be reviewed. The reviewer should verify that these guidelines have been consistently applied and that the results of the analysis are well documented. Guidelines for evaluating the consequence of different leak sizes and selecting the most severe consequence should also be reviewed if applicable.

ll1. 2. 2.6 Risk Imoact of ISI Chances The risk impact of the proposed change in the ISI program is reviewed for compliance with the acceptance criteria in subsection 11.2.2 of this SRP section. The licensee's risk assessment is reviewed to verify that any proposed increases in core damage frequency and risk are small and are consistent with the intent of the Commission's Safety Goal Policy Statement. Selection of piping segments is reviewed to ensure that assumption guiding the spatial effects of pipe failures are applied consistently. It should reflect the current plant ISI program, and risk insights developed should arise from comparing the baseline with the proposed RI-ISI program implementation plant risk. Risk insights are reviewed to ensure that they appropriately account for the change in the number of elements inspected, and when feasible, the effects of an enhanced inspection method. The emphasis put on the risk insights and on the PRA results in the decisionmaking process is determined. The PRA is reviewed to verify that the scope, level of detail, and the quality of the PRA is commensurate with the role the risk and the change in risk results play in determining the acceptability of the requested ISI program.

Ill.2.3 Intearated Decisionmakina Acceptance criteria for integrated decisionmaking process is given in subsection 11.2.3. The process by which the traditional engineering analysis addiesses the relevant regulations and the currently approved requirements of the plant is reviewed to confirm that the regulation is met and the intent of the ASME BPVC to maintain integrity of reactor coolant system boundary by ISI is preserved under the RI-ISI program. The documentation providing input to the integrated decision making process is reviewed to ensure that all applicable risk insights, key principles, and supporting elements were addressed and communicated to the final decision making panel. The documentation of the panel deliberations, recommendations, and finding should be review to ensure that all relevant risk informed insights were incorporated into the final program description. After the RI-ISI program is approved and initiated, plant performance should be supported by inspection and analysis and maintained by programmatic activities goals by comparison against specific performance goals.

Acceptability of selection of locations to be inspected is reviewed for compliance with the acceptance criteria in subsection 11.2.3.1 of this SRP. Risk measures used are reviewed to determine that appropriate thresholds are used to rank the piping into high-safety-3.9.8-20

O significant and low-safety-significant. The risk ranking process is reviewed to ensure that it is capable of systematically identifying all high-safety-significant pipe segments, including those that are not included under ASME Section XI.

The procedure used to further review piping segments and piping structural elements that may be inappropriately ranked as low-safety-s;gnificant is reviewed to verify that PRA limitations, operationalinsights, industry pipe failure data, and Maintenance Rule insights are taken into consideration. In addition, the procedure used to determine the ISI program for piping that are subject to ISI under ASME XI requirements but have no segments or piping structural elements exceeding the screening criteria is reviewed to ensure that it is in accordance with the acceptance criteria of subsection 11.2.3.1 of this SRP, JJQ Element 3: Imolementation and Monitorina Proarams The reviewer verifies that the inspection strategies address f ailure mechanisms of concern and there is a sufficiently high probability of detecting oamage before structuralintegrity is compromised. The reviewer verifies that the degradation mechanisms, postulated failure modes, and configuration of piping structural elements are incorporated in the definition of the inspection scope and inspection locations. Selected inspection locations are reviewed to confirm that stress concentration, geometric discontinuities, and terminal ends are considered in establishing the inspection locations. In addition, the reviewer verifies that plant-specific pipe cracking experience has been considered in selecting inspection locations. The reviewer also determines if alternate examination methods are specified to G

ensure structuralintegrity in cases where examination methods cannot be applied due to limitations, such as inaccessibility or radiation exposure hazard. RI-ISI program is reviewed to ensure that system pressure tests and visual examination of piping structural elements is to be performed on all Class 1,2, and 3 systems in accordance with ASME BPVC Section XI Program regardless of whether the segments contain locations that have been classified as high or low-safety-significant.

Sample selection process is examined to verify that expansion of the sample size is consistent with ASME Section XI criteria.

inspection methods selected by the licensee are examined to verify that they address the degradation mechanisms, pipe sizes, and materials of concern. The RI-ISI inspection program is reviewed to confirm that appropriate examination methods and intervals are used and acceptance standards meet the requirements of ASME BPVC Section XI or existing regulatory guidance applicable to the piping system.

IV ELEMENT 4: DOCUMENTATION The reviewer will review the licensee's submittal to ensure that it contains the documentation necessary to conduct the review described in this SRP (i.e., the documentation described in RG 1.178). The Rl-ISI program and its updates should be maintained on site and available for NRC inspection consistent with the requirements of 10 CFR 50, Appendix B.

3.9.8-21

The reviewer should also ensure that the cover letter that transmits to the licensee the staff's safety evaluation approving the proposed RI-ISI program (i.e., alternative ISI program to that prescribed by the ASME Code) contains a statement to the effect that " Failure to comply with the RI-ISI program as reviewed and approved by the NRC staff and authorized pursuant to 10 CFR 50.55afal/3) [e.g., including scope, inspection strategy, documentatiori and other programmatic requirements) constitutes noncompliance with 10 CFR 50.55a and is enforceable."

V EVALUATION FINDINGS The reviewer verifies that sufficient information has been provided and that the evaluation is sufficiently complete and adequate to support conclusions of the following type, to be included in the staff's safety evaluation report.

The staff concludes that the proposed RI-ISI program, which provides an alternative to the ISI requirements of paragraphs of 10 CFR 50.55a, provides an acceptable level of quality and safety. This conclusion is based on the following findings.

The licensee's RI-ISI submittal defines the proposed changes to the ISI program in general terms. The licensee has confirmed that the plant is designed and operated in accordance with the currently approved requirements and that the PRA used in support of the RI-ISI program submittal reflects the actual plant. The licensee has identified those aspects of the plant's licensing bases that may be affected by the proposed change, including rules and regulations, FSAR, technical specifications, and licensing conditions. In addition, the licensee has identified all changes to commitments that may be affected. The particular piping systems, segments, and welds that are affected by the change in ISI program have been identified. Specific revisions to inspection scope, schedules, locations, und techniques are also identified. In addition, plant systems and functions that rely on the affected piping have been identified. Industry and plant-specific experience with inspection program results was obtained and characterization relative to the effectiveness of past inspections of the piping and the flaws that have been observed is described.

The licensee demonstrated that the plant's currently approved requirements and practices are properly reflected in the risk insights derived using the plant specific PRA model and that these insights reflect the impact of previous changes made to the approved requirements. The PRA quality, level of detail, and scope are appropriate for the analysis and the integrated decision process compensated for potential limitations in this quality, level of detail, or scope.

The licensee has conducted an engineering analysis of the proposed changes using a combination of traditional engineering analysis with supporting insights from a PRA. The licensee has demonstrated that the proposed change is consistent with the defense-in-depth philosophy and that it maintains sufficient safety margins as described in RG 1.174.

The scope of the piping systems included in the RI-ISI program for the purpose of screening to classify piping systems as high-safety-significant and low-safety-significant is adequate and the proposed increases in core damage frequency and risk are small and are consistent with the intent of the Commission's Safety Goal Policy Statement.

3.9.8-22

,.m 1

The procedure utilized to subdivide piping systems into segments is acceptable since

.V portions of piping having the same consequences of failure and degradation mechanisms have been placed into the same piping segments in addition, consideration is given to identifying distinct segment boundaries at branching points, locations of size changes, isolation valve, MOV and AOV locations, and pipe break probability.

Each segment's potential for failure is appropriately represented as failure on demand, unavailability, or frequency of failure. The procedure utilized is acceptable since the potential for failure is based on systematic consideration of degradation mechanisms, segment and weld material characteristics, and environmental and operating stresses. The assessment of component failure potential due to aging and degradation takes into account uncertainties. Any computer codes used to generate quantitative failure estimates have been verified and validated against established industry codes.

The impact on risk due to piping pressure boundary failure considers both direct and indirect effects. Consideration of direct effects includes failures that cause initiating events, disable single or multiple components, trains or systems, or a combination of these effects. Indirect effects of pressure boundary failures affecting other systems, components and/or piping segments, also referred to as spatial effects such as pipe whip, jet impingement, flooding or failure of fire protection systems have also been considered.

The results of the different elements of the engineering analysis are considered in an

f integrated decisionmaking process. The impact of the proposed change in the ISI program is acceptable since it is based on the adequacy of the traditional engineering analysis, N

acceptable change in plant risk relative to the criteria, and the adequacy of the proposed implementation and performance monitoring plan.

Careful consideration has been given to implementation and performance-monitoring strategies. Inspection strategies ensure that failure mechanisms of concern have been addressed and there is a sufficiently high probability of detecting damage before structural integrity is impacted. Safety significance of piping segments is taken into account in defining the inspection scope for the Rl-ISI program. Inspection scope and examination methods for the Rl-ISI program provide an acceptable level of quality and safety as stipulated in 10 CFR 50.55ala)(3)(i).

System pressure tests and visual examination of piping structural elements will conthiue to be performed on all Class 1,2, and 3 systems in accordance with ASME BPVC Section XI program regardless of whether the segments contain locations that have been classified as high or low-safety-significant.

VI lMPLEMENTATION 1

The following is intended to provide guidance to applicants and licensees regarding the NRC staff's plans for using this SRP section.

Except in those cases in which the applicant or licensee proposes an acceptable alternative T

method for complying with specified portions of the Commission's regulations, the method

/

J 3.9.8-23 l

I

described herein will be used by the staff in its evaluation of conformance with Commission regulations.

Vll.

REFERENCES 1.

Draft Regulatory Guide RG 1.174, " An Approach for Plant Specific Risk-Informed Decision Making: General Guidance," February 28,1997.

2.

Draft Regulatory Guide 1.178, "An Approach for Plant-Specific, Risk-Informed Decisionmaking: Inservice Inspection of Piping," May 16,1997.

3.

Draft Standard Review Plan Chapter 19, "Use of PRA in Regulatory Activities,"

dated March 3,1997.

4.

Nuclear Energy Institute Draft (Draft A) " Industry Guideline for Risk-Based Inservice Inspection" dated April 12,1996.

5.

ASME Research Report (CRDT-Vol. 20-2, Volume 2 - Part 1), " Risk-Based Inspection

- Development of Guidelines" dated 1992.

l 6.

Westinghouse Owners Group Topical Report WCAP-14572, Revision 1, " Application of Risk-informed Methods to Piping inservice inspection," October 1997.

l 7.

EPRI Report TR-106706, " Risk-informed Inservice Inspection Evaluation Procedure,"

dated June 1996.

8.

ASME Code Case N-560, " Alternate Examination Requirements for Class 1, Category B-J Piping Welds,Section XI, Division 1," dated August 1996.

9.

Proposed ASME Code Case N-577, " Risk-Informed Requirements for Class 1,2, and 3 Piping (Method A),Section XI, Division 1," dated March 1997.

10.

Proposed ASME Code Case N-578, " Risk-informed Requirements for Class 1,2, and 3 Piping (Method B),Section XI, Division 1," dated March 1997.

11.

Generic Letter 88-01, "NRC Position on IGSCC in BWR Austenitic Stainless Steel Piping," U.S. Nuclear Regulatory Commission, January 1988.

12.

Generic Letter 89-08, " Erosion / Corrosion-Induced Pipe Wall Thinning," U.S. Nuclear Regulatory Commission, May 1989.

O 3.9.8-24

1Il ll\\;

i4

'1 D

I A

LP I

7 AS 6

ME~

G.

E SFC DR O SALN N N CA ST I

U M TE SG R

RA E

F T P

I SO P

1 e,.

NO I

S S 0 0

1 I

0 0

M 0 3

M-5 O5 E

S C5 SS E

0 SU TY2 EN E AR I

T TO C SA S T D UV BIR DA E L N, LP AI R TUO C

N G T I O I

FF E G F Y U RIN OT L

R H A

A S N

E

. E A P

LW CU a

N

-e 1.