ML20195K053
| ML20195K053 | |
| Person / Time | |
|---|---|
| Issue date: | 11/20/1998 |
| From: | Seale R Advisory Committee on Reactor Safeguards |
| To: | Travers W NRC OFFICE OF THE EXECUTIVE DIRECTOR FOR OPERATIONS (EDO) |
| References | |
| ACRS-R-1792, FACA, NUDOCS 9811250154 | |
| Download: ML20195K053 (6) | |
Text
.- - - _ . - - - ---
8
[ % UNITED STATES ACRSR-1792
, o NUCLEAR REGULATORY COMMISSION l
5 I ADVISORY COMMITTEE ON REACTOR SAFEGUARDS PDR WASHINGTON. D. C. 20655
(' \, . ... , /.
November 20,1998 l
i Dr. William D. Travers Executive Director for Operations U.S. Nuclear Regulatory Commission Washington, D.C. 20555-0001
Dear Dr. Travers:
SUBJECT:
SAFETY EVALUATION REPORT RELATED TO WESTINGHOUSE OWNERS GROUP APPLICATION OF RISK-INFORMED METHODS TO INSERVICE INSPECTION OF PIPING, TOPICAL REPORT (WCAP-14572, REVISION 1)
During the 457th meeting of the Advisory Committee on Reactor Safeguards, November 4-7,1998, we met with representatives of the NRC staff and the Westinghouse Owners Group (WOG) to discuss the staff's draft Safety Evaluation Report (SER) on the topical report (WCAP-14572, Revision 1) regarding the WOG application of risk-informed methods to inservice inspection (ISI) of piping and associated Structural Reliability and Risk Assessment (SRRA) model (Supplement 1). Our Subcommittees on Reliability and Probabilistic Risk Assessment.and on Regulatory Policies and Practices met on October 29,1998, to discuss these documents and related matters. We also had the benefit of the documents referenced.
The reactor coolant system boundary (RCSB) is one of the primary barriers to fission product release and has been designed to be highly reliable. Piping constitutes a significant portion of the RCSB.
Because of its robust design and the protection afforded by other mitigation systems, piping failures generally make relatively small contributions to measures of risk such as core damage frequency (CDF). Assurance of the integrity of primary barriers such as the RCSB is, however, a comerstone of defense-in-depth. Inservice inspection is used to ensure that failure modes such as flow-accelerated corrosion or unanticipated thermal fatigue that were not anticipated in the original design do not unduly compromise the integrity of this barrier.
Conclusions and Recommendations
- 1. We concur with the conclusion reached by the staff in the SER that the methodology described in WCAP-14572, Revision 1, can be used to develop risk-informed ISI programs
, that will provide an acceptable (and, we believe, superior) alternative to the requirements of I
paragraph (g) of 10 CFR 50.55(a) and that conform to guidance in Regulatory Guides 1.174 () Ofk (General Guidance) and 1.178 (ISI). B
,y.- .
! 9811250154 981120 PDR ACRS R-1792 PDR,,;
- , 1 l
l 2
'2. The draft SER identifies changes that the staff believes need to be made in WCAP-14572. l We recommend that the changes requested by the staff be incorporated into WCAP-14572.
We note that WOG has already proposed revisions (Ref. 3) that are intended to address i most of the issues in the draft SER. We believe that one of the changes proposed by WOG !
(Item 19, Ref. 5) should be modified, as discussed later in this letter. We also recommend that the modification regarding model uncertainty (Page 127 of WCAP-14572, Revision 1),
proposed in Ref. 5, be omitted. ;
I
- 3. Although the codes used to derive probabilities of failure are useful tools, the values j obtained are very sensitive to the decisions of the analyst who must identify and select the '
l appropriate input parameters to the code and the likely failure mechanisms. We l recommend that the information provided to the expert panel include a discussion of the
! significance of model uncertainties in code predictions and their potential impact on the
! classification of pipe segments.
- 4. Because risk-informed ISI can reduce the risk from piping failures, occupational radiation exposure to personnel, and associated inspection costs, we commend the staff and industry for their efforts in resolving differences in a timely manner.
Overall Methodoloav
! WCAP 14572 documents a methodology that can be used to develop alternatives to the current ASME Code Section XI inspection program for piping. In the Code procedure, the piping is grouped into three broad Classes ranked in order of presumed risk significance. The probability of failure for the piping element is ranked in terms of the design stress levels and the cumulative usage factor. The inspection is focused completely on welds and the fraction of welds, to be-inspected, and depends only on the Class to which the piping belongs. The WCAP 14572 methodology can be used to examine additional failure mechanisms and locations and can provide more informed estimates of risk significance, the relative probability of failure of piping i segments, and the number of welds that rnust be inspected to achieve an acceptable level of reliability. l l
In the WCAP analysis, piping segments are classified in terms of high and low failure potential
("importance"in the WCAP terminology), and high- and low-safety significance. In accordance with the guidance provided in Regulatory Guide 1.174 and Regulatory Guide 1.178, the quantitative results derived from the plant probabilistic risk assessment (PRA) and other analytical tools, together with input from other engineering analyses, operational experience, and an expert panel, are used in an integrated decisionmaking process to develop the inspection program. The unique features of the WCAP-14572 methodology are its approach to using an existing PRA to quantify risk significance of piping segments, the SRRA model, a probabilistic fracture mechanics tool for computing probabilities of failure, and the statistical model used to determine number of locations that must be inspected in order to meet the proposed performance measure, i.e., a low probability of leakage.
, 3
.Use of Exis' tina PRAs to Determine Safety Sianificance Existing PRAs do not directly incorporate pipe segment failure events. In WCAP-14572, the WOG does not propose modification of the PRA to incorporate these events directly, but instead proposes that the impact on CDF and large, early release frequency (LERF) for a segment can be determined by the use of surrogate events, i.e., initiating events, basic events, or groups of events that are already modeled in the PRA and that have effects representative of those associated with the failure of the piping segment. Such an approach to the use of a PRA to gain insights on the potential significance of elements not directly included in the PRA could have broader applications l beyond ISI.
The Risk Reduction Worth (RRW) of a piping segment, which measures the reduction in CDF when the segment is assumed never to fail, is used as a quantitative measure of safety ;
significance. Because piping failure probabilities are low, if the total CDF for all plant internal I i events is used to compute RRW, none of the pressure boundary piping components would be
- safety-significant, i.e., all RRWs would be equal to 1. To prioritize piping segments, the RRW is instead computed using just the portion of the total CDF that is associated with piping boundary failures. We agree that this approach provides a more meaningful measure of the risk l l
significance of a piping segment. '
Any application using risk-insights derived from the PRA presumes a sufficient standard for PRA
,. quality. Additional considerations are required when using measures such as RRW. For i
example, it is often assumed that if something cannot be modeled accurately, it is satisfactory to '
at least model it conservatively. Although this may be true for measures of ~overall risk such as CDF and LERF, undue conservatisms in some parts of the analysis can give completely l misleading results in the case of measures such as RRW Both the staff and WOG are aware of l such potential difficulties, and until more accurate assessments of the quality of PRAs are l available, the expert panelis expected to recognize misjudgments of significance.
Determination of Pioina Failure Probabilities l The SRRA probabilistic fracture mechanics model used to estimate piping fracture probabilities l has been benchmarked against the PRAISE code, developed by NRC. The SRRA modelis j intended to be simpler, more user friendly, and more computationally efficient than PRAISE. In a l series of benchmark calculations, results of SRRA have compared well with those of PRAISE.
The SRRA model also includes flow-accelerated corrosion, which is not included in PRAISE.
Neither SRRA nor PRAISE is meant to provide detailed mechanistic predictions of degradation phenomena, but used together with insights based on plant operating experience, they provide relative estimates of the susceptibility of the piping segment to failure. The relative ranking will be largely determined by the judgment of the analyst through selection of input parameters to the code. This selection reflects the analyst's knowledge of the phenomenon and operating experience. The SRRA code provides a quantification of this subjective understanding and j converts the knowledge that an expert has (the relative aggressiveness of the strer., sors on a j piping segment) into a quantity, the probability of failure, that otherwise would be difficult to determine.
- - - - - ~ .-
. 4
. Effect of Uncertainties Uncertainties include those due to parameter uncertainties and those related to model uncertainty,
! l.a., the inability to correctly describe all degradation behavior and determine all parameters that affect degradation. The parameter uncertainties, such as the inherent randomness in material properties and flaw distributions, are relatively easy to model, but they are also the least significant source of uncertainty.
Although both the staff's SER and the Westinghouse reports focus on parameter uncertainties, the dominant role of model uncertainties is noted. Section 4.4 of Supplement 1 of WCAP-14572 states that model uncertainty " bounds all the other uncertainties, [and) is also the most difficult to predict."
\
The probability of piping failure for systems such as PWR primary coolant piping, where the only damage mechanism is mechanical fatigue due to loads anticipated in the design basis, is very low (leak probabilities are typically <104 and break probabilities are about <104over the life of the plant). For systems with active degradation mechanisms, the probabilities of failure are much higher (3 to 4 orders of magnitude). Hence, despite the uncertainties associated with these calculated failure probabilities, the classification of the piping segments into those with high failure potential and low-failure potential chould be relatively robust because the analyst and the expert panel need only be able to distinguish those segments in which an active degradation mechanism is present and those in which it is not.
The impact of the uncertainties in the failure probabilities on the safety significance classification is more difficult to characterize. The WCAP eMempts to address model uncertainty by examining the impact of variations in the pipe failure probabilities on the safety significance classification of the segments. In the SER, the staff has requested that such analyses be performed on a plant-specific basis to demonstrate that no segments of low-safet/ significance move into the high-safety significance category when reasonable variations in the pipe failure probabilities are considered. The results of these analyses would be provided to the expert panel. The staff concludes that such analyses would adequately address model uncertainty for the purpose of classifying the segments as either high or low safety significance. We believe that such an approach is adequate for this application. The WCAP (Item 19, Ref. 5) should be modified, however, to make clear that the robustness of the classification should be investigated over reasonable ranges of the input parameters describing the degradation modes (flow-accelerated corrosion, stress corrosion cracking, vibration fatigue, etc.), since these modes will be more scrutable for review by the expert panel than are the failure probabilities, in its response (Ref. 4) to questions raised at the October 29,1998 ACRS Subcommittee meeting, WOG proposes to address these uncertaintie'sby assuming lognormal distributions with median values equal to the code estimates and the standard deviations estimated using judgment. We believe that there is no technical basis for the assumption that the code results may be used as median values. In fact, model uncertainty means that one does not know how good the code results are. Thus, it does not appear that this approach is helpful.
We believe that the issue of model uncertainty is very important and that its importance should be highlighted in both the WCAP report and the staff's SER and that it should be made clear to the expert panel so that the integrated decisionmaking process will be fully informed. What really
. - - . - ~ _
f
, S
, , matters is that the final classification of the oipe segments be robust and that the focus of the
! panel's deliberations be the possible imp of model uncertainties on this classification.
l Determination of the Number of Locations to be insoected All piping segments, including those classified as having low-failure potential and low-safety significance, will continue to be subject to the system pressure tests and visual inspections l currently required by ASME Section XI. The WCAP comm.ts its users to the volumetric inspection l 1 of 100 percent of the locations in piping segments of high-safety significance that are susceptible to degradation mechanisms, such as thermal fatigue. Segments with failure modes that have established auginented inspection programs, e.g., flow-accelerated corrosion or stress corrosion cracking, would be inspected in accordance with that program. Other locations in the segments of
, high-safety significance are selected for examination by a statistical evaluation method that uses the probability of a flaw, the conditional probability of a leak, the frequency of leaks considered ac t ptable (target leak rate), and a desired degree of confidence to determine a minimum nt. )er of welds to inspect. The proposed target leak frequencies vary with pipe size and range fror.1 x 104 to 1 x 10 4/ year / weld. These values are slightly more conservative than operating system experience would suggest has been achieved when ASME Section XI criteria have been used. The pipe break frequency, which drives the safety significance classification, is typically at least three orders of magnitude lower than the frequency of smallleaks. The proposed statistical evaluation method has been peer reviewed and determined to be a satisfactory approach for determining the number of welds that need to be inspected to meet the target leak frequencies at a 95 parcent confidence level.
Concludina Remarks We concur with the staff's conclusion in the SER that, although the calculation of the change in risk (CDF/LERF) using the WCAP methodology is not precise, it willillustrate whether the result is an increase or decrease in risk. It will provide reasonable assurance that the changes to the ISI program will not result in a total risk increase that would exceed the guidelines in Regulatory Guide 1.174.
As we have noted in our recommendations, both the staff and industry have t een working diligently to complete the review of the topical report and the Surry pilot project. We believe that implementation of effective risk informed inservice inspection for piping will be a significant step towards a more efficient regulatory system.
j Sincerely, R. L. Seale Chairman
. .~ . _ - .
l'# "
. 6
References:
.1. Safety Evaluation Report Related to " Westinghouse Owners Group Application of Risk-Informed Methods to Piping inservice inspection" (Topical Report WCAP-14572, Revision 1), received November 4,1998. (Predecisional)
- 2. Westinghouse Energy Systems, WCAP-14572, Revision 1, " Westinghouse Owners Group Application of Risk Informed Methods to Piping inservice inspection Topical Report,"
l October 1997.
l
- 3. Westinghouse Energy Systems, WCAP-14572, Revision 1, Supplement 1, " Westinghouse Structural Reliability and Risk Assessment (SRRA) Model for Piping Risk-Informed Inservice Inspection," October 1997.
- 4. Letter dated November 3,1998, from Lawrence A. Walsh, Westinghouse Owners Group, to i
Peter C. Wen, U.S. Nuclear Regulatory Commission,
Subject:
Transmittal of Further Proposed Revisions to WOG RI-ISI Program Reports: WCAP-14572. Revision 1 (Non-l Proprietary]"WOG Application of Risk-informed Methods to Piping inservice inspection Topical Report" and WCAP-14572, Revision 1, Supplement 1 (Non-Proprietary]
" Westinghouse Structural Reliability and Risk Assessment (SRRA) Model for Piping Risk-Informed Inservice inspection."
l 5. Letter dated September 30,1998, from Louis F. Liberatori, Jr., Westinghouse Owners Group, to Peter C. Wen, U.S. Nuclear Regulatory Commission,
Subject:
Transmittal of Responses to NRC Open items on WOG RI-ISI Program and Reports: WCAP-14572, Revision 1 [Non-Proprietary]"WOG Application of Risk-Informed Methods to Piping inservice inspection Topical Report" and WCAP-14572, Revision 1, Supplement 1 [Non-l Proprietary] " Westinghouse Structural Reliability and Risk Assessment (SRRA) Model for Piping Risk-informed inservice Inspection."
- 6. Report dated June 12,1998, from R. L. Seale, Chairman, ACRS, to Shirley Ann Jackson, Chairman, NRC,
Subject:
Proposed Final Standard Review Plan Section 3.9.8 and i
Regulatory Guide 1.178 for Risk-informed inservice Inspection of Piping.
- 7. W. E. Vesely, Reservations on "ASME Risk-Based inservice inspection and Testing: An Outlook to the Future," Risk Analysis, Vol.18, No. 4 (1998), pp. 423 425.
- 8. ASME Research Members on Risk Based Inservice Inspection (ISI) and Testing (IST) and Supporting Industry Representatives, Response to Reservations on "ASME Risk-Based inservice Inspection and Testing: An Outlook to the Future," Risk Analysis, Vol.18, No. 4 (1998), pp. 427-431.
- 9. U. S. Nuclear Regulatory Commission, Regulatory Guide 1.174, "An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis," July 1998.
- 10. U. S. Nuclear Regulatory Commission, Regulatory Guide 1.178, "An Approach for Plant-Specific Risk-informed Decisionmaking Inservice inspection of Piping," issued for trial use September 1998.
~