ML20198G185
| ML20198G185 | |
| Person / Time | |
|---|---|
| Issue date: | 12/15/1998 |
| From: | NRC (Affiliation Not Assigned) |
| To: | |
| Shared Package | |
| ML20198G175 | List: |
| References | |
| PROJECT-694 NUDOCS 9812290009 | |
| Download: ML20198G185 (59) | |
Text
_ _ -. -
p* ucoq j
y ,
t UNITED STATES j
NUCLEAR REGULATORY COMMISSION
't WASHINGTON, D.C. 2055N1 o
%,.....,,o l
i SAEEILEVALUAILORBY THE QEEICERENUCLEAR REACTOR REGULAIlON WCAP-14572. REVISION 1. " WESTINGHOUSE OWNEESJGROUP_
i AEEllCATION OF R[SK-lNFORMED METHODS ICLElEINGjhSERVICE INSPECTION TOPICAL REPORT" i
i l
l l
l 9812290009 991215 l
PDR TOPRP ENVWEST C
PDR I
Enclosure i
i
o i
4 I
l TABLE OF CONTENTS
1.0 INTRODUCTION
.1 2.0
SUMMARY
OF THE PROPOSED APPROACH.
1 3.0 EVALUATION
.2 3,1 Proposed Changes to ISI Programs 2
3.2 Engineering Analysis
.3 3 2.1 Scope of Piping Systems.
4 3.2.2 Piping Segments.
5 3 2.3 Piping Failure Potential 6
324 Consequence of Failure.
11 3.3 Probabil;stic Risk Assessment.
12 3.3 1 Evaluating Failures with PRA
. 14 3.3 2 Use of PRA for Categcrizing Piping Segments...
14 3.3.2.1 Sensitivity to Modeled Human Actions.
15 3.3.2.2 Sensitivity to Segment Failure Probability.
. 16 3.3.3 Change in Risk Resulting from Change in ISI Programs.
18 3.4 Integrated Decisionmaking 19 3.4.1 Selection of Examination Locations.
21 3 4.2 Examination Methods 22 3.5 Implementation and Monitoring 22 3.6 Conformance to Regulator; Guide 1.174 24 2
4.0 CONCLUSION
S.
.25
5.0 REFERENCES
.30 APPENDIX A Review of WCAP-14572. Revision 1, Supplement 1," Westinghouse Structural Reliability and Risk Assessment Model for Piping Risk-Informed Inservice inspection
. A-1 A.1 Introduction
.A2 A2
Background
A-2 A.3 Overview of Assessment A-3 ii
b l
-c-A.4 Review of Specific Issues.
... A-3 A.4.1 Failure Mechanisms...
. A-3 A 4.2 Fatigue........
.A-4 A.4.3 - Stress Corrosion Cracking.
. A-4 A.4.4 Flow Assisted Corrosion / Wastage.
.A-5 A.4.5 Failure Modes (Leaks and Breaks)
..A-7 A.5 Component Geometries.
A-7 A.6 Structural Materials
.. A-8 A.7.
' Loads and Stresses
. A-8 A.8 -
Vibrational Stresses..
... A-9
. A.9 Residual Stresses
. A-10 A.10 Treatment of Conservatism.
. A..
A.11 Numencal Methods and importance Sampling
. A-11 A.12 Documentation and Peer Review
.A-12 A.10 Validation and Bench Marking.
.... A-12 A.13.1 Bench Marking Against pc-PRAISE
.A-12 A.13.2 Validation with Operating Experience
...A-14 A.14 Flaw Density and Size Distributions
' A-15 A.15 Initiation of Service-induced Flaws
.A 15 A.16 Preservice Inspection.
A-16 A 17 Leak Detection
. A-16 A.18 Proof Testing
... A-17 A 19 Inservice inspection
....... A-17 A.20 Service Environment A-18 A.21 Fatigue Crack Growth Rates
. A-19 A.22 IGSCC Crack Growth Rates
.. A-19 A 23 Wall Thinning Rates.
. A 19 A.24 Material Property Variability.
. A-20 A.25 Summary and Conclusions
.. A-20 A.26 References for Appendix A
.. A-23 iii
l ABBREVIATIONS 1
l ASME American Society of Mechanical Engineers l
BWR Boiling Water Reactor j.
'CDF Core Damage Frequency l
CRGR Committee to Review Generic Requirements l
EC Erosion Corrosion
[
EPRI Electric Pov'er Research Institute FAC-Flow-assisted Corrosion FSAR Final Safety Analysis Report IGSCC Intergrannular Stress Corrosion Cracking
.lSI-Inservice inspection l
l-
- LERF Large Early Relief Frequency l
. MOV Motor-operated Valves NDE Nondestructive Examination L
NEl Nuclear Energy Institute 1
POD Probability of Detection l
PRA Probabilistic Risk Assessment PWR Pressurized Water Reactor RAWL Risk Achievement Worth I
RCS Reactor Coolant System RG Regulatory Guide RIISI Risk informed Inservice inspection RRW Risk Reduction Worth SER Safety Evaluation Report SRP Standard Review Plan SRRA
- Structural Reliability and Risk Assessment WOG Westinghouse Owners Group f
l 4
iv l
I
1 1
SAFETY EVALUATION REPORT RELATED TO
" WESTINGHOUSE OWNERS GROUP APPLICATION t A RISK INFORMED METHODS TO PIPING INSERVICE INSPEUllON" (TOPICAL REPORT WCAP-14572, REVISION 1) i
1.0 INTRODUCTION
On October 10,1997, Nuclear Energv Institute (NEI), on behalf of Westinghouse Owners Group (WOG), submitted Revision 1 of Topical Report WCAP 14572, ' Westinghouse Owners Group Application of Risk informed Methods to Piping inservice inspection * (Ref.1) for review and approval by the staff of the U. S. Nuclear Regulatory Commission (NRC). Supplement 1,
" Westinghouse Structural Reliability and Risk Assessment (SRRA) Model for Piping Risk-l Informed Inservice inspection, " (Ref. 2) was included as part of that submittal.
WCAP-14572. Revision 1, provides technical guidance en an alternative for selecting and categonzing piping components as high safety-significant (HSS) or low safety-significant (LSS) groups in order to develop a nsk informed inservice inspection (ISI) program as an alternative to the Amencan Society of Mechanical Engineers (ASME) 8PVC Section XI ISI requirements for piping. Current inspection requirements for commercial nuclear power plants are contained in the 1989 Ed; tion of Section XI. Division 1 of the ASME Boiler and Pressure Vessel Code (BPVC), entitled " Rules for Inservice Inspection of Nuclear Power Plant Components", (the Code) The nsk-informed inservice inspection (RI-ISI) programs enhance overall safety by focusing inspections of piping at HSS locations and locations where failure mechanisms are likely to be present, and by improving the effectiveness ofinspection of components because the examination methods are based on the postulated failure mode and the configuration of the piping structural element. WCAP 14572 provides details required to incorporate risk-insights when identifying locations for inservice inspections of piping, in accordance with the general guidance provided in Regulatory Guide (RG)-1.174 (Ref. 3) and RG 1.178 (Ref. 4).
The WOG has asserted that the WCAP methodology for RI-ISI is a detailed implementation document for ASME Code Case N-577 (Ref. 5). However, the staff has net evaluated Code Case N-577 to determine its acceptability. Also, the staff has not evaluated WCAP-14572 to determuie ifit is an acceptable document to meet the intent of Code Case N-577.
In developing the methods desenbed in WCAP 14572. Revision 1, the industry incorporated insignis gained from two plants. Millstone Unit 3 and Surry Unit 1. The staff's review of WCAP 14572 incorporates information obtained through technical discussions at public meetings and through formal requests for additional information in address the issues related to the analytical methods, observance of the application of the methods to the Surry pilot plant, review of the Surry RI ISI application, independent audit calculations, and peer reviews of selected technical issues.
2.0
SUMMARY
OF THE PROPOSED APPROACH The scope of the Rl-ISI program includes changes in the current ASME XI piping ISI requirements with regard to the number of inspections, locations of inspections, and methods of flLi SI R%C AP hl.
I j
__ _ _ ~ _.._
inspections. The scope of the RI ISI program does not include changes in the curre'nt ASME XI piping ISI requirements with regard to the inspection intervals and periods, acceptance criteria for evaluation of flaws, expansion criteria for flaws discovered, inspection techniques and personnel qualification. It should also be noted that augmented examination program for degradation mechanisms such as intergrannular stress corrosion cracking (IGSCC) and erosion-corrosion (EC) would remain unaffected by the RI ISI program.
Page 4 (Section 1,1) of WCAP 14572 states that "This report provides an alternative inspection location selection method for nondestructive examination (NDE) and does not affect current l
Owner-defined augmented programs? For RI-ISl programs whose scope incorporates I
augmented inspection programs, the effect of the current augmented programs on risk should be addressed. In most circumstances, the staff believes that the current augmented programs would be found acceptable. However, should the Rl ISI analysis identify that improvements to the augmented programs are warranted to maintain risk at acceptable levels, then those changes should be integrated into the respective programs.
The proposed approach is specifically for the NDE of Class 1 ar.d 2 piping welds, but also includes Class 3 systems and non-Code class components found to be HSS in the risk evaluation. As stated by the Westinghouse Owners Group (WOG), other non-related portions of the Code will not be affected by implementation of WCAP 14572, Revision 1, approach.
The Rl-ISI process includes the following steps.
l scope definition segment definition consequence evaluation failure probability estimation e
risk evaluation expert panel c.ategorization element /NDr - alection l
implementatich, monitoring, and feedback 3,0 EVALUATION For this safety evaluation, the NRC staff reviewed the WOG RI-ISI methodology, as defined by WCAP-14572 Revision 1, and its Supplement 1. with respect to the guidance contained in RG 1.178 and Standard Review Plan (SRP) Chapter 3.9 8 (Ref. 6) which desenbes the acceptable methodology, acceptance guidelines, and review process for proposed plant-specific, risk-l informed changes to ISI programs for piping components. Further guidance is provided in RG 1.174 and SRP Chapter 19.0 (Ref. 7) which contains general guidance for using Probabilistic l
Risk Assessments in risk informed decision making.
3.1 Proposed Changes to the ISI Programs Under the ASME Code, licensees are required to perform inservice inspection (ISI) of Category l
B-J and C-F piping welds. as well as Examination Category 8-F dissimilar metal welds, during
(
l
l l'
j successive 120-month (10-year) intervals. Currently,25% of all Category B J piping welds greater than 1 inch nominal diameter are selected for volumetric and/or surface examination on the basis of existing stress analyses. For Cstegory C-F piping welds,7.5% of non-exempt welds are selected for surface and/or volumetric examination. Under Examination Category B-F, all dissimilar metal welds require volumetric and/or surface examination.
i Pursuant to Title 10, Section 50.55a(a)(3)(i), of the Code o/FederalRegulations (10 CFR 50.55a(a)(3)(i)), licensees proposin; to use WCAP-14572 methodology would propose an alternative to the ASME Code examination requirements for piping ISI at their plants. As stated in Section 1.2 of WCAP-14572, Revision 1, the RI ISl program is intended to improve ISI effectiveness by focusing inspection resources on HSS locations where failure mechanisms are likely to occur. Therefore, the proposed approach meets the intent of ASME Section XI that the flaws are found before they lead to leakage and therefore the approach provides an acceptable level of safety.
Augmented examination program for degradation mechanisms such as IGSCC and EC would remain unaffected by the RI-ISI program. As stated in the WCAP 14572 (page 80, Section 3.5.5) and reiterated in the public meeting (item 11, Ref. 8) with Westinghouse on September 22.1998. no changes to the augmented inspection programs are being made with the proposed j
change to the ASME Section XI Program. For calculating risk rankings, augmented programs such as erosion-corrosion and stress corrosion cracking programs are credited when the augmented program is deemed adequate to detect relevant degradation mechanisms.
Augmented programs are also credited in the change of nsk evaluation for both ASME Section
(
XI programs and RI-ISI programs.
Sections 1.1 and 14 of WCAP 14572 Revision 1, desenbe the proposed changes to the ISI program that would result from applying this methodology. Details of the proposed changes (that is, the specific pipe systems, segments, and welds, as well as the specific revisions to inspection scope, locations, and techniques) are plant specific and, therefore, are not directly applicable to this evaluation. Section 3.2 of WCAP-14572 describes the process for identifying the piping systems to be included in the scope of the RI ISI program. Plant functions are considered n the expert panel review process during the consequence evaluation. In response to the staff open item 8(a) (Ref, 9), WCAP-14572 is being revised (Ref. 8) to state that the safety functions of the system and piping segment being reviewed should be presented to the expert panel to ensure that the expert panel specifically addresses the relationship between the systems and piping being evaluated and their associated plant safety functions. WCAP Sections 3.5 2 cnd 3.5 3 address how industry and plant specific experience are considered as part of the evaluation process, Finally, Sections 4.4 and 4.5 of WCAP-14572 provide examples from the pilot studies of revisions to inspection scope, locations, and techniques.
I 3.2 Engineering Analysis According to the guidelines in RGs 1.174 and 1.178, the licensees proposing an RI ISI program should perform an analysis of the proposed changes using a combination of engineering analysis with supporting insights from a probabilistic risk assessment (PRA). For the RI ISI program, engineenng analysis includes determining the scope of piping systems included in the RI-ISI program. establishing the methodology for defining piping segments, evaluating the failure HLE SE RwCAP WL 3
l l
m..... - _ _. -. _ _ - -. - _ _. _ _. _. _ _-._ _ - -.._.-. _._ _
i L
l potential of each segment, and determining the consequences of failure of piping se'gments.
The following subsections discuss each of these aspects in greater detail.
3.2.1 Scope of Piping Systems l
In accordance with the guidelines in Section 1.3 of RG 1.178, the staff has determined that full l
scope and partial scope options a e acceptable for Rl ISI programs for piping. The full scope l
option includes ASME Class 1,2, and 3 piping and piping whose failure would compromise safety related structures systems, or components (SSC), and non-safety related piping that are
~ relied upon to mitigate accidents or whose failure could prevent safety-related SSC to perform their function or whose failure could cause a reactor scram or actuation of a safety-related system. For the partial scope option, a licensee may elect its RI ISI program for a subset of
. piping classes, for example, Class 1 piping only.
Section 3.2 of WCAP-14572, Revision 1, describes the scope of systems to be considered in an RI ISI program WCAP-14572 identifies three enteria for system selection. Criterion 1: all Class 1,2, and 3 systems currently within the ASME Sect;on X! program; Criterion 2: piping systems modeled in the PRA. and Critenon 3: balance of plant fluid systems determined to be of l
importance (mainly on the basis of NEl guidance for,molementation of the Maintenance Rule with respect to safety significe. ce categorization). The Maintenance Rule scope definition is i
used to provide a starting poti for the determination of the scope of the Rl ISI program.
l Section 2.3 of WCAP-14572 states that the scope incorporates piping segment cutsets that i
cumulatively account for about 90 percent of the core damage frequency attributed from piping alone.
In addressing the exclusion of piping systems from the scope of the RI ISI program, Section 3.2 of WCAP 14572 includes the following explanation:
' Twenty-one systems were selected to be evaluated in more detail for the representative WOG plant. The remaining systems are excluded from the scope of the risk informed ISI program. These systems are not addressed by ASME Section XI, but some were considered by the PRA (such as emergency dieseljacket water, containment instrument air, and instrument air). However. each of these systems was reviewed by the plant expert panel using the same enteria as in the determination of risk-significance for the Maintenance Rule In addition, the consequences postulated from the loss of any of these systems from a pipe failure were determined not to be significant. Therefore, these systems in their entirety, were determined to be outside the scope and not further evaluated."
l l
In order to allow for partial scope, the next revision of WCAP-14572 will add the following statement in Section 3 and 3.2 as stated on page 264 of Ref. 8:
"A full scope program is recommended because a greater portion of the plant risk from piping pressure boundary failures is addressed in the risk-informed ISI program versus current ASME Section XI requirements since the examination are now placed in several high safety-significant piping segments that are not currently examined by the current Section XI approach However, a partial scope evaluation may be performed given that the evaluation d
HLE SIRWC AP FM 4
c
includes a subset of piping classes, for example, ASME Class 1 piping only, including piping exempt from the current requirements."
The staff finds acceptable the discussion of scope since this definition is consistent with guidance provided in RG 1.178 and SRP Chapter 3.9.8. However, the staff notes that the scope
{
of piping systems for RI-ISI should be plant-specific, and the staff is not endorsing WCAP-14572 l
pilot list of systems for generic use. The staff also finds acceptable the discussion of partial scope option which is consistent with guidance provided in RG 1.178 and SRP Chapter 3.9.8 which state that ine partial scope option is acceptable as long as it is well defined, and the change in risk due to the implementation of the P!-ISI program meets the guidelines in RG 1.174.
l 3.2.2 Piping Segments Section 3 3 of WCAP-14572. Revision 1 provides a definition for piping segments. The approach used to define piping segments was based on the following considerations:
(1) piping failures that lead to the same consequence determined from the plant-specific PRA and other considerations (e.g, loss of a residual heat removal (RHR) train, loss of a refueling water storaga tank (RWST). inside or outside containment consequences, etc.)
(2) where flow splits or joins (3) piping to a point where a pipe break could be isolated (This includes check valves and motor-operated or air-operated valves No credit is generally given for manual valves however, situations may occur where manual valves can be used to isolate a failure by l
plant operators and, in these cases, the decision for crediting manual valves is made by the plant expert panel and documented as such.)
(4)
Pipe size chanrs in defining pipe segments. the possibility of check valves and other isolation valves failing to close is not considered; that is, proper operation of the valves is assumed when defining segment boundanes The staff notes that this assumption will not have a significant impact on the results. since the probability of a valve failing to close is small (ranging from 107 per demand for motor-operated valves (MOV) to approximately 10' per demand for check valves) and the consequences from failure will not change in most instances. In addition, when operator action is credited for the isolation of a pipe break, the valve failure probability will be small when compared to the human error probability, and this cornbined probability will be subject to a sensitivity study as discussed in Section 3.3 of this safety evaluation report (SER). Finally, the treatment of automatic isolation valves will be clarified as follows (item 9 of Ref. 8):
" Automatic isolation valves are assumed to close if the pipe failure in question would create a signal for the valves to close. Containment isolation valves should be carefully
}
considered for segments which contain the containment penetrations. If the segment l
consequences are significantly different assuming an automatic and/or containment isolation valve failure. then the piping segment definition should be reviewed and if F il l $1 RW C \\P I Nt 5
)
i necessary, the piping segment should be further combined or subdivided such tha't the failure of the valve, under pipe failure conditions, would be considered in conjunction with 1
the change in consequences."
The staff finds that the definition of a piping segment, as addressed in Section 3.3 of WCAP-14572, Revision 1 (and subject to the revision noted above) is acceptable since this definition is consistent with the expectations expressed in Section 4.1.4 of RG 1,1M which states that one acceptable approach to divide piping systems into segments is to identify segments as portions of piping having the same consequences of failure in terms of an initiating event, loss of a particular train, loss of a system, or combination thereof. The staffs approvalis conditioned upon Westinghouse making the change to WCAP-14572 described above.
3.2.3 Piping Failure Potential WCAP-14572 methodology is based on industry experience and the Structural Reliability and Risk Assessment (SRRA) computer code to determine the failure probabilities of piping segments. The staff believes that the purpose of the piping failure probability estimation is to provide a relative estimate of the piping failure potentialin order to differentiate the piping i
segments based on potentral failure mechanism and postulated consequences. The relative failure probabilities of piping segments provide insights for use by the expert panelin defining the scope of inspection for the RI-ISI program. Section 3 4 of this SER provides a detailed discussion of the qualification and role of the expert panel.
At its briefing in July 1997, the NRC's Committee to Review Generic Requirements (CRGR) requested that the staff should have a peer review performed with regard to using structural reliability and risk assessment computer codes to estimate the probability of a piping failure.
The peer review, performed by Battelle-Columbus, and documented in a letter report (Ref.10),
concluded that the SRRA computer code is technically sound and within the state-of-tha-art, and that its application can facilitate risk-informed regulatory decision-making in the area of ISI.
Over the past 3 years, as ASME-Research and the WOG developed methods to perform RI-ISI programs for piping. the staff held public meetings with both groups to develop guidelines for acceptable uses of probabilistic fracture mechanics computer codes. In addition, with the assistance of Pacific Northwest National l aboratory (PNNL), the staff performed independent audit calculations to validate the results of the SRRA computer code.
Computer programs CLVSQ and other SRRA computer codes for RI-ISI, such as LEAKMENU and LEAKPROF, were develaped, venfied and controlled in accordance with the Westinghouse Quality Management System.
Section 3.5 of WCAP-14572. Revision 1 presents general discussion of failure probability determinations; the details of the methodology, process, and rationale are contained in Supplement 1 to the WCAP-14572. This includes piping failure modes, degradation mechanisms, SRRA models, program input, uncertainties, and calculation of failure probability over time. Piping failure potential was determined based on failure probability estimates from the SRRA software program. This software uses Monte-Carlo simulation to calculate the probability of a leak or break for Type 304 or 316 stainless steel piping or for carbon steel piping.
1 i
It is recommended in Section 3.5.2, that known failures at other plants be considered and evaluated for applicability, 1
Section 3.4 of WCAP-14572, Supplement 1, addresses the treatment of uncertainties in the failure probability assessments. The statistical variations for a number of input parameters are discussed therein Material properties such as yield strength, ultimate strength, fracture toughness, ard tearing modulus are not mentioned, but inputs for these properties are more j
appropriately addressed in plant specific applications of the program.
j WCAP-14572 methodology involves assigning all significant degradation mechanisms present in the segment to a single weld, and imposing the operating characteristics and environment to that weld The failure probability developed from the Monte-Carlo simulation of this weld is subsequently used to represent the failure probability of the segment, regardless of the number of welds in the segment, or the length of the segment. WCAP-14572 states that this approximation is appropriate since the same loadings occur across the segment and a single i
weld failure will fail the segment WCAP 14572 also states that failures in a piping segment due.
to the dominating failure mechanisms are correlatcJ, and that the failure probability of the weld subject to the dominating mechanisms is typically several orders of magnitude higher than those without the dominating mechanisms. When more than one degradation mechanism is present, the combination of all significant degradation mechanisms for the segment failure probability should produce a limiting failure probability. The output of the SRRA code is thus best desenbed as a relative estimate of the susceptibility of a pipe segment to failure as determined by the weld matenal and environmental conditions within the segment. The WOG methodology primanly uses these estimates in the following ways:
Combine with quantitative nsk estimates from the PRA to support the expert panel's classification of segments into LSS or HSS.
Provide guidance regarding the susceptibility of each segment to failure during the sub-panel's selection of welds to be inspected under the Rl-ISI program.
Since the WCAP 14572 methodology involves assigning all significant degradation mechanisms present in the segment to a single weld. and imposing the operating characteristics and environment to that weld, the staff finds the methodology acceptable to estimate pipe segment failure probabilities, i e.. the estimation of relative failure probabilities is sufficiently robust to support categonzation of pipe segments by the expert panel when this information is used in conjunction with considerations of defense-in-depth and safety margins to support the RI-ISI change request.
The staff also finds it acceptable that the SRP.A code assumes that unstable fractures (ruptures) i of piping are governed by the limit load craerion because it meets the limit load criterion used in the ASME Code, Section XL Appendix H, for unstable fractures. The Log-Normal distributions of flaw aspect ratios are based on the same assumptions used in the pc-PRAISE code, an NRC sponsored code.
i i
The Monte-Carlo method as implemented into the SRRA code is a standard approach which is commonly used in probabilistic structural mechanics codes including the pc-PRAISE code.
importance sampling, again a common and well-accepted approach, increases the l.
Fl! E MR%C \\P FN1
l l
l computational efficiency of the Monte Carlo procedure by shifting the distnbutions fdr random I
variables to increase the number of simulated failures. The magnitude of shift applied to the i
variables by the SRRA code is relatively modest and is not believed to be sufficient to cause l
incorrect estimates of failure probabilities. The staff finds the numerical method acceptable because it represents standard probabilistic fracture mechanics techniques. is based on sound, generally accepted principles of solid mechanics, and is consistent with guidance provided in l
RG 1.178 and SRP Chapter 3 9 8.
l WCAP-14572 states that the median values for stresses were set equal to one-half the stress l
values calculated by ASME Code stress analysis. In the public meeting on September 22,1998 i
[itern 2, Ref. 8) Westinghouse stated that in most piping stress analyses, dead weight, thermal, and pressure stresses are calculated on the basis of conservative assumptions such as coricentrated dead loads, rigid support stiffnesses, conservative design conditions and stress concentration factors. Westinghouse also stated that the next revision of WCAP-14572 will clanfy that if piping stress analysis is performed on the basis of realistic rather than conservative assumptions. higher median values and lower uncertainty can be justified and used in the detailed input options Conditioned upon this change being incorporated into the next revision of WCAP-14572. the staff concludes that the approach for estimating the median values for stresses is acceptable because it is based on assumptions of conservative stresses in common pipe stress analyses and also accounts for situations when realistic, rather than conservative, values of dead load and thermal stresses are used.
In the public meeting on September 22,1998 [ item 3. Ref. 8]. Westinghouse stated that the welding residual stresses used in the SRRA code are consistent with the pc-PRAISE code, Because of conservatism in applying these stresses in the SRRA code, the residual stresses are truncated at a maximum value of 90% of the material flow stress. Westinghouse also stated that the next revision of WCAP-14572 will provid a basis for estimating the residual stresses to be used in the SRRA code. The staff finds the estimation of residual stresses to be acceptable because the conservatism that the residual stress is assumed to be constant through the weld wall and around the circumference. and no ielaxation of residual stress is assumed for an initial fabncation flaw Justifies the assumption that the yield strength of the weld is assumed to be 90%
of the flow stress in the SRRA code for RI-ISI. The staff's approvalis conditioned upon Westinghouse making the change to WCAP 14572 as described above.
In the public meeting on September 22,1998 (item 4. Ref. 8), Westinghouse stated that industry expenence has shown that axial cracks which could initiate from longitudinal welds are not a serious concern and have a low probability of occurrence because of the normal pressure and temperature ranges associated with nuclear operating plants. ASME Code Case N-524 was written to eliminate the requirement to examine longitudinal welds beyond the region of intersection with circumferential welds The staff concludes that this approach is acceptable to address the axial cracks that could initiate from longitudinal welds, conditioned on Westinghouse revising WCAP-14572 [ item 4 Ref. 8] to state that in the rare situation that a longitudinal weld or nonstandard geometry would need to be evaluated, the failure probability should be estimated by other means, such as expert opinion or advanced modeling.
The PRODIGAL program is used to calculate the number of flaws per weld length near the inner
{
surface of the pipe. The staff concludes that this treatment of near-surface flaws is adequate and acceptable because all near-surface flaws are assumed to be inner surface breaking flaws.
Fill WRM \\P INI
i the stress intensity factor for the near surface flaws are conservatively calculated in'the SRRA l
fracture mechanics models, and the flaw density used for the failure probability calculation is not l
reduced to eliminate the effect of flaws that are not actually surface flaws. The staff's approvalis conditioned upon Westinghouse making the change to WCAP-14572 described above as stated by Westinghouse in the public meeting on September 22,1998 [ item 4, Ref. 8].
The CLVSQ program uses a simplified correlation to calculate leak rates. The staff finds the leak rate model to be acceptable since the accuracy of the correlation for fatigue type cracks is estimated to be within 25% and was judged to be acceptable by the ASME Research Task Force. PNNL's studies with pc-PRA'SE also showed that the large leak and break probabilities were relatively insensitive to the actual value of the detectable leak rate in the range of 0.3 to l
300 gpm [ item 5 (c), Ref. 8].
The staff had identified an open item that WCAP-14572, Revision 1, does not identify the value that is used for the high-cycle fatigue stress for the 1-inch pipe size. Westinghouse clarified in the public meeting on September 22,1998 [ item F Ref. 8], that the vibration input for 1-inch pipe size is an input parameter determined by the SRRA user and an insert will be added in WCAP 14572 to provide guidelines for the SRRA user. A correction factor is applied to this stress to obtain the fatigue stress for other pipe sizes. The staff finds this approach to be acceptable since it specifies that the simplified input parameter is the peak-to-peak vibratory stress range in ksi corresponding to a one-inch prpe size. The staff's approvalis conditioned upon Westinghouse making the change to WCAP 14572 desenbed aoove.
Figure 4-2 of WCAP-14572, Revision 1 Supplement 1, graphically compares SRRA model
=
predictions with industry plan' data relative to the probability of violating minimum wall thickness entena because of flow-accelerated corrosion wastage. The staff had expressed a concern (Ref. 9) that the graph indicates that the SRRA model tends to over predict the failure probability early in plant life and to under predict later in life. In the public meeting on September 22,1998
[ item 7 (a), Ref. 8), Westinghouse explained that the minor over prediction early in life is attributable to lower plant startup capacity factors (fraction of time at full power and flow), while the minor under prediction later in life is attributable to higher capacity factors during this more mature period of plant operation. The staff finds this response acceptable since the industry observed failure rates due to wastage are within a factor of 2 to 3 of the SRRA calculated values even though the calculation was based upon data averaged values of p'pe size and wall thickness Supplement 1 to WCAP 14572 provides information on assumptions made in the SRRA wall thinning model. In the public meeting on September 22,1998 [ item 7 (D), Ref. 8], Westinghouse stated that the next revision of WCAP 14572 will provide guidance for material wastage potential consistent with Ref.11. The staff concludes that the guidance for estimating the material wastage potentialis acceptable since, if material wastage rates are high enough to proceed l
through the pipe wall, the probabilities of smallleak, large leak and break are all calculated to be the same. The staffs approvalis conditioned upon Westinghouse making the change to WCAP-i 14572 described above. In addition, the acceptance is limited to this application, i.e.,
development of a risk informed ISI program. As noted elsewhere, the licensees' augmented programs for erosion-corrosion will not be changed as a result of this alternative, and the staff is not endorsing the SRRA code for application in such augmented programs.
FILE MRWC AP FNL 4
l l
l i
The staff had identified an open item that WCAP should provide guidance for the an'alyst on the I
SRRA code limitations for complex geometries and guidance for effective use of the code in such applications. In the public meeting on September 22,1998 [ item 12, Ref. 8], Westinghouse j
stated that the SRRA piping models only apply to standard piping geometry (circular cylinders with uniform wall thickness). Westinghouse further stated that a limitation on the use of nonstandard geometry will be added in the next revision of WCAP-14572. The staff finds this clarification of the code limitation to be acceptable. The staffs approvalis conditioned upon Westinghouse making the change to WCAP 14572 described above.
The staff had also indicated that WCAP should specify the level of training and qualification that the code user needs to properly execute the SRRA code. In the public meeting on September 22,1998 [ item 13, Ref. 8]. Westinghouse indicated that the next revision of WCAP-14572 will state that to ensure that the simplified SRRA input parameters are consistently assigned and the SRRA computer code is properly executed, the engineering team for SRRA input should be trained and qualified. The revised WCAP will also list the topics covered in this training as described in the September 22,1998, public meeting (item 13, Ref. 8]. The staff finds the level of training and qualification that the code user needs to properly execute the SRRA code to be acceptable since it includes training on overall risk-informed ISI process, and how SRRA calculated probabilities are used in the piping segment risk calculation. The staffs approvalis conditioned upon Westinghouse making the change to WCAP-14572 described above.
It was the sta'fs understanding that the existing correlation for leak rates are limited to pressurized-water reactors (PWR) reactor coolant system (RCS) conditions. The staff had indicated (Ref. 9) that Westinghouse should clarify whether the SRRA code can be applied to boiling water reactors (BWR) and justify the applicability of the correlations used to calculate leak rates under BWR operating conditions. In the r'ublic meeting on September 22,1998, Westinghouse stated that the existing correlations for leak rates can be used for other plant conditions beyond the RCS and that the SRRA code can be applied to BWRs; however, care must be exercised in applying this approach to BWR piping systems, particularly those subjected to intergrannular stress corrosion cracking (lGSCC). In addition, Westinghouse indicated that WCAP-14572 will be revised [ item 5(d), Ref. 8] to provide guidance on addressing stress corrosion cracking. The staff finds the response acceptable since most piping susceptible to stress corrosion cracking (SCC)is also subject to fatigue loading, such as normal heat up and cool down, and the leak rate correlation for fatigue type cracks was conservatively assumed for the CLVSQ Program. The staffs approva;is conditioned upon Westinghouse making the change to WCAP-14572 described above.
The staff had identified an open item that WCAP should describe how proof testing is addressed in the SRRA calculat!ons. In the public meeting on September 22,1998 (item 14 Ref. 8], Westinghouse stated that the effect of proof testing on the segment risk ranking and categorization would be very small and slightly conservative. Westinghouse also indicated that the next revision of WCAP 14572 will clarify that SRRA models in LEAKPROF do not take credit for eliminating large flaws, which would fail during the pre service hydrostatic proof test, even though this is allowed as an input option in pc PRAISE. The staff concludes that the approach for addressing proof testing is acceptable because Westinghouse has demonstrated that the effect of proof testing on the segment risk ranking and categorization would be very small and slightly conservative. The staffs approvalis cond.tioned upon Westinghouse making the change to WCAP-14572 desenbed above.
HLE SER% CAP iM 10 i
l l
Before issuing this SER, the staff had identified an open item that the probability of detection curves used in calculations need to be justified for the material type, inspection method, component geometry, and degradation mechanism that apply to the structural location being addressed. In the public meeting on September 22,1998 [ item 15 (a), Ref. 8], Westinghouse stated that the default input values for the probability of detection (POD) curves are consistent with the default input values for pc PRAISE. The revised WCAP will emphasize that the SRRA code user must ensure that the specified input values for POD are appropriate for the type of material, inspection method, component geometry, and degradation mechanism being evaluated. The staff finds this response acceptable since POD curves are consistent with the default input values for pc-PRAISE code which has been validated and accepted by the staff for various applications. The staff's approvalis conditioned upon Westinghouse making the change to WCAP-14572 described above.
Before issuing this SER, the staff had identified an open item that Westinghouse should expand the code documentation to provide additional guidance for selecting the input for the calculation.
In the public meeting on September 22,1998 [itern 15 (b), Ref. 8], Westinghouse stated that the next Revision of WCAP-14572, Supplement 1. will provide detailed guidelines for simplified input variables and any associated assumptions that could be important in assigning the input values for the SRRA code WCAP-14572 will also state that if more thare one degradation mechanism is present in a given segment. the limiting input values for each mechanism should be combined so that a limiting failure probability is calculated for risk ranking. The staff finds the guidance in item 15 (b), Ref 8 to be acceptable because it provides sufficient guidance for the code user for selecting input parameters The staff's approvalis conditioned upon Westinghouse naking the change to WCAP-14572 desenbed above.
3.2.4 Consequence of Failure The consequences of the postulated pipe segment failures include both direct and indirect effects of each segment failure. The direct effects include failures that cause initiating events or disable system trains or entire systems as a result of the loss of flow paths or loss of inventory, and the possible creation of diversion flow paths. Indirect effects include spatial effects, such as flooding, water spray. Jpe whip. and jet impingement. WCAP-14572 methodology relies on the use of PRA models and results to gain insights into the potential direct and indirect consequences of pipe failures. Plant waikdowns are also an integral part of the methodology.
The staff finds the general guidance provided in WCAP-14572 to determine the direct and indirect consequence of segment failure to be acceptable because it is comprehensive and systematic, and should produce a traceable analysis. WCAP-14572 does not include a detailed discussion of the specific assumptions to be used to guide the assessment of the direct and indirect effects of segment failures. For example, although diversion of flow is included as a direct effect, there is no guidance for determining whether a flow would be sufficiently large to i
fail a system function. Similarly, WCAP-14572 does not provide clear guidance for calculating flooding effects with regard to the required modeling of flood propagation pathways, modeling of flood growth and mitigation, and assumptions for the failure of crit; cal equipment within a flood zone (e g., if electro mechanical components must be submerged before failure, etc.). The staff finds that specific assumptions regarding the direct and indirect effects of pipe segment failure should be developed by the individuallicensees and should form part of the onsite documentation A revision to WCAP-14572 (see item 8 (e) in Ref. 8) will require that details from FILE SERwCAP FNL 11
the consequence evaluation be maintained onsite for potential NRC audit.
WCAP 14572 methodology recommends considering a spectrum of different size breaks (i.e.,
failure modes)in every segment. The failure modes considered are the smallleak, the disabling leak, and a full break, as discussed in Section 3 of Supplement 1. Failure probability for each of these modes typically decreases as the size of the break increases. WCAP-14572 also defines the direct and indirect effects to be evaluated for each postulated failure mode. The staff finds that the association between failure mode and effects is reasonable when compared to previous results and findings from PRAs of internal flooding events.
In section 3.4.2 of WCAP-14572 it is stated that the indirect effects of a pipe whip need not include the rupture of other piping of equa! or greater size, but it should be assumed that a through-wall crack will develop in a line that is impacted by a whipping pipe of the same size. In Ref. 8. Westinghouse stated that the bases for these assumptions are found in Ref.13 and Ref.
- 14. These references also provide justification for WCAP-14572 guidance on the location of circumferential and longitudinal breaks in high energy piping runs. In accordance with item 10 of Ref. 8, Ref.13 and Ref.14 will be added to the WCAP-14572, and cited appropriately in the text.
The staff finds that the bases found in Ref.13 and Ref.14 to be acceptable because they represent estabbshed and commonly accepted industry practices. The staff's approvalis conditioned upon Westinghouse making the change to WCAP-14572 described above.
3.3 Probabilistic Risk Assessment The requirements of a PRA and the general methooology for using PRA in regulatory apphcations is discussed in the guidelines in RG 1.174. RG 1.178 provides guidance that is more specific to ISI. It is expected that licensees who wish to apply the WCAP-14572 methodology to an Rl ISI program will also conform to the RGs 1.174 and 1.178 guidelines for PRA quality, scope, and level of detail.
In July 1997, at staff briefing of the CRGR on draft RG 1.178, CRGR suggested that a peer review be performed of the use of PRA methods to support RI-ISI. The methodology proposed in RG 1.178 is similar to that found in WCAP-14572. The peer review, performed by Brookhaven National Laboratory (BNL), and documented in a letter report (Ref.12), concluded that the PRA approach is technically sound and within the state-of the-art, and that the approach can facihtate nsk-informed regulatory decisionmaking in the area of ISI.
WCAP-14572 does not presenbe the incorporation of pipe segment failure events into the PRA model. Instead, the core damage frequency (CDF)/large early relief frequency (LERF) for each segment is determined by the use of surrogate events (i.e., initiating events, basic events, or groups of events) already modeled in the PRA with failures that are representative of the effects of the piping segment failure. By setting the appropriate surrogate events to a failed state in the PRA and by re-quantifying the PRA, the impact of the pipe segment failure can be estimated.
The staff finds this process acceptable as long as the truncation limits used in the baseline calculations are maintained and the modelis re quantified. If a pre-solved cutset/ scenario modelis used instead of re-quantifying the baseline model, the application should include justification as to why the truncated model still produces reasonable results given that the equipment is assumed to be failed.
FILE SER%C AP FNL 12
O The segment failure probability / rate is combined with the results of the risk calculation as descr; bed in Equations 3-1 to 3-10 of WCAP-14572, Revision 1. The results are subsequent combined into a total piping segment CDF (or LERF). The staff recognizes that the WCAP equations are approximations for segment failures which do not trip the plant and that are discovered before an unrelated plant trip. Following the discovery of such a rupture, the likely operator action would be to isolate the break and to decide whether to shutdown or to continue plant operation. In some cases, the break may disable equipment required by the technical specifications and plant operation will be governed by allowed outage time (AOT). If the decision is made not to shut down the plant, the licensee would presumably realign the affected systems to facilitate repairs. If the decision is made to shut down the plant, the licensees may realign the systems to provide more robust mitigating function capabilities during the shutdown process, or may simply begin a controlled plant shutdown. In all cases except the long AOT scenario, the degraded condition would only be present during a relatively short time span.
Furthermore, a pipe segment rupture is an unusual event and the operations staff would be very aware of the degraded functions and would be prepared to actively intervene if necessary. The staff finds the assumption that short AOT and controlled shutdown risk are minor contributors compared to risks associated with segment failure following an unrelated transients acceptable because of the short exposure time and the heightened awareness by the plant staff.
Shod exposure time and heightened plant staff awareness may not, however, be a reasonable assumption if there is a long AOT. In response to staff comments, Westinghouse indicated that in a future revision to WCAP-14572 [ item 18 Ref. 8], Equation 3-8 will be modified such that, for systems in which outage times are approximately the same order of magnitude as the test interval (T, ), e g, ar croximately %T,, the contribution attributed to maintenance unavailability (expressed as FR,,
- AOT) will be added to the total component unavailability.
The staff notes that the description associated with equation 3 5 on page 97 of the WCAP is not an appropriate charactenzation of the CCDF" variable in the equation. The equation estimates what the WCAP refers to as a " Conditional Core Damage Frequency" (CCDF) to characterize the risk due to pipe failures that do not cause an initiating event but only fail mitigating systems.
The staff believes that the desired quantity is not the conditional core damage frequency given a pipe break as stated, out rather the increase in the core damage frequency when the pipe break probability is changed f. m zero to unity. This change is multiplied by the pipe break failure probability to obtain the core damage frequency due to the pipe break. With this change in definition (e.g., CCDF as Change in Core Damage Frequency) of the result being calculated by the equation, the equation is correct and acceptable.
The staff notes tnat Equation 3-8 on page 99 is used to characterize several slightly different failure modes of piping segments. For failure modes where the pipe is continuously degrading and eventually reaches the point that transient or additional stresses associated with a demand following an initiating event would cause the pipe to fail, the equation corresponds to the normal standby failure estimate (e.g, the pipe integrity has failed but the failure only becomes apparent on demand). If the segment does not continuously degrade, but the strength is degraded slightly on each test demano, the equation is also a valid approximation. If the pipe does not degrade, but there are variations in the demand stress, the equation underestimates the failure probability by a factor of two. The staff finds the approximation acceptable since it is valid for the most likely failure modes, and produces a reasonable approximation for the other failure mode.
FILE SERWCAP FNL U
. ~ -
I The staff finds that the methodology will yield results of commensurate precision with the segment failure probabilities and which, after review by the expert panel, can be used to support safety significance determination.
3.3.1 Evaluating Failures with PRA The staff finds that the discussion in Section 3.6.1 of WCAP 14572, Revision 1, conceming the evaluation of CDF/LERF using surrogr,te components needs clarification with regard to the incorporation of indirect consequences associated with pipe segment failures. Since WCAP-14572, Revision 1, does not explicitly state that all components subject to a harsh environment, Jet impingement, pipe whip, etc., initiated by a pipe segment failure should be failed in the PRA model evaluation, individual appi; cations utilizing WCAP-14572 methodology must assume failure of this equipment in the risk evaluation, or provide justification as to why failure is not assumed in order to be considered an acceptable implementation of WCAP-14572 (e g., the component is environmentally qualified to the conditions expected from the pipe failure event).
For some initiating events and plant operating modes. the scope of the available plant-specific PRA models may not be sufficient to estimate the impact of a pipe segment failure. For example, some PRAs may net model fires, seismic or other external events, and the shutdown mode of operation to the level of detail required to estimate relative risk importance or risk impact. For these cases, the impact of failure of each pipe segment on risk must then be i
developed and incorporated in the decision making process by an expert panel. WCAP-14572 provides sample expert panel worksheets that incluoe a listing and discussion of the safety.
significant functions a system must perform. The expert panelis expected to consider the importance of these functions for scenarios not modeled in the PRA so that the categorization of safety significance of the pipe segments reflects all plausible accident scenarios. Since the text in WCAP 14572 does not discuss system functions and their use by the expert panel, individual Rl ISl applications must address this issue in order to be considered an acceptable i
implementation of WCAP-14572.
3.3.2 Use of PRA for Categorizing Piping Segments Based on quantitative PRA results which assume no credit for ISI, risk reduction worth (RRW) and risk achievement worth (RAW) measures are developed for each pipe segment as described in Equations 3-11 and 312 of WCAP-14572. The RRW calculates the current contribution of the segment failure to risk and the RAW calculates the potential change in risk associated with the failure of the pipe segment. Use of these measures provides usefulinsights to the integrated decision making process. The staff finds that the use of quantitative models which assume no credit for ISI is appropriate for the determination of the safety significance of pipe segments because one of the goals of the RI ISI program is to target the inspection of l
those elements where inspection will be most efficient. If a pipe segment has one or more welds inspected under an augmented inspection program, WCAP-14572 methodology specifies that i
{
the representative weld failure probability is calculated assuming credit for ISI. The use of l
quantitative models which credit ISI for segments inspected under the augmented program is
[
FILE SER% CAP FNL I4 I
appropriate since the augmented program inspection is maintained in the RI ISI proi:ess.
WCAP-14572 recommends that pipe segments with RRW greater than 1.005 should be categorized as HSS while the segments with RRW values between 1.001 and 1.004 should be identified for additional consideration by the expert panel. The staff recognizes the utility of the suggested RRW guidelines and finds that tnese suggested values may be used for initial screening. WCAP 14572 does not provide guidelines for the RAW values for classification of safety significance. Instead, WCAP-14572 suggests that these values should be generated and supplied to the expert panel for consideration. The staff finds that the RAW values, or some other measure of the consequence of segment failure, provides a valuable input to the decision making process. The expert panel should be aware of the implications of high RAW values (or other consequence measure) so that their decisions are made with a full understanding of the severity of the consequences of each segment's rupture. The appropriateness of the RRW guidelines and use of the RAW values should be documented as part of the licensee's categorization process and should be assessed on a plant specific basis within the framework of the proposed ISl program and based, in part, on the risk impact from the application.
An integral part of the categorization process is the expert panel which makes a final determination of the safety significance of each pipe segment. The expert panel considers pipe segment characteristics (e.g., Table 3.6-9 of WCAP-14572, Revision 1), the system characteristics (e g., Table 3 6-12 of WCAP-14572, Revision 1), the risk-related information in the form of relative pipe segment importances and consequences of pipe failure, and information not available from the nsk analyses such as the importance of the pipe for mitigating unquantified events (shutdown, external events, etc.). In addition, guidance to be added to Section 3 6.3 of WCAP-14572 [ item 8(c), Ref. 8] will ensure consistent application of the expert panel process Section 3 4 of this SER provides a detailed discussion of the qualification and role of the expert panel. The staff finds that in the categorization of pipe segments, the use of an expert panel (as documented in Section 3 6.3 of WCAP-14572) to combine PRA and engineering information (as described in example Tables 3.6-9 and 3.6-12)is acceptable and necessary. The staff finds the process acceptable since it meets the intent of the integrated decision-making process guidelines discussed in RGs 1.174 and 1.178, in that engineering and risk insights (both quemative and quantitative) are taken into consideration in identifying safety significant piping segments. The staff notes that the expert panel's records must be retained on site and available for NRC staff audits The staff's approvalis conditioned upon Westinghouse making the change to WCAP-14572 described above.
3.3.2.1 Sensitivity to Modeled Human Actions Operator actions to isolate a break and mitigate its immediate consequences are credited in the RI-ISI analysis. For example, operator action to close an MOV to stop the loss of water from a break can be credited, if this action is shown to be feasible. WCAP-14572 methodology recommends that two sets of calculations be performed, one assuming all such actions are successful and another assuming that all such actions fait. The RRW and RAW measures are calculated for these different assumptions and if the RRW is greater than 1.005 for the CDF or LERF calculations with or without operator action the segment :s classified HSS. If any RRWis between 1.005 and 1.001, safety significance considerations are reviewed and the safety significance determined dunng the expert panel dehberations. The staff finds it acceptable to FILE SERWCAP FNL if
... ~ - _ -
use sensitivity studies to bound the possible impact of operator actions since these sensitivity l
l calculations may point to areas where credit for recovery actions plays a major role in the classification of pipe segments (and where licensee commitment to these actions is important, or dependence on these recovery actions can be lessened).
In addition to operator recovery actions, the modeling of human actions can affect the RI-ISI process in another way. Specifically, choosing a surrogate PRA component to represent the system effects of a pipe failure in a segment must include consideration of how the surrogate component is modeled in the PRA, including the modeling of recovery actions for the component. To emphasize this consideration when choosing surrogate components, the j
following will be added to a future revision of WCAP-14572 [ item 8 (d) of Ref. 8]:
l "When choosing a surrogate component, care must be taken to account for the ways in which the component has been modeled in the PRA, including recovery actions which may have been modeled to restore the operability of the component. If the recovery action was determined to be inappropriate for the postulated consequence given a piping failure, the recovery action basic event should also be failed with a probability of 1.0."
The staff finds the above addition to be acceptable since operator recovery actions that are no longer feasible as a result of a flood, will no longer be credited. The staffs approvalis conditioned upon Westinghouse making ine change to WCAP-14572 described above.
3.3.2.2 Sensitivity to Segment Failure Probability WCAP-14572 includes an evaluation in which the impact of the variation in the segment failure probabilities on the safety significance determination is investigated. The analysis was based on assigning a range factor to the pipe failure probabilities. The staff finds that this study is useful and should be performed on a plant specific basis for Rl ISI applications so that the impact of the variation of the pipe failure probabilities on the safety significance classification process can be evaluated.
As part of the staffs review of the WCAP methodology, independent audit analyses were performed by PNNL to estimate the uncertainties in the calculated failure probability for a piping
, ~
l segment. Highlights of the uncertainty studies are documented in NUREG 1661 (Ref.15). The.
results from the uncertainty studies are illustrated in Figure-1 and summarized below:
- 1. The upper bound curve was based on the largest of the 100 failure probabilities calculated from the 100 pc PRAISE runs for each given cyclic stress level.
- 2. The largest uncertainties are for those cases that have very low values of calculated failure probabilities. The uncertainties decrease with increasing failure probabilities.
- 3. The categorization of piping segments as high-and low safety-significant is a function of the degradation mechanism and consequences. "lnactive" versus " active" degradation mechanisms result in significant variation in failure probabilities. This variation renders the i
impact of the large uncertainties for components with low failure probabilities as having a relatively smallimpact on the categorization. The effects of uncertainties on component categorization can be accounted for through numerical evaluations, such as Monte Carlo FILE SERM CAP FNL 16 l
(
a.
- analyses, t
- 4. The calculations for components with very low failure probabilities are particularly sensitive to the tails of the distributions assumed for input parameters such as flaw depths and crack growth rates. The large uncertainties in the calculated failure probabilities are a direct results of the fact that the tails of these input distributions are based on extrapolations from actual data.
- 5. Failure rates for components with high calculated failure probabilities can be assessed for consistency with plant operating experience and with industry data bases on reported fieiJ failures. The ability to make such comparisons helps to minirnize the uncertainties in the calculated probabilities.
..............._.........._y.
- satz,
..,s*.
- sens,
.s.
, t es,
, e/....
../...
.t<t, p."".
..j.........
e...........
. se
....,,f.
is,..
. g en,
,(..,..
$ $-,4 i
.................ev.................,...
Best Estim.te Failure Procabsts'y Figur? - 1 Uncertainty Bounds Related to Values of Calculated Failure Probabilities To ensure that the potentialimpact of uncertainties is adequately addressed in the l
categorization of piping segments, Westinghouse committed to add the following as part of a l
future revision to WCAP-14572 [ item 19. Ref. 8]:
"In addition to the sensitivity studies described above, a simplified uncertainty analysis is performed to ensure that no low safety significant segments could move into the high safety significance category when reasonable variations in the pipe failure and conditional CDFILERF probabilities are considered. The results of the evaluation along with other insights are provided to the plant expert panel."
l.
FILE SER% CAP FNL 17 l
l The staff finds that the sensitivity studies as proposed by WCAP-14572 (and as amended by above addition) would address model uncertainty in terms of pipe failure probabilities, and would ensure that pipe segment categorization is robust. The staff's approvalis conditioned upon Westinghouse making the change to WCAP 14572 described above.1 J>4 J
1 ; 4 3.3.3 Change in Risk Resulting from Change in ISI Programs To estimate the change in risk from the implementation of the Rl-IST program, WCAP-14572 methodology utilizes the SRRA code to provide a quantitative estimate of the relative susceptibility of pipe segments to failure as determined by the weld material and environmental conditions within the segment. Different weld failure probabihties are calculated depending on whether the weld is inspected or not. The methodology credits the reduction in weld failure probability attributable to ISI at the segment level. If one or more welds within a segment are inspected under the current Section XI program or the RI-ISI program, the selected weld failure probability including credit for ISI is assigned to the segment. That is, the segment failure probabihty will not change as a result of any changes in the inspection strategy applied to the welds within a segment. If one or more welds were inspected under the Section XI program, but no welds will be inspected under an Rl ISI program, the segment failure probability willincrease.
If no welds were inspected under the Section XI program, but one or more welds will be inspected under the Rl-ISI program, the segment failure probability will decrease. If one or more welds within a segment are inspected in the augmented program, the selected weld failure probabihty including credit for the augmented program is assigned to the segment. For a selected pipe segment where at least two separate inspections are being performed (one for the primary failure mechanism which is addressed by an augmented program, and other inspection (s) performed under the Section XI program or the Rl ISI program, so that the secondary mechanism is addressed), a factor of three improvement in the failure probability is credited.
The staff finds the above process acceptable,'out recognizes that this process underestimates risk reductions arising from changing inspection locations from a weld subject to no degradation mechanism to another with an identified degradation mechanism. It also underestimates risk increases arising from the reduction in the number of welds inspected within each segment.
The staff expects that the targeting ofinsnections to degradation mechanisms should yield relatively large nsk reductions, while the reduction in the number of inspections within a segment will yield a larger numbre of smaller risk increases. However, as discussed in Section 3.2.3 of this SER, the increase in risk resulting from a reduction in the number of inspections should be minimal since WCAP-14572 methodology will characterize the failure probability of a segment by combining the failure probabilities of the dominant degradation mechanisms in that section.
In determining whether the change in CDF and LERF associated with WCAP-14572 methodology is acceptable, the following factors were also considered; the statistical evaluation used to develop an initial estimate of the number of welds to inspect, and the four criteria for j
evaluation of results found in Section 4.4.2 of WCAP-14572. These are further discussed below.
To ensure that a target leak rate is met with a stated level of confidence, the statistical evaluation methodology proposed in WCAP-14572 uses the prubability of a flaw, the conditional r!LE SER% CAP FYL 1R l
probability of a leak, and a target leak rate to determine the minimum number of welds to inspect, in discussions with the staff, Westinghouse stated that,in controlling the frequency of pipe leaks, the pipe break frequency (which drives the safety significance classification)is also l
controlled. This is supported by the pilot WCAP Rl-ISI application, which reported that the conditional probability of a pipe break is sufficiently small when compared to the conditionalleak probability, and that the level of confidence that the target leak frequency is not exceeded is also the confidence that the pipe break frequency is not exceeded. WCAP-14572 methodology thus provides a systematic evaluation of the required number of inspections that is acceptable for the RI ISI program, and confidence that :he failure likelihood of high safety significant piping segments will not increase above these values used to support the finding.
WCAP 14572 provides guidelines for evaluating the change in plant and system-level risk resulting from changes to the.lSi program. The first guideline suggests the addition of examinations until at least a risk neutral change is estimated. The second guideline suggests that the risk-dominant pipe segments within systems which dominate the estimated risk (e.g.,
greater than 10% of the total) should be reevaluated to identify where additional examinations may be needed so that the overall risk for these systems could be reduced. The third guideline suggests that, for systems where risk increases are identified, additional examinations may be necessary to minimize the risk increase (to less than two orders of magnitude below the RI ISI CDF/LERF for that system and less than a 10" CDF increase or a 104 LERF increase). The staff finds that these WCAP guideline are consistent with the guidance in RGs 1.174 and 1.178 which state that risk increases (if any) resulting from a proposed change should be small and consistent with the intent of the Commission's Safety Goal Policy Statement.
In summary, the staff finds that, although the calculation of the change in risk (CDF/LERF) will not precisely estimate the magnitude of the change, the calculation can illustrate whether the resulting change will be a risk increase or a risk decrease. Using sensitivity studies, the quantitative results can be shown to be robust in terms of credit for operator actions and pipe segment failure probability. By utilizing plant and system level criteria as discussed above, the risk from individual system failures will be kept small and dominant risk contributors will not be created. When applied as part of an integrated decision-making process, the staff finds that the analyses, results, and decision criteria associated with the determination of segment safety significance and subsequent change in nsk estimates provide reasonable assurance that the change in the ISI program would result in a total plant risk neutrality, risk decrease, or a small risk incr ase that will be consistent with staff guidelines found in RG 1.174. For full scop RI ISI e
programs, such as the one performed for Surry Unit 1, the staff anticipates the program to be risk neutral or result in a nsk reduction.
3.4 Integrated Decisionmaking RG 1.178 and SRP Chapter 3 9.8 guidelines describe an integrated approach tW should be utilized to determine the acceptability of the proposed RI-ISI program by considering in concert the traditional engineering analysis, risk evaluation, and the implementation and performance monitoring of piping under the program.
In the WCAP-14572 approach to integrated decisionmaking, conventional fracture mechanics analysis methods are combined with Monte-Carlo probabilistic simulations to determine failure FILE SER% CAP FNL to l
probabilities for the pipe segments, as discussed in Supplement 1 to WCAP-14572, Revision 1.
These failure probabilities are used together with the results of consequence evaluations to characterize the conditional risk associated with the failure of each segment, as discussed in l
Section 3.6 of WCAP-14572. Specifically, section 3.6 explains how this information is integrated with deterministic considerations and an expert panel evaluation to categorize pipe segments as either LSS or HSS. Section 3.7 of WCAP-14572, Revision 1, explains how the results of this l
risk-ranking process are used in selecting structural elements for examination.
An integral part of the RI-ISI process is the expert panel which makes a final determination of the safety significance of each pipe segment. The expert panelis responsible for the review and approval of all risk-informed selection results by utilizing their expertise and past experience in inspection results, industry piping failure data, relevant stress analysis results, PRA insights, and j
knowledge of ISI and nondestructive examination techniques. The RI-ISI expert panel should l
include expertise in the following areas:
1 l-PRA i
Plant Operations Plant Maintenance Plant Engineering ISI i
Nondestructive Examination Stress and Materials Engineering Section 3.6.3 of WCAP-14572. Revision 1, provides details of the WOG expert panel process.
i Item 8(r-) of Rd 8 provides further details on the role of tne expert panel to evaluate the risk-informed results and make a final decision by identifjing HSS segments for ISI. Item 8(c) of Ref.
8 also states that segments that have been cetermined to be HSS should not be classified lower by the expert panel without sufficient justification that is documented as part of the program and that the expert panel should be focussed primarily on adding piping segments to the higher classification.
The expert panel evaluations are an established part of the Maintenance Rule implementation and their use in risk-infcrmed applications is well estaolished. The staff finds that in the categorization of pipe segments the use of an expert panel (as documented in Section 3.6.3 of l
WCAP-14572) to combine PRA and engineering information (as described in example Tables 3.6-9 and 3.612)is acceptable and necessary. In addition, guidance to be added to Section 3.6.3 of WCAP-14572 [ item 8(c), Ref. 8) will ensure consistent application of the expert panel l
process. The staff finds the proce,*s acceptable since it meets the integrated decision-making j
process guidelines discussed in RG 1.174 and SRP Chapter 1.178, in that engineering and risk insights (both qualitative and quantitative) are taken into consideration in identification of safety significant piping segments. The sta'f's approvalis conditioned upon Westinghouse making the change to WCAP 14572 described above.
FILE SER% CAP WL 20
1 l
3.4.1 Selection of Examination Locations At its July 1997 briefing, CRGR requested that the staff should have a peer review performed to assess the use of Perdue-Abramson statistical model to determine the number of elements to be inspected within a piping segment. The contractor performing the peer review in this area (Los Alamos National Laboratory (LANL)) concluded (Ref.16) that the Perdue-Abramson method is a statistically sound method for use in determining the number of welds to be inspected in an RI-ISI program in order to ensure that r specified target leak frequency is not exceeded at the pre-specified confidence level of 95%. LANL further stated that although other sampling schemes could be used (such as classical and/or Bayesian double or sequential sampling schemes), the Perdue-Abramson modelis capable of providing the desired confidence or assurance.
Section 3.6.1 of WCAP-14572 addresses evaluation of the classification of piping segments, using sensitivity studies to demonstrate whether changes in assumptions or data can affect these classifications. Piping systems at Millstone Unit 3 and Surry Unit 1 were considered in these studies. Operationalinsights are addressed in Section 3.6.2 of WCAP-14572, which indicates that information obtained from plant operation and maintenance experience is used to identify piping segments having a history of design or cperating issues. Section 3.6.3 states that an expert panel reviews and approves the final classification of piping segments on the basis of their expertise and insights as discussed in Section 3.4. A discussion of the risk ranking process is provided in Sections 3.6.4 and 3.6.5 of WCAP-14572.
Sections 3.7.1 and 3.7.2 of WCAP-14572 address the criteria used to determine the number of structural elements selected for examination, consistent with the safety significance and failure potential of the given pipe segment. The RI-ISI program includes examinations of HSS elements contained in Regions 1 and 2 of the element selection matrix (Figure 3.7-1 of WCAP-14572). By the WCAP-14572 selection process,100% of the susceptible locations (Region 1A) are examined. Elements in Regions 18 and 2 are generally subject te a statistical evaluation process such as the Perdue Model.
The Perdue Modelis
- tended to be used on highly reliable piping to establish a statistically relevant sample size and verify the condition of the piping. In cases where an active degradation mechanisin exists, particularly where there is an ongoing augmented program, it is inappropriate to use the Perdue Model for element selection. In these cases, the expert panel must apply other rationales for selecting the number of elements to examine. At Surry, the licensee selected certain elements to address a secondary degradation mechanism and reduce the delta risk compared to current Section XI ISI. In other cases, elements were selected to address defense in depth considerations. As discussed in the public meeting on September 22, 1998 [page 274, Ref. 8), Westinghouse indicated that additional guidance would be added in Section ' of WCAP-14572 to address sample size relection in cases where the Perdue Model could not ce applied to state that ' additional rationale must be developed when a statistical model cannot be applied to determine the minimum number of examination locations for a given segment."
The staff finds the methodology to determine the number of elements selected for examination to be acceptable sinc t Jul HSS segments with known degradation mechanisms will be subject to 100% examination, HSS segments with no known degradaticn mechanism will be sampled for examination on a sound statistical basis to ensure that a specified target leak frequency is not FILE sFR% CAP ThL M
l
O-exceeded at the pre-specified confidence level of 95%, LSS segments with known degradation mechanisms will be subject to examination in accordance with the licensees defined program, and the final scope of examination will result in a change in risk consistent with RG 1.174 l
guidelines. The staff's approvalis conditioned upon Westinghouse making the change to WCAP-14572 described above [page 274, Ref. 8].
1 l
3.4.2 Examination Methods Licensees who wish to apply the WCAP-14572 methodology to an RI-ISI program must conform
- to the guidelines in RG 1.178 for examination and pressure test requirements. Examination methods and personnel qualification must be in accordance with the ASME Section XI Code Edition and Addenda endorsed by the NRC through 10 CFR 50.55a. For inspections outside the scope of Section XI (e.g., EC. IGSCC) the acceptance criteria should meet existing regulatory guidance apolicable to those programs.
The objectNe of ISI and ASME Section XI are to identify conditions (i.e., flaw indications) that are precursors to leaks and ruptures in the pressure boundary that may impact plant safety.
Therefore, the Rl ISI program must meet this objective to be found acceptable for use. Further, since the nsk-informed programs is predicated on inspection for cause, element selection should target specific degradation mechanisms.
WCAP-14572, Revision 1. specifies that inservice examinations and system pressure tests are to be performed in accordance with Section 4 of WCAD-14572 which should meet the requirements contained in Section XI of the ASME BPVC Code Edition and Addenda specified in the Owner's current ISI program except where specific references are provided that add -
supplemental requirements, specify other Code editions and addenda, or recommend / require j
.the use of ASME Code Cases. The examination methods for HSS piping structural elements, specified in Table 4.1-1 of WCAP-14572 are taken directly from Code Case N 577, Table 1. As i
an alternative to Table 4.1-1, ado;tional guidance for the selection of examination methods is
. provided in Table 4.1-2 of WCAP-14572, which contair;s suggested examination or monitoring methods consistent with the configuration of the structural element and the postulated failure mode. This guidance is subject to approval by the Authorized Nuclear Inservice Inspector (ANil) under the requirements of Paragraph IWA 2240 of ASME Section XI. Consistent with RG 1.178 guidelines, all ASME Class 1,2, and 3 piping systems must continue to receive a visual examination for leakage in accordance with the applicable pressure test requirements of ASME i
Section XI as endorsed by 10 CFR 50.55a.
j 3.5 Implementation and Monitoring The objective of this element of RGs 1.174 and 1.178 is to assess performance of the affected piping systems under the proposed RI-ISI program by implementing monitoring strategies that confirm the assumptions and analysis used in developing the RI-ISI program. To satisfy 10 CFR 50.55a(a)(3)(i), implementation of the RI-ISI program (includ'ng inspect,'on scope, examination methods, and methods of evaluation of examination results) must provide an adequate level of quality and safety. The plant-specific application process is covered in Section 5 of WCAP-14572, which provides the framework for applying the risk-informed methods to a rlLE SERwCAP FNL 22 3
+4 p
=
--~~9,y.
or -
y m-w--
i s
l
' specific plant for the ISI of piping.
Considering that the implementation of the proposed RI-ISI program will greatly reduce the number of examinations, limited examinations could have a significant impact on the detection of inservice degradation. In cases where examination methods are not practical or appropriate, RG 1.178 states that alternative inspection intervals, scope and methods should be developed to ensure that piping degradation is detected and structuralintegrity is maintained. To address this aspect, a stepped approach to limited examinations will be incorporated into WCAP-14572 that'may include the examination of adjacent e'ements and more frequent pressure testing and visual examination for leakage. However, it should be noted that, in accordance with the regulations, limited examinations must be documented and submitted to the staff as relief j
requests for review and approval.
q The qualification of NDE personnel, processes and equipment must comply with Section XI of the ASME Code to meet the requirements of 10 CFR 50.55a. In general, this means procedures.
must be qualified in accordance with ASME Section XI, Appendix Vill, or in the spirit of Appendix Vill, for techniques. As discussed in response G-19 in the NEl submittai dated March 13,1997 (Ref.17), Westinghouse stated that the reference plant "would qualify methods, procedures, personnel, and equipment to a level commensurate with the intent of an Appendix Vill performance demonstration.
Section 4 of WCAP 14572, " Inspection Program Requirements," notes that the use of a number of Code Cases is recommended (i.e., N-4161, N-4981, N-532). Staff acceptance of the WOG approach does not automatically imply acceptance of the referenced Code Cases. Licensees proposing to use the WOG approach must submit separate proposed alternatives to use these or other unapproved Code Cases.
i.
Implementation of a RI-ISI program for piping should be initiated at the start of a plant's next ISl.
interval, consistent with the requirements of the ASME Code Section XI Edition and Addenda committed to by an Owner in accordance with 10 CFR 50.55a, or any delays granted by the NRC staff. In addition to other changes in Section 4.5 of WCAP-14572, Westinghouse stated in l
the public meeting on September 22,1998 (item 20. Ref. 8], that the following sentence will be added in the next revision of WCAP-14572' l
l
" Documentation of program updates shall be kept and maintained by the Owner on site for audit. Changes arising from the program updates should be evaluated using the change l
mechanisms described in existing applicable regulations (e.g.,10 CFR 50.55a and Appendix l
B to 10 CFR Part 50) to determine if the change to the Rl-ISI orogram should be reported to j
the NRC."
The staff finds the periodic reporting requirements to be acceptable since they meet the existing applicable regulations. The staffs approvalis conditioned upon Westinghouse making the change to WCAP-14572 described above.
L WCAP-14572, Revision 1 states that periodic updates of RI-ISI programs will be performed at l
least on a period basis to coincide with the inspection program requirements contained in ASME Section XI under Inspection Program B. The staff finds these updates acceptable because they i
meet ASME Section XI which requires updates following the completion of all scheduled FILE SLR% CAP bl M
~
l e
l 3
i J
examinations in each inspection interval. WCAP-14572 also states that RI-ISI progr' ms will be a
j evaluated for changes in safety-significance and inspection requirements due to plant design feature changes, piant procedure changes, equipment performance changes, and examination i
results including flaws or indications of leaks. This process for RI-ISI program updates meets the guide!ines of RG 1.174 that risk-informed applications must include performance menitoring l
and feedback provisions and hence is acceptable to the staff.
3.6 Conformance to Regulatory Guide 1.174 RG 1.174 desenbes an acceptable method for assessing the nature and impact of licensing basis changes by a licensee when the licensee chooses to support these changes with risk information. This Reg Guide identifies a four-element approach for evaluating such changes, l
and these four elements are aimed at addressing the five principles of risk-informed f rgulation.
j Section 1.4 of WCAP-14572 Revision 1 summarizes how the proposed WOG RI ISI process
[
conforms to the RG 1.174 approach. The staff finds that WCAP-14572 approach is consistent with RG 1.174 as discusud below.
l in Element 1 of the RG 1174 approach, the licensee is to define the proposed change. Section i
1.1 of WCAP-14572 discusses current regulatory requirements for the ISl program and the changes in regulatory compliance using the RI-ISI approach The scope of the changes is also discussed. and this scope includes the addition of non-ASME code piping that has been identified as high safety significant. The staff finds that the discussion in Section 1.1 of WCAP-14572 to be consis:ent with the guidance provided in Section 2.1 of RG 1.174.
Element 2 is the performance of the engineering analysis. In this element, the licensee is to consider the appropriateness of qualitative and quantitative analyses, as well as analyses using traditional engineenng approaches and those techniques associated with the use of PRA findings. Regardless of the analysis method chosen, the licensee must snow that the pr;nciples set forth in Section 2 of RG 1.174 have been met. The staff finds that the evaluation process as described in Section 3 of WCAP-14572 meets the requirements of this Element. WCAP Section
,; describes the probabilistic and deterministic engineering analyses to be perfurmed and integrated through the use of a plant expert panel to define the high and low safety significant piping segments. The results of these ana;yses are used to select the inspection locations and inspection methods. and a statistical modc'is used to determine the number of locations to be inspected to meet confidence and reliability goals.
Element 3 is the definition of the implementation and monitoring program. The primary goal of this element is to ensure that no adverse safety degradation occurs because of changes to the L
ISI program, and the staff finds that the guidance provided in WCAP Section 4.5 is adequate to meet this goal. Section 4.5 of WCAP-14572 discusses how the implementation of the RI-ISI l
program is consistent with the requirements of ASME Code Section XI. In addition, the i
monitoring, feedback and corrective action program discussed is consistent with guidelines provided in Section 2.3 of RG 1.174.
Element 4 is the submittal of the proposed change. WCAP-14572 states that each licensee will submit their proposed change at the time they perform a RI-ISI program.
l In t st RWCAP FTL N
l i
RG 1.174 states that, in implementing risk-info,med decision-making, plant changes'are expected to meet a set of key principles. The paragraphs below summarize these principles, and staff findings with regard to the conformance of WCAP-14572 methodology with these principles.
Principle 1 states that the proposed change must meet current regulations unless it is expUcitly related to a requested exemption or rule change. The proposed Rl-ISI change is an alternative to the ASME Section XI Code as referenced by 10 CFR 50.55a(a)(3) for piping ISI requirerr ents with regard to the number of inspections, locations of nspections, and methods of inspectioris.
Principle 2 states that the proposed change must be consistent with the defense-in-depth philosophy. ISI is an integral part of defense-in-depth. It is expected that as part of the Rl-ISI process, the safety significance categonzation, the expert panel review and approval, and the subsequent number and location of elements to inspect will maintain the basic intent of ISI (i.e.,
identifpng and repainng flaws before pipe integnty is challenged). Therefore, although a reduction in the number of welds inspected is anticipated, it is expected that there will be reasonable assurance that the program will provide a substantive ongoing assessment of piping condition Pnnciple 3 states that the proposed change shall maintain sufficient safety margins. No changes to the evaluation of design basis accidents in the final safety analysis report (FSAR) are being made by the RI ISI process in addition. Section 3.7 of WCAP-14572 describes the use of a statistical mode! to assure that safety margins (in terms of pipe failure probability) are maintained This statistical modelis cased on the evaluation of potential flaws and leakage rates that are precursors to piping failure Pnnciple 4 states that, when proposed changes result in an increase in core camage frequency or risk. the increases should be small and consistent with the intent of the Commission's Safety Goal Policy Statement Sections 14,3 6,3.7, and 4.4 of WCAP-14572 provide arguments that a RI ISI program is as a minimum, a nsk-neutra! application and should result in a risk reduction. Staff findings with regard to pnnciple 4 are found in Section 3.3.3 of this SER.
Principle 5 states that the impact of the proposed change should be monitored using performcmce measurement strategies WCAP 14572 conformance to this principle is already discussed in the paragraph on Element 3 above.
4.0 CONCLUSION
S 10 CFR 50.55a(a)(3) states that alternatives to the requkements of paragraph (g) may be used, when authonzed by the NRC, if (i) the uroposed alternatives would provide an acceptable level of quality and safety or (ii) compliance with the specified requirements would result in hardship l
or unusual difficulty without a compensating increase in the level of quality and safety. The staff l
concludes that the proposed RI-ISl program as desenbed in WCAP-14572. Revision 1, conditioned upon the changes to be incorporated as discussed in Ref. 8, will provide an acceptable level of quality and safety pursuant to 10 CFR 50.55a for the proposed alternative to the piping ISI requirements with regard to the number of inspections, locations of inspections, and methods of inspections This conclusion is founded on the findings discussed in the llLF 51 RWC AP F M 25
i remainder of this section.
The methodology conforms to the guidance provideo in RGs 1.174 and 1.178, in that applying the methodology results in risk-neutrality or risk-reduction for the piping addressed in the RI-ISI program. According to this methodology, the licensees willidentify those aspects of the plants' licensing bases that may be affected by the proposed change, including rules and regulations, FSAR, technical specifications, and licensing conditions. In addition, the licensees willidentify all changes to commitments that may be affected as well as the particular piping systems, segments, and welds that are affected by the change in the ISI program. Specific revisions to inspection scope, schedules, locations, and techniques will also be identified, as will plant systems and functions that rely on the affected piping. The WOG procedure to subdivide piping systems into segments is founded on portions of piping naving the same consequences of l
failure to be placed into the same piping segments. In addition, consideration is given to l
identifying distinct segment boundaries at branching points, locations of pipe size changes, l
isolation valve, and MOV and air-operated valves (AOV) locations.
Each segment's potential for failure is appropriately represented as failure on demand, l
unavailability, or frequency of failure. The relative potential for failure is consistent with l
systematic consideration of degradation mechanisms. segment and weld material charactenstics. and environmental and operating stresses. The assessment of component I
failure pctential attnbutable to aging and degradatior takes into account uncertainties.
Computer codes used to generate quantitative failure estimates have been venfied and validated against established industry codes Supplement 1 to WCAP-14572, Revision 1, I
desenbes the models, software, and valic'ation of the SRRA computer code. The SRRA model is used to estimate the probability of piping failures. Peer reviews of the SRRA code have been performed on several occasions The author of the code has published several papers for presentation at technical conferences. with technical peer reviews being part of the publication process. Earlier versions of the code have been used by Westinghouse in past research i
projects which have also been reviewed by the staff. In addition, the methodology of the code l
parallels approaches used in other generally accepted probabilistic structural mechanics codes, such as pc-PRAISE. Technical reviews of the SRRA code were performed during the Surry Unit l
1 pilot plant study by the staff, its contractors, and the ASME Research Task Force on Risk-Based Inservice inspection These efforts provided a detailed review of the Westinghouse SRRA code, and comments from this effo" resulted in severalimprovements to the SRRA code, as reflected in WCAP 14572. Revision 1 Supplement 1. The recent reviews were based on (1) documentation of the code, (2) detailed desenptions of example calculations, (3) trial I
calculations performed with the SRRA code by peer reviewers, and (4) benchmark calculations to compare failure probabilities predicted by the SRRA code and the pc-PRAISE code.
The stress corrosion cracking model of the SRRA code has a relatively simple technical basis, which does not attempt to model the complex failure mechanism in a detailed mechanistic manner. The calculations are based on a number of significant assumptions as discussed in l
Section A.4.3 of this SER. In particular, the code documentation given in WCAP-14572, I
Revision 1, Supplement 1, acknowledges the limitations of the model, and recommends the use of the pc-PRAISE computer code if predictions from a more refined mechanistic model are needed The probabilistic fracture mechanics calculations for IGSCC have not been benchmarked for consistency with plant-specific and industry operating experience. In this regard, the Surry Unit 1 evaluations do not provide a particularly good basis to evaluate the FILE SERW CAP Pu 3
l
SRRA stress corrosion cracking model, because IGSCC makes only a small contribution to piping failures for PWR plants. The staff therefore requires that the IGSCC model be further evaluated on future applications to BWR plants, because IGSCC is a major factor goveming piping integnty at BWRs.
The staff noted severallimitations, e g., IGSCC modeling, lack of benchmarking of E-C model compared to existing E-C programs, lack of modeling of complex geometries, etc. in the SRRA code These limitations in the SRRA code result in a need for judicious use of the code anc' careful attention by the expert panel % ensure that the results of the code seem appropnate. It should be noted that the use of SRRA, or other probabilistic fracture mechanics codes, to estimate relative failure frequencies of piping systems and components is appropriate, but that the ability of such codes to estimate failure frequencies is limited by the quality of the input data and modeling limitations inherent in the code itself. Providing bounding or conservative inputs to
\\
the model or relying on the conservative nature of certain aspects of the code can potentially lead to inappropriate conclusions regarding the relative susceptibility to failure of various piping segments and components. Therefore, it is extremely important that these limitations be recognized by the user of the code and by the licensees' expert panel and that the results of the analyses are carefully scrutinized to assure that they make sense when compared to engineenng knowledge of degradation mechanisms and plant specific and generic operating expenence Furter details of the limitations and staff recommendations on tne use of the SRRA code are provided in Section A 25 of this SER.
The impact on nsk attnbutable to piping pressure boundary failure considers both direct and indirect effects Consideration of direct effects includes failures that cause initiating events or disable single or multiple components, trains or systems, or a combination of these effects. The methodology also considers indirect effects of pressure boundary failures affecting other systems, ccmponents and/or piping segments, also referred to as spatial effects such as pipe whip, jet impingement, flooding or failure of fire protection systems.
The results of the different elements of the engineering analysis are considered in an integrated decision making process The impact of the proposed change in the ISI program is founded on the adequacy of the engineenng analysis, acceptable change in plant nsk, and the adequacy of the proposed implementation and performance monitoring plan, in accordance with RG 1.174 guidelines.
WOG methodology also considers implementation and performance-monitoring strategies.
Inspection stratagies ensure that failure mechanisms of concern have been addressed and there is adequate assurance of detecting damage before structuralintegrity is impacted. Safety significance of piping segments is taken into account in defining the inspection scope for the RI-ISI program.
System pressure tests and visual examination of piping structural elements will continue to be performed on all Class 1,2. and 3 systems in accordance with the ASME BPVC Section XI program, regardless of whether the segments contain locations that have been classified as HSS or LSS The Rl-ISI program applies the same performance measurement strategies as existing ASME requirements and. in addition, broadens the inspection volumes at weld locations.
rit L M R%C AP iNI T
O L
l
[
WCAP-14572; Revision 1, has provided the methodology to conduct an engineering' analysis of l
l the proposed changes using a combination of engineering analysis with supporting insights from a PRA. Defense-in-depth and quality is not. degraded in that the methodology provides l
reasonable confidence that any reduction in existing inspections will not lead to degraded piping performance when compared to existing performance levels. Inspections are focused at locations with active degradation mechanisms as well as. selected locations that monitor the performance of the front line primary system piping (the second barrier of fission product release).
i l
Safety margins used in decign calculations are not changed. Piping materialintegrity is monitored to ensure that aging and environmental influences do not significantly degrade the
]
piping to unacceptable levels.
i 1
Augmented examination program for degradation mechanisms such as lGSCC and EC would remain unaffected by the RI-ISI program and WCAP-14572 should not be taken as a basis to change the augmented inspection program.
l l-Although the staff finds that the general guidance provided in WCAP-14572 Revision 1 (and as amended by Ref. 8) to be acceptable, application of this guidance will be plant-specific. As such, individual applications in RI-ISI must address :he various plant-specific issues. These include' o The qua!ity, scope and level of detail of the PRA used, as described in RG 1.174 and 1.178 1
(see Section 3 3 and 3 3.1 of this SER).
o The guidelines and assumptions used for the deteimination of direct and indirect effects of flooding, including assumptions on the failure of components affected by the pipe break (see Sections 3.2.4 and 3.3.1 of this SER) l o The criteria, and the justification for the cri%ria used for the categorization of piping segments, including sensitivity studies to model human actions and segment failure probability (see Section 3.3 2 of this SER).
In the public meeting on October 8,1998 (Ref.18), the staff and the industry discussed the i
information to be submitted toihe NRC and the list of retrievable onsite documentation for l
potential NRC audits of licensees that seek to utilize the WOG methodology for their RI ISI i
program The staff's expectation is that contents of submittals to NRC listed below will consist of i
brief statements and results of program development with details available as retrievable onsite j
documentation for potential NRC audits:
i l
Submittal Contents i
l
'(1) justification for statement that PRA is of sufficient quality l
(2) summary of risk impact i
(3) current inspection Code
'(4) impact on previous relief requests (5) revised FSAR pages impacted by the chang if any (6) process followed (WCAP, Code Case, and exceptions to methodology, if any)
[
flLLNERWCAPfv 3
l
l 1
i
- (7) summary of results of each step (e.g., number of segments, number of HSS'and LSS segments, number of locations to be inspected, etc.)
(8) a statement that RG principles are met (or any exceptions)
(9) summary of changes from current ISI program l
(10). ' summary of any augmented inspections that would be impacted t
Retrievable Onsite Documentation for Potential NRC Audit L
-(1) scope definition' l
(2) segment definition
-(3) failure probability assessment (4).
. consequence evaluation
[
(5)
PRA model runs for the Rl ISI program
'(6) risk evaluation (7) structural element /NDE selection (8) change in risk calculation (9)
PRA quality review l
(10) continual assessment forms as program changes in response to inspection results I
(11) documentation required by ASME Code (including inspection personnel qualification, o
. inspectron results, and flaw evaluations) i 1
i i
l l
l 5,0 REFERENCES 1.
Westinghouse Topical Report, WCAP-14572, " Westinghouse Owners Group Application of Risk-informed Methods to Piping inservice inspection Topical Report," Revision 1, October 1997.
2.
Wesiinghouse Topical Report. WCAP-14572, Supplement 1, " Westinghouse Structural Reliability and Risk Assessment (SRRA) Model for Piping Risk-Informed Inservice Inspection." Revision 1. October 1997.
l 3.
U.S. Nuclear Regulatory Commission, "An Approach for Using Probabilistic Risk i
Assessment in Risk-Informed Decisions on Plant Specific Changes to the Licensing Basis," Regulatory Guide 1.174, July 1998.
4.
U.S Nuclear Regulatory Commi:,sion, "An Approach for Plant-Specific, Risk-informed Decisionmaking: Inservice inspection of Piping " Regulatory Guide 1.178 for Trial Use, September 1998.
l 5.
Amencan Society of Mechanical Engineers, Boiler and Pressure Vessel Code, Code Case N-577 ' Risk-Informed Requirements for Class 1,2. and 3 Piping, Method A,"
l September 2.1997.
6.
Standard Review Plan Chapter 3 9.8. " Standard Review Plan for Trial Use for the Review of Risk Informed inservice Inspection of Pipino," October 1998.
7.
Standard Review Plan Chapter 19.0, "Use of Probabilistic Risk Assessment in Plant-
)
Specific. Risk Informed Decisionmaking: General Guidance," NUREG-0800, July 1998.
[
l 8.
Letter from Louis F. Liberatori, Jr., Chairman ( Westinghouse Owners Group), to Peter C.
Wen (NRC), " Transmittal of Responses to NRC Open Items on WOG RI-ISI Program and Reports WCAP-14572 Revision 1, and WCAP 14572, Revision 1, Supplement 1,"
September 30.1998.
L 9.
Letter from Peter C. Wen (NRC), to Andrew Drake (Westinghouse Owners Group),
"Open items Related to Westinghouse Owners Group Application of Risk-Informed i
Methods to Piping inservice Inspection (WCAP-14572, Revision 1)," September 2,1998.
o l
10.'
Letter from P. Krishnaswamy (Battelle Columbus), to Deborah Jackson (NRC),
" Independent Peer Review of Draft Regulatory Guide DG-1063," October 31,1997.
I 11.
Chexal, B. et al.. "CHECWORKS Flow-Accelerated Corrosion,'/ersion 1.0F, User Guide," Final Report TR-103198 P1, Electric Power Research Institute, June 1998.
12.
Letter from W.T. Platt and T. L.Chu (Brookhaven National Laboratory), to Jack Guttmann (NRC), " Independent Peer Review of Draft Regulatory Guide DG-1063 " October 15, 1997.
13.
American Nuclear Society. ' Design Basis for Protection of Light-Water Nucleer Power flLE SFR%CAPINL
+'
n-l j
Plants Against the Effects of Postulated Pipe Rupture," ANSI /ANS 58.2-1988,1988 14.
Westinghouse Systems Standard Design Criteria (SSDC) 1,19, " Criteria for Protection Against Dynamic Effects Resulting from Pipe Rupture," Revision 1,1980.
15.
U.S. Nuclear Regulatory Commission NUREG-1661,* Technical Elements cf 1
Risk-Informed Inservice Inspection Programs for Piping" to be published.
' 16.
Letter from Harry Martz (Los Alamos National Laboratory), to Lee Abramson (NRC),
" Independent Peer Review of Draft Regulatory Guide DG-1063," September 5,1997.
1 17.'
Letter from Anthony R. Pietrangelo (Nuclear Energy Institute), to Dr. Brian W. Sheron (NRC), containing responses to NRC's Request for AdditionalInformation, March 13, j
- 1997, 18.
Minutes for NRC Meeting with Nuclear Energy institute (NEI) Regarding Risk Informed Inservice inspection Programs on October 8.1998.
i t.
j g
FILE %ERWC AP fM
.i l 4.
. _ ~..-
I l...
l L
l l
l I=
l.
APPENDIX A Review of WCAP-14572, Revision 1, Supplement 1," Westinghouse Structural Reliability and Risk Assessment Model for Piping Risk-informed inservice inspection" l
i j-i g
4 i.
flLE SERWCAP FNL g.i-l-
o l
A.1 INTRODUCTION Supplement 1 to WCAP-14572, Revision 1, desenbes the models, software and validation of the SRRA computer code. The SRRA modelis used to estimate the probabilities of piping failures, which are input to the PRA in support of the WOG RI-ISI program for piping.
j A.2 Background RG 1.178 provides an option for licensees to quantitatively estimate the reliability of individual pipe segments within the scope of the Rl-ISI program. These estimates are to be consistent with industry databases on piping failure rates and relevant to plant-specific operating experiences. Detailed knowledge of piping design parameters, materials degradation mechanisms, plant operating conditions, and the hkelihood of fabrication and service-induced flaws are elements of a quantitative analysis that need consideration. The use of probabilistic structural mechanics computer codes is an acceptable approach to estimate structural failure probabikties on the basis of such detailed knowleoge.
The SRRA computer software was developed by the Westinghouse Electric Company over the last decade and has been enhanced to support the development of risk-informed inservice inspection programs of piping This software was applied in plant applications of the RI-ISI program development for the Millstone Unit 3 and Surry Unit 1 nuclear power plants. The NRC staff and contractor personnel were bnefed at public meetings during the course of these pilot applications. Dunng these studies and methods development activities, the SRRA code was enhanced as issues were identified and resolved.
l i
The current review was performed recognizing that probabilistic structural mechanics codes, including the SRRA code, are limited in their ability to predict absolute values of failure probabilities with a high degree of accuracy. The models themselves, along with the various inputs needed to apply these models. are subject to many uncertainties. In addressirig the value of a given computer code to calculate failure probabilities the following considerations were i
taken to be important:
Whi,e it is expected that advances in the technology will someday reduce the levels of uncertainty in calculated failure probabihties. the abihty of the models to estimate relative failure probabikties is considered to be more important than their ability to predict absolute values. In this regard. RI-ISI is largely governed by relative values ;f risk both for the ranking j
l and selection of components to be inspected and for the evaluation of risk increases or decreases associated with changes in the inspection programs.
Relatise values of failure probabilities are not used directly in the RI ISI process. However,it is the relative values of failure probabihties along with relative values of failure consequences that are important to the final results of the risk-informed evaluations.
l It is important to the RI-ISI process to calculate absolute values of failure probabikties as l
accurately as possible. because an increased levels accuracy and consistency in the calculations will contribute to a corresponding enhancement in the accuracy of the relative l
values of failure probabihties.
f!LL Si RWCAP E.L W
o.
The calculation of failure probabilities with codes such as SRRA should not be performed in isolation of other independent methods of estimating failure probabilities, such as data bases and plant operating experience. Results of calculations should always be evaluated for reasonableness and consistency, and the assumptions and inputs to the calculations should be refined as appropriate.
A,3 Overview of Assessment Over the past 3 years, as ASME-Research and WOG developed methods to perform RI-ISI of piping, the staff held public meetings with both groups to devtJop guidelines for acceptable uses of probabilistic fracture mechanics computer codes. In addition, with the assistance of Pacific Northwest National Laboratory (PNNL), the staff performed independent audit calculations to validate the results of the SRRA computer code.
The following discussion addresses the strengths and limitations of the Westinghouse SRRA computer code. ~Given the broad scope of piping designs and operating conditions, it was not expected that any one computer code could address all of the failure mechanisms and piping designs encountered in a nuclear power plant. Therefore, a key part of this review focused on the documentation for the Westinghouse code and t ow wellit achieved the following objectives:
(1)
Inform the code user about code limitations.
(2)
Provide technically sound guidance on alternative approaches to estimate piping failure probabikties.
Important elements of this evaluation include the equations and assumptions (inputs) used in the piping reliabikty models. as well the validation of the estimated failure probabilities. In some cases,it is appropriate to place certain detailed inputs outside the direct control of the user (incorporating inputs into the model itself). In other cases, specific recommendations can be provided in the user document with example problems. Where possible, input values were standardized for speific applications. Many of these inputs were the subject of significant discussions dunng penodic pubhc meetings on the Surry Unit 1 pilot applications, and are addressed in this review.
A.4 REVIEW OF SPECIFIC ISSUES This section addresses specific aspects of the probabilistic structural mechanics model from the standpoint of the consistency and reasonableness of the estimated failure probabikties.
l A,4.1 Failure Mechanisms As described in the following sections, the Westinghouse SRRA code addresses with various levels of detailed modeling the degradation mechanisms of (1) fatigue, (2) stress corrosion cracking, and (3) flow assisted corrosion / wastage or wall thinning. The present review concludes that acceptable technical approaches are used for each of these mechanisms.
rit.r srR%CM r%l.
&3 i
I
l e
l l
A.4.2 Fatigue l
The fatigue model assumes that all failures by this mechanism result from preexisting flaws.
Inputs to the model are sufficiently flexible to address low cycle fatigue attributable to normal plant transients, high cycle fatigue from thermal fatigue (resulting, for example, from stratification of fluids), and high cycle vibrational fatigue.
l l
Calculations are based on a relativelv detailed mechanistic model which relates fatigue crack l
growth to the amplitude and frequency of the cyclic stresses. The Westinghouse /SRRA model for fatigue is very simdar to that used in the NRC developed pc PRAISE code, and numerical results of the SRRA code have been successfully benchmarked (as described later) against results from the pc-PRAISE code.
In common with the pc-PRAISE code, Supplement 1 to WCAP-14572 does not address fatigue crack initiation except in an indirect manner by conservatively assuming that initiated cracks are present at the beginning of plant operation. The limitations of this approach to fatigue crack initiation are addressed below.
In common with the pc-PRAISE code. fatigue cracks are all conservatively assumed to be located at the pipe inner surface, Crack growth in both the depth direction (through-wall direction) and in the length direction are simulated in a manner essentially the same as that used in the pc PRAISE code.
The SRRA code permits the simulation of uncertainties in the levels of low and high fatigue stress cycles, which treats the amplitude of fatigue stress as a deterministic parameter.
The staff concludes that the SRRA code addresses fatigue crack growth in an acceptable manner since it is consistent with the technical approach used by other state-of-the art codes for probabilistic fracture mechanics. It should be noted, however, that realistic predictions of failure probabilities require that the user define input parameters, which accurately represent all sources of fatigue stress and the probabilities for p:eexisting fabrication cracks in welds. The major limitation of the model is its inability to realistically simulate the initiation of fatigue cracks, which exnenence has shown to be the pnmary contnbutor to fatigue failures at operating plants.
A.4.3 Stress Corrosion Cracking The stress corrosion cracking model of the SRRA code has a relatively simple technical basis, which does not attempt to model the complex failure mechanism in a detailed mechanistic manner. The calculations are based on a number of significant assumptions as follows:
. All piping failures by this mechanism result from preexisting fabrication flaws, although l
service experience with stress corrosion cracking indicates that such failures are dominated j
by cracks in welds that initiate during plant operation.
The effects of crack initiation can conservatively be estimated by assuming one flaw per weld at the start of plant operation, with the flaw size distribution being the same as that for i
fit i sl R%C APINL b-8
l I
welding-related fabrication flaws. Although calculations based on this assumptioil can j
provide relative probabilities of failure for different pipe segments, it is important for the expert panel to review the predicted failure probabilities to ensure a selection of input parameters that provides predictions, which are reasonable and consistent with plant operating experience.
There is sufficient knowledge on the part of the plant technical staff and the expert panel (in combination with plant operatinJ history with the occurrence of IGSCC) of the plant specific environmental factors (water chemistry, temperature, etc.), levels of weld sensitization, and residual stre 3 levels to identify pipe segments that have a high, medium or low potential for failure by stress corrosion cracking.
The probability of through-wall cracks for the high failure potential case can be calculated using a bounding crack growth rate curve developed in 1988 (NUREG-0313), this curve relates crack growth rates to crack tip stress intensity factors.
IGSCC related crack growth rates of moderate and none are assigned in the SRRA code to be a factor of 0 5 and 0 0 less than the bounding rate. with engineering judgement used to assign crack growth rates to these broad categories. Alternatively, the SRRA user can directly assign a numencal factor to be applied to the bounding crack growth rates.
In summary, the stress corrosion cracking model of the SRRA code provides a systematic basis to translate inputs into estimated failure probabilities on the basis of engineering judgement and operating experience The model combines the inpu*s for stress corrosion cracking with o'her factors such as pipe dimensions and applied loads to predict pipe failure probabilities. While some of the modeling assumptions appear to be quite conservative, the calculations for the Surry Unit 1 plant appear to predict reasonable trends.
In particular, the code documentation given in WCAP-14572, Revision 1 Supplement 1, acknowledges the limitations of the model, and recommends the use of the pc-PRAISE computer code if predictions from a more refined mecaanistic model are needed. The probabilistic fracture mechanics calculations for IGSCC have not been benchmarked for consistency with plant specific and industry operating expenence. In this regard, the Surry Unit l
1 evaluations do not provide a particularly good basis to evaluate the SRRA stress corrosion l
cracking model, because IGSCC makes only a small contribution to piping failures for PWR plants. The staff therefore requires that the IGSCC model be further evaluated on future applications to BWR plants because IGSCC is a major factor governing piping integrity at BWRs.
A,4.4 Flow Assisted Corrosion / Wastage The wastage model of the SRRA code has a relatively simple technical basis and does not attempt to model the complex wall thinning processes in a detailed mechanistic manner.
Deterministic models, such as the CHECKWORKS code developed by the Electric Power Research Institute (EPRI) are available to relate wall thinning rates to basic parameters such as i
flow velocity, chemical composition of the pipe matenal, fluid temperature, single-phase water versus two-phase steamiwater mixture. and pH level of the fluid. However, probabilistic forms of IllJ M Rw C AP FNL u
f
. ~.
such deterministic models have not yet been developed.
While a close reading of the code documentation as given in WCAP-14572, Revision 1 Supplement 1, provides information on assumptions made in the SRRA wall thinning model, j
many users could have difficulty relating inputs to the model to the type of information available to plant technical staff, in addition, users may not have sufficient insight into the assumptions behind the wall thinning model to perform calculations in a correct and consistent manner.
However, the calculations for Surry U it 1 had sufficient participation by the Westinghouse staff to ensure that calculations for the Surry Unit 1 study yielded reasonable results.
Supplement 1 to WCAP-14572, Revision 1, provides information on assumptions made in the SRRA wall thinning model. Before issuing of this SER, the staff expressed a concern that many users could have difficulty relating inputs to the model with the type of information available to plant technical staff. In addition, users may not have sufficient insight into the assumptions behind the wall thinning model to perform calculations in a correct and consistent manner.
Consequently, the staff indicated that WCAP-14572 should provide guidance for plant personnel executing the SRRA code for flow-assisted corrosion (FAC) that provides reasonable assurance that the results calculated for FAC failure probabilities are appropnate. In the public meeting on September 22,1998 (item 7 (b), Ref. 8]. Westinghouse stated that the next Revision of WCAP-14572 will provide guidance for material wastage potential. The staff concludes that the guidance for estimating the matenal wastage potentialis acceptable since, if material wastage rates are high enough to proceed through the pipe wall, the probabilities of smal1 leak, large leak and break are all calculated to be the same. The staff's approvalis conditioned upon Westinghouse making the change to WCAP-14572 desenbed above.
The wall thinning model in the SRRA code is based on the following assumptions:
The user of the code is able to estimate the rate of wall thinning (e.g., inches of wall thickness reduction per year) and express this rate in terms of a "best estimate" value and a distribution function (e g. log-normal distnbution) that describes the variability or uncertainty associated with the best estim.e Wall thinning can be treated in a simplified manner by assuming that the maximum local rate of thinning occurs uniformly over a substantiallength of straight pipe; this is a conservative assumption which does not account for vanations (reduced rates of thinning)in the axial or circumferential directions as is case for the important case of local wall thinning at elbow locations.
Consistent with the previous assumption, all failures af piping resulting from wall thinning will l
result in pipe breaks rather than leakages; pipe failures will occur when the simulated level of l
pressure-induced hoop stress becomes equal to the simulated values of the flow stress of the piping matenal.
Data from industry expenence, along with structural mechanics considerations of localized thinning, provide evidence that leak-before-break events are more likely than sudden pipe 3
breaks. The assumption that leak-before-break does not apply. as used in the SRRA code, is a 1
conservative assumption.
i HLF SF RwCAPIM u
The input parameter for the wall thinning rate is expressed in a simplified manner in 'he SRRA t
code with a parameter of 1.0 being assigned whenever the user believes that the thinning rate is high. The code assigns a "best estimate" thinning rate of 0.0095 inch per year for this rate parameter along with a variability described by a log-normal distribution which implies that the naturallogarithm of the thinning rate has a standard deviation of 0.893 (which corresponds to a value of 2.3714 for the so called " deviation or factor" used as input to the SRRA code). For a l
rate parameter other than 1.0, the best estimate of the thinning rate is assigned to be proportional to the selected value of the parameter.
The staff concludes that plant technical personnel have sufficient knowledge and field measurements of wall thinning rates to develop reasonable inputs to the SRRA code for estimating failure probabihties for FAC degradation mechanisms. Such information is generally available as a result of the ongoing programs for flow-assisted corrosion which are required at all plants. The approach uses data and/or engineering judgement to estimate a wall thinning rate.
The probabilistic structural mechanics model then calculates failure probabilities based on the estimated thinning rates, in combination with other governing parameters such as the pipe dimensions, apphed stresses, and material strengths Calculations with the model must be closely coordinated with the existing plant programs for the management of wall thinning. because the model requires inputs that can be obtained only from the knowledge gained from ongoing monitoring and evaluations of wall thinning rates.
Furthermore, apphcation of the probabikstic model of the SRRA code should not be used to make changes in exishng programs for the inspection and monitonng of piping for wall thinning.
A.4.5 Fallure Modes (Leaks and Breaks)
The staff finds the code's failure modes capabilities acceptable for RI ISI application since the SRRA code was modified dunng the Surry Unit 1 pilot application to address the failure mode of large system-disabling leaks in addition to the failure modes of smallleaks (through-wall cracks) and pipe breaks. The disabbng leak rate for each system is assigned to be consistent with existing evaluation of plant operational and safety evaluations. The modified program can address the vanous modes of pipe failure corresponding to consequences identified in plant PR/ 3 and safety analysis reports A.S Component Geometries The SRRA code was developed to address the simple geometry of a circumferential flaw in a girth welded pipe joint. In this regard. the SRRA code has a capability similar to that of other state-of-the-art probabikstic fracture rnechanics codes such as pc-PRAISE.
Application of SRRA to other more complex component geometries (e.g., elbow and tee pipe fittings) requires conservative assumptions founded on treating the maximum local stresses as uniform through the pipe wall, with no credit taken for the mitigating effects of stress gradients.
Calculations by Khaleel and Simonen (1997) have shown that this assumption can result in failure probabikties being overestimated by an order of magnitude or more.
(
ritt si nwcae tu v
t l
With proper attention to stress inputs and the interpretation of calculated results, the'SRRA code l
can be used effectively to estimate failure probabilities for components with more complex geometries. Before issuing this SER, the staff identified an open item that WCAP should provide guidance for the analyst on the code limitations for complex geometries and guidance for effective use of the code in such applications. In the public meeting on September 22,1998
[ item 12, Ref. 8], Westinghouse stated that the SRRA piping models only apply to standard piping geometry (circular cylinders with uniform wall thickness). Westinghouse further stated that a limitation on the use of non standard geometry will be added in the next revision of WCAP-14572. The staff finds this clanfication of the code limitation to be acceptable. The staffs approval is conditioned upon Westinghouse making the change to WCAP-14572 described above.
A,6 Structural Materials For calculational convenience. structural reliability computer codes should be able to address a range of piping matenals The capabilities of the SRRA code meets this criterion. The code has generally been applied in a mode which uses simplified inputs consistent with standardized material properties for stainless and ferntic piping materials. However, the code can also be operated in a mode which allows greater flexibility for the specification of input parameters for material properties.
1e staff recommends that licensees apply the code in a manner that accounts for the knc plant specific material characteristics as they may be governed by such factors as carbon cs
. int. heat treatments, etc.
As with any compLte. code the quality of results often depends on the capabilities of the code user in this case, the user must first recognize situations for which it is inappropriate to use the standard menu selections of material properties. Before issuing this SER, the staff indicated that WCAP-14572 should specify the level of training and qualification that the code user needs to properly execute the SRRA code. In its response in the public meeting on September 22,1998
[ item 13 Ref. 8). Westinghouse indicated that the next revision of WCAP-14572 will state that to ensure that the simplifia" SRRA input parameters are consistently assigned and the SRRA computer code e properly executed, the engineering team for SRRA input should be trained and qualified. The revised WCAP will also list the topics covered in this training as presented in the public meeting on September 22.1998 [ item 13, Ref. 8). The staff has reviewed the additional guidance for training and qualification and determined that it provides reasonable assurance that code users will be able to properly execute the SRRA code. The staffs approvalis conditioned upon Westinghouse making the change to WCAP-14572 described above.
A,7 Loads and Stresses The SRRA code has several inputs to describe the loads and stresses that govern piping failure.
The stresses used for plant specific applications should be based on actual plant experience l
and operational practices (including thermal and vibrational fatigue stresses), which may differ from the stresses used for purposes of the original design of the olant. The types of stresses of concern include residual and vibrational (fast transient) stresses which are specifically 4
addressed below. Other inputs address low cycle fatigue (slow transients) and design-limiting stresses which include the effects of seismic loadings. For applications of RI-ISI programs to flLE NrR% CAP FNI.
M l
.-~
~--
_ _ - - - - -. - -. ~ -.
l actual plants, plant specific inputs such for loads and stresses should be used.
All calculations assume that the stresses are uniformly distributed through the thickness of the pipe wall. This simplifying assumption is conservative and could be avoided (with methods currently used in the pc-PRAISE code).
The inputs for low cycle fatigue can address only one type of loading transient, which is assumed to represent the dominant contnbution to fatigue crack growth, although well-known methods exist to evaluate the combined effects of many operational transients. However, limiting the evaluation to one dominant transient is a reasonable approach, given the intended scope of the SRRA code, which is to estimate failure probabilities using simplified approaches.
Similarly, the SRRA code requires the user to select a single level of design-limiting stresses and an associated occurrence frequency which best characterizes the loads governing the probabikties of a pipe break. The selection is based on plant experience, records of transients, engineenng judgement or other considerations. 'fn some cases, the normal operating loads will be more important (because they occur with a probabikty of 100 percent) than much larger seismic loads that have lower occurrence rates (e g, a frequency 103 per year). Applications of the SRRA code before the 1996 benchmarking activity were founded on design-limiting stresses related to seismic loads, and with a standardized occurrence frequency of 103 per year.
Ulscussions dunng the 1996 benchmarking effort noted that higher probability loads should also be addressed. These discussions led Westinghouse to use as inputs the design-limiting (e.g.,
pressure, dead wwght. etc ) loads in combination with an occurrence frequency of once per year, or probabilistically distributed as a function of time in the calculations, an approach which may res'.:lt in conservative predictions of pipe break frequencies.
The staff finds the treatment of loads and stresses as discussed above to be conservative and acceptable for the purpose of Rl ISI program application since the use of less conservative loads and stresses would require more detailed structural analyses and in most cases should not impact either the categorization process or the change in risk calculations. In reviewing plant specific calculations performed with the SRRA code it has been noted that sensitivity calculations have been used to evaluate the effects of conservative inputs for piping stress. For example, failure probabilities associated with high stresses due to postulated snubber lockup have been adjusted to account for the prot 3bility that the lockup condition will actually occur.
Such evaluations are an important step to ansure that conservative inputs do not unrealistically impact the categonzation and selection of piping locations to be inspected, in summary, while an appropnate selection for input parameters for loadings is a critical step in the evaluation, licensees have the needed expertise to identify the required input to the SRRA input menu.
l A,8 Vibrational Stresses The NRC staff and the industry have recommendations that address appropriate levels (as a function of pipe size) for vibrational stresses to be used in failure probability calculations. These recommendations arose from concerns regarding assumptions made for early calculations performed for Surry Unit 1 by Westinghouse and Virginia Power, and were developed with guidance from the ASME Research Task Force on Risk-Based Inspection Guidelines.
?
r IlLL NLRW CTP FN1 u
Since the Westinghouse SRRA code has incorporated the recommendations of the ASME Task Force as default values for those piping locations at which high levels of vibrational stresses are expected, the staff concludes that the treatment of vibrational stress as in the SRRA code is acceptable. The recommended levels of vibrational stresses will be fully documented in a revision to WCAP-14572. The actual piping locations where vibrational stresses are to be expected are assigned by plant technical staff on the basis of judgement taking into account such factors as proximity to rotating equipment and knowledge of plant operating experience.
i The staff's approval is conditioned upon Westinghouse making the change to WCAP-14572 desenbed above.
A.9 Residual Stresses The Westinghouse SRRA code includes inputs for residual stress which describe both median values and variability in the level of stress. The rewdual stress contribution is an important contnbution to the growth of stress corrosion crackr and can also influence the growth of fatigue cracks through the so-called R-Ratio effect.
Appropnate levels of welding residual stress were discussed in review meetings held during the Surry Unit 1 pilot application. and a consensus was developed to guide the selection of residual stress inputs. Since the SRRA code uses the resulting recommendations which specify a log-normal distnbution to descnbe the uncertainty in residual stress, with an upper bound on the distabution (or truncation) at 90 percent of the flow stress (corresponding to the 90th percentile of the log-normal distnbution), the staff finds the treatment of residual stresses acceptable.
A.10 Treatrnent of Conservatism RG-1.174 recommends that all calculations used in the categorizing risk (including the calculations of component failure probab;lities) should be performed on a "best estimate
- basis rather than conservatively. Conservative assumptions can introduce undesirable biases into the ranking process by masking the significance of those components for which realistic rather than conservative evaluations are performed. In the case of inservice inspections, the result could, for exampie. lead to an inappropnate amount of inspection of small versus large pipes, or excess in:.pection for stress corrosion cracking versus inspection for flow-assisted corrosion.
With a few exceptions, the Westinghouse SRRA code performs "best estimate
- calculations. On the basis of this review, the staff concludes that conservative assumptions are consistent with practices used in similar computer codes, and/or are consistent with limitations of current technology to predict structural failures. Nevertheless, particular applications of the code may address uncertainties regarding code inputs by assigning very conservative values, and thereby generate inappropriately conservative estimates of failure probabilities. The present review also addresses the following potential sources of conservatism on the basis of practices used in the Surry Unit 1 pilot study:
l Inputs for the number and sizes of fabrication flaws are a significant source of uncertainty, in estimating the number of flaw in a weld the SRRA code accounts for the volume of metalin the weld by relating this volume to the circumference and wall thickness of the pipe. The FILE SI R% C AP hl A 10
-~
. ~
'O l
l e
SRRA code, like the pc-PRAISE code, places all flaws at the pipe inner surface, and in this step makes conservative assumptions about the fraction of the flaws in each given weld which should be counted as surface flaws. This estimated fraction is believed to be somewhat more conservative for thicker wall piping than for thinner wall piping, and may therefore bias inspections to larger piping.
The treatment of stress corrosion cracking could give very conservative predictions of failure probabilities because of consemative assumptions in the structural mechanics model. In particular, the model makes thrae conservative assumptions:
(1) There is a 100 percent probability that an IGSCC crack willinitiate in each weld.
(2) The crack initiates at time equals zero.
(3) The size distribution of the initiated cracks is the same as for welding related flaws.
Evidently, there are offsetting factors which lower the calculated crack growth rates and thereby account for a generally good correlation of the calculated failure probabilities with service expenence. The reason for the good correlation with experience is not clear.
However, it appears that the SRRA calculations were performed with the intent of achieving qualitative agreement with plant operating experience. In this regard, staff recommendations encourage the use of data and operating experier:ce to augment computer models to estimate piping failure probabilities The WCAP does not document a formal process to use expenence as a means to calibrate the SRRA calculations. Nevertheless, discussions dunng public meetings for reviews of the Surry Unit 1 pilot application did focus on piping locations with highest values of failure probabilities with attention to the degradation mechanisms involved and how the predictions correlated with service experience. Evidently the SRRA models have been adjusted or calibrated to ensure that the piping locations with the highest potential for IGSCC have calculated failure probabilities that are generally consistent with the experience. Having " anchored' the highest values of calculated probabilities, the model permitted probabilities for locations with lower potentials to be estimated on the basis of the relative values of calculated failure probabilities.
The review of the Surry Unit 1 pilot study indicates conservative engineering judgements used to assign cyclic and design limiting stress. One example is that vibrational stresses are often assumed to be present (with a prebability of 100 percent), where in reality the identified locations only have a potential for the occurrence of such stresses. At other locations, code limiting stress levels are assigned because results of detailed stress calculations were not available. However review of the predicted failure probabilities calculated for the Surry pilot plant showed consistency with available industry data for the frequency of vibrational failures.
As in the case of failures due to IGSCC, the results of SRRA calculations for vibrational failures were reviewed dunng public meetings. Inputs for vibrational stress levels were refined with an objective to predict failure probabilities that were reasonable and consistent with plant operating experience. The staff, therefore, finds the selected application of conservatism for vibrational stresses acceptable.
A.11 Numerical Methods and importance Sampling On the basis of this review, the staff concludes that the SRRA code calculates failure ritr. sto cmM ut
1 o
probabilities using acceptable statistical and probabilistic methods. The Monte-Carlo method as implemented in the SRRA code is a standard approach commonly used in probabilistic structural mechanics codes including the pc-PRAISE code. Importance sampling, again a common and well-accepted approach, increases the computational efficiency of the Monte-Carlo procedure by shifting the distributions for random variables to increase the number of simulated failures. The magnitude of shift applied to the variables by the SRRA code is relatively modest and is not i
believed to be sufficient to cause incorrect estimates of failure probabilities.
A.12 Documentation and Peer Review Having reviewed WCAP-14572, Revision 1, Supplement 1 the staff concludes that this document, along with other referenced technical reports and papers, provides an acceptable level of documentation for the SRRA computer code.
Peer reviews of the SRRA code have also been pc. formed on several occasions. The author of the code has pubhshed several papers for presentation at technical conferences, with technical peer reviews being part of the publication process. Earlier versions of the code have been used by Westinghouse in past research projects which have also been reviewed by the staff. In addition. the methodology of the code parallels approaches used in other generally accepted probabikstic structural mechanics codes. such as pc-PRAISE.
Dunng the Surry Unit 1 pilot plant study, technical reviews of the SRRA code were performed by the NRC staff its contractors, and the ASME Research Task Force on RI-ISI. These reviews provided a detaded assessment of the Westinghouse SRRA code on the basis of (1) documentation of the code. (2) detaded desenptions of example calculations, (3) trial calculations performed with the SRRA code by peer reviewers, and (4) benchmark calculations to compare fadure probabilities predicted by the SARA code and the pc-PRAISE code. Related comments resulted in several improvements to the SRRA code, as reflected in WCAP-14572, Revision 1, Supplement 1 A.13 Validation and Benchmarking Westingnouse has used a vanety of approaches to validate the ability of structural mechanics code to predict component fadure probabikties. These approaches have included comparing code predictions with plant operating experience, and comparing SRRA predictions with predictions mace by other probabilistic structural mechanics codes. Results of these efforts are desenbed in WCAP 14572. Revision 1, Supplement 1, and in a recent ASME technical paper (Bishop 1997) The results of these vahdation efforts are reviewed in the following subsections.
A.13,1 Benchmarking Against pc-PRAISE l
As part of the Surry Unit 1 piiot application during 1996, a benchmarking activity to compare results from the Westinghouse SRRA code with the pc-PRAISE code was completed. The scope of the benchmarking calculations was kmited to the failure mechanism of fatigue, because both codes address this mechanism and approach the fatigue evaluation in a similar manner.
Fill: St RW C \\P F Nl 0 12 l
The objective of these calculations was to start with identical specifications for input ' parameters, and to establish whether the two codes predict the same or similar probabilities of failure for small leaks, large leaks, and pipe rupture.
The 1996 benchmarking calculations did not address the failure mechanisms of stress corrosion cracking or wall thinning caused by flow-assisted corrosion. The pc PRAISE code does not i
address the failure mechanism of wall thinning, and therefore provided no means to benchmark the predictions denved using the all thinning model from the Westinghouse SRRA code. In addition, although both codes address stress corrosion cracking, they use significantly different technical approaches which result in very different types of input parameters. Therefore, the appropriate validation approach for this failure mechanism was to validate each code en its own ments against operating experience.
NRC staff and contractors participated in the benchmarking activity, which Westinghouse staff documented in a recent paper presented at an ASME conference (Bishop 1997). This evaluation report summarizes the benchmarking procedures and (in part) the results of that effort.
A wide range of pipe sizes. material types cyclic stress levels and frequencies, design limiting stresses, and leak detection capabilities were addressed by the calculations. While the present review desenbes some difficulties and issues encountered in comparing break probabilities for stainless steel piping when leak detection was included in the calculations, the present review agrees with the overall conclusion stated by Westinghouse that the calculations did successfully benchmark the calculations for the srnall leak, large leak. and full break probabilities..
As stated, the benchmarking calculations of the Westinghouse SRRA code against the pc-PRAISE code were limited to the mechanism of fatigue and more specifically, fatigue-related failures of piping associated with preexisting flaws in circumferential welds. The calculations excluded failures caused by service-related cracks initiated by fatigue. However, the range of cyclic stresses and cyclic frequencies was sufficiently broad to address low cycle fatigue attributable to normal plant transients, and high cycle fatigue caused by pipe vibrations or thermal fatigue conditions.
The benchmarking effort addressed concerns over the number of Monte-Carlo trials and importance sampling implemented within the Westinghouse SRRA code. Both aspects of the numerical approach were found acceptable. Results from the audit calculations led Westinghouse to increase the default number of Monte-Carlo simulations from the original value of 5000. In addition, the review established the correctness of the importance sampling approach, which in the Westinghouse SRRA code involves a shifting of distributions for the random variable in such a direction as to obtain a large number of simulated failures. Default values for the number of shifting were judged to be modest, and unlikely to be a source of error in calculated failure probabilities. Sensitivity calculations by Westinghouse were performed to establish the amount of sNfting which would degrade the accuracy of the calculated failure probabilities, and this level far exceeded the default parameters for shifting distributions.
The benchmark calculations generally showed good agreement in calculated failure probabilities. There were no areas of significant disagreement for probabilities of either small or large leaks over the full range of input parameters, which gave a very wide range of calculated FILI. 5t RM \\P I NL W3 l
O failure probabilities, in a few cases, limited to certain calculations involving very low break probabilities, differences in calculated break probabilities amounting to several orders of magnitude were noted between results from the two codes. Calculations with the Westinghouse SRRA code gave higher break probabilities than predicted by pc-PRAISE. The pipe break probabilities were always sufficiently small so that the pipe segments would make only negligible contributions to the core damage frequency or categonzation. No sigMicant differences were observed for cases that neglected the effects of leak detection or where the piping material was ferritic steel versus stainless steel.
The benchmarking activity was concluded before all remaining differences in calculated break probabilities were resolved. As a result, some patential sources of numerical differences were not fully explored, including details of the importance sampling procedure, and the logic used to simulate the effects of leak detection. Westinghouse has put forward revised calculations that show relatively good agreement for all break probabi;ities.
It shou;d be noted that there were significant differences in calculated failure probabilities for smallleaks. large leaks. and pipe breaks during the first phase of the benchmarking calculations. It became clear that the codes themselves were not the source of the differences, but rather differences in the selection of numerical values for certain input parameters, which had not been adequately specified dunng the initial definition of the parameters for the benchmark problems. The most cnticalirguts were those for flaw density and size distributions, levels of vibrational fatigue stresses, and inputs for the simulation of leak detection.
Participants in the benchmarking efforts subsequently agreed to develop improved and standardized values for the enticalinputs. Using results of calculations performed by Rolls Royce and Associates. the participants developed improved inputs for flaw size distributions.
Inputs for vibrational stress levels were related to pipe sizes, resulting in reduced levels of vibrational stress for the largest pipe sizes As a final step, the SRRA code was modified to simulate the effects of leak detection using a technique consistent with the state-of-the-art methodology used by *e pc-PRAISE code. These changes resulted in good agreement between the two codes A.13.2 Validation with Operating Experience A number of approaches can be used to validate calculated failure probabilities for consistency with plant operation experience. The documentation given in WCAP-14572, Revision 1, Supplement 1, provides two acceptable examples of such validation for the SRRA code, Both examples address failure mechanisms (FAC and IGSCC) for which there have been a sufficient number of field failures to provide data to permit benchmarking of calculated failure probabilities with observed failure rates. The staff found acceptable the agreement between predictions and operating expenence for both failure mechanisms.
"or most pioing segments, calcu!ations with the SRRA code have predicted relatively small values for failure probabilities. The results indicate that failures for such pipe segments would not be expected to occur for the limited number of years of plant operation accumulated to date.
The SRRA code has therefore been shown to predict very low failure probabilities for those
(
FILF M RWC J FNL bi4 l
i j
failure mechanisms and piping locations which have exhibited a high level of operational reliability, I
The predicted failure probabilities predicted by the SRRA code for the Surry Unit 1 plant have been reviewed from the standpoint of plant-wide trends. The net plant-wide calculated failure l
fregt.ency (accounting for all pipe segments and all systems) indicates about one pipe leak per year for the entire plant, and a few pipe breaks over the 40-year operating life of the olant.
l These predictions of overall failure rates, predicted degradation mechanisms, and the most likely locations for piping failures show an acceptable level of agreement with plant operating experience. However, as noted above, most piping locations have experienced no failures or detectable degradation, and for these locations the operating experience provides no means to validate the correctness of the relative values of calculated failure probabilities. In this regard, the RI-ISI process is designed to provide feedback of future operating experience to permit refinement of the predictive models as appropriate.
A.14 Flaw Density and Size Distributions inputs for the number and sizes of welding-related fabrication flaws are a large source of uncertainty in performing probabilistic structural mechanics calculations. WCAP-14572 Revision 1, Supplement 1, indicates that the SRRA code uses acceptable inputs for flaw densities and size distributions. The inputs used with the SRRA code are those developed during the 1996 benchmarking activity. These inputs were derived on the basis of trends observed in calculations generated by Rolls Royce ar'd Associates through application of the RR-Prodigal model to simulate flaws in typical nuclear piping welds.
While there remain uncertainties in the estimated absolute values of flaw densities, the technical basis of RR Prodigal model helps to ensure consistency in the relative values for the number and sizes of flaws as a function of pipe material, w'elding practice, pipe wall thickness, and volume of weld metal. The 1996 modification of the SRRA code, which included the improved means for describing flaw distnbutions, significantly enhanced the ability of the SRRA code to predict reasonable values (cunsistent with data from operating experience) for the relative failure probabilities of large diameter piping versus small diameter piping.
A.15 Initiation of Service Induced Flaws The fatigue and stress corrosion cracking models in the SRRA code address only failures caused by preexisting fabrication related flaws. Such flaws are an important contribution to piping failures, particularly when the service stresses a e insufficient to cause cracking of initially un-flawed material. However, many service-related failures have been associated with severe cases of cyclic stress (e.g, thermal fatigue) or aggressive operating environments (e.g., stress corrosion cracking). In these cases service induced flaws rather than preexisting flaws are the dominant contnbutor to piping failures.
The documentation provided in WCAP-14572, Revision 1, Supplement 1, appropriately acknowledges the limitations of the SRRA code, and suggests that other approaches may be needed to address failures due to service-induced flaws. These methods include the pc-FILE SER% CAP FNL Ad5
.m
._ _ ~ - _ _ _.
e
~.
PRAISE code which offers the capability to simulate the initiation of stress corrosion' cracks in stainless steel welds. In this regard, the diversity of experience represented by the expert panel reviews should ensure that appropriate computer codes and data bases are used to estimate failure probabilities.
In practice, as dunng the Surry Unit 1 pilot study, calculations with the SRRA code have approximated service-induced flaws by assuming that one flaw per weld initiates immediately upon the start of plant operation; The size of this flaw is described by the same distribution us'ed to describe welding related flaws. This modelis an acceptable basis to calculate conservative
[
or bounding values of failure probabilities. However, failure probabilities calculated using this approach must be used with caution, because the overly pessimistic predictions could result in i
assigning inappropriately high rankings to certain pipe segments at the expense of other components which could have larger contributions to risk.
A.16 Preservice Inspection
~
There are no simulations within the SRRA code to account for preservice inspections as a means to reduce the number of initial fabrication flaws. Effects of preservice inspections must be included indirectly through the inputs for flaw densities and size distributions. The staff finds
- the flaw distnbution parameters described in WCAP 14572 Revision 1, Supplement 1, to be acceptable since they were derived from predictions by the RR-Prodigal flaw simulation model, which accounts for the effects ofinspections performed after completion of welding. Using these l
input parameters, the calculations with the SRRA code have properly addressed the effects of l
preservice inspections.
l A.17 Leak Detection Consistent with the objective of calculating "best estimate" rather than conservative failure probabihties, the effect of leak detection in preventing catastroph,ic piping failures should be included in determining the change in CDF/LERF that lead to changes in the inspection program. The Westinghouse SRRA code includes a simulation ofleak detection as an enhancement to the code made dunng the 1996 code benchmarking activity (It should be noted that for categonzing prping segments, leak detection is not normally credited, except for the reactor coolant system where redundant leak detection capabilities exist.). It is important that inputs to the SRRA code specify reakstic values of detectable leak rates. This requires an understanding of the reliabihty of the techniques used to detect leaks in the various plant systems of interest.
The simphfiec leak rate modelin the Westinghouse SRRA code is based on a correlation of L
calculated data on leak rates obtained from a more detailed model which is part of the pc-PRAISE code. This correlation provides an acceptable basis for addressing leak detection for the specific pressure ano temperature conditions for the primary coalant loop of PWR plants having fatigue type cracks. The correlation accounts for effects of crack size, pipe stress, and internal pressure, and gives approximate predictions leak rates suitable for use in leak detection
{
models. However, the correlation can give incorrect simulations of leak detection (due to over
[
prediction of leak rates) for systems operating at the pressures and temperatures for BWR
(-
nli MRWC AP FNI.
A le
l l
plants that have IGSCC cracks with morphologies differing from those of fatigue cracks.
l Before issung this SER, the steff had identified an open item that Westinghouse should address the applicability of those correlations to other plant conditions. The staff also indicated that Westinghouse should clarify whether the SRRA code can be apphed to BWRs and justify the l
applicability of the correlations used to calculate leak rates under BWR operating conditions. In l
the public meeting on September 22,1998 [ item 5 (d), Ref. 8], Westinghouse stated that the i
existing correlations for leak rates can be used for other pl d conditions beyond the RCS and that the SPRA code can be applied to BWRs: however, care must be exercised in applying this approach to BWR p. ping systems, particularly those subjected to IGSCC. In addition, Westinghouse indicated that WCAP-14572 will be revised to provide guidance on addressing stress corrosion cracking. The staff finds the response acceptable since most piping susceptible to stress corrosion cracking (SCC) is also subject to fatigue loading, such as normal heat up and cool down, and the leak rate correiation for fatigue type cracks was conservatively assumed for l
the CLVSQ Program. The staff's approvalis conditioned upon Westinghouse making the l
change to WCAP-14572 described above.
A.18 Proof Testing The Westinghouse SRRA code does not exphcitly address the potential benefits of preservice proof tests (e g pressunzation tests) as a means to reduce piping failure probabilities. As such, the calculated failure probabilities are hkely to be somewhat conservative. Components having very low failure probabilities are hkely to be those most affected by proof testing (i e., potential service failures are attnbutable to very deep cracks which can be discovered during proof testing).
Proof testing can be addressed indirectly by the SRRA code with a modification to the h. puts for the number and sizes of initial fabncation f!aws The proof test serves to reduce the nurr.ber of very large flaws.
Before issuing this SER. the staff had identified an open item that WOG should desenbe how proof testing is addressed in the SRRA calculations, and iould clanfy what impact its neglect would have on the calculated failure probsoilities and categorization. In the public meeting on September 22,1998 (item 14. Ref. 8]. Weenghouse stated that the effect on the segment risk ranking and categorization would be very small and slightly conservative. Westinghouse also indicated that the next revision of WCAP-14572 will clanfy that SRRA models in LEAKPROF do not take credit for eliminating large flaws, which would fait during the pre-service hydrostatic proof tests, even though this is allowed as an input option in pc-PRAISE. The staff concludes that the approach for addressing proof testing is acceptable because Westinghouse has demonstrated that the effect c ' proof testing on the segment risk ranking and categorization would be very small and slightly conservative. The staff's approvalis conditioned upon Westingho' se making the change to WCAP-14572 described above.
u A.19 Inservice inspection The Westinghouse SRRA code can simulate the reduction in piping failures resulting from ISI.
FILL SERWCAP f%L A l' l
l However, the methodology desenbed in WCAP-14572, Supplement 1, assumes no i'nservice l
inspection for purposes of establishing risk importance measures, but does credit inservice
)
inspection in calculating the change in CDF/LERF that results in changes to the ISI program.
l Inservice inspections are simulated by the SRRA code following an approach which is similar l
but not identical to the pc-PRAISE code. In most cases, the approach should give acceptable predictions of the effects of insoections. Nevertheless, due care must be taken to avoid overly j
optimistic evaluations. Before issuing this SER, the staff had identified an open item that tM probabikty of detection curves used in calculations need to be justified for the material type, inspection method, component geometry, and degradation mechanism that apply to the structurallocation being addressed. In the public meeting on September 22,1998 [ item 15 (a),
Ref. 8] Westinghouse stated that the default input values for the probability of detection (POD) curves are consistent with the default input values for pc-PRAISE. The revised WCAP will emphasize that the SRRA code user must ensure that the specified input values for POD are appropriate for the type of matenal, inspection method, component geometry, and degradation mechanism being evaluated The staff finds this response acceptable since (POD curves are consistent with the default input values for pc PRAISE code which has been validated and accepted by the staff for various applications. The staff's approvalis conditioned upon Wcstinghouse making the change to WCAP-14572 desenbed above. In addition, the detection probabiht es used in SRRA ca!culations should be justified and documented as part of plant specific submittais A.20 Service Environment Service environments (charactenzed by pressure, temperature, water chemistry, flow velocity, etc.) can affect corrosion rates and crack growth rates. These effects raust be addressed on a segment-by-segment basis in probabikstic structural mechanics model since the classification of high-safety-significance and low-safety-significance is based on a segment-by-segment basis.
The SRRA code allows the effects of service environment to be included in calculations of piping failure probabihties. For thJ failure mechanism of fatigue crack growth, the equations for predicting crack growth rates are appropriate since they have been derived on the basis of tests performed with specimens exposed to reactor water environments.
Crack growth rates (for stress corrosion cracking) and wall thinning rates (for flow-aasted conosion) can be specified by the inputs in a manner that includes appropnate effects of operating environments Crack growth rates are appropriate since the SRRA code has incorporated bounding rates for these two degradation mechanisms, bounding rates are founded on laboratory data and service experience corresponding to high failure probabilities, and the user shouH specify numencal factors to be applied to these bounding rates, with the assigned factors derived from plant operating expenence and engineering judgement.
In summary, the SRRA code provides an acceptable method to account for the effects of the l
operating environment since the method is largely reliant on qualitative judgments to indirectly assign quantitative factors. This is appropnate since typical calculations must often be j
performed without detailed knowledge of such factors as water chemistries and flow velocities and the documentation for the code acknowledges hmitations of the approximate methodology rlli M RM \\P iN1
\\ lx l
.~
and recommends other methods for use as needed.
l:
- A.21 Fatigue Crack Growth Rates l
The equations used by the Westinghouse SRRA code to predict fatigue crack growth rates in i
both stainless and ferntic steels are the same equations used by the pc PRAISE code. These l
equations represent the best avai'able correlations for the statistical distributions of mean crack growth rates and for crack growth On the basis of this review, the staff concludes that the
. SRRA code has an acceptable basis for simulating fatique crack growth rates.
i A.22 IGSCC Crack Growth Rates l
The equations used in SRRA to relate crack tip stress intensity factors to growth rates for stress corrosion cracks are consistent with NRC staff evaluations of BWR piping performed in the 1980s. These equations provide an acceptable approach to predict bounding growth rates for sensitized stainless steel welds in BWR water environments.
The equations implemented in the SRRA code do no: provide a mechanistic basis to address stress corrosion cracking unde'less aggressive conditions. Limitations of the equations are acknowledged in the code documentation provided in WCAP 14572, Revision 1, Supplement 1.
A code user is guided to apply knowledge of the materials / welding variables and of the plant I
operating conditions in combination with engineenng judgement to estimate crack growth rates j
relative to the bounding rates incorporated into the SRRA code. The user is also guided in this difficult task with the option to assign a high, medium, er low category for the crack growth rates.
With this option the code internally assigns the numerical parameter which is applied ac a multiplying factor to the bounding crack growth rates.
A.23 Wall Thinning Rates i
The Westinghouse SRRA code estimates vall thinning rates using a statistical correlation (mean of 0.0095 inch per year and standard deviation of 0.893 inch per year) of field measurements of thinning rates from piping subject to flow-assisted corrosion. These measured rates were from selected piping locations which had sufficient wa!! thinning to violate minimum wall thickness requirements and thus result in replacement of the piping.
The user of the coce must apply knowledge of the piping materials, operating conditions, and (if possible) plant-specific measurements of thinning rates to assign each pipe location to the categories of high, medium, and low thaining rates. The high category corresponds to the statistical data correlation contained in the code, with the other categories corresponding to internally assigned multiples of this reference thinning rate.
i Plant technical staff will typically have data available from existing programs for augmented inspection and the management of wall thinning for piping systems at their plants. In these
[
cases, the user can overnde the parameters corresponding to the three standard categories, I
FILE 5ERWCAP fN.
ble
o e
and directly assign input to desenbe the best estimate and uncertainty in the thinning rates.
These assignments can be based on location specific wall thickness measurements, predictions of thinning rates such as by the CHECKWORKS code, or can be based on other sources of knowledge and/or engineering judgement.
With proper inputs, the code provides a useful tool to assist in estimating piping failure probabilities attnbutable to wall thinning. Before issuing this SER, the staff had identified an open item that Westinghouse should expand the code documentation to provide additional guidance for selecting the input for tna calculation. In the public meeting on September 22, 1998 [ item 15(b), Ref. 8], Westinghouse stated that the next Revision of WCAP-14572, Supplement 1, will provide detailed guidelines for simplified input variables and any associated assumptions that could be important in assigning the input values for the SRRA code. WCAP-14572 will also state that if more than one degradation mechanism is present in a given segment, the limiting input values for each mechanism should to combined so that a limiting failure probability is calculated for risk ranking. The staff finds the guidance in item 15(b), Ref. 8 to be acceptable because it provides sufficient guivance for the code user for selecting input parameters The staff s approvalis conditioned upon Westinghouse making the change to WCAP-14572 desenbed above.
A.24 Material Property Varisbility Vanabihty and uncertainties in certain material properties have a large influence on calculated failure probabihties Nonetheless it is appropnate for probabilistic structural mechanics codes to treat some matenal properties as deterministic. While the variability and uncertainty in other properties must be simulated in the probabilistic model. Experience has shown that it is critical to treat the matenal input parameters associated with crack growth rates, fracture toughness, and strengtn levels as random variables.
The SRRA code treats probabikstically the important parameters which descrioe material properties. The staff finds that the code provides an acceptable basis to account for uncertainties in material-related charactenstics since the code documentation clearly indicates which material properties are treated in a probabilistic manner and which parameters are treated as deterministic inputs A,25
SUMMARY
AND CONCLUSIONS This review concludes that the Westinghouse SRRA code provides an acceptable method that can be used, in combination with trends from data bases and insights from plant operating experience, for estimating pipir.g failure probabilities. The underlying deterministic models used by the code are based on sound engineenng principles and make use of inputs which are within the knowledge base of experts that will apply the code. Effects of variability and uncertainties in code inputs are simu'ated in a reasonable manner. The documentation for the SRRA computer code shows examples where the code has been benchmarked against other computer codes l
and vahdated with service expenence, While the SRRA code can be apphed as a useful tool for estimating piping failure probabilities, l
RJ
le a
the present review has identified a number of limitations in the types 9f calculations that can be performed by the code. Some of the concerns which users of the code must be aware include:
The quality and usefulness of results from the SRRA code are very dependent on the quality of inputs provd td to the code. It is important that users of SRRA be adequately trained in the features and limitations of the code, and have the access to detailed information of the plant specific piping systems being modeled.
The results of SRRA calculaticas should always be reviewed to ensure that they are reasonable and consistent with plant operating experience. Data from plant operation should be used to review and refine inputs to calculations. in all cases, greater confidence should be placed in relative values of calculate failure probabilities than on absolute values of these probabihties.
The stresses used for plant specific applications should be based on actual plant experience and operational practices (including thermal and vibrational fatigue stresses) which may differ from the stresses used for purposes of the original design of the plant.
The present review desenbes some numerical difficulties and issues encountered in comparing break probabihties for the fatigue of stainless steel piping when leak detection was included in the calculations. Nevertheless, the present review agrees with the overall conclusion as stated by Westinghouse that the calculations did successfully benchmark the calculations for the small leak, large leak, and full break probabi!!!ies.
The simp 4fied nature of the SRRA code has resu ted in a number of conservative assumptions and inputs being used in applications of the code. It is therefore recommended l:
that sensitivity calculations be performed to ensure that excessive conservatism docs not unrealistically impact the categonzation and selection of piping iMations to be inspected.
The model of piping fatigue and stress corrosion cracking by the SRRA code addresses only failures due to the growth of preexisting fabrication flaws and does not address service induced initiation of cracks. Given plant operating experience which shows that piping failures by fatigue and IGSCC are very often due to initiated cracks, the prediction of failure probabikties for these degradation mechanisms will often be better addressed by other methods ana/or other computer codes, such as pc-PRAISE The SRRA model for flow assisted corrosion and wastage only addresses the variability in Wall thinning rates, and assumes that the user has a basis for assigning values for expected or nominal thinning rates. Application of the SRRA model should be macc within the context of existing plant programs for the inspection and management of wall thinning of piping systems. The SRRA code can be applied most effectively if there are means to estimate the thinning rates, based, for example, on data collected from wall thinning measurements or l --
from predictions of computer codes such as the EPRI developed code CHECKWORKS.
i l'
The pilot applications of the SRRA code to risk-informed ISI as described in WCAP-14572 l
represent a new and evolving application of the probabilistic structural mechanics technology Lessons learned from the pilot applications and consideration of the code limitations as identified in the present review should be used to guide the future development and rlLisrRwC\\PrM MI 1
.~ -.
--=
G i
,4 i
l
?
enhancement the SRRA code.
i l
l I
I nusrneuno s.::
-. -...-_...~..
I f
e f
C I'
A.26 REFERENCES for APPENDIX A Bishop. B.A.,"An Updated Structural Reliability Model for Piping Risk-informed ISI," ASME PVP Vol. 346, pp. 245 252, Fatigue and Fracture - Volume 2,1997.
Chexa!, B, et al., 'CHECWORKS Computer Program User Guide, Report TR-103496, EPRI, December 1993.
Harris; D.O., and D. Dedhia, " Theoretical and Users Manual forpc PRAISE, a Probabilistic Fracture Mechanics Computer Code for Piping Reliability Analysis," NUREGICR 5864, U.S.
Nuclear Regulatory Commission, Washington, D.C.,1991.
Hazelton, W.S., and W.H. Koo, ' Technical Report on Material Selection and Processing Guidelines for BWR Coolant Pressure Boundary Piping.' NUREG-0313, Revision 2, U.S.
Nuclear Regulatory Commission Report,1988.
Khaleel. M.A., and F A. Simonen " Effects of Through-Wall Bending Stresses on Piping Failure Probabilities," ASME PVP. Vol. 346, pp 217-224, Fatigue and Fracture - Volume 2,1997.
i l
f l
l FILE $1 R% CAP FNL A 23 w
w
r l
Westinghouse Owners Group Project No. 694 cc:
Mr. Nicholas Liparulo, Manager Equipment Design and Regulatory Engineering Westinghouse Electric Corporation Mail Stop ECE 4-15 P.O. Box 355 Pittsburgh, PA 15230-0355 Mr. Andrew Drake, Project Manager Westingnouse Owners Group Westinghouse Electric Corporation Mail Stop ECE 5-16 P.O. Box 355 Pittsburgh, PA 15230-0355 Mr. Jack Bastin. Director Regulatory Affairs Westinghouse Electnc Corporation 11921 Rockville Pike Suite 107 Rockville. MD 20852 Mr. Hank Sepp. Manager Regulatory and Licensing Engineenng Westinghouse Electnc Corporation PO Box 355 Pittsburgh, PA 15230-0355 l
l