ML20198K157

for Comment Issue of Draft Reg Guide DG-1063, Approach for Plant-Specific,Risk-Informed Decisionmaking:Inservice Insp of Piping

ML20198K157
Person / Time
Issue date:	10/31/1997
From:	NRC OFFICE OF NUCLEAR REGULATORY RESEARCH (RES)
To:
References
TASK-*****, TASK-DG-1063, TASK-RE REGGD-01.XXX, REGGD-1.XXX, NUDOCS 9710230137
Download: ML20198K157 (192)

Text

_ - .

.g U.S. NUCLEAR REGULATORY COMMISSION Octob:r 1997 f 1 OFFICE OF NUCLEAR RECULATORY RESEARCH Divisi:n 1 Draft DG 1063

.....) DRAFT REGULATORY GUIDE

Contact:

J. Guttmann (301)415 7732 S. Ali (301)415 2776 DRAFT REGULATORY GUIDE AN APPROACH FOR LAN n4 -SPECIFIC, RISK-INFORMED EC gONMAKING:

} INSERVICE INS $0N OF PIPING o

g .f.; Y 1

.  :,~

n.. ..gs.io,y guim, b.ing i..u.d in d,.n . i. in.oi.. ,,, ,ue .. in is. .. , . .g.. o, is. ....i nm.ni of . ..gui. .,y no.. ion in i,.. .....

nh ..c...d .om, . . .,f ...i.. .nd do. ,,oi . .s.m .n .if.ci.i uRC . ... .. .on.

m. o un.ni. . b ng . i..ii.d on is. d,.. go.d. i.nciud.og .n, impi.m.ni.i,on .cs.ds.i .nd . .... . .d ,.gui.io,, .n.iv.i. o,

..iu.r-i .i. .ni. Com,r,.ni. .wd b. .ccomp.n..d b . on... . .ungo,t.ng d.i.. w,,n.n . ,.ni, m., b. .ub,n.n.d io ... Rs..

.nd Dir.ctiv D,.nch, Dific. of Admirwett. tion. U.S. Naci.., Regul.to,y commission. W.sNngton. DC 20555-000), Copi.. of comm.nts

..o.sv.d m.y b. .m. min.d .1 th. NRC Publi. Docum.nt Room. 2120 L Str... NW.. W.shengton, DC, Comm.nts will b. mo.t h.lpful 6f r.csiv.d by January 9,1998.

)

R.es t. for .ingt. copi of dr.ft or .ctiv. ,. gut. tory guid.s ivvhich m.y b. ,.produc.d) or for pisc.m.nt ori .n .utom.it. distribution lest for

.mel. copi of futur. d..ft guid In .p.cifes divi. ion. .hould b. m.d. in wnting t. the U S. Nucl..r R.gul. tory Commis. ion, W.shington, DC 20555000). Att.ntion: P,inting Or.phie., .nd Distribution B,.nch, or by f. to (301)415 5272.

~

9710230137 971031 PDR 01.XXX R REGGD PDR lllll)lt, , .

hl

s

/ # **%..\ U.S, NUCl[ AR REGULATORY COMMISSION Octot>es 1997

-\

I f ' !.' ) OFFICL OF NUCLEAR R(GULATORY MtSt ARCH Division 1 Oraf t DG.1063

( ... .// .

DRAFT REGULATORY GUIDE ti.e teci: .t cutimann 1301641te 7732 5 Ali 1301141 f.-? ? ?0 DRAFT REGULATORY GUIDE DG 1063 AN APPROACH FOR PLANT. SPECIFIC, RISK. INFORMED DECISIONMAKING:

INSERVICE INSPECTION OF PIPING v .w... . - % . .. .....i.e.... .

mm....-....................a,................. ...c......

.....c............................

s..,r.,

o

. i ..- .. . i.n: ,.. .. p.. 5,. e m..-

o. .. .

. . ... ... . .. s . . . ..

... . . .. oc 4.s u. i u,......

, i .,. 34 i. .. . . in 4. . .

January 9,1998.

ni.,..........,.......,,.....s.,...#.,........1, .... . . . . . . . .

w. s.s .e t .. e.... e..s.. . 5.e. ... e . . ,4 . .o .iv ... e. 4 s s 6. p. . , . . . . .. n.. avie.- et 30nt60001.An *.i &..u.iv 0. .. e 4.u .. . . .. e.. i33 i .4 iV 6i r;

_ __. ---.ms_--_-_.- _ _ . _ _ _ _

Table of Contents

1. INTRODUCTION . . . ...........................................1 1.1 Background.............................................1 1.2 Pu r po se o f t h e G uid e . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3 1.3 Scope of the RI.lSI Program . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4

. 1.4 Organization and Content .................... .............. 6 1.5 Relationship to Other Guidance Documents . . . . . . . . . . . . . . . . . . . . . . . 6 1.6 Abbreviations /De finitions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7

2. PRO C E S S OVE RVI E W . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9

3. ELEMENT 1: DEFINE THE PROPOSED CHANGES TO INSERVICE. INSPECTION PROGRAMS.................................................13 3.1 Description of Proposed Changes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13 3.2 Formal interactions With The Nuclear Regulatory Commission . . . . . . . . . 13

4. ELEMENT 2: E NGINE E RING AN ALY SIS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15 4.1 Traditional Analysis ......................................15 4.1.1 Re gulatio n s . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16 4.1.2 Defense.in. Depth Evaluation . . . . . . . . . . . . . . . . . . . . . . . . . . . 16 4.1.3 Safety Margins ....................................17 4.1.4 Engineering Fracture Mechanics Evaluation . . . . . . . . . . . . . . . . . 17 4.1.5 Engineering Failure Modes & Effects Analysis ...............18 4.2 Probabilistic Risk Assessment ...........................18

) 4.2.1 Scope of Piping Segments . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20 4.2.2 Piping Segments ...................................22 4.2.3 Modeling Pipe Failures in PRA . . . . . . . . . . . . . . . . . . . . . . . . . . 23 4.2.4 Piping Failure Pot ential . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23 4.2.5 Consequences of Failure . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24 4.2.6 Risk Impact of ISI Changes . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25 4.2.7 Element Sele ction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2 7 4.3 Integrated Decisionmaking . . . . . . . . . . . . . . . . . . . . . . . . . . . . , 2 8

5. ELEMENT 3: IMPLEMENTATION. PERFORMANCE MONITORING. AND CORRECTIVE ACTION STRATEGIES . . . . . . . . . . . . . . ................32 5.1 Program implementation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3 2 5.2 Performance Monitoring ...............................,...33 5.3 Corrective Action Programs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36 5.4 Accept ance G uideline s . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3 8

6. ELEMENT 4: DOCUMENT ATION . . . . . . . . . . . ......................45 6.1 Risk. Informed inservice inspection Program Plan . . . . .............. 45 6.2 Engineering Analysis Records and Supporting Data . . . . . . . . . . . . . . . . . 46 6.2.1 Traditional Analysis Records and Supporting Data ............ 46 6.2.2 Probabilistic Risk Assessment Records and Supporting Data ..... 46 6.3 Integrated Decisionmaking Process Records . . . . .................51 6.4 Development of ISI Prc, gram .......................... ... . 51 6.5 Implementation Plans and Schedule ......................... . 52

) 6.6 Quality Assurance ................... .............. . . . . 52 i'i.

l l

l

7 7 .= _ - -

. _ _ _ . _ . _ _ _ - _ . ~ _

l l

i REFERENCES ..................................................... 57 Appendix 1: PROBABILISTIC STRUCTURAL MECHANICS COMPUTER CODES FOR ES11 MATING FAILURE PROBABILITIES . . . . . . . . . . . . . . . . . . . . . A1 1 A1.1 Introd u ction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . A 1 1 A1.2 Areas of Structural Reliability Code Review . . . . . . . . . . . . . . . . . . . . . A12 '

A1.3 Selected Structural Reliability Code issues . . . . . . . . . . . . . . . . . . . . . . A13  !

A 1.3.1 Loads and Stresses .............................A13 i A 1.3.2 Vibrational Stresses . . . . . . . . . . . . . . . . . . . . . . . . . . . . . A1 3 i A1.3.3 Re sidual Stre sse s . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . A 1 4 A 1.3.4 Preservice inspection . . . . . . . . . . . . . . . . . . . . . . . . . . . . A1 4 A 1.3.5 Pr oo f T e st . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . A 1 5 A 1.3.6 Leak Detection ................................A15 A1.3.7 Failure Modes (Leak Versus Break) . . . . . . . . . . . . . . . . . . . A15 A1.3.8 Service Environment . . . . . . . . . . . . . . . . . . . . . . . . . . . . . A 1 5 ,

A1.3.9 Initial Flaw Sire Distributions . . . . . . . . . . . . . . . . . . . . . . . A1 5 A1.3.10 Fla w initia tion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . A 1 7 A 1.3.11 Crack Growth Rates . . . . . . . . . . . . . . . . . . . . . . . . . . . . . A1 7 A L 3.12 Material Property Variability . . . . . . . . . . . . . . . . . . . . . . . . A1 7 A 1.3.13 Comparison with Service Experience .................A18 A 1.3.14 Effects of Inservice inspection (CDF vs importance Measure Calculations) ...................A18 A1.3.15 Cumulative Effects of Repeated / Periodic In spe ctio n s . . . . . . . . . . . . . . - . . . . . . . . . . . . . . . . . . . . . A 1 8 A1.3.16 Review and Treatment of Uncertainties . . . . . , . . . . . . . . . . A19 A1.3.17 Realistic Versus Conservative Calculations . . . . . . . . . . . . A 1 10 A1.3.18 Consideration of Failure Mechanisms . . . . . . . . . . . . . . . . A1 10 A1.3.19 Materials Considerations . . . . . . . . . . . . . . . . . . . . . . . . . A1 11 A1.3.20 Consideration of Component Geometries . . . . . . . . . . . . . . A1 11 A1.3.21 Deterministic Structural Mechanics Models . , . . . . . . . . . A 1 11 A 1.3.22 Selection of Probabilistic Variables , . .... . . . . . . . . . A 1 12 A1.3.23 Numerical Methods ........... ...... . . . . . . . . . A 1 13 A1.3.24 Assignment of input Parameters ...................A113 A 1.3.25 Supporting Data Bases . . . , . . . ..................A114 A 1.3.26 Documentation and Peer Review ... . . . . . , . . . . . . . . . A 1 14

- A1.3.27 Identification of Code Limitations . . . . , . . . . . . . . . . . . . . A1 15 A1.3.28 Benchmarking with Other Computer Codes . . . . . . . . . . . . A1 15 A 1.3.29 Consistency with Operating Experience .. . . . . . . . . . . . A 1 16 A1.4 Formal Process for Validating and Updating SRRA Codes . . . . . . . . . . A 1 17 A1.5 References for Appendix 1 ...... ........ ... , . . . . . . . . A 1 18 Appendix 2: USING PRA TO EVALUATE THE CHANGE IN RISK ASSOCIATED WITH CHANGES TO AN ISI PROGRAM .... . ,,,..,,........A21 A2.1 Modeling Passive Systems in PRA ... .... .. .,,. ......A23 A2.2 Determine Consequences of Pipe Failures ... . .............A23 A2.3 Pipe Segments . . . . . . ......... .. .. ...... . ........A27 A2.4 Incorporate Pipe Segments into PRA Model . . . . , . . . . . . . . . . . . . . . A210 A2.5 Piping Failure Potential . . . . ..,. ........ ... . . . . . . . . . . . A 2 12 A2.5.1 Overview of Estimation Procedure .................A212 iv

A2.5.2 General Guidance on issues . . . . . . . . . . . . . . . . . . . . . A2 14 j l A2.5.3 Methods for Estimating Failure Probabilities . . . . . . . . . . A218 i A2.5.4 Structural Reliability Computer Codes . . . . . . . . . . . . . . A2 21 i A2.5.5 Screening and Sensitivity Studies for the Purpose of Categorizing Pipe Segments . . . . . . . . . . . . . . . . . . - . . . . . A2 23 4

A2.6 Risk impact from Proposed Changes to the ISI Program . . . . . . . . . . . . A2 25 A2.7 Selection of Locations To Be inspected . . . . . . . . . . . . . . . . . . . . . . . A2 32 A2.7.1 Methods of Selectmg Pipe Segments for inspection . . . . A2 32 ,

A2.7.2 Structoral Element Selection Within Pipe Segments . . . . A2 38 )

A2.7.3 Inspection Strategy . Reliability and Assurance Program . A2 42  !

A2.8 References for Appendix 2 ...............................A250 j Appendix 3: ESTIMATION OF FAILURE PROBABILITIES USING EXPERT JUDGMENT ELICITATION ,...............................A31 A3.1 Int r od u ct ion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . A3 1 A3.2 Background...........................................A31 A3.3 Expert Judgment Elicitation Process . . . . . . . . . . . . . . . . . . . . . . . . . . A3 2 A3.3.1 Selection of issues . . . . . . . . . . . . . . . . . . . . . . . . . . . . A3 3 A3.3 2 Selection of Expert s . . . . . . . . . . . . . . . . . . . . . . . . . . . A3 3 A3.3.3 Elicit ation T r aining . . . . . . . . . . . . . . . . . . . . . . . . . . . A3 4 A3.3.4 Presentation and Review of issues . . . . . . . . . , . . . . . . . A3 4 A3.3.5 Preparation of Analyses ........,, ............. A3 5 A3.3.6 Discussion of Issues and Analyses . . . . . . . . . . . . . . . . . A3 5 A3.3.7 Elicitation ..................................A35 A3.3.8 Recomposition and Aggregation . . . . . . . . . . . . . . . . . . . A3 5 A3.3.9 Review by Expert s . . . . . . . . . . . . . . . . . . . . . . . . . . . . A3 6 f A3.3.10 Documentation ..............................A37 A3.4 Example Application to Nuclear Piping Systems . . . . . . . . . . . . . . . . . . A3 7 A3.5 References for Appendix 3 ...............................A312 Appendix 4: INSPECTION STRATEGY-RELIABILITY AND ASSUR ANC E PROG R AM . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . A4 1 A4.1 The Concept of Statistical Risk ............................. A41 A4.2 Calculation ot Risk . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . A4 2 A4.3 Correction For Imperf ect Detection . . . . . . . . . . . . . . . . . . . . . . . . . . . A4 4 A4.4 System Assurance . Example Calculation ...................... A4 6 A4.5 The Global Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . A4 9 A4.6 References for Appendix 4 ...............................A413 Appendix 5: RISK.lNFORMED INSPECTION PROGRAM DEVELOPMENT . . . . . . . . . . . A51 AS.1 Elements of Inspection Strategies . . . . . . , , . . . . . . . . . . . . . . . . . . . . AS.6 AS.2 Failure Probability Considerations . . . . . . . . . . . . . . . . . . . . . . , , . . . AS.9 A5.3 Integration of Probabilistic Structural Mechanics Calculations . . . . . . . . AS.10 t.5.4 Example Probabilistic Structural Mechanics Calculations . . . . . . . . , , A514 AS.5 Additional Considerations for Selecting Strategies ............... AS.16 A5.6 Ovantification of NDE Reliability . . . . . . . . . . . . . . . . . . . . . . . . . . . . AS 18 AS.7 Alternative Strategies to Reduce Failure Probabilities ..... ....... A5 22 A5.8 Ref erences f or Appendix 5 . . . . . . . . . , . . . . . . . . . . . . . . . . . . . . . AS.24 V

, . . _ . . . . , ~. . _ - _ , _ . __

Appendix 6: EXISTING DETERMINISTIC APPROACH . . . . . . . . . . . . . . . . . . . . . . . . A61 A6.1 Introduction . . . . . . . . . . ...............................AG1 A6.2 Deterministic Decislonmaking Criteria . . . . . . . . . . . . . . . . . . . . . . . . A G .1 A 6.3 Documents with Deterministic Roquirements . . . . ...............AG.2 A6.4 Inservice inspection Requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . A6 3 A6.5 Refetences for Appendix 6 ..............................A65 Regulatory Analysis ...............................................RA1 Figures 2.1 Principles of Risk Inf ormed Regulation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9 2.2 Principle elements of risk.intormed. plant specific decisionmaking ...........10 4.1 Example Attributes for Risk. Informed ISI Programs . . ...................19 5.1 Elements of a Performance Monitoring Program . . .....................35 A 1.1 Stress Corrosion Cracking PRAISE vs Field DNta .......... ...........A11 A 1.2 Example 01 Major Parameters That Can influence Calculated Pipe Failur e Proba bilit y . . . . . . . . . . . . . . . . . . . . . . . . ................,..A19 A2.1 Process f or probabilistic analysis for risk. informed ISI . . . . . . . . . . . . . . . . . . A2 2 A2.2 Process for Modifying PRA to include Passive Components . . . . . . . . . . . . . . . A2 4 A2.3 Syst em pipe segment examples . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . , . . . A2 9 A2.4 General process for estimating f ailure probabilities . . . . . . . . . . . . . . . . . . . . A213 A2.5 Example Code .vs Service Experience ............................A216 A2.6 Core damage frequency calculation prucess (adapted from Figure 3,6 2 of Reference ) ....................................A226 A2.7 Cumulative Risk Contribution . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . A2 3 7 A2.8 Structural element selection matrix . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . A2 40 A3.1 Expert judgment process . . . . . . . . . . . . . . . . ......................A33 A3.2 Process f or estimating f ailure probability using expert judgment . . . . . . . . . . . . A3 8 A3.3 Failure Frequency Estimates for the Auxiliary Feedwater (AFW)

S yst e m C omp on e n t s . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . A3 10 A3.4 Failure frequency estimates for the reactor pressure vessel ..............A311 A4.1 Single S a mple Pla n Logic . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . A4 5 A4.2 Double Sa mple Plan Logic , . . . , , . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . A4 6 AS.1 Inspection strategy table . . . . . . . . . . . . . . . . . . .............. . . . . . A S.8 AS.2 Improvement f actors for f our inspection interval (NDE performance level for POD = Very Good") ..................................A517 AS.3 Example POD curve used in pc. PRAISE , . . . . . . . . . . . . . . .... . . . . . . . A 5 21 i

l l

vi

I

1. INTRODUCTION The NRC's Commission Policy Statement on probabilistic risk analysis (PRA) encourages use of risk informed analysis techniques to improve safety during decisionmaking and improve regulatory efficiency A number of NRC staff and industry activities are presently under development in response to the Commission's policy statement. One activity now under way is the use of PRA insights to support modifications to a nuclear plant's current licensing basis (CLB). A number of specific CLB changes are now under staff review.

This regulatory guide is being developed to describe acceptable apprnaches for incorporating insights from probabilistic risk assessment techniques to inservice inspection (ISI) programs for pipes. Given the recent initiatives by the American Society of Mechanical Engineers,it is anticipated that licensees will request changes to their CLB for a nuclear power f acility that incorporates risk insights in their ISI programs (known as risk informed inservice inspection programs .. RI ISI). As always, licensees can and should identify how the chosen approach, methods, data, and criteria are appropriate for the decisions they need to make,

1.1 Background

Traditionally, regulation of the design and operation of commercial nuclear power plants has been based on conventional engineering criteria (meaning criteria developed using traditional engineering analysis methods without applying probabilistic methods as in PRA). These

)

engineering criteria continue to successfully assure that plants can be placed in a safe condition following a number of postulated design basis accidents. The traditional engineering criteria also provided the basis for identifying what plant structures, systems, components (SSCs), and activities are important to safety. Regulation of these ' safety-related" SSCs and activities is controlled through regulatory requirements.

During recent years, both the NRC and the nuclear industry have recognized that PRA has evolved to the point that it can be used increasingly es a toolin regulatory decisionmaking.

In August 1995, the NRC adopted a policy statement regarding the expanded NRC use of-PRA (Ref.11, in part, the policy statement states that:

• The use of PRA technology should be increased in all regulatory matters to tne extent supported by the state of the art in PRA methods and data and in a manner that complements the NRC's deterministic approach and supports the NRC's traditional philosophy of defense in depth,

• PRA and associated analyses (e.g., mensitivity studies, uncertainty analyses, and importance measures) should be used in regulatory matters, where practical within the bounds of the state of the art, to reduce unnecessary conservatisra associated with current regulatory requirements, regulatory guides, license commitments, and staf f practices. Where appropriate, PRA should be used to support the proposal of additional regulatory requirements in accordance with 10 CFR 50109 (Backfit Rule). Appropriate procedures for including PRA in the process for changing regulatory ruuirements should be

_ - developed and followed, it is, of course, understood that the intent of this 1

policy is that existing rules and regulations shall be comphed with unless these rules ted regulations are revised.

PRA evaluations in support of regulatory decisions should be as realistic as practicable and appropnat, supporting data should be publicly available for review.

The Commission's safety goals for nuclear power plants and subsidiary riuneical objectives are to be used with appropriate consideration of uncerta nties in making regulatory judgments on the need for proposing and backfittmo new generic requirements on nuclear power plant licensees.

In its approval of the policy statement, the Commission articulated its expectation that implementation of the policy statement willirnprove the regulatory process in three areas:

foremost, through safety decit.ionmak:ng enhanced by the use of PRA insights; through more efficient use of agency resources; and through a reduction in unnecessary burdens on licensees, in parallel with the publication of the policy statement, the stafI developed a regulatory framework that incorporates risk insights. That framework was articulated in a November 27, 1995 paper (SECY 95 280) to the Commission (Ref. 2). This regulatory guide, which addresses ISI programs of welds in pipes at nuclear power plants, implements, in part, the Commission's policy statement and the staff's framework for incorporating risk insights into the regulation of nuclear power plants.

While the conventional regulatory framework, based on traditional engineering criteria, has and continues to serve its purpose in assuring the protection of public health and safety, the current information base comains insights gained from over 2000 reactor years of plant operating experience and extensive research in the areas of material sciences, aging phenomena, and inspection techniques. This information, combined with modern risk assessment techniques and associated data can be used to develop a more effective approach to ISI programs of pipes.

The current ISI requirements for piping components are found in 10 CFR 50.55a and the --

General Design Cnteria listed in Appendix A to 10 CFR Part 50 (Ref. 3h Requirements for piping are scattered throughout the General Design Criteria, such as in Sectior:1 Overall Requirements Section 11. Protection by Multiple Fission Product Barriers, Section Ill, Protection and Reactivity Control Systems.Section IV, Fluid Systems, etc.

10 CFR 50.55a referencesSection XI of the American Society of Mechanical Engineers (ASME) Boiler and Pressure Vessel Code (BPVC) (Ref. 4), Section 50.55a addresses the codes and standards for design, fabocation, erection, construction, testing, and inspection of piping systems. The objective of the ISI program is to identify conditions, such as flaw indications, that are precursors to pipe leaks and ruptures, thereby meeting, in part, the requirements set in the General Design Criteria and 10 CFR 50.55a. ISI programs are intended to address all piping locations that are subject to degradations. Many of the inspections are focused on criticallocations, such as welds, if such locations have the highest likelihood for f ailure. However, experience over many years has shown that while the location of examination usir.g the current Section XI criteria have been effective for Category 2

r

.. B J'" welds Class 1 piping, many of the actual reported problems (Ref. 5) were in other *

) locations. The majority of flaws found in Category B.J piping welds have been caused by f actor' outside the scope of the current selection criteria. Some of the inspected locations that are not expoted to active degradation mechanisms have led to unnecessary rad;ation exposure to personnelimplementing the inspections. Incorporating risk insights into the programs can have the potential to focus on the more important locations for inspections and reduce personnel exposure while at the same time maintaining or improving public health and safety.

As a result of the above insights, more efficient and technically sound means for selecting and scheduling Isis of piping are under development by the ASME l(Ref. 6) and (Ref. 7)).

This regulatory guidance docume'nt builds upon the knowledge base documented in NUREG/CR 6181, Rev.1 (Ref. 8), and it reflects the experience gained from the ASME init!stives (pilot plant activitiesh When categorizing pipe segments in terms of their ,

contribution to risk, it is the responsibility of a licensee to justify that the categorization of pipe segments and the resulting inspection programs provide a change in core damage frequency (CDF) that is consistent with the guidelines addressed in Draft Pegulatory Guide DG 1061. *An Approach for Using Probabilistic Risk Assessment in Risk informed Decisions on Plant Specific Changes to the Currant Licensing Basis"(Ref. 9). This draf t regulatory guide is being developed to provide guidance on how to incorporate risk insights in an inservice inspection program, provide guidance on developing methods that identify locations where both increases and decreases in ISIinspections are needed to meet the requirements of 10 CFR 50.55a(a)(3)(i), and address performance objectives.

) 1.2 Purpose of the Guide Changes to many of the activities aild design characteristics in a nuclear power plant's CLB* require NRC review and approval. The current inservice inspection programs are performed in compliance with the requirements of 10 CFR 50.55a and with Section XI of the ASML Boiler and Pressure Vessel Code, which are part of the plant's CLB This regulatory guide des :ribes acceptable alternative approaches to the existing Section XI requirements for ISI programs. Its use by licensees is voluntary. This alternative approach provides an acceptable levcl of quality and safety {per 10 CFR 50.55ata)(3)(i)) by incorporating insights from probabilistic risk analysis calculations. Licensees proposing to apply risk informed inservice inspection progtams will be required to amend their final safety analysis report (FSAR. Sections 5.3.4 and 6.6) accordingly.

' Category B J welds are pressure retaining welds in piping.

'This regulatory guide adopts the to CrR Part 54 definition of current beensing basis. That is.

• Current Licensing uasis ICLO)is the set of NRC requitements apphcable to e specific plant and a hcensee's written commitn ents f or ensuring comphance with anToperation within apphcable NRC requirements and the plant-r.pecific design basis bncluding all modifications and additions to such commitments over the hf e of the beensee) that are docketed and in etf r ct. The CLB includes the NRC regulations contained in 10 CFR Parts 2.19,20,21, 26, 30. 40, s1. 54. 55. 70. 72. 73.100 and appendices thereto, orders; bcense conditions; exemptions; and technical specific 6tions. It also includes the plant speCatic design basis inf ormation defined in 10 CFR 50.2 as documented in the mcs1 recent final saf ety analysts report (updated FSAR) as required by 10 CFR 50.71 and the hcerisee's cornmitments remaining in ef fect that were made in docketed hcensing correspondence such as hcerisee response.; to NRC bulletins, generic letters, ano enf orcement actions, as well as hcensee commitments occumented in NRC saf ety evaluations or hcervee event reporty' 3

l

This regulatory guide addresses acceptable approaches that apply risked informed (RI) methods to develop, monitor, and update more efficient ISl programs for pipes at a nuclear '

power facility. This guidance does not preclude other approaches for incorporating risk insights into the ISI programs. Licensees may propose alternative approaches for NRC consideration. It is intended that the approaches presented in this guide be regarded as examples of acceptable practices and that licensees should have some degree of flexibility in satisfying the regulatory needs on the basis of their accumulated plant experience and l knowledge. This document addresses risk informed approaches that are consistent with the '

basic elements identified in DG 1001 (Ref. 9) to inservice inspection programs. In addition, this document provides guidance on: l e

acceptable methods for estimating leak, disabling leak, and rupture probabilities for pipe segments.

• Identifying structural elements for which inservice inspection can be modified (reduced or increased) based on risk insights, defense in depth, as low as ressonably achievable (ALARA) principles for radiation exposure to personnel, etc.,

determining the risk impact of changes to inservice inspection programs.

+

capturing deterministic considerations in the revised inservice inspection program, and

+

developing an inspection program that monitors the performance of the pipe elements that are consistent with the conclusions from the PRA.

The NRC staff willinitiate rulemaking as necessary to permit licensees to implement RIISI t programs, consistent with this regulatory guide and the accompanying Standard Review Plan (SRP) chapter, without having to get NRC approval of an alternative to the ASME Code requirements pursuant to 10 CFR 50.55a(a)(3). Until the completion of such rulemaking, the staff anticipates the need to review and approve each licensee's RIISI program as an alternative to the current Code required ISI program, prior to implementation. As such, the licensee's Rl ISI prog:am will be enforceable under 10 CFR 50.55a.

1.3 Scope of the RI ISI Program This regulatory guide only addressrs changes to the ISI programs for inspection of pipes. In i

the majority of the cases, pipe welds are the point of interest in the inspection program, although within this regulatory guide, references to

• welds" are intended to address j inspections in general of critical structurallocations including the base metal. On the average, pipe welds are anticipated to have approximately forty times the likelihood of experiencing a leak prior to the base pipe structure. Exceptions to this rule of thumb can occur when an active degradation mechanism is present, such as flow assisted. corrosion (e.g., erosion corrosion). The risk implication of each pipe segment is determined by the safety significance of a pressure boundary failure of the pipe at that location, augmented by the failure likelihood of the pipe segment. When the risk implications or degradation mechanisms along a pipe vary, the pipe is subdivided into segments, as discussed in Chapter 4.

4

g ..

To adequately reflect risk implications, the scope of systems, structures and componer'ts

) (SSCs) covered by this regulatory guide'*' includes:

• All Class 1,2, and 3* pipes within the current ASME Section XI programs, and

+ All pipes whose failure would compromise Safety related structures, systems, or components that are relied upon to remain functional durinD and following design basis events to ensure th) integrity of the reactor coolant pressure boundary, the capability to shut down the reactor and maintain it in a safe shutdown condition, or the capability to prevent or mitigate the consequences of accidents that could result in potential offsite exposure comparable to 10 CFR 100 guidelines.

Non safety related structures, systems, or components:

• That are relied upon to mitigate accidents or transients or are used in plant emergency operating procedures; or Whose f ailure could prevent safety related structures, systems, or components from fulfilling their safety related function; or

+

Whose failure could cause a reactor scram or actuation of a safety-related system.

) To ensure that the proposed RlISI program will provide an acceptable level of quality and

~

safety, the licensee snould use the PRA to identify the appropriate scope of pipe segments to -

be included in the program. This will include all pipes within the scope of the current ISI program, in addition, licensees implementing the risk informed process may identify pipe segments categorized as high safety significant (HSS), which are not currently subject to the traditional Code requirements or to a level of regulation which is commensurate with their risk significance. PRA systematically takes credit for systems with non Code piping that provide support, act as alternatives, and act as backups to those systems with piping that are within the scope o; the current Section XI Code. To maintain the validity of the PRA as it is used to categorire pipe segments and to evaluate the effects of the proposed RIISI program on plant risk, all HSS pipe segments should be included in a licensee's RI ISI proposal.

Specifically, the licensee's RI ISI program scope should include those ASME Code Class 1,2,

&3 and non Code systems that the licensee's categorized as HSS.

' The PRA should also be used to evaluate AlISL program inspection requirements as practicable. Consequently, the licensee should examine the inspection strategies for all welds in the final proposed ISI program, including those inspections in the current Section XI

• It is anticipated that this regulatory guidance document will, at some f uture date, be consistent with the ASME's ongoing programs to incorporate risk intormed insights onto the ASME Section XI progra.ns.

• Generally, ASME Code Class 1 includes all reactor coolant pre.sure bounrary (RCPB) components. ASME Code Class 2 generally includes systems of portioris of systems impartant to saf ety that are designed f or post-accident containment and removat of heat and fission products. ASME Code Class O gene. ally includes those system comoonents or potoons of systems important to saf ety that bae designed to prowde cooling water and auxiliary f eedWater f or the f ront lane systems.

5

program. The inspection strategy most capable of detecting the effects of the specific degradation mechanism to which each we'd is exposed should be identified and selected.

1.4 Organiza"on and Content This regulatory guide is structured to follow the general four eltment process for risk informed applicat>ons discussed in Draf t Regulatory Guide DG 1001. Chapter 2 summarizes the four element process developed by the NRC staff (referred to as, staff) to evaluate proposed CLB changes as it applies to the development of a risk informed 151 program.

Chapter 3 discusses an acceptable approach for defining the proposed changes to an ISI program. Chapter 4 addresses, in general, the traditional and probabilistic engineering evaluations pr; formed to support risk informed ISI programs and presents the risk acceptance goals for determining the acceptability of the proposed change.

Chapter 5 presents one acceptable approach for implementing, anonitoring, and corrective actions for RI.lSI programs. The documentation the NRC will use to render its safety decision is discussed in Chaplet 6. Detailed discussions of issues and/or ac,cptable approaches associated with the engineering evaluations needed to support an RI ISI program are provided in Appendices 1 through 5. The existing ASME Section XI traditional approach is highlighted in Appendir 6.

1.5 Relationship to Other Guldance Documents As stated in Section 1.2. this regulatory guide discusses acceptable approaches to implement risk insights into an ISI program and directs the reader to Draf t Regulatory Guide DG 1061 for general guidance, where appropriate.

Draf t Regulatory Guide DG 1061 describes a general approach to risk informed regulatory decisionmaking and includes discussions on specific topics common in all risk informed regulatocy applications. Topics addressed include:

. PRA quahty'* data, assumptions, methods,

. Scope internal and/or external event initiators, at power and/or shutdown modes of operation, consideration of Level 1,2, and 3 analyses requirements, etc.,

• RirN metrics core damage frequency. LERF and importance measures.

. Sensitivity and uncettainty analyses, and

. Process for ensuring quality relationship to 10 CFR Appendix B.

'Draf t rJUREG 1602 *Use of PRA in Risk inf ormed tspphtauons.* provides tect.nical details tr.at support Dratt Regulatory Guide DG 1061 (Ref. 21L

'tevel 1 hccident sequence analysis. Level 2 acuderi' promession and source 1erni analysis, and Level 3 -

00rMCQuence Onalysis 6

Megulatory guides that contain ASME Code Cases for inservice inspection programs and that

) are based on traditional engineering criteria include (Ref.10), (Ref.11), and (Ref.12). For references to other risk informed applications, the reader is directed to regulatory guides pert 6ining to inservice testing (IST) (Ref.13). graded quality assurance (GOA) (Ref.14) and technical specifications (lech Specs) (Ref.15). SRP sections associated with each of the risk informed regulatory guides are addressed in (Ref.16), (Ref.17), (Ref.1B), (Ref.19), and (Ref. 20).

Regulatory guides are issued to describe to the public methods that are acceptablo to the NRC staff for implementing specific parts of the NRC's tegulations, to explain techniques used by the staf f in evaluating specific problems or postulated accidents, and to provide guidance to applicants, Regulatory guides are not substitutes for regulations, and compliance with regulatory guides is not required. Regulatory guides are issued in draft form for public comment to involve the public in developing the regulatory positions. Draf t regulatory guides have not received complete staff review; they therefore do not represent official NRC staff positions.

.The information collections contained in this draf t regulatory guide _ are coveted by the requirements of 10 CFR Part 50. which were approved by the Office of Managernent and Budget, approval number 3150 0011. The NRC may not conduct of sponsor, and a person is not required to respond to, a collection of information unless it displays a currently valid OMB control number, 1.6 Abbreviations / Definitions AEC Atomic Energy Commission ALARA As Low as Reasonable Achievable ASME Americaa Society of Mechanical Engineers BPVC Boiler and Pressure Vessel Code BWR Boiling Water Reactor CCF Common Cause Failure CDF Core Damage Frequency CLB Current Licensing Basis ECC/AM Emergency Core Cooling and Accident Mitigation ECCS Emergency Core Cooling System (s)

FMEA Failure Modes and Effects Analysis FSAR Final Safety Analysis Report Expert Elicitation This refers to experts in a specific field normally outside the level of expertise f ound at the plant. The expert ehcitation ib used to estimate the f ailure probability and the associated uncertainties of the materialin question under specified degradation mechanisms. For example, if a fracture mechanics Code is not qualified to calculate the failure i probability of talastic pipes, then experts in plastic pipes and their f ailure may be used to estimate the failure probabilities.

Expert Panel fjormally refers to plant personnel experienced in inservice inspection programs and other related activities / disciplines that impact the decision under consideration.

FV Fussell Vesely importance Measure GOA Graded Quality Assurance HSS High Safety Significance 7

HSSC High Safety Significant Component IGSCC Intergranular Stiess Corrosion Cracking importance Measures Used in PRA to rank systems of components in terms of risk significance iPE Individual Plant Examination ISI inservice Inspection IST Inservice Testing LERF Large Early Release Frequency LOCAs .

Loss of. Coolant Accident LSSC Low. Safety Significant Component NDE Nondestructive Examination NEl Nuclear Energy Institute NPAR Nuclear Plant Aging Research .

NRC Nuclear Regulatory Commission NUMARC Nuclear Management and Resources Council PDI Performance Demonstration initiative POD- Probability of Detection PRA Probabilistic Risk Assessment PSA Probabilistic Saf)ty Assessment FWR Pressurized Water Reactor RAW Risk Achievement Worth RCPB Reactor Coolant Pressure Boundary RCS. Reactor Coolant System i RIISI Risk Informed inservice Inspection RWST Refueling Water Storage Tank staff Refers to NRC Employees Sensitivity Studies Varying parameters to assess impact due to uncertainties SER Safety Evaluation Repurt SRP Standard Review Plan SRRA Structural Reliability / Risk Assessment (refers to fracture mechanics analysis)

SSCs Structures, Systems, Components-Tech Specs Technical Specifications

)

+

b 8

_ _ _ _ _ . - ... _..,. ~ .,_ _ . _ _ -

2. PROCESS OVERVIEW

) ,

For the licensee who elects to incorportte risk insights into its inservice inspection programs.

11 is anticipated that the licensee will build upon its existing probabilistic risk analysis (PRA) activities, beginning with the individual plant examination programs (IPE). Figure 2.1 illustrates the five key principles involved in the integrated decisionmaking process which is described in detailin Draf t Regulatory Guide DG 1061. In addition. Draft Regulatory Guide DG 1061 describes a four element process for evaluating proposed risk informed changes to the CLB as illustrated in Figure 2.2.

M alntain Defenbe in Deptli r

L  :

(

Mminisin Meet Current Sutricient Regulations ]

1 f afet3

$ e integrated Detitionmaking bmplementation /

Proposed increases in rbk \

And Monitorint and their cumulative effect Strategies Which are smalland do not cauhe Address the NRC's Safety Goals to

) Uncer1aintics ,

( be czeceded j Figure 2.1 Principles of Risk informed Regulation, k The key principles and the location in this guide where each is addressed for RIISI programs are as follows: -

1. The proposed chance meets the current regulations. \This applies unless the proposed change is explicitly related to a requested exemption or rule change.1 (Section 3.1)

2. Defense in depth is maintained. (Section 4.1.1)

3. Sufficient safety margins are maintained. iSection 4.1.2)

4. Proposedincreases in risk and their cumulative effect are small and do not cause the NRC's Safety Goals to be exceeded. iSections 4.2 and 4.4)

5. Performance based implementation and monitoring strategies are used that sJdress uncertainties in analysis models and data and provide for timely feedback and corrective action. (Chapter 5) 9

The individual principles are discussed in detailin Draft Regulatory Guide DG 1061, and are not repeated here. However, an overview of the four element process is provided and specific issueb that arise for risk informed ISI are discussed.

. The four element process described below begins with a set of proposed changes to ISI. The process for developing the initial proposal for changes is lef t to the licensee, but can benefit from an examination of PRA information, including distinguishing the affected pipe segments through a categorization process based on various importance measures and engineering insights.

Traditional - I,RA Analysis

\ / / '

\ / l/

\

\/

/

[/ls's

Define Perforrn Implementation / Submit Define + Engineering 4->- + Prop sed Change Monitoring Analysis Program Change i

Figure 2.2 Principle elements of risk informed, plant specific decisionmaking, s Element 1: Ceefine the proposed change in this element the licensee identifies the pipes and welds that are affected by the change in inspection practices. This would include components currently in the ISI program and additional pipes categorized as high safety significant (HSS), Specific revisions to the inspection programs, schedules, and techniques should be documented. Plant systems and functions that rely on the affected pipes should be identified.

The licensee should assess whether an adequate PRA is available for risk informed evaluations (see (Ref. 9) and (Ref. 21)) and how the existing regulations-the plant's current licensing basis-may be impacted by the proposed change. Finally, plant specific experience with inspection program results should be examined and characterized relative to the elfectiveness of past inspections and the types of flaws that have been observed. Chapter 3 provides a more detailed description of Element 1.

Element 2: Perform engineering analysis in element 2. the proposed changes are evaluated with regard to:

• Maintaining adequate defense in depth.

10

] + Maintaining edequate safety margins.

,' + -The risk impact of the changes, including the treatment of uncertainties. The princis te that the proposed increase in risk and their cumulative ef fect are small and do not cause the NRC Safety Goals to be exceeded is also addressed.

q + Comparison of the PRA results with the acceptance guidelines in Draft Regulatory Guide D01061.

+

An integrated decision making process that considers insights from both the engineering and probabilistic risk analyses.

Traditional engineering and PRA methods are used in this evaluation. The results of the complementary traditional snd PRA methods are considered together in an integrated decisionn aking process. Dunop the integration of all of the available information, it is expects d that many issues will tieeri to be resolved through the use of a well reasoned

}udgm nt process of ten involving a combinatior. of dif ferent engineering skills. This activity has tyaically been referred to in industry documents as being performed by an ' expert panel."

As dis ;ussed in this document, this important procer,s is the licensee's responsibility and may be scramplished by means other than a formal panel, it is the licensco's responsibility to ensure that any submittal to the NRC is accurate and complete, in carrying out _this_ process,

- the licensee will need to make a number of decisions based on the best available information.

Some of this information will be derived from traditional engineenng practices and some will be probabilistic in nature, resu' ting from PRA studies. It may be that certain issues discussed in this guide are best evaluated through the use of traditional engineering approaches, but for other issues, PRA may have advantages. It is the licensea's responsibility to ensure that its RI ISipogram is developed using a well reasoned and inte0 rated decision process that considers both forms of input information (traditional engintennp and ptobabilistic) including.

those cases in which the choice of direction is not obvious. Exaniplet,01 this latter situation are when there is insufficient information to make a clear decision or if the PRA results appear to disagree w3h the traditional engineering data. Depending on the itsues involved, technical or otherwise, thrs importar decision making process rnay at temos require the participation of special combinast ons of licensee experts (staff) and/or outSde tonsultants. This integrated

' decisionmak.ng process is disc. ssed further in Section 4.3.

More Jaails concerning Element 2 are contained in Chapter 4.

Element 3: Develop Implementation. Periormence@lonttosint), rmd Co'rective Action Strateglu h

In thii element, plam are formulated to monitor f actors that telle(l u.vn p nWiability come.ensurate with the pipe's safety significance. l'ur evato;.A opots to.) e d environmental conditions should be incnitored for consistency with the assumptem in the i HA analysis, in

-addition, the results of the individurJ Isis shoutri be munitoied to enwie that pipmg vegradation is not beyond the assumptions :I the PRA. In the een ll.a' pipe tailures or unanticipated degradations occur in on RI ISI progrom, tjumanar tw :oloatir.g the need for and the implementation of corrective ctions should be in'.;tuond in ine Na%. Speofic guidance for Element 3 is given in Chapter b.

3 j

11

_ _ __a

I l

l Element 4: Document evaluations and submit request for proposed change The final element involves preparing the documentation to be included in the submittal and to be snaintained by the licensee for later reference (i.e., archival) as needed. The submittal will be reviewed by the NRC following the guidelines set in the standard review plans (NUREG.

0800) Chapter 19 and Section 3.9.8. Documentation requirements for RIISI programs are given in Chapter 6 of this regulatory guide.

12

G 1

3. ELEMENT 1: DEFINE THE PROPOSED CHANGES TO INSERVICE-

) INSPECilON PROGRAMS 3.1 Description of Proposed Changes in thib first element of the process, the proposed changes to the -

ISI program are defined. This involves describing the scope of ISI components that will be incorporated in the overall assessment and how their inspection would be changed. Also included in this 1

, Del~tne h Clienge element is an identification of supporting information, and a proposed plan for the licensee's interactions with the NRC EM i throughout the implementation of the RIlSI. ELEMENT 1 A full description of the proposed change in the ISI program is prepared. This description would include:

(1) An identification of the aspects of the plant's Cl.B that would be affected by the proposed RIISI program.

(2) An identification of the specific revisions to existing inspection schedules, locations, and methods that would result from implementation of the propused program.

(3) Any piping not presently covered in the plant's 151 program, but which are determined to be categorized as high safety significant (e.g., through PRA insights) should be identified and appropriately addressed. In addition, the particular systems that are affected by the proposed changes should be identified since this information is an aid

~}

in planning the supporting engineering analyses.

(4) An identification o. the information that will be used to support the changes. This will include performance data, traditional engineering analyses and PRA information, (5) A brief statement describing the way the proposed changes meet the objectives of the Commission's PRA Policy Statement.

3.2 FormalInteractions With The Nuclear Regulatory Commission The licensee can make changes to its approved Rt.lst program under the following conditions:

1. Changes made to the NRC approved RI.lSi program that could af fect the process and results that were reviewed and approved by the NRC staff (including the change in plant risk associated with the implementation of the RI ISI programi should be evaluated to ensure that the basis for the staff's prior approval has not been compromised, if these is a question regarding this issue, the licensee should seek NRC review and approval prior to implementation.

2. All changes should also be evaluated using the change mechanisms described in existing applicable regulations (e.g.,10 CFR 50.55a.10 CFR 50.59) to determine if NRC review and approvalis required prior to implementation.

13 l

l

__a

l For example:

+ Changes to component groupings, inspection intervals, and inspection methods that do not involve a change to the nverall RI ifl approach where the overall RIISI approach was reviewed and approved by the NRC do not require specific (i.e.,

additional) review and approval prior to implementation provided that the effect of the changes on plant risk increase is insignificant.

+ Component inspection method changes involving the implementation of an NRC endorsed ASME Code, NRC endorsed Code Case, or publit,hed NRC guidance which were approved as part of the RI ISI program do not require prior NRC approval.

• Inspection method changes that involve deviation from the NRC endorsed Code requirements require NRC approval prior to implementation.

• Changes to the Rl ISI program that involve programmati. 6anges (e.g., changes to the plant probabilistic model assumptions, changes to the grouping criteria or figures of merit used to categorire components, and changes in the Acceptance Guidelines used for the licensee's integrated decision making processi require NRC approval prior to implementation.

Piping laspection method changes will typically involve the implementation of an applicable ASME Code or Code case (as approved by the NRC) or pubbshed NRC guidance. Changes to the piping inspection methods, which nonetheless meet applicable Code requirements and/or NRC guidance do not require NRC approval. However, inspection method changes that involve deviation from the NRC approved Code requirements do require NRC approval prior to implementation.

The licensee willinclude in its submittal, a proposed process for determining when formal NRC review and approval are or are not necessary. As discussed, onct this process is approved by the NRC, formal NRC review and approval are only needed when the process determines that such a review is necessary, or when changes to the pro:ess are requested.

14

) 4. ELEMENT 2: .!NGINEERING ANALYSIS This chapter summarireb the regulatory issues and engineering activities that a risk. informed inservice inspection program .fredis6onel J should consider. The discussions are divided into traditional Asah sis N and PRA analyses, as illustrated in Figtere 2.2. Section 4.1 addresses the traditional engineering analysis. Section 4.2 addresses the PRA related analysis, Section 4.3 describes the 3

\

\j/ [f.

/

, /.

// 'p',-

integration of the traditional and PRA analyses, and Section

'I 4.4 outlines the acceptance guidelines, g , 'i, ,',',(

Asalysls The key principles of the engineering evaluations are to:

• Demonstrate that adequate defense in- E1.tM ENT 2 depth is maintcined;

• Demonstrate that adequate safety margins are maintained;

• Demonstrate that the proposed ISI program changes do not result in unacceptable risk to the public and plant personnel, and are consistent with the decision metrics guidance identified in Draft Regulatory Guide DG 1061; and

+ Support the integrated decisionmaking process.

The scope and quality of the engineering analyses"' performed to justify the proposed changes to the ISI programs should be appropriate for the nature and scope of the change.

The decision criteria associated with each key principle identified above are pissented in the following subbections. Equivalent criteria can be propsed by the licensee if such criteria can be shown to meet the principles set forth in Section 2.1 of DG 1061. Germaine to the essessment of the impact of the proposed ISI change on plant risk, technical details on the use of risk importance measures are .

highlighted in draf t NUREG 1602 (Reference 21) and in Appendix 2. s[ h ttIO M-l A"pasWalg 4.1 Traditicmal Analysis This part of the evaluation is based on traditional engineering methods. Areas to be evaluated from this viewpoint include meeting the regulations, defense in depth attributes and safety margins. Probabilistic risk insights may be usefulin the evaluation by providing information on relative importance of various SSCs.

' Augmented inspection programs of pipes {e g. NRC mandated programs) are also addressed in the engineering analysis perf ormed by licensees when electing a risk inf ormed inspec11on program. The potential core damage contributions f rom f ailures of pipes that experience active degrecation mechanisms may not be negligible.

f However, appropriate inspection programs with compensatory measures (e 9. replacement of pipes at appropriate intervals) could result in negligible contribution to core damage f requency.

15

4.1.1 Regulations ,

The engineering evaluation should assess whether the proposed changes in the 151 programs have comprornised compliance with the regulations. The evaluation should consider the appropriate general design criteria, national standards, or other regulatory guidance.

Specifically, the evaluation should consider

• 10 CFR 50.65a e Appendix A to 10 CFR Part 50, 1

. Section 1 *Overall Requirements" Section 11 T.otection of Multiple Fission Product Barriers" Section lli " Protection and Reactivity Control Systems"

- Section IV " Fluid Systems." etc.

+ ASME Boiler and Pressure Vessel Code, Se 'lon XI,

+ Regulatory Guide 1.147, and 4.1.2 Defense in Depth Evaluation As stated in Draft Regulatory Guide DG 1061, the General Design Criteria and national standards are to be considered in the engineering evaluation. Defense in depth for ISI  ;

programs focuses on barriers (both preventive and mitigative) to core damage, containment failure, and population exposure.

The licensee should assess whether the proposed changes to the ISl program adversely -

impacts the CLB's conclusions on defense in depth. One acceptable set of guidelines for making that assessment are summaraed below. Other equivalent decision criteria will also be considered.

Defense in depth is preserved when-

+

a reasonable balance among prevention of core damagu, prevention of containment failure, and consequence mitigation is preserved;

+

- over reliance on programmatic activities to compensate for weaknesses in plant design is avoided:

system redundancy. independence, and diversity are preserved commensurate with the expected frequency and consequences of challenges to the system:

defenses against potential common cause failures (CCFs) are preserved and the introduction of new CCF mechanisms are monitored for prevention:

+

independence of barriers is not degraded: and

+

defenses against humsn errors are preserved.

A PRA systematically assimilates all the above attributes of defense in depth into a coherent package. From this package, a detailed analysis can be performed to assess the impact of ,

proposed modifications on those attributes. For example, the degradation of balance among 16

- - _ - - _ _ _ - ~ _ - .. .. --. . . - - - - - - - _ - - _ - -

prevention of core damage, prevention of containment failure, and consequence mitigation

) can lead to calculated CDF outliers.

4.1.3 Safety Margins in any engineering program, safety margins are applied to the design and operation of a system. The:,e safety margins and accompanyN engineering assumptions are intended to account for uncertainties, but in some cases can lead to operational and design constraints that are excessive, costly, and could deter from safety (e.g., result in unnecessary radiation exposure to plant personnel). Insufficient safety m:.:,,ns may require additional attention.

Prior to a request for relaxation of existing requirements, the licensee must ensure that the uncertainties are adequately addressed. The quantification of uncertainties willlikely require supporting sensitivity analyses.

The engineering analyses should assess whether the irt. pact of the proposeu ISI changes are cansistent with the principle that adequate safety margins are maintained. An acceptable set of guidelines for making that assessment are summarized below. Other equivalent decision criteria are acceptable.

Sufficient safety margins are maintained when:

• codes and standards (as given in Section 4.1.1) or alternatives approved for use by the NRC are met, and

• safety analysis acceptance criteria in the current licensing basis (e.g., updated

) FSAR, supporting analyses) are met, or proposed revisions provide sufficient margin to account for analysis and data uncertainty.

Performance based inspection programs that monitor for degradations that can lead to leaks and are measured to acceptable targot leak frequency goals, such as those identified in Section A2.7.3.3 of Appendix 2 (or alternative goals approved by the staff), can belo provide confirmation of adequate safety margins. For exemple,if it can be demonstrated that reduction in inspections for a spec.Iic pipe segment will not lead to more leaks than the present ASME Section XI performance, then one can argue that the existing safety margins (due to inspections) are excessive and unnecessary. In the same sense,if the performance of a pipe segment exceeds the target leak frequency, then the safety margins are not sufficient and additional attention to that segment is needed.

4.1.4 Engineering Fracture Mechanics Evaluation An important input to inservice inspection programs is the identification of structural mechanics parameters, possible degradation mechanisms, design limit considerations, operating practices and environment, and the development of a data base or analytic methods for predicting the reliability of piping systems. Design and operational stress / strain limits are assessed. This information is available to the licensee in its design information for its plant.

The loading and resulting stresses / strains on the piping is needed as input to the fracture mechanics calculations that predict the failure probability of a pipe segment, Use of validated fracture mechanics computer programs, with appropriate input, is strongly recommended, because it facilitates the regulatory evaluation of a submittal. The method of applying computer simulation to calculate piping degradation has now achieved a level of maturity and 17

- - . - - . . . - - . - . ~ _ __ . .

validation that it can be applied in probabilistic risk applications. This topic is discussed in detaillater ,n Appenda 1. '

Where validated analytic computer programs are ny flable to predict the consequencer for 1 the degradation mech.ousms or materialin question,, .pucable data bases and expert I elicitation programs can be applied to provide the necessary information. l I

4.1.5 Engineering Failure Modes & Effects Analysis Sound enDi neering practices include validation of the parameters and consequences.

An acceptable process that provides the risk insl 0hts to ISl proDrams includes detailed walkthrough of a nuclear power facility. Assessrnent of internal and external events, including resulting primary and secondary effects of pipe degradations (e.g., leaks and breaks), are important parameters for the risk informed program. A r.etailed engineering failure modes and effects analysis (FMEA) provides an acceptable, disciplined, approach to the engineering analyses. Alternate methods should be submitted to tne NRC for review and approval.

4.2 Probabilistic Risk Assessment Using PRA to Assess the Change in Risk Associated with Changes to an ISI Program g g[-

The risk informed application process is intended not only to ' bIl#'#8IS -

support relaxation (number of inspections, inspection intervals and k .M method), but also to identify areas where increased resources should be allocated to enhance rafety. An acceptable RI ISl process should, theref ;re, not focus exclusively on areas l' which reduced inspection could be justified. This ser tion addresses ISI specific consiuerations in the PRA to support relaxation of inspections.

enhancement of inspections, and validation of component operability.

The general methodology for using PRA in regulatory arpsications is discussed in Draf t Regulatory Guide DG 1001, with reference to draf t NWlEG 1602, where technical details on scope, quality, and uncertainty issues are provided to ',upport Draf t Regulatory Guide DG-1061. General PRA issues specific to the development of a risk informed ISl program are discussed below. Detailed discussions on an acceptable quantitative approach are provided in Appendix 2. Other approaches can be proposed and will be acceptable if they adequately address allissues discussed here and in Appendix 2.

For the results of the PRA to play a major and direct role in the ISI decision making process.

there is a need to ensure that the results are deriveci from quality analyses. Figure 4.1 identifies attributes of a quality ISI analysis.

18

Figure 4.1 Example Attributes for Risk Inic' eid ISI Programs hributes of a Quality ISI Risk-infortc:d M ethodology

• Failure modes (e.g., smallleak, riisabling (large) leak, break) that can have either direct conscquences (e.g., disable a s) stem) or indirect consequcnces (water spray, pipe whip, etc.) arc addressed.

• Full range of failure mechanisms (e.g., mechanical fatigue, thermal fatigue, stress ,

corrosion cracking, flow assisted corrosion, etc.) that can contribute to component failure have been addressed. .

• Evaluation of failure potential makes use of plant specific operating esperience and industry data bases on failure occurrences.

• Categorics for failure potential are related to u til defined numerical ranges of failure frequencies or probabilitics such that the assignment of the failure potentials to categories can he supported und/or ocnchmarked with failure experience data and with predictions based probabilistic structural mechanics models.

• Evaluation of failure potentialinclude degradation mechanisms which are seldom or not yet esperienced. Structural mechanics models may indicate that these mechanisms, ahhough cutside the scope of current operating cxperience and/or industry data bases, can contribute to the lnwer failure pntential category (ics).

-

• hicntificatino ;.f 'ipe segments with particularly high failure consequences, so that i

inspection programs for these segments can he designed to detect degradation

. f.icchanisms which are either uncspected or more aggressive than espected.

Idce 4 w ie of structural elements hasing the highest relative contributions to core dam.m , cd include 100 percent of these top clements in the list of ISI locations.

• Identification of a population of structural clements which, as a group, contribute only a small fraction to the overall core damage risk associated with piping components. These stuctural cicments can he subject to a reduced level of inspectinn.

- Evaluation of the impact or change in plant risk associated with implementation of the proposed RI ISI programs.

The licensee.is expected to use its judgment, drawing from the appropriate technical disciplines for the CLB change being considered, of the complexity and difficulty of the

< implications of the proposed CLB change to decide upon adequate engineering analyses to support the regulatory decisionmaking. Thus, the licensee should consider the appropriateness of qualitative and quantitative analyses, as well as analyses using traditional engineering approaches and those techniques associated with the use of PRA findings.

Application of qualitative simplification of risk assessment may be found acceptable if benchmarked by quantitative methods. Any approach should develop performance objectives 19

i l

and means to achieve those objectives. That includes technically justified means to impose ~%

both increatas and decreases in inspection requiroments. The method needs to clearly )

illustrate the generality of the approach to strive for specified safety objectives.

4.2.1 Scope of Piping Segments To adequately reflect risk implications, the scope of SSCs covered by this regulatory guide includes

• All Class 1,2, and 3 pipes within the current ASME Section XI programs, and

• All pipes whose f ailure would compromise

- Safety related structures, systems, or components that are relied upon to remain functional during and following design basis events to ensure the integrity of the reactor coolant pressure boundary, the capability to shut down the reactor and maintain it in a safe shutdown condition, or the capability to prevent or mitigate the consequences of accidents that could result in potential offsite exposure comparable to 10 CFR 100 guidelines.

- Non safety related structures, systems, or components:

• That are relied upon to mitigate accidents or transients or are used in plant emergency operating procedures: or

+ Whose f ailure could prevent safety related structures, systems, or components from fulfilling their safety related function; or

• Whose failure could cause a reactor scram or actuation of a safety-related system.

The final piping systems that are to be included in the scope of the RI ISI program must be clearly defined. Similarly, piping systems not addressed by the RIISI programs must also be identified, documented and justified for exclusion. Table 4.1, adapted from (Ref. 7), provides an example list of systems included within the scope of an example risk-informed ISI program. Table 4.1 simply presents an example of information that should accompany a regulatory application. This regulatory guide recognizes that each plant choosing to submit changes to its ISI programs to incorporate risk insights willidentify it own sets of systems that will differ from those listed in Table 4.1.

The basis for excluding a plant's piping systems from consideration for inspection should be clearly discussed in the context of the criteria outlined above. Any pipe in the plaat can be selected for inservice inspection programs based on considerations outside the regulatory safety arena (e.g., pipes whose f ailure would have an inconsequential effect on safety, but could affect the economical operation of the plant). An example list of systems that may be considered for exclusion from consideration in a risk informed ISI evaluation is provided in Table 4.2. Such a table should also accompany a regulatory submittal. All systems excluded from consideration must be justified.

20

Table 4.1 Example of Systems identified as Falling under RlISI

] Programs for a Reference PWR (Adapted from Reference 7)

System Description Basis BDG Steam Generator Bluwdown High Energy Line Break Concerns CCE Charging Pump Coohng PRA' CCl Safety injection Pump Cochng PRA' CCP Reactor Ptmt Component Cookng PRA & ASME Section XI CHS Chemical & Volume Control PRA & ASME Section XI CNM Condensate PRA' DTM Turbine Plant Miscellaneous ASME Section XP Drains ECCS Emergency Cdre Cooling PRA & ASME Section XI EGF Emergency Diesel Fuel PRA FWA Auxihary Feedwater & PRA & ASME Section XI Recirculation FWS Feedwater PRA' & ASME Section XI HVK Control Bldg. Chilled Water PRA

~~

MSS Main Steam PRA & ASME Section XI OSS - Quench Spray PRA & ASME Section XI RCS Reactor Coolant PRA & ASME Section XI

. ~s RHS Residual Heat Removat PRA & ASME Section XI.

RSS Containment Recirculation PRA & ASME Section XI SFC Fuel Pool Cochng & Purification PRA*-

SlH High Pressure Safety injection PRA & ASME Section XI SIL Low Pressure Safety injection PRA & ASME Section XI

} SWP Service Water PRA & ASME Section XI

' included in PRA boundary, but exempt by ASME Section XI pipe size.

' Modeled indirectly in PRA, 8

Drain knes from MSS hsted because of ASME Section XI.

• ECCS is a combination of piping segments which impact b number of systems Charging, HPSI, LPSI, Quench Spray

• Not included in PRA internal events model, important to shutdown risk.

21

1; . . _ . . - _ . - - _ . . . - _ - . -

Table 4.2 Example of Risk Informed Systems Excluded from Consideration in RIISI Programs for a Reference PWR l System ID System Descrip n Resolution DSM Moistoie Separator Drains & Vents Determined to be non resk sionificant' DSR Main Steam Separator Rcheater Drains Determined to be non risk significant' and Vents EGO Emergency Diesel Fuel Exhaust & Determined to be non risk signsf acant Comb. Air ESS Extraction Steam Determined to be non-risk significant' GMC Stator Cooling Water Determined to be non-risk significant GMO Generator Seal Oil Determined to be non-risk significant HDH H P. Feedwater Heats t Drains Determined to be non risk significant' HDL L.P. Feedwater Heater Drains Deterreined to be non-risk significant' LAC Containment instrument Air Cetermined to be non risk significant TMB Turbine Control System Determined to be non risk sionificant CCS Turbine Plant Component Cooling Determined to be non rssk significant'

' in addition, based on the outcome of the Feed. vater. Condensate, SG Blowdown and Main Steam System piping segments evaluation, these other systems are Considered bounded by these evaluations which determined all segments to be less safety significant.

4.2.2 Piping Segments An acceptable method for modeling a run of a pipe in a PRA or to define its ISI requirements is to divide the pipe run into segments. Portions of pipes within the piping systems having the same consequences of f ailure should be systematically identified. Consequences of failure may be defined in terms of an initiating event, loss of a particular train, loss of a system, or combinations thereof. The location of the piping in the plant, and whether inside or outside the containment, should be taken into account in defining piping segments.

Piping sections subjected to the .ame degradation mechanism should be systematically identified. Most of the degradation mechanisms present in nuclear power plant piping are dependent on a combination of design characteristics, fabrication processes and practices, operating conditions, and service 9xperience.

A piping segment should be defined as that run of piping for which the potential degradation mechanium is the same, and a f ailure at any point in the segment results in the same consequence, in addition, consideration should be given to identifying distinct segment boundaries at branching points such as flow splits or flow joining points, locations of size changes, isolation valve, MOV and AOV Iccations. Distinct segment boundaries should be defined if the break probability is expected to be significantly different for various portions of piping.

22

+

As can be noted from the previous discussions, the process of defining pipe segments is

) iterative, it generally requires an analyst to make several modifications to the pipe segment definitions before they are finalized.

See Section A2.3 of Appendix 2 for an acceptable approach on how to segment and display pipe segment information.

4.2.3 Modeling Pipe Failures in PRA One acceptable approach to the incorporation of pipe failures into a PRA is to define logic model events to represent pipe segments, f ailures, and to incorporate them in the logic model

.in such a way that their consequence in terms of equipment f ailures (see Section 4.2.5)is captured. By estimating the probabilities of these pipe segment f ailures, their contribution to risk can be incorporated quantitatively in the PRA model.

An alternative acceptable approach is based on categorizing each segment's f ailure likelihood and the consequences of each segment's f ailures in terms of their impact on the plant. These two elements of risk, f ailure likelihood and consequences, are then systematically combined to determine the safety significance of each segment.

New initiators may need to be added to the PRA modelif the greater resolution of the piping f ailures introduce different demands on mitigating systems than the generic pipe f ailures did in the baseline PRA, Correspondingly, when non initiating event pipe failure consequences cannot be captured by surrogate basic event f ailures, new basic events may need to be added

]I to the models. For example, consider a system model that initially has only two basic events

^

representing the failure of train A and train B of the system. Train A contains two parallel flow paths, one of which can be failed oy the failure of a particular pipe segment. Since the model does not contain a surrogate basic event that represents the failure of the particular pipe segment, the model should be revised by adding basic events to represent the failure of each parallel flow path in train A. In addition, careful attention should be given to pipe failures which could cause initiating events anA at the same time, f ail or degrade mitigating systems (common cause initiators).

. . See Section A2.4 of Appendix 2 for more details on an acceptable quantitative approach for modeling pipe f ailures in a PRA, 4.2.4 Piping Failure Potential The determination of failure likelihood of piping segment:,, either as a quantitative estimate or a categorization into groups, should be based on appropiiate values reflecting degradation mechanisms, opeiational characteristics, potential dynamic loads, flaw size and distributions, inspection parameters, experience data base, etc. The evaluation should include the appropriate quantitative definition of the f ailure pottntial (e.g. the f ailure rate or f ailure unavailability associated with the pipe and the basis for the quantitative cefinition. The f ailure probability or frequency used in the PRA should be appropriate for the specific environmental conditions, degradation mechanisms, and f ailure modes for each pipe location. When data analysis is used to develop a quantitative cstimate, the data should be appropriate. When elicitation of expert opinion is used in conjunction with, or in lieu of pr%abilistic fracture mechanics analysis. a systematic procedure should be developed for . inducting such

- elicitation in such cases, a suitable team of experts should be seledd and trained.

23 l

l

To understand the impact of specific assumptions or models used to characterize the pipe -

f ailure frequency or probability, appropriate sensitivity or uncertainty studies should be performed These uncertainties include, but are not limited to, definition of limiting f ailure modes, such as loss of function as opposed to loss of structuralintegrity; design versus fabrication differences: variation in material properties and strength; effect of various degradation and aging mechanisms; variation in steady state and transient loads; availability and accuracy of plant operating history; availability of inspection and maintenance program data; and capabilities of analytic methods and models to predict realistic results. Qualitative arguments may also be used to addioss these assumptions and models, but these arguments should be self supporting and self evident.

The methodology, process, and rationale used to determine the f ailure likelihood of piping tegments should be independently reviewed during the final classification of the safety significance of each segment. This review should be documented and included in the submittal. When new computer codes are used to develop quantitative estimates, the techniques should be verified and validated against established industry codes.

See Section A2.5 of Appendix 2 for details on an acceptable approach for determining pipe f ailure likelihood for use in PRA.

4.2.5 Consequences of Failure The impact on risk due to piping pressure boundary f ailure shculd consider both direct and indirect ef fects. Consideration of direct effects should include f ailures that cause initiating events, disable single or multiple components, trains or systems, or a combination of these effects. Indirect eftects of pressure boundary f ailures affecting other systems, components i and/or piping segments, also referred to as spatial ef fects such as pipe whip, jet impinge-ment, consequentia initiation of fire protection systems, or finoding should clso be considered. Part of the analysis should incorporate insights obtained from the licensee's analysis of IPE, IPEEE, fire, flooding, etc.

The direct and indirect effects of pipe failures should be characterized to incorporate appropriate failure mechanisms and dependencies into the PRA model. An acceptable method oPincorporating pipe failures is to classify pipe f ailures as leaks, disabling leaks, and breaks, Each of these f ailure modes has a specific f ailure probability and a corresponding potential for degrading system performance through direct and/or indirect effects. Leaks can result in moisture intrusion through jet impingement. flooding, and sprays. Disabling leaks (larger break area than for leaks) can result in initiating events and loss of system function in addition to indirect effects. Breaks can result in damage due to pipe whip in addition to all of the above mentioned damages. The corresponding failure probability or potential normally decreases as the break area increases.

To understand the 9act of a specific assumption or model on the results of the PRA, appropriate sensitivity studies should be performed. Use of qualitative arguments should be self supporting and self evident.

The consequence evaluation should ncorporate the contributions to risk from pipe f ailures as initiating events, mitigating system f ailures, and f ailures that cause both (common cause initiators). Risk assessment incorporates more than the contribution of pipe segment failing.

24

lt includes operator actions, system interactions, common component (segment) interactions, etc. A qualitative assessment needs to consider the impact of these measures.

See Section A2.4 of Appendix 2 for more details on an acceptable approach for incorporating the consequences of pipe failures in a PRA.

4.2.6 Risk Impact of ISI Changes A risk-informed ISI change request should demonstrate that principle four in DG 1061, highlighted in Section 4.4 of this regulatory guide,is met. Principle four states that proposed increases in risk, and their cumulative effect, are small and do not cause the NRC Safety Goals to be exceeded. Increase in risk caused by changes in the ISI program could arise from a decrease in the number of welds inspected, reduced efficiency from simplified weld inspections, or both. Decreases in risk could arise from inspecting welds not currently being inspected in the program, improved weld inspections, or both. The greater the potential risk increase in the proposed change in the ISI program (e.g., the larger the reduction in the number of welds to be inspected and of replacements of detailed inspections with simplified inspections) the more rigorous and detailed the risk analyses needed.

The licensee's risk assessment should be used to address the principle that proposed increases in risk, and their cumulative effect are small and do not cause the NRC Safety Goals to be exceeded. For purposes of implementation, the licensee should assess the expected change in CDF and LERF. The necessary sophistication of the evaluation is that needed to ensure that the potential risk impact of a change to the ISI program is acceptable. For m changes that result in substantialimpact, an in-depth ano comprehensive PRA analysis of appropriate scope to derive a quantified estimate of the totalimpact of the proposed change

'} will be necessary to provide adequate justification. In other applications, calculated risk importance measures or bounding estimates will be adequate. In still others, a qualitative assessment of the impact of the change on the plant's risk may be sufficient.

The fulfillment of principle four should be based on a

risk importance measures or bounding estimates capable of categorizing plant specific pipe element f ailure potential categories of high and low f ailure potential, and consequences categories of high and low safety significant piping (see Section A.2.7),

1 a systematic process to combine failure potential and consequence to determine pipe element safety-significance.

a weld inspection selection process which provides for changes in the ISI program based on the safety-sig'nificance of the pipe element.

a discussion and evaluation of the aggregate risk impact of the set of changes requested in the ISI program, and an assessment and accounting of the sensitivities and uncertainties associated with the evaluations.

25 l

The process needs to demonstrate that the major part of the risk attributed to piping f ailure is covered by the RI ISI program.

The general approach to risk impact evaluation f or inspection of piping is illustrated in Figure 4.2. See Section A2.6 of Appendix 2 for details on an acceptable quantitative approach determining the risk impact of an ISI change.

FIGURE 4.2 General Approach to Risk Impact Evaluation of Piping

'h._~4.=.'3

} ,, ,, . .

$1dsntify thsLPi iing' l Segments and~A'ssociate'd3 Veld? '

Q (P6pulationt

~;,  ; -

{EfDetermine.the RiskImpact of thePiping Segment Failurs[

w we .g - % 1 -

.- - o 3 f w$,ws:PipingfS~egment p 99 :tto;

- ~ . , .

Failure -YDs="57IYelersu.keith5 r

eg, y syy  ;

~.s s ., ,

y',".(f'; Determine,ttheSystem Unavailability IncreasiDue toD*

f 1Piilu(Sigment l Failure E fEstimate the Piping Segment Failure Probabilities:

3 ,,.6,,, . ** ,

..m .

i 4 nE}Dstermine'th;e Piping Segment Risk Importancer 4

jCombihing the Risk' Impact and Failure Prob ~ ability 1

):D ;j 3 ... s. .

fmSIde'ntify the lreas of the Piping Segment and ihe Sample-

jWelds to be Inspected to Control the Risk Level Using the Risk Importance of the Piping Segments 4.2.6.1 initiating Events 7

For purposes of determining RI ISI requiremt nts ai! init ating events (internal and external) and all operating modes should be esaluated to see e.htthei mitiating events and predicted plant response are af fected by RI-ISI preomed ch.mga in adJition. other initiators, including 20

y those that have been screened out (eliminated) from the base PRA, have to be considered by

) answering the following questions.

(1) Does the ISIissue involve a change that could lead to an increase in the frequency of a particular initiator already included in the PRA?

(2) Does the ISIissue involve a change that could lead to an increase in the frequency of 4

a particular initiator initially screened out of the PRA?

(3) Does the ISIissue affect the quantification of previously identified accident scenarios for specific initiators that were screened out and eliminated from the PRA because of truncation?

(4) Does the ISIissue have the potential to introduce a new initiating event?

4.2.6.2 Dependencies and Common Cause Failures The ef te. ts of dependencies and Common Cause Failures (CCFs) for ISI components need to be consideced carefully because of the significance they can have on core damage frequency.

Generally, dita are insufficient to produce plant specific estimates based solely on the data.

, For CCFs, data from generic sources may be required. (Ref. 21) and Appendix 2 to this document aldress CCFs in more detail.

4.2.6.3 Uncertainty and Sensitivity Analyses l'ocertainty and sensitivity analyses are expected to play an important (and complex) part in 4

the support of risk informed ISI program changes. These topics are discussed further in (Ref.

I 21 and Section A2.5.5 of Appendix 2 of this document. It is expected that certain application specific guidance will be developed from the ongoing NRC reviews of the proposed RI ISI pilot plant programs.

t l

4.2.6.4 Human Reliability Analyses

See (Ref. 21) for further discussions on this topic. For ISI-specific analyses, the human I reliability analysis methodology used in the PRA must account for the impact that the pipe

- segment break will have on the operator's ability to respond to the event, in addition, the

reliability of the inspection program (both operator and equipment) that factor into the l probability of detection should also be addressed (see Attachments 4 and 5).

4.2.7 Element Selection This section discusses the establishment of the number of elements (e.g., welds) per segment requiring inspection and provide's guidance on how to meet the requirements of 10 CFR 50.55a(a)(3)(i). 10CFR50.55a(a) states:

(3) Proposed alternatives to the requirements of paragraphs (c), (d), (e), (f) (g), and (h)

! of this section or portions thereof may be used when authorized by the Director of the

._ Office of Nuclear Reactor Regulation. The applicant shall demonstrate that:

4

}

_)

(i) The proposed alternatives would provide an acceptable level of quality and sa fe ty....

l 27 J

+

.: = -.. : z . =.:: .===..n..====:=..==.=== - -

.  :.a: - -

Section 4.2.6 addressed the determination of the risk impact of ISI changes and the categorization of pipe segments as high and low safety significant. The segments 1 categorized as low safety significant will require less oversight and inspection than those categorized as high safety significant. .

One option for meeting the ' acceptable level of quality and safety" criterion of 10 CFR 50.55a(a),is for a licensee to review existing industry experience with the ASME Section XI requirements and assess that performance on systems and piping components (e.g.,

developing target leak frequency goals based on existing ASME results). Meeting this performance standard with high assurance levels for the high safety significant piping segments could be used as one element in the staff's determination of acceptable levelof quality and safety.

Appendix 2 to this regulatory guide provides one examble of determining leak target goals that conform to the 50.55a requirement, listed above. A licensee could propose its leak 1 target goals and develop a program that meets those goals. Such a program would define the number of welds requiring inspection.

For the example ' leak target goals" identified in Appendix 2, the target goals are applied to the system under consideration. For example, if a system is comprised of 36 segments, and 20 of which are categorized as high safety significant, then the target goal for those 20 segments should meet the target leak goals at the 95% confidence level. The staff will find acceptable a 95% assurance level that the target leak goals will be met.

The target leak goals can be established on a system or element level. If established on an element level, the goals should ensure that the system's reliability is consistent with existing '

Section XI performance. For example, the leak target goals defined in Table A2.9 is based on globalindustry piping performance. These target goals would be applied only to the HSS segments in a system. Appendix 4 to this regulatory guide provides an examples of how one could calculate the number of welds in be inspected to meet the leak target goals.

Any analysis needs to consider the inspection method and the probability of detection.

Appendix 4 provides an example of such a calculation.

4.3 Integrated Decisionmaking This section discusses the integration of the technical considerations involved in reviewing submittals from licensees proposing to implement RI-ISI programs, General guidance for risk-informed applications is provided in Draft Regulatory Guide DG 1061. Specifically, the integrated decision process should assess whether or not:

The comprehensive plant model, including the PRA and the integrated deterministic analysis, is technically sound and suppor's the rest of the findings regarding the proposed RI ISI program.

The analysis is based on the as-built and as operated and maintained plant.

• All safety impacts of the proposed changes to the licensee's ISI program have been evaluated in an integrated manner as part of an overall risk management approach in which the licensee is using risk analysis to improve operatiocal and engineering 28

N- decisions broadly and not just to eliminate requirements seen as undesirable (i.e., the

.-) approach used to identify changes in requirements for ISI were used to identify areas where requirements in ISI should be increased as well as reduced).

The proposed changes to the ISI program have been evaluated in an integrated fashion that ensures that all of the key safety principles are met.

The cumulative s;sk evaluation accounting for all of the proposed ISI program changes confirms that changes to the plant core damage frequency (CDF) and large early release frequency (LERF) aie smallin conformance with the guidelines given in Section 2.4.2 of Draft Regulatory Guide DG 1061 and summarized below.

The risk acceptance guidelines discussed in DG 1061 are based on the principles and expectations for risk informed regulations. As such, the licensee's risk assessment should:

address the principle that increases in estimated CDF and LERF resulting from the proposed CLB changes will be limited to smallincrements.

be sophisticated enough to support the determination of the expected change in the risk, be subjected to appropriate quality controls, and realistically reflect the actual design, construction, and operational practices of the plant requesting the proposed CLB change.

For the purpose of establishing objectives or guidelines for risk informed decisionmaking, the CDF objective of 1E 04 per reactor year has been adopted. A large early release frequency (LERF) range of 1E 6 to 1E 5 per reactor year has been adopted as a containment performance guideline.

The acceptance guidelines have the following elements:

~

For a plant with a mean core damage frequency at or above 1E 4 per reactor year (the Commission's subsidiary core damage frequency objective) or with a mean LERF at or above 1E 5 per reactor year, it is expected that applications will result in a net decrease in risk or be risk neutral.

For a plant with a mean core damage frequency of less than 1E-4 per reactor year, applications will be considered which, combined with the LERF guidelines described below:

Result in a net decrease in CDF or are CDF neutral; ,

Result in increases of calculated CDF that are very small (i.e., CDF increases of less than 1E 6 per reactor year): or Result in an increase in calculated CDF in the range of 1E-6 to 1E 5 per reactor year, subject to increased NRC technical and management review and

- considering the following factors:

The scope, quality, and robustness of the analysis (including but not limited to the PRA), including consideration and quantification of uncertainties, 29

• The base CDF and LERF of the plant.

• The cumulative impact of previous changes (the licensee's risk management approach),

• Consideration of the NRC's Safety Goals policy screening criteria in the staff's Regulatory Analysis Guidelines, which define what changes in CDF and containment performance would be needed to consider potential backfits.

• The impact of the proposed change on operational complexity Lurden on the operating staff, and overall safety practices, and

• Plant specific performance and other f actort including, for example, siting f actors, inspection findings, performance it- Scators, and operational events.

AND

• Fcr a plant with a mean LERF of between 1E 6 and 1E 5 per reactor year:

• Result in a net decrease in LERF or are LERF neutral:

• Result in an increase in calculated LERF of up to 1E 6 per reactor year, subject to increased NRC technical and management review, as described above:

OR

• For a plant with a mean LERF of less than 1E-6 per reactor year:

• Result in a net decrease in LERF or are LERF neutral:

• Result in increases in calculated LERF that are very small (i.e., LERF increases of less than 1E 7 per reactor year) or

• Result in an increase in calculated LERF of up to 1E 6 per reactor year, subject to increased NRC technical and management review, as described above.

The rigor of analyses needed to support these different types of applications is addressed in Section 2 of DG 1061.

• Appropriate consideration was given to the uncertainties in the analyses and interpretation of the results.

• Plant specific data was incorporated into the analyses, as appropriate.

• Defense in depth evaluations have been performed, and insights from these have been duly incorporated into the classification scheme. the performance goals, and the associated programmatic activities. These evaluations confirm that sufficient safety margins exist and the CLB's defense in depth evaluation is not compromised.

• The scope and models used were appropriate for the proposed change and the analysis was subjected to quality controls.

• Pipe segments have been identified and appropriately cctegorized for use in prioritizing and implementing the program, in particular,important components not modeled in the PRA have been identified and appropriately categorized using available deterministic supporting information.

30

]

-/.

. An appropriate monitoring program is proposed to assess plant performance and provide for feedback and corrective action if performance goals are not met.

• The dala, analysis methods and assessment criteria used in the development of the RI-ISi programs are scrutable and available for public review.

In summary, acceptability of the proposed change should be determined using an integrated decision-making process that addresses three major areas: (1) an evaluation of the proposed change in light of the plant's current licensing basis, (2) an evaluation of the proposed change relative to the key principles and the acceptance criteria, and (3) the proposed plans for implementation, performance monitoring, and corrective action. As stated in the Commis-sion's Policy Statement on the increased use of PRA in regulatory matters, the PRA information used to support the RI ISI program should be as realistic as possible, with proper consideration of uncertainties. These factors are very important when considering the cumulative plant risk and accounting for possible risk increases as well as risk benefits. The licensee should carefully document all of these considerations in the RIISI program description including those areas that have been quantified through the use of PRA as well as qualitative arguments for those areas that cannot be readily quantified. Examples of qualitative subjects include ALARA for plant personnel, operator procedures that ease the burden on plant personnel, organizational human factors, etc. When making final 3

programmatic decisions, choices must be made based on all of the available information.

There may be cases where information is incomplete or where conflicts appear to exist between the traditional engineering data and the PRA generated information. It is the responsibility of the licensee in such cases to resolve such issues.

31

5. ELEMENT 3: IMPLEMENTATION, PERFORMANCE MONITORING, AND CORRECTIVE ACTION STRATEGIES Using the information produced from Elements 1 and 2 of the RIISI process (as described in gg Chapters 3 and 4), the licensee develops a proposed RI ISI program. The program should Implementationi include implementation, performance Monitoring monitoring, and corrective action strategies. Program The program should be self correcting as experience dictates. The programs should contain performance measures used to confirm the safety insights from the PRA. While the ELEMENT 3 actual development of the RI ISI program is lef t to the licensee's discretion, Appendix 5 provides a detailed discussion on an acceptable approach for developing an RI-ISI program.

Upon approval of the RI-ISI program, the licensee should have in place an implementation schedule for inspecting all HSSCs and LSSCs identified in its program. The number of required inspections should be a product of the systematic application of the rit.k informed process.

5.1 Program implementation The implementation of a RI-ISI program for piping may begin at any point of the inspection interval as long as the examinations are scheduled and distributed to be consistent with the inspection interval requirements of the ASME Boiler and Pressure Vessel Code Section XI Edition and Addenda committed to by a licensee in accordance with 10 CFR 50.55a. The requirements for these intervals are contained in Section XI under Article IWA-2000 as they apply to inspection Program B. Initial Rl ISI programs should be submitted for NRC staff approvalin accordance with 10 CFR 50.55ata)(3) and documentation of program updates should be kept and maintained by the licensee on site for audit. Updates to thee RIISI program should be performed at least on a periodic basis to coincide with the inspection program requirements contained in Section XI under inspection Program B. These updates should be expedited as dictated by any plant established procedures to update their PRA which may be more restrictive than the Section XI period uodate. As plant design feature changes are implemented, changes to the input associated with the RI-ISI program segment definition and element selections should be reviewed and modified, as needed. Changes to equipment performance, the plant procedures that can affect system operating parameters, changes in component test intervals. valve lineups, operating modes of the equipment, or the ability of the plant personnel to parform actions associated with accident mitigation should be included in any RI ISI program update. When scheduled RI-ISL program NDE examinations and pressure tests are ccmpleted with corresponding VT-2 visual examinations for leakage and flaws or indications of leakage are identified. the existence of these conditions should be evaluated as part of the RI-ISI update.

Each 10-year inspection interval is subdivided into inspection periods which end at 3,7, and 10 years of plant service within each interval. Variations in these inspection program 32

intervals and periods by plus or minus 1 year are allowed under Section XI based on

) refueling outage situations and may be employed by a licensee who implements an RIISI program. These same basic RI ISI program interval and period requirements may also be used by a licensee who chooses to perform on line Nondestructive Examination (NDE), but special considerations may have to be taken in regard to program updates during the performance of corrective actions that result from these examinations.

5.2 Performance Monitoring RI-ISI programs are living programs and should be monitored continuously. Monitoring these programs encompasses many facets of feedback or corrective action that include periodic updates based on input and changes resulting from plant design features, plant procedures, equipment performance, examination results, and individual plant and industry f ailure

~ information. Since the PRA used in the development of any RI ISI program is a state of knowledge at the time of implementation, any significant change in parameters affecting the total plant's CDF or LERF needs to be considered upon identification. Plant administrative procedures should be in place to implement these changes into the PRA and incorporate any relevant results into the Rl ISI program outside of any periodic update.

The purpose of performance monitoring is to confirm:

(1) the assumptions in the PRA that could affect the probability or consequences of pipe failures, (2) the target objectives or goals used in the integrated decisionmaking process are being met, (3) the known degradation mechariisms are understood, and (4) that any unknown degradation mechanisms are identified before they have a detrimentaiimpact on risk.

(5) that the integrated decisionmaking process remains current with plant and industry experiences.

Performance monitoring of the risk-informed ISI plan is intended to confirm that:

- Piping reliabilities used in the calculation of risk contributions from passive piping components remain valid and thereby justify continuation of the ISI plan without modifications

• Appropriate modifications to the ISI plan are developed if new or unexpected degradation mechanisms occur.

The inspection procedures and analyses must provide assurances that performance degradation is detected with sufficient margin that there is no adverse effect on public health and safety (i.e., the f ailure rates cannot be allowed to rise to unacceptable levels before detection and corrective action take place). The basic elements of an acceptable performance monitorin0 program are illustrated in Figure 5.1 and summarized in the following subsections.

33

Periodic Updates.

Updates to an RlISI program should be performad at least on the basis of periods that coincide with the inspection program requirements contained in Section XI under inspection Program B. These updates would be expedited as dictated by any plant established procedures to update their PRA which may be more restrictive than a Section XI period type update.

Plant Design Feature Changes.

As plant design changes are implemented, changes to the inputs associated with RI ISI program segment definition and element selections may occur,it is important to address these changes to the inputs used in any engineering assessment or structural reliability risk assessment (SRRA) model that may affect resultant failure probabilities in terms of pipe leakage, disabling leakage, and full rupture events. Some examples of these inputs would include the following:

+ Operating characteristics (e.g., changes in water chemistry control)

+ Material and Configuration Changes:

+ Welding Techniques / Procedures:

Construction and Freservice Examination Results: and

• Stress Data (Operating Modes, Pressure, and Temperature Changes) in addition, plant design changes could result in significant changes to a plant's CDF or LERF, which in turn could result in a change in consequence of f ailure for system piping segments.

Plant Procedure Changes.

Changes to plant procedures that effect system operating parametcrs or the ability of plant operations personnel to perform actions associated with accident mitigation should be included for review in any RI-ISI program update. Additionally, changes in these procedures which effect component inspection intervals, valve lineups, or operational modes of equipment should also be assessed for their impact on changes in postulated f ailure mechanism initiation or CDFILERF contribution.

Equipment Performance Cnangss.

Equipment performance changes should be reviewed with system engineers and maintenance personnel to ensure that changes in performance parameters such as valve leakage, increased pump testing or identification of vibration problems is included in the periodic evaluation of the RI-ISI program update. Specific attention should be paid to these conditions if not previously assessed in the qualitative inputs to the element selections of the RI-ISI program.

34

,) .

PERFORMANCEbMONITORING c d;h:r .3< ? ~ .x . , ' ,

^fie

~

J L

M onitor Identify Precursor Conditions Periodle Upd ..e Plant Lesign Change Characterize Operability, Safety l Plant Procedure Change - & Reporting Requirements Equipment Perforasance Change Evaluate - Cause / Corrective Action Plani Esassine: -

• Results - .... .

M anagement Approval Individual Plant Failure information -

Industry Failure Inform ation Implement Corrective Action Plan Trend .

% lf .

RI-ISI PRO' GRIM; O ALIDATION

~ -

Figure 5.1 Elements of a Performance Monitoring Program Examination Results.

When scheduled RI-ISI program NDE examinations and pressure tests are completed with corresponding VT 2 visual examinations for leakage, and flaws or indications of leakage are

_____ identified, the existence of these conditions should be evaluated as part of the RI-ISI program update.

Individual Plant and Industry Failure Information.

r Review of individual plant maintenance activities associated with repairs or replacements, including identified flaw evaluations, is an important part of any periodic update, regardless of whether the activity is the result of an RI-ISI program examination. Evaluating this information as it relates to a licensee's plant provides failure information and trending information that may have a profound effect on the element locations currently being examined under an RI ISI program. When this review is coupled with industry failure information, a thorough update results. Industry f ailure data is just as important to the overall program as the owner's information. During the periodic update, industry data bases (such as the international data base being pursued by EPRI and SKI, and U.S. industry data base) should be reviewed for applicability to the owner's plant.

.)

35

5,3 Corrective Action Programs Each licensee of a nuclear power plant is responsible for having a corrective action program, consistent with Draft Regulatory Guide DG 1061. Measures are to be established to assure that conditions adverse to quality, such as failures, malfunctions, deficiencies, deviations, defective material and equipment, and nonconformances, are promptly identified and corrected in the case of significant conditions adverse to quality, the measures must ensura that the cause of the condition is determined and corrective action taken to preclude repetition. The identification of the significant condition adverse to quality, the cause of the condition, and the corrective action are to be documented and reported to appropriate levels of management, 11is anticipated that a corrective action program willincorporate the following elements:

Ider,tily.

Through the inspection location selection process established under an RI ISI program, the structural element examinations performed should identify those conditions that would be adverse to quality in relation to identifying precursors to potential or actual leaks, disabling leaks, or pipe ruptures.

Characterize.

Depending on the timing of the condition identification and operational mode of the plant, (this may be a more critical situation when on line NDE is performed) the initialissues to be addressed include:

a the effects on operability of safety related systems, structures, or components;

• if regulatory reporting is required; or the condition results in an immediate plant / personnel safety or operational impact.

If any of ese three considerations exist, then the plant's management must be immediately notified through plant established procedures.

Evaluate Evaluation has two parts: (1) determine the cause and extent of the condition identified, and (2) develop a corrective action plan or plans. Additional examinations should be considered an acceptable method in providing this cause and extent determination. Under an RI ISI program, both quantitative and qualitative insights are used to identify postulated failure modes and elements to be examined. Performances of examinations on selected elements have been grouped into regions of "High" and " Low" failure potential and safety significance. These groupings provide the basis for additional examinations to be performed to determine the cause and extent of the condition identified. Acceptable sampling schemes such as those identified in ASME Section XI under IWB 2430 may be used with due consideration given to limit the additional examinations by piping segment. materials, 36

l l

r service conditions, and f ailure modes already established in the RIISI program. Alternativel'y,~

l due to the available information used in an RI ISI program, an engineering evaluation may be _l used as a substitute for additional examinations to determine the cause and extent of the '

condition identified.

i Once the true extent of the condition has been identified and documented by a licensee.

then a corrective action plan should be developed. The plan could include repair.

L replacement, or rnonitoring of the condition identified depending on its safety significance.

Several options of corrective action may be available to a licensee, but in all cases, needed success crieria must be defined and documented with the corrective action plan. These success criteria include the measurable attributes needed to evaluate the effectiveness of 1 the corrective action in the prevention of a recurrence of the identified condition. The success criteria may be as simple ts implementation of new element selections based on the l new f ailura information during the next scheduled periodic update of the RI-ISI program and then perfoiming the examinations to confirm that the issue has been corrected. Conversel,,

to prevent the condition from reoccurring, these criteria may require a plant design change, depending on the condition idcotified, and possible routine scheduled replacements.

1 Decide.

l

- A decision should be made by appropriate levels of managtment on the owner's l implementation of any corrective action plan. Agreement on the adequacy of the success 4

criteria should be reached among the personnelinvolved and resources al!ocated tu 3 implement the plan. Cost will inevitably play a part in the decision process, but it is more

) important to fix the problem correctly the first time so as to avoid recurrence in the future, implement.

4

- Complets the work necessary to both correct the problem and prevent its recurrence. In the case of an RI-ISI program, successive examinations may bc one way to measure the

, effectiveness of the corrective action plan. A licensee could follow the requirements for

successive exemir.ations as described in Section XI iWB 2420. These requirements could be used when flaws or conditions have been accepted by analytical evaluations and j _ measurements of potential service related degradation. It is essentiarto~ avoid a future failure of a pipe element.

Monitor.

The first activity that must be monitored is whether or not the planned corrective action wis implemented. Management should accomplish this as part of their oversight of daily work activities, in an RI-ISI program this may be as simple as having administrative procedures in place to verify that the program has been updated as a result of the corrective action plan and review the data to verify that the examinations are being performed as scheduled.

Once it has been determined that corrective actior's have been implemented, the planned actions to verify that the desired results are obtained should be conducted. This is done by measuring the success criteria at regularly scheduled intervals in accordance with the 37 '

l I

I l

I i

corrective action plan. This measurement may indicate that the success criteria did not fix the problem or only partially fixed the problem. Additional corrective action pl > s may have to be developed and implemented if this situation occurs.

Trend. .

The purpose of trending is to identify conditions that are significant based not only on individualissues, but on accumulation of similar issues. Even issues assigned low significance may be deemed of greater significance if there are an increasing number of similar issues. During the RI ISI program, periodic updates of occurrences which required corrective actions should be reviewed by the ISI team and appropriate oversight groups / management to determine if these insights should result in additional or different locations for examination.

5.4 Acceptance Guidelines The acceptance guidelines for the implementation, monitoring, and corrective action programs for the accepted RI-ISI program plan are presented below (a. through p./. In addition, acceptance guidelines for the initial development of the RI ISI program plan, as described in Appendix 4, are provided (h through t). The acceptance guidelines include:

a. The implementation program will be evaluated based on the attributes presented in Section 5.1.

b. The monitoring strategy should evaluate that the RI ISI components (i.e., pipe segments and elements) meet the guidelines addressed in Chapter 4 and are adequate to uncover components that fail to either meet the acceptance guidelires or are otherwise determined to be in a non-conforming condition.

c. The corrective action program should provide reasonable assurance that a nonconforming component will be brought back into conformance.

N

d. Evaluations within the corrective action program should: -

(1) assure that the cause of the condition is determined and that correctiva actions are taken to preclude repetition. The identification of ,he significant condition adverse to quality, the cause of the condition, and the corrective action are to be documented and reported to appropriate levels of management.

(2) determine the impact of the failure or nonconformance on system / train operability since the previous inspection (3) determine and correct the root cause of the f ailure or nonconforming condition (4) assess the applicability of the failure or nonconforming condition to other components in the RI-lGI program 38 1 1

A

).

./ - (5) correct other susceptible RI ISI components as necessary

16) incorporate the lessons in the data base and SRR A computer models, if appropriate (7) assess the validity of the PRA f ailure rate and unavailability assumptions in light of the failure (s), and (8) consider the effectiveness of the component's inspection strategy in de*ecting the failure or nonconforming rondition. Adjust the inspection interval and/or inspection methods, as appropriate, when the component (or group of components) experiences repeated f ailures or nonconforming conditions.

e. The corrective action evaluation should be providad to the licensee's PRA group so that any necessary model changes and regrouping ue done cs might be appropriate.

/. .. The RI ISI program documents should be revised to occument any Rt.lSI program changes resulting from the corrective actions taken,

p. A program is in place that monitors industry findings, h- h. Piping Subject to Examination

]

/

The examination requirements include Class 1,2, and 3 piping evaluated by the risk-informed process. Piping in systems evaluated as part of the plant PRA, but outside the current Gection XI examination, and categorized as high safety significant, in accordance with Chapter 4 of this regulatory guide, are included.

/. Inspection Program The examinations are to be completed during each inspection intervalin accordance with the goals established for leak probability per weld ,)er year (or other NRC approved performance monitoring criterion), with the following exceptions.

(1) If, during the interval, a reevaluation using the RI ISI process is conducted and scheduled items are no longer required to be examined, these items may be eliminated.

(2) If, during the interval, a reevaluation using the RI ISI process is conducted and items are required to be added to the examination program, those items shall be added and the NRC informed.

f. Successive inspections Locations selected for inspections should be subjected to examinations consistent with Section XI requirements at appropriate intervals, such as given by items (1)

- through (3), below. Those locations with detected degradation (found to be at 39 l

l

., .- -. . . . . - . . . - ... . -. .. - . . - = - . , - - - - - - - - - = - - - - - - - - - - - - - - - -

acceptable levels) should be subject to more frequent examinations. An acceptat,le  ;

schedule for examinations is:

(1) The sequence of piping examinations established during the first inspection interval using the RlISI process shall be repeated during each successive inspection interval; however, the examination sequence may be revised to satisfy the requirements of Table IWB 24111 or Table IWB 24121, of Section XI.

(2) If piping structural alements are accepted for continued service by analytical evaluation in accordance with m (below), the areas containing the flaws or relevant conditions shall be reexamined during the next three inspection periods referenced in the schedule of the inspection program of / (above).

(3) If the reexaminations required by j.2 reveal that the flaws or relevant conditions remain essentially unchanged for thice successive inspection periods, the piping examination schedule may revert to the origine' schedule of successive inspections.

k. Additional Examinations Examinations performed in accordance with / (below) that reveal flaws or relevant conditions exceeding the acceptance standards are to be extended to include additior al examinations. The additional examinations are to include piping structural elements described in Table 5.1 with the same postulated f ailure mode and the same or higher f ailure likelihood.

(1) The number of additional elements will be the number of piping structural elements with the same postulated failure mode originally scheduled for that f uel cycle.

(2) The scope of the additional examinations may be limited to those high-safety-significant piping structural elements within systems whose materials and service conditions are determined by an evaluation to have the same postulated failure mode as the piping structural element that contained the original flaw or relevant conditions, if the additional examinations required above reveal flaws or relevant conditions exceeding the acceptance standards, the examination will be f urther extended to include additional examinations.

(3) Thert examinations are to include all remaining piping elements witnin Table 5.1 whose postulated f ailure modes are the same as the piping structural elements originally examined above.

(4) An evaluation will be performed to establish when those examinations are to be conducted. The evaluation must consider f ailure mode and likelihood.

40

. For the inspection period following the period in which the examinations of above were completed, the examinations are to be performed as originally scheduled.

l. Examination and Pressure Test Requirements

- Piping structural elements categorized as high-safety significant are to be examined as required in Table 5.1.

Pressure testing and VT 2 visual examinations are to be performed on Class 1,2, and 3 piping systems in accordance with Section XI specified in the licensee's ISI

. program.

Examination qualification and methods and personnel qualification are to be in accordance with the edition and addenda of Section XI specified in the licensee's ISI program.

m. Acceptance Standards for Identified Flaws For component configurations or examination methods not addressed by Table 5.1, the licensee is to develop acceptance criteria consistent with the requirements of IWA 3000. The referenced paragraphs below and in Table 5.1 are to be applied in accordance with the edition and addenda of St.ction XI specified in the licensee's ISI program (1) Flaws that exceed the acceptance standards listed in Table 5.1 found during j surface or volumetric examinations may be accepted by repair / replacement activitics or approved analytir.al evaluation.

(2) Flaws or relevant conditions that exceed the acceptance standards listed in Table 5.1 found during visual examinations may be accepted by supplemental examination, corrective measures, repair / replacement activities, or approved analytical evaluation.

-. - (3) Other unacceptable conditions not addressed above may be accepted by repair / replacement activities, or by approved analytical evaluation.

n. Repair / Replacement Procedures Repair / replacement activities are to be performed in accordance with the Section XI requirements specified in the licensee's ISI program.

o. System Pressure Tests System pressure tests should be performed in accordance with IWA 5000, IWB-5000;IWC 5000, IWD 5000 of the S:ction XI Edition and Addenda, as specified in the iicensee's ISI program.

41

p. Records and Reports i Records and reports should be prepared and maintained in accordance with IWA-6000 of the Section XI Edition and Addenda as specified in the Licensee's ISI program.

q. The licansee's RiISI program submittal should be consistent with the acceptance guidelines contained throughout this regulatory guide, specifically with the findings listed in this section, or justify why an alternative approach is acceptable,

r. The licensee's proposed RI-ISI program should address the four principal elements of risk informed decisionraaking (addressed in this document) by defining the proposed change, basing the new program on traditional analysis with insights from probabilistic risk assessments, and incorporating an implementation and monitoring program that enables the staff to conclude that the proposed Rl ISI program, provides "an acceptable level of quality and safety" [10 CFR 50.55a (a)(3)(ill

s. Administrative procedures should be in place to implement changes into the PRA and traditional analysis and incorporate any relevant results into the RI ISI program during and outside any periodic update.

f. The RI-ISI program provides an acceptable level of qua:ity and safety when compared to the existing Section XI performance.

42

G Q g Table 5.1 Examination Category R-A, Risk-informed Piping Examinations Ports Enemined Eseminedorf Eseminefion Acceptone Estent* end frequency Estent* endfressnency Defer se End of Retsivement* Method e first kuteeve! Succesolve hetervals* heeeevel Stendert!

High Safery Sigreificant ffpirw Stnocturnt Elements

• flaments Subject te theemos IWB-7500 Sic 3' Vetumeteic FWS 3514 - Inspect once per inspection Some es 1st interwel Not Pe,mseesa.

Fetigue twe 7500- trerewaf"

• 9.80.11 IWC 2500 7f el' flaments Subsect to Heg83 Cycle fWB 2500 8(ct' Vesusf. VT 2" fWB-3147 hspect once pee esfuelmc Some os ist intervel Net Pseemsew Mectionient F sticue fWB 7500- outage 9.10.11 fWC- 7500-7tel' 1

tiements Subsect to Cnrensive, N-te 8 Voksmeseic* tier fWB 3514 kspect once per inspecteve Scene es Ist inteeval Not Pemmeseer feesive, ce Cowdaten Weste0e Internet West egel et Note 8 epteewet*

Surface fior Eeteenef Westegel Elements Sutstect to Ceewere Note 7 Volumetesc fWB 3514 InspMt once pee inspectiere Seeae es Iet e iteevet Not Pomessete Coreosson Croc6mg meerwet*

Flements Se&t to Premeev Note 7 V, suet. VT-2 T IWS 3947 anspect once pee eefuehng Some es 1st weeevel Not Pemessene Wstee Stress Corroserm Ceeching outege (f'WSCCI' (tements Seeh,ect to Intergeenuler IWS 2500 8 Volumetese fWS-3514 hopect once per bepection Some se tot inteevet Not Pesensesbie Steess Coesoseon Cemeteng itGSCCI IWS 25 N intervet' 9.10.1I Etementa Sob,ect to fWS 7500 8 Veswet VY-3 Note 8 inspect once per merecten Same es 1et weteeves te,e tw Meceob.nenger esiv h%enced fWS 75M ane.enet Surf aces or etervsf Corrosen (MIC) 9.10.11 Vohenetesc*

F Icmens. %Aseii fa i f m Ace ciermed Neee e %ee N,eee %eee Nase 9 %ee 9 Cearecourm q f Ad *)

Nf eT($

eie The triy4 Ev the evere meesm erilume olief he erseseest se eictusse 9 e beyond each ende of te beee e= Met certsw= earweece es scorerstwee a2n enchasco e5 e.- - = hassees strenned e ereentame ad the awk ecfrened eetecipe guerees .

a tv h6sdre ter cfeeeweressnomasitwee wei R1wnteecqueest. . = echene ce eres carews be e=wwwwd dise to eserteveente by unsches _  ; es pere peevncey.lenetJ . __ ehet tieevenessed by the 151 Team Se are=yse**y Assei l awh usegwe ede brased ew_ i. and mee heece, ehet he dansnmhd Iat The eseriensenr== eeB eachte wie 6mpetedral melde e We Inesman eclecord fee ew . e Nase 2 The hwyeo4eisi =cid enemvisease eespevisinus shef be enn Es hash weremocrie sat perspel es=e enemswine entisme defried e Meer 2 s

43

.2 .-.- :-- .

i ,

si

.Ay

1,1,

-I.

11,1 It 5

j3 Il i

-t l iii 1M i 'll tI g{ii  :

I,t i} 5 i

a- :

I{l D}

il;:[

11'{i i 11 ti-111 ,

E3 4--

I -.

Ill[fi h}y}jf with

                         'EECE ES

     \)                           6.      ELEMENT 4: DOCUMENTATION The recommended format and content for a plant specific risk-informed ISI submittal are presented in this section. Use of this format by licensees will help ensure the completeness of the information provided, will assist the NRC staff in locating the                              Submit information, and will aid in optimizing the time needed for the                              Proposed review process. Unless otherwise noted, allinformation should                              Change se contained in the main submittal report.

This format follows the staff's guidance identified in the Standard Review Plan Chapter 3.9.8 (Ref.17). Additional ELEMENT 4 guidance on style, composition, and specifications of safety analysis reports is provided in the introduction of Revision 3 to Regulatory Guide 1.70,

           " Standard Format and Content of Safety Analysis Reports for Nuclear Power Plants (LWR Edition)" (Ref. 22).

Table 6.1 provides an overall summary of the documentation information needed to support a risk informed ISI submittal. 6.1 Risk Informed inservice inspection Program Plan The licensee's submittal should describe the proposed RI ISI p sgram with enough detail to

      ')   be clearly understandabla. <o the reviewers of the program. The description should cover the five items listed in Chapter 3 including sufficient detail such that reviewers of the

_f program can understand how the program would be implemented. These items are: (1) @ changes to the plant's CLB, (3) changes to inspection schedules, locations, and methods, plus a description of the process used for determining these. (3) listing of affected components including an explicit description of any grouping of components, (4) identification of supporting information, and (5) brief statement regarding the way in which the proposed changes are consistent with the Commission's PRA Policy Sta'ement. The licensee's submittal should describe how its proposed RI ISI program addresses the four principle elements of risk informed decisionmaking (addressed in this document) by defining the proposed change, basing the new orogram on traditional analysis with insights from j probabilistic risk assessments, and incorporating an implementation and monitoring program that enables tha staff to conclude that the proposed RI ISI program provides "an acceptable leve' of quality and safety" required by 10 CFR 50.55ata)(3)(1). The submittal should document the administrative procedures in place to implement changes into the PRA and traditional analysis and incorporate any relevant results into the RI ISI program during and outside any periocir. Update. The submittal should be consistent with the guidelines contained throughout this regulatory guide, or provide justification for an alternative approach. The submittal should a:so include a description of the process that was used for the categorization of components (further discussed in Section 6.2.2) and for the determination 45

                                                                                                                                              )

a-- ; = x,-- _-;- - - - - - =--_a _a ; , . - = -_a-  ; . , ,_ , _ _ _ . cf when formalinteraction with the NRC is or is not needed when making changes to an approved RI ISI program (as described in Section 3.2). Exemptions from the regulations, technical specification amendments, and relief requests that are required to implement the licensee's proposed RI ISI program should also be specified and included in the application.

        '6.2-      Engineering Ant.:ysis Records and Supporting Data The licensee's submittel should describe how the proposed RI ISI program ensures that plant risk is maintained at acceptable levels. The description should cover the four items listed in Chapter 4 in sufficient detail such that reviewers can determine whether the proposed plan ensures risk is maintained at acceptable levels. Theses items are: (1) illustrate that defense in depth is maintair ed, (2) illustrate that adequate safety margins are maintained, (3) demonstrate that the proposed ISI program changes do not result in unacceptable risk to the public and plant personnel and are consistent with the guidelines identified in Draft Regulatory Guide DG 1061 (and presented in Chapter 4), and (4) support the integrated decisionmaking process, items 1 and 2 are discussed in Section 6.2.1, and item 3 is discussed in Section 6.2.2. Item 4 is discussed in Section 6.3.

6.2.1 Traditional Analysis Records and Supporting Data i Thie section should describe how the proposed RI-ISI program continues to ensure that i defense in-depth is maintained litem.1) and how the ISI program ensures that adequate safety margins are maintained (item 2). This description should include a presentation of the decision criteria used to determine whether defense in depth (see Section 4.1.1) and adequate safety margins (see Section 4.1.2) are maintained and a discussion of how the i proposed ISI program meets these criteria. 6.2.2 Probabilistic Risk Assessment Records and Supporting Data This section should describe the plant's probabilistic risk assessment in sufficient detail to allow a reviewer to ascertain whether the PRA accurately reflects the current plant configuration and operational practices, and whether the change in risk is acceptable by providing discussions on the topics identified below. 6.2.2.1 Scope l The application should clearly articulate the boundaries for the scope of piping systems, L segments, and elements to be included in the RI ISI program as follows. Piping Systems The licensee should document that the piping systems incorporated in the scope of the RI-ISI ptogram include: All C! ass 1. 2. and 3 pipes within the current ASiAE Section XI programs, and All pipas whose f ailure would compromise 46

\'

                 -       Safety related structures, systems, or components that are relied upon to remain functional during and following der,;n basis events to ensure the integrity of the reactor coolant pressure boundary, the capability to shut down the reactor and maintain it in a safe shutdown condition, and the capability to prevent or mitigate the consequences of accidents that could result in potential offsite exposure comparable to 10 CFR 100 guidelines,
                 .        Ncn safety related structures, systems, or components:
                          +       That are relied upon to mitigate accidents or transients or are used in plant emergency operating procedures; or

• Whose failure could prevent safety related structures, systems, or components from fulfilling their safety related function; or-

                          +       Whose f ailure could cause a reactor scram or actuation of a safety.

related system, in addition, the' details of the process used by the licensee to determine the final piping systems list for the RI ISI program should be included, Any systems excluded from the scope of the RI ISI program should be justified by appropriate documentation. Pipe Segments Criteria or procedures used to establish pipe segments wi'hin the piping systems should be provided. Documentation should be sufficient to 61low a ieviewer to determine whether consequences of f ailure, degradation mechanisms, and segment boundaries are properly considered for defining pipe segments in accordance with the guidance in this document.'

        ' Any deviations from the guidance in this document should be fully documented and justified.
  - -Structural Elements Piping structural elements included in the scope of the RI lSi program should be documented to confirm those pressure retaining welds, base metal areas, weld counterbore areas, nozzle welds, valves and fittings are subject to ISIin accordance with the guidelines provided in this document. Deviations from the guidelines should be documented in sufficient detail to allow NRC review, Lots if structural elements from more than one pipe segment are subsumed within one lot for the purpose of statisticalinsp3ction sampling, as described in Appendix A4, the criteria used and the justification for subsuming the welds (elements) should be documented in sufficient detail to allow NRC review and approval. For a hypothetical example, assume that four
        . segments in a piping system are identical, with respect to degradation mechanisms and 47 i

l 1 f ailure likelihood. Each segment may contain four elen:ents, it may be argued that a ! random sampling strategy be developed by which the sixteen (4

• 4) elements are i subsumed in one calculation (e.g., one lot comprising of 10 elements), versus performing

} four separate calculations for each segment (e.g., four lots, with four elements in each lot). i 6,2.2.2 Determination and Quantificotlon of Accident Sequences This section should present the methods and techniques used to identify and quantify the l accident sequences. As part of the documentation, a table should be provided that stanmarizes how the PRA model used to develop the risk insights compares with the FRA technicalissues identified in draft NUREG 1601. In addition, specific detailed information should be provided on identifying and gt. ntif ying initiating events; developing or modifying event trees; developing or modifying system models (i.e., f ault trees); identifying, modeling, and quantifying passive component f ailures (i.e., pipe segment f ailures);identif ying, morteling, and quantif ying human actions; sequence quantification; and uncertainty / sensitivity calculations as described below, initiating Events The process used to identify initiating events and the results from the process should be documented. For the process, describe how it will result in the identification of all, or the complete set of, initiating events important to the ISI analysis, including those initiating events that may result from the f ailure of ISI.affected passive component (i.e., pipe segments). For each initiatig event identified by the process, present: (1) a description of the initiating event (2) the rational for including or excluding the event (3) the event's ' frequency, and (4) e discussion of how the frequency was estimated. if individualinitiating events are collapsed into a group, describe the basis for such a grouping. Allinformation should be provided in the main report. Event Trees The process used to develop the event trees should be documented. Provide example event trees that111ustrate pictor; ally the logic structure. The description should include: (1) how the structure of the event tree was developed (i.e., what top events were included and why), (2) a description of each top event, including the success criteria for each top event, (3) and a description of each core damage sequence modeled in the event tree. System Model Fault Trees and Passive Component Failures The f ault trees used to model the systems (top events)in the event trees should be documented. in addition, the methad used to identify and incorporate passive component (pipe segment) f ailures into the analysis should be discussed, inciuding tne impact of eacn failure. For each system model. provide: (1) a graphic representation of the logic structure (i.e..

  - f ault tree), (2) a simplified piping and instrumentation diagram or a one line diagram with all pertinent (both active and passive) components identified including any dependencies, and 48

            ~
              -(3) a list or graphic representation of all dependencies associated with the system. The graphical representation of the f ault trees should be provided in an appendix.

For the passive component (pipe segment) f ailures, provide a description of : (1) the method used to identify the passive f ailures (2) how the passive component f ailures era incorporated into the analysis, (3) the direct (i.e., the system or train function lost) and ' i indirect (e.g., pipe whip, spray impingement, and flood propagation) impacts associate with

the loss of each component, (4) how the f ailure probability for the passive component was

, estimated using experience data sources, structural reliability motheds, and/or expert judgment, and (5) uncertainties associated with each f ailure probability. (NOTE The NRC's preferred approach to estimating the failure probability of a pipe is the use of accepted fracture mechanics codes and operational dets. Use of expert elicitation should be fully documented and the results submitted to the NRC for information. This enables the NRC to - monitor new degradstion mechanisms and to monitor consistency within the industry. The NRC recommends that the use of expert elicitation be performed by an industry group or professional society and the results incorporated into the fracture mechanics codes. 1his l process ensures consistency in industry wide application of RMSIprograms.) The following i information should be provided to document the estimated failure probabilities for each l component / pipe segment and structural element within the systems being eddressed: i i + Failure mechanism (s) that dominates the overall f ailure probability

                +       Flaw frequencies and size distribution used in the fracture mechanics calculations
      ~}  s
                +       Assumptions used in calculating f ailure probability for every f ailure degradation mechanism, including tne qualification of the method of analysis.
                +       Failure models) for the component (rupture, large leak, etc.) that was identified as I                        having safety consequences

• Method used to estimate each f ailure probability i

                +        Estimaiad numerical mean value of f ailure probabilities for the identified f ailure mode (s) and mechanism (s> (NOTE: Table 6.2 provides -en example summary of l                        possible methods for obtaining failure probabilities based on specified degradstion mechanisms. The staff recommends that licensees provide such a table with supporting discussions.)

i l + Estimated numerical mean value of each segment's CDF used in the categorization and in the ACDF and ALERF calculations

                +        Overall f ailure probabilities for each system and for each pipe segment corresponding to the total contribution from all sub elements making up the system or pipe g

segment being addressed

                +        Detailed discussion (for each system) of the major contributors to the structural f alture probabilitles.

49 4 a

7_. .- . l Human Actions The technique (s) used to identify and quantify human actions should be described. For  ; each action, describe: (1) how the action was identified (e.g., explicit identification of the  ! immediate response action for a spt.cific initiating event), (2) what method was used to ' estimate the failure probability associated with the action (e.g., THERP), (3) which - performance shaping (or performance influencing) f actors were or were not considered. (4) how the f actors identified in (3) were estimated, and (5) how the effects of the f actors identified in (3) were incorporated into the estimate of the action's f ailure probability. Sequence Quantification The method used to quantify the accident sequences should be described. This description should: (1) identify what sof tware package was used to quantify the accident sequences. (2) identify the truncation limit used to eliminste sequences from the analysis, and show that the truncation limit conforms to the criteria as described in DG 1001, (3) list the failure probability or unavailability value used for each basic event in the analysis, including any uncertainty associated with the event, (4) list the core damage frequency for each sequence analyzed, and (5) present the results and discuss the implications of the uncertainty and sensitivity studies, t Uncertainty / Sensitivity Calculations The data used in any uncertainty calculations (i.e., uncertainty distributions for basic events or input parameters) and any sensitivity calculations (e.g., giving additional or less credit for operator actions than that considered in the base case) should be provided consistent with the guidance provided in Draft Regulatory Guide DG 1061. How uncertainty was accounted for in the segment categorization, and what sensitivity studies were performed to ensure the robustness of the categorization should be described. 6.2.2.3 Contribution to Risk and Risk importance Measures for Pipe Segments # Total CDF ano LERF, prior to and following implementation of a RI ISI program, should be documentsd and compared against the acceptance guidelines in Draf t Regulatory Guide DG-1061 and Chapter 4 to provide assurances that pressure boundary f ailures associated with plant piping systems do not impose an undue increase in risk, Appropriate assumptions (i.e., no credit for ISI when categorizing, credit for ISI for total CDF/LERF considerations) used to obtain risk categorization Wlues for 151 should be documented, importance measures shrwid be documented and shown to be in accordance with the threshold values speciised in Appendix A2 of this document. The role of the OA program and the procedure used by an appropriate panel to further review pipe segments and piping structuralelements that may be inappropriately categodzed as low safety significant should be documented to provide assurances that the PRA strerigths andli'nitations, deterministic insights, operationalinsights, industry pipe tailure data, and evasintenance Rule insights are taken into consideration.

                                                                                                                           +

i l 50 \. - - - - - ^

                                                                                          - - ~ ~ ~ ~ ~ ~ ~

)  6.3      Integrated Decisionmaking Process Records in addition to the general documentation requirements identified in Draf t Regulatory Guide DG 1001, provide a description of each issue considered in the integrated decision making process and a discussion of how the resolution of each issue impacts the original probabilistic categotiration, information should be provided in the main report.

6.4 Development of ISI Program Describe the ISI program. The licensee's program for monitoring the performance of both HSS and LSS segments should be described. The description if the RIISI program should include: (1) the inspection frequency or frequencies associated with each category, (2) the method or methods of inspection associated with each element within a passive compnant, and (3) comparisons between existing ASME Section XIinspections and RIISI inspections. The applicant should provide adequate documentation that verifies that the degradation mechanisms, postulated f ailure modes, and configuration of piping structural elements are incorpori.ied in the definition of the inspection scope and inspection locations. Selected inspection locations are reviewed to confirm that stress concentration, geometric discontinuities, and terminal ends are included in the inspection program. In additiori, the documentation should verify that plant specific pipe cracking experience has been considered in selecting inspection locations. Sampling methods (e.g., the Assurance Level Sampling Method recommended by the Perdue Abramson method are identified in Chapter 4 and Appendix 4) used to identify elements to be inspected should be documented, justified

 )  and compared to existing Section XIlicensing basis requirements. The licensee needs to document if alternate methods are specified to ensure structuralintegrity in cases where examination methods cannot be applied due to limitations, such as inaccessibility or radiation exposure harard. The licensee should document that its RI ISI program continues to perform pressure tests and visual examinations of piping structural elements on all Class 1,2, and 3 systems in accoroance with ASME BVPC Section XI programs regardless of whether the segments contain locations that have been classified as high or low safety-significant and high and low f ailure potential.

The licensee should document that its proposad RI ISI inspection program and examination methods and acceptance guidelines currently included in the ASME BVPC Section XI program are used as guidance. Examination meth,ods and acceptance guidelines should be documented to ensure compliance with the acceptance guidelines. The procedure to evaluate pipes containing flaws that exceed the acceptable flaw standard should be documented to ensure that the techniques employed are in accordance with the acceptance guidelines. As required by the ASME Code, a record of each inspection should be maintained in which component degradation and f ailures occurred and corrective action was required. Procedures should be in place which are initiated by piping f ailures that are detected by the RI ISI program as well as by other mechanisms $.g., normal plant operations, inspections, industry experience etc.). Procedures should also exist to determine their impact on the

plant PRA, Piping specific performance data should be used to support periodic PRA and RI. ISI program updates. The submittal should also include a proposed schedule for initiating the RI lSI program pending NRC approval. 6.5 Implementation Plans and Schedule The licensee's implemntation plans should be provided including a proposed schedule for initiating the prob.utignsng NRC approval. Describe the process for determining when formal NRC review me upval are or are not necessary (Section 3.2). As discussed, once this process is approveo e, the NRC, formal NRC review and approval are only needed when the process determines that such a review is necessary, or when changes to the process are requested, in addition, document the types of information that will be submitted to the NRC for l information only, to enable the NRC to monitor operational experience by the industry, l including new degradation mechanisms. 6.6 Quality Assurance The NRC expects that the quality of the engineering analyses conducted to justify proposed CLB changes will be appropriate for the nature of the change. In this regard,it is expected that for traditional engineering analyses (e.g., deterministic engineering calculations) existing provisions for quality assurance (e.g., Appendix B to 10 CFR Part 50 for safety-related SSCs) will apply and provide the appropriate quality needed. Similarly, when a risk assessment of the plant is used to provide insights into the decisionmaking process, the NRC expects that the PRA will have been subject to quality control. To the extent that a licensee elects to use PRA information to enhance or modify activities affecting the safety related functions of SSCs, the following, in conjunction with other guidance contained in this guide, describe an acceptable way to ensure that the pertinent quality assurance requirements of Appendix B to 10 CFR Part 50 are met and that the PRA is of sufficient quality to be used for regulatory decisions:

• utilize personnel qualified for the analysis e

utilize procedures that ensure control of documentation, including revisions, and provide for independent review, validation or checking of calculations and information used in the analyses (an independent peer review can be used as an important element in this process)

    +

provide documentation and maintain records in accordance with the guidelines in Draft Regulatory Guide DG 1061. provide for an independent audit function to verify quality (an independent peer review can be used for this purpcse)

    +

Utilize procedures that ensure appropriate attention and corrective actions are taken if analyses or information used in previous decision making is determined to be in error. 52

Where performance monitoring programs are used in the implementation of proposed change to the CLB. It is expected that those programs will be implemented utilizing quality provisions commensurate with the safety significance of affected SSCs. An existin0 PRA or analyses can be utilized to support a proposed CLB change, provided it can be shown that the appropriate Quality provisions have been met. I J 53 s

Table 6.1 Documentation Summary Table ERA c.,sificehon Au ess one ed.euse,0 u. rRA modei used in u. ceicuieisons Address Ue acceptance guidehnes en Chaplet 4 of th.s document and Dieti Reguietw, cuide Do ion s.nu,o e obabase, c.ievisinens Awess u. n.ihodisi used to ceievisie o,e iedu.e p,0bei,anvii,ee nc, os e pipe ei.ni.ni An, use et .spert siicii.ison snouw be swii, documented changes in cor end LtRr Add ess the change en ioisi cDr end Lthe seguning t,w.s ihe ets progf am ve# sus the RIl$1 program isis,si.ms w.nid, sie use s,si.ms eispeci.d based on one ete p,og, ems and compare u. s,si.ms sw use Ri tsi programs. sor use ciass s .nd a pipes. piovede e schematic dieg... ed.nist,.ng ih. cte end Ri-tsi .nsp.cison iocesions and t,oeu.nc, oi .nse.cimens. segm.nietoon w.nidr eiwoiods u..d to segm.ni piping .rsi.ms cei.gorv enon w.nid, nwoiode used io catego.we gip. segm.nis end .i.menis as H1$. L$$, HFP, and LFP 6dentit, all De HSS and HFP etenwnts Doconwnt additionet pipms elements that wdl undertie 158. but ove outside the scope of this deconwnt This wds etimmete future reguietor, mismieepretation

&amphng Method                                            identity the nwthod used to conculate the nun.bes of welds to be enspected Docunwnt ow nothod used to establish .lements wroun a lot le g . use of the Assurance level or Otobal statistical sempting method as described on Appendia 4, ce oliernetsve methodi Locations of inspections                                  Provide e systent/pipuig diagram that overleve the esisteg CLB locations el enspection end ovestoy ow R6 t&llos.etion of mopection Discuss the diHerences Failure Protiebditmo                                       identd, the methods used to arrive et see teiluee peobabdities f or pipe segments Periormance Morutorme                                      Discuss the performance to,e's and correchve action p#ograms Periodic Revows                                             identd, Uw tveowenc, of performance monitonne end activstes en support of the RIl&l progtem Addiens consist 9nc, wsth ottet RI progeoms le g., Maintenance Rule, IST, loch Spect, .tc.)

QA Pepgram C= scribe ow Q A peogram used to assure proper emplem.ntation of RiISI process and categorgetion and consistene, with other RI progtems [ apert Ektstetion identet, en, use of espert elicitation used to estimate e toduve pr ob abilet, Address the teosons why en espert ekcitation was required, provide all supporting en ormation used to b, the esports. d document the conclusions. and address how the results wdl be encorporated en en endustr, date t>ese or computer code f ech weld to be inspect.d idento, 1, the NDE enethod to be used 2 the applicable gegeadation suechanism to be inspected and 3 the treeuency of u$spection Compliance with Regulations Veed, compliance with appl.cebie reguistions Datense n Depth Address any empact on defense en depth Setet, Mergens Cunterm edequale selety n.eegins enest implenwntation and Monstoring Program Adoress the Acceptance Guidelines outlined in Chapter 5 of this Reg Guide l 54

G J Table 6.2 Example Summary of Methods Used to Estimate Pipe Failure Probabilities for IWsk Categorization Failure Mechanism Methods for Estimating Probability Name of Contributing Failure Stainless Carbon Other Mechanism Factors Mode Steel Steels Materials High Cycle Thermal Striping Crack Code Name Code Name Fatigue Flow induced Vibration Initiation Failure Mechanical Vibration _ Database Growth Low Cycle Thermal Stratification Crack Code Name Code Name Fatigue Heat-up and Cool-down Initiation Failure

                                   '~'       "U

• Crack Code Name Code Name Growth Corrosion Coolant Chemistry Crack Code Name Not Cracking Crevice Corrosion initiation Applicable Failure Susceptible Material Database High Stresses Crack Code Name Not IResidual. Springing) Growth Applicable Wastage Flow Accelerated. Corrosion W all Name of Code Name of Code Failure Microbio'ogically Ind. Corr. Thinning Database Pitting and/or Wear Other Creep Dama'ge Miscellaneous Failve Failure Failure Mechanisms Thermal Aging 5 Mudes Database Database Database frrad_ EmbrittImment l 55

REFERENCES'"

1. USNRC, *Use of Probabilistic Risk Assessment Methods in Nuclear Activities: Final Policy Statement," Federal Register, Volume 60, p. 42622, August 16,1995,

2. USNRC, " Framework for Applying Probabilistic Risk Analysis in Reactor Regulation,"

SECY 95 280, November 27,1995.

3. Code of Federal Regulations, " Domestic Licensing of Production and Utillration Facilities," 10 CFR Part 50, current version.

4. American Society of Mechanical Engineers, Section XI, Rules for Inservice inspection of Nuclear Power Plant Components ASME Boiler and Pressure Vessel Code,1989 Edition, New York.

5. American Society of Mechanical Engineers.

• Evaluation of inservice inspection Requirements For Class 1, Category B J Pressure Retaining Welds in Piping," ASME Section XI Task Group on ISI Optimization, Report No. 92 01 01, Revision 0 December 1994

6. S. R. Gosselin et al., " Risk informed inservice inspection Evaluation Procedure,"

Electric Power Research Institute IEPRll, TR 106706, June 1996.

7. WCAP 14572, " Westinghouse Owners Group Application of Risk Based Methods to Piping Inservice Inspection," March 1996.

8. T.V. Vo, H.K. Phan, B.F. Gore, F.A. Simonen, S.R. Doctor, "A Pilot Application of Risk Informed Methods To Establish Inservice Inspection Priorities for Nuclear components at Surry Unit 1 Nuclear Power Station " USNRC, NUREG/CR 6181, Revision 1, February 1997.

9. USNRC, "An Approach for Using Probaoilistic Risk Assessment in Risk Informed Decisions on Plant Specific Changes to the Current Licensing Basis," Draft Regulatory Guide DG 1061. June 1997. _ _ _ _

10. USNRC, " Inservice inspection Code Case Acceptability. ASME Section XI, Division 1,"

Regulatory Guide 1.147, Revision 11 October 1994. 8 Copies of Commission policy statements. EPRI und WC AP reports ref erenced herein are eveilable for mopection or copymg tot a fee from the NRC Public Document Room at 2120 L strict NW Washington. DC: the PDR's mailing address is Mail st9 '. 6. Washmgton. De 20555; telephone (2021634 3273; tan (2021634 3343.

                , vp.es of NUREGs are avo.loisle et current rates trom the u.s. Gove#nment Pnntmg office. P.o. Bos 37082.

Washington. DC 20402 9328 Helephone (202:512 22496: or from the National Technicalinformabon service by wnting NTis et 5285 Port Royal Road, spongf end. vA 22161. Copies are eveilable for mspechon or cc.pymg for a tee from the NRC Public Document Room at 2120 L sueet NW., Westungton. DC; the PoR's mailing sodress ,o Mail stop LL 6. Washmgton. DC 2055s: telephone (2021634 3273 tas (2026634 3343. Reevests for single copies of dratt or active regulatory guides (which may be reproduced) or for placernent on en automat #c d.stnbution list tot single copies of futwe e drott guides in specihc divisions should be made m writing to the u.s. Nuclear Regulatory Commission. Washington. DC 20555 0001 Attention: Pnnting. Graphics and Distributiot Branch or by Ias to (301141s 5272. 56 l

s) 11. USNRC, " Design and Fabrication Code Case Acceptability, ASME Section ill, Division 1,* Regulatory Guide 1.84, Revision 30. October 1994.

12. - USNRC, " Materials Code Case Acceptability, ASME Section lit, Division 1,*

Regulatory Guide 1.85, Revision 30. October 1994.

13. USNRC, "An Approach for Plant Specific Risk informed Decisionmaking: Inservice Testing," Draf t Regulatory Guide DG 1062. June 1997, 14, USNRC, "An Approach for Plant Specific, Risk informed Decisionmaking: Graded Quality Assurance," Draf t Regulatory Guide DG.1064, June 1997.

15. USNRC, "An Approach for Plant Specific, Risk Informed Decisionmaking: Technical Specifications," Draf t Regulatory Guide DG 1065, June 1997,

16. USNRC, "Use of Probabilistic Risk Assessment in Plant Specific, Risk Informed Decisionmaking: General Guidance," Standard Review Plan, NUREG 0800 Draf t Chapter 19, March 1997.

17. U. S. Nuclear Regulatory Commission, " Standard Review Plan for Risk informed Decisionmaking: Inservice Inspection of Piping," Standard Review Plan, NUREG-0800, Draft Section 3.9.8, September 1997.

18. USNRC, " Risk informed Inservice Testing Applications," Standard Review Plan, NUREG 0800, Draf t Section 3.9.7, March 1997. .

19. USNRC, " Risk Informed Decisionmaking: Graded Quality Assurance ' Standard Review Plan, NUREG Draf t Section 16.1, March 1997,

20. - US'4RC,

• Risk informed Decisionmaking: Technical Specifications," Star Jard Review Plan, NUREG 0800, Draf t Chapter 16.1, March 1997.

21. USNRC, "The Use of PRA in Risk info'and Apphistions," Draf t NUREG 1602, June 1997.

22. USNRC,

• Standard Format and Content of Nafmy Analysis Reports for Nuclear Power Plants it.WR Edition)," Regulatory Guide 170 Revision 3, November 1978.

57

,, ,_ _ m , - -+g 4e a y e =5 * - W *d*6M+ -

                                                               **M'9 * * '"

               ]                               Appendix 1:                PROBABILISTIC STRUCTURAL MECHANICS COMPUTER CODES FOR ESTIMATING FAILURE PROBABILITIES A1.1 Introduction This reguletory guide does not require or endorse particular computer codes or preclude the use of siternative codes to those cited here as examples. Nevertheless, the use of validated computer codes is recommended for estimating f ailure probabilities, it is anticipated that use of validated and controlled cor,iputer codes willlead to a more efficient and timely regulatory review, in all applicaticas the computer codes and associated structural reliability and risk assessment (SCilA) models and methodology should be documented and/or referenced.

Such documents should identify the f ailure mechanisms modeled, describe the underlying analyticiengineering models, identify the parameters that are simulated as random variables, describe the input for these variables, and describe the numcrical methods (e.g., Monte i Carlo simulation) used to calculate f ailure probabilities. New computer codes should be validated by coraparison with results from other generally accepted and documented codes, including applicable data. Structural mechanics computer codes are valuable tocis for estimating f ailure probabilities of piping components. Such codes can evaluate the impacts of parameters related to

      ']                               component design, stresses, operating conditions, material characteristics. and f abrication j                       practices on failure probabilities. Predictions of these models can be usefulin estimating both absolute and relative values of structural f ailure probabilities. Structural mechanics computer codes also predict the progress of degradation (e.g., crack growth) with time, and thereby provide a basis for selecting appropriate inspection intervals. Figure A1.1 illustrates
                                                        ,fo   . , -    ,                                  ,-               .
                                                                                                        , _ _ ,_        - t g

• 12,, " . ~ ' s........,,.m j), g ' ' , N. , _

e

• NW /.s*,,s..

                                                                    ..                                      5 a .. . .

3 e A.,... gg i e 4 & 12 10 *O

                                                                                           /      M    N'      N    Uc    40 r%1 Age. Yubn Figure A      1.1 Stress Corrosion Cracking PRAISE vs FieldData A1 1

                            ~.                                                           -

- - - . - = - . . _ - _ _ _ - _ - . - . - . - -

                                                                                                           .; . 7 I

the capability of a structural mechanics computer Code. This Appendix provides the present criteria by which the NRC willjudge acceptability of codes for use in estimating failure probabilities of piping components and a detailed discussion of selected structural reliability Code issues. A1.2 Areas of Structural Reliability Code Review The areas of review of the structural mechanics computer codes include the following: '

• Addressing the f ailure mechanisms under consideration.

Addressing the structural materials and component geometries under consideration. Assuring that the structural mechanics models are based on pertinent engineering 1 principals and approximations used in the models are appropriate.

                 +        Assuring that the probabilistic aspects of the structural mechanics models address those parameters with the greatest variability and uncertainty.                                     <
                +

Assuring that the model calculates f ailure probabilities using realistic considerations, without conservative or non conservative assamptions that would inappropriately bias risk based categorizations towards particular systems, failure mechenisms or operating conditions. The numerical methods, including Monte Carlo (er appropriate? simulations and importance sampling techniques. The inputs to the codes are within the knowledge base of the experts applying the Code. , e internally assigned (hardwired) parameters and probability distributions are documented and supported by available data and knowledge base. Documentation of technical bases of the modelis available for peer review.

               +         Limitatio.is of the Code are identified and cautions provided for cases when alternative structural mechanics models and/or other estimation methods should be used.
               +

Benchmarking with structural mechanics codes considered acceptable by the NRC such as pc. PRAISE.

• Calculated failure probabilities are consistent with historical failure rate data from plant operating experiencr' The development of the computer Code, documentation, and application are consistent with quality assurance requirem".nts in Appendix B to 10 CFR Part 50.

A12

]/ The evaluation should identify limitations of the codes, and should establish the appropriate role (absolute or relative probabilities) for the calculated f ailure probabilities obtained from the codes.

A1.3 Selected Structural Reliability Code issues A 1.3.1 Loads and Stresses inputs for loada and stre.sses to SRRA models should address both conditions anticipated during the design of the systems, and unanticipated loads that have become known only through operating experience at the plant of concern or at other similar pl.*nts. SRRA evaluations should use realistic input for loads and stresses and for occurrence rates of plant transients. it should be noted that ca;ulated stress levels in piping stress reports are generally based on conservative analysis assumptions. It is appropriate in the evaluations to treat such ca!culated stresses as upper bounds on uncertainty bands for the actual operating stresses, with exputed values being lower than those cited in stress reports. The exception may be stresses due to internal pressures which are subject to less uncertainty in calculations than other stresses such as the stresses from restraint of thermal expansions. Loads and transients should be based as much as possible on actual operating experience rather than on design or bounding conditions. Loadings having low estimated probabilities of occurrence should not be neglected but should be addressed explicitly in a probabilistic manner in the evaluations. Given the computation effort of probabilistic calculations, the loading cases should be limited to those that have the largest potential contributions to component failure probabilities, insight- 4 tom engineering calculations along with bounding estimates of loading frequencies and c, litional f ailure probabilities should be used to eliminate from consideration those load cases and/or transients with little potenti.ml contribution. A1.3.2 Vibrational Stresses Uncertainties associated with high cycle f atigue strestes, such a5 Eom mechanical vibration and thermal f atigue, should be given special consideration in calculating f ailure probabilities. High cycle f atigue applies whenever the number of stres cycles is sufficiently large such that cracks grow through the pipe wall thickness within a small portion of the design life, given that the cyclic stress levels exceed the threshold AK for f atigue crack growth. The followiag f actors govern the growth of such cracks: Threshold AK In applications of the pc PRAISE Code, published data have been used to estimate appropriate inputs for AK,, for stainless steels (4.6 ksilin for an R. Ratio = 0.0) whereas AK,, = 0.0 has been assumed for ferretic steels in accordance with the ASME Sec. tion XI. . R Ratio - The structural mechanics models and inputs to these models should

 )          account for the impact of mean stresses on reducing the governing values of AK,,,.

A13 l l

l Vibrational Stress Levels Decause vibrational stresses are random in nature, the levels of these stresses are difficult to estimato in practice. Such stresses tend to be greatest for smaller pipe sizes. The guidelines developed on the pilot application of risk informed inservice inspection to the Surry.1 plant provide an acceptable basis for estimating vibrational stresses, as follows, where the cyclic stresses are given in terms of a stress amplitude (i.e., % (o.. 0 ): Pipe Diameter Upper Bound Median inch Cyclic Stress, Cyclic Stress, ksi ksi 1.0 6.0 3.0 5.0 2.5 1.25

                                     > 10.0                  1.0                   0.5 Occurrence Rate In most cases the probability that the vibration stress will occur is relatively low, and also the duration of these stresses may be limited to the time periods of intermittent operation of vibrational sources such as pumps, it is acceptable to adjust calculated failure probabilities to account for these uncertainties.

A1.3.3 Residual Stresses Residual stresses can be the major f actor in the growth of cracks by the mechanism of stress corrosion cracking, and can also enhance crack growth by f atigue by increasing the level of mean stress as characterized by the calculated R. Ratio. Guidelines developed on the pilot application of risk informed inservice inspection to the Surry 1 plant provide an acceptable basis for estimating residual stress levels. These guidelines recommend a lognormal distribution with maximum stresses distributed by two standard deviations, corresponding to 90 percent or thi naterial flow stress. These guidelines quantified the un. aies in welding residual stresses, and addressed the possibilities that residual stresses can a..un yield strength levels or can be essentially zero in other cases. Statistical distributions to describe uncertainties in residual stresses should be truncated et the material flow strength (average of yield and ultimate strengths). Levels as high as 90% of the flow strength should have relatively low probabilities corresponding, for example, to a 90* percentile of a lognormal distribution. A1.3.4 Preservice Inspection The effects of preservice inspections by such methodi as ultrasonics and radiography should be included either explicitly or implicitly in the calculation of f ailure probabilities. In most cases, suel, inspections are addressed implicitly through their elfects on the estimated number and sizes of initial f abrication flaws. In such cases, the simulation of preservice inspection in the structural mechanics modelis inappropriate since such a simulation would result in double counting of the effects of preservice inspections. A14

A1.3.5 Proof Test

 }

it is recommended that the effects of proof tests performed af ter f abrication but before plant operation be included in the probabilistic structural mechanics calculations. Simulated f ailures that occur during such proof tests should not be included in the f ailure probabilities addressed by the inservice inspection program. A1.3.6 Leak Detection in calculating pipe degradation (leaks to ruptures) probabilities, the effects of leak detection from through wall flaws should be addressed, and pipe f ailures that would be detected by observations of leakage should not be included in the calculation of leak / rupture probabilities. Leak detection can be due to explicit leak monitoring measures, or to detection of leaks by plant staff in the course of plant walkdowns or system testing. Leak rate calculations and leak detection thresholds used in the calculations of pipe f ailure probabilities should be documented and justified. The leak rate modelin (Ref.1)is an acceptable basis for predicting leak rates from through wall cracks. A1.3.7 Failure Modes (Leak Versus Break) Failure probability calculations should address the failure modes of concern to the risk-categorization process, and should include the categories of smallleaks (through wall cracks), large leaks that disable a system (labeled as a disabling leak), and pipe breaks. The leak rate for the disabling leak category should be based on the consequences

 )    considerations identified in the plant PRA and safety analyses reports.

The methodology identified in Reference 1 is an acceptable basis for predicting leakage through cracks for use in calculations of large leak probabilities and for simulating the impact of leak detection of pipe f ailure probabilities. An example of an acceptable implementation of this leak prediction methodology is currently part of the pc PRAISE Code. A1.3.8 F tvice Environment The service environments that affect both corrosion rates and crack growth rates should be addressed in the SRRA models. Such environments are of ten described in the SRRA models in terms of discrete categoriec such as air versus water or high versus low oxygen environments. The selected environments used in each SRRA calculation shoulet be documented along with the rationale for the selections. Data bases used to develop distributions of crack initiation and crack growth rates should represent the range of operating conditions expected for the structural component being addressed by the SRRA models, in those cases for which the service environment is subject to large uncertainties and variations, the SRRA models can be structured to simulate these variations, and to use the models to simulate the effects of these variations on the resulting failure probabilities. A 1.3.9 Initial Flaw Size Distributions Stresses at most pipe locations are sufficiently low such that the calculated f ailure probabilities are essentially zero, unless there is an initial f abrication flaw present at the A15

structurallocation of concern (e.g., weld). Therefore, SRRA models should simulate the number, size, and location of such fabrication flaws. These characteristics should be , estimated and should be described statistically with distributions that are appropriate for the l material, wall thicknesses, welding practices, and inspection procedures for the specific location of interest, j The documentation of the SRRA calculations should describe and justify the number and sizes of defects that were assumed. The model developed in (Ref, 2) for simulating f abrication defects is an acceptable method for estimating initial flaw densities and size (depth and length) distributions. Applications of this model to pipe welds and data from detailed examinations of actual welds, suggest flaw densities of one or more defects per weld, but with lest, than ten percent of these flaws being inner surf ace connected The flaw depth distribJtion; from this model can be approximated by a lognormal distribution with the mean flaw depth being on the order of the thickness of one weld bead. A collection of flaw distribution calculations has been performed with the modelin Reference 2 to support a pilot application of risk informed inservice inspection for the pilot plant These calculations addressed a wide range of welds, and the results provide an acceptable basis for estimating the numbers and sizes of flows in most cases of piping welds, A future report will describe details of these calculations along with trend curves that describe flaw densities and flaw depth distributions as a function of pipe wall thickness, material (stainless versus ferritic steel;, and post weld inspection (i.e., with or l without radiographic examination). The results indicated the following trends: Flaw densities are best characterized in terms of f!aws per unit length of weld rather than in terms of flaws per unit volume of weld material. This measure of flaw density can be conveniently described by curves giving flew density as a function of pipe wall thickness. Most fracture mechanics models conservatively assume that all flaws are surface breaking flaws at the pipe inner surface. Therefore, only a small fraction of the total flaw density should be included in the flaw density used in fracture mechanics calculations, in order to account forthe fact that buried defects are less likely to cause failures than surf ace breaking defects. Radiographic inspection has a significant impact on the number (density) of flaws, but relatively little impact on the size distributions of the flaws, The number (density) of flaws is similar for stainless and ferritic steels, but the probability of a very deep flaw being present is greater for welds in ferritic steel piping. For the cases of manual metal arc and tungsten inert gas welding processes, the number of flaws and the sizes of these flaws are insensitive to the particular process used to make the weld.

           +

The modelin Reference 2 addresses generalized basis for estimating the numbar and sizes of flaws in pipes, and is a method that covers a wide range A16 l

~ of pipe sizes and f abrication practices. The final selection of the number and sizes of flaws has to be documented and submitted for NRC review. A1.3.10 . Flaw initiation Operating experience tws many cases whereby flaws have initiated during service due to such mechanisms as t,trass corrosion cracking or f atigue associated with cyclic stresses (e.g., thermal fatigue). Unless service induced cracks can be justified to be negligible contributors to f ailure probabilities, the SPRA models for components should account for the potential contributions of initiated cracks to f ailure probabilities. These contributions should be added to the contributions from taltist f abrication cracks. Documentat!on of SRRA calculations should describe and justify the explicit or implicit approaches taken to address crack initiation. Various direct and indirect approaches can be used to account for crack initiation. The pc-PRAISE Code provides an approach for simulating the initiation of lGSCC cracks. SRRA models for the mechanism of f atigue, including pc PRAISE, do not yet simulate the contributions of f atigue crack initiation, although such ef fects may be approximated through inputs regarding the number and sizes of very smallinner surface defects. For example, (Ref 3) assumed each weld had one smallinner surf ace flaw with the depth described by a uniform distribution ranging f tom 0.002 to 0.010 inch. A1.3.11 Crack Growth Rates The prediction of crack growth rates by f atigue and by stress corrosion cracking is a critical step in the calculation of piping frilure probabilities, l.atge experimental efforts are required to perform crack growth tests, and to develop predictive equations that correlate data bases from laboratory tests it is recommended that probabilistic structural mechanics codes make use of recognized and accepted correlations. The correlations described in the documentation for the pc PRAISE Code provide an acceptable basis for predicting crack growth rates for stainless and ferritic steels. These equations should be applied only for the relevant materials and service conditions..Other crack growth relationships should be used to address materials and service conditions outside the scope of the equations developed for pc PRAISE. Such equations should be justified on the basis of measured crack growth rate data, the effects of mean stresses or R. Ratio (i.e., K,,,,/K,.), and should address threshold AK levels. A1.3.12 Material Property Variability Variability and uncertainties in material properties can be simulated by the SRRA models. Only those properties that have significant variability and/or for which the f ailure probabilities are particularly sensitive need to be simulated. Other properties can be treated as deterministic inputs. Typical variables that should be simulated in the probabilistic model include material strength levels, fracture toughness, and crack growth rates due to f atigue and/or stress corrosion cracking. Documentation for SRRA calculations should state which material property inputs were treated as deterministic parameters, and which parameters A17

were simulated in the probabilistic model. The bases for assigning mean values, standard deviations, and distribution functions should be documenteo. A1.3.13 Comparison with Service Experience The numerical estimates of f ailure probabilities from SRRA models should be compared with the service experience for the structural components being addressed. In most cases the predictions will give very low leak and rupture probabilities. Calculations should be compared for consistency with the plant specific experience regarding leaks and detected degradation. Since the f ailure probabilities for specific, structurallocations are almost always too small to permit meaningful comparisons,it is recommended thr , comparisons of calculations with service experience also be made for the tctal f ailure probability for all components for each system. Date on pipe rupture occurrences will seldom, if ever, be available. Therefore it is more likely that data on waks and detected material degradat 9n will provide evidence that the component designs and/or operational conditions are sufficiently severe to enhance the probability for pipe ruptures. Industry wide experience for similar materials, designs, and operating conditions shoula also be used as an additional basis to check the credibility of SRRA calculations. A1.3.14 Effects of Inservice Inspection (CDF vs importance Measure Calculations) As documented in the body of this report, one acceptable approach to RI ISI programs consists of two components. The first component is the quantification of the total CDF (or 6CDF) that results from the proposed change in the ISI program. The second component is to categorize a pipe segment as high or low safety significant. For calculating the total CDF (or ACDF) from changes to the programs, the calculated pipe failure probabilities should be consistent with the operations and procedures of the plant. That includes effects of the inservice inspection programs. However, when calculating f ailure probabilities for use in establishing ask impt tance measures to be used in component categorization scheme, the analyses should assess both the of fects of implementing inservice inspection programs (ISI) and the etf ects of no inservice inspection programs. To support the development of effective ISI programs, SRRA modeling should also be applied with the simulations of inspections to evaluate alternative inspection strategies. Two criticalinputs to such SRRA calculations are the inspection method f as characterized by a probability of detection curve), and the time interval between the inservice inspections. Inputs for detection probabilities should be relevsnt to the materials, component geometries, and degradation mechanisms for the structurallocation being addressed. inputs for detection probabilities should be documented and jtstified. A1.3.15 Cumulative Effects of Repeated / Periodic Inspections Failure of an inspection to detect a particular flaw is of ten due to physical footors such as crack tightness, crack orientation, etc. Such f actors can prevent detection regardless of i A18

'S   how many inspections are performed. Calculations of the benefit of inservice inspection should assume 1,                                    nondetection of a particular flaw in one trial will be correlated with the outcome (nondett' von) during a subsequent inspection. Overly optimistic estimates of ISI effectiveness can be predicted if the alternative assumption of independent outcomes is assumed.

A1.3.16 Review and Treatment of Uncertainties Uncertainties in modeling assumptions and inputs to calculation should be identified and quantified. Figure A1.2 identifies parameters that should be reviewer: for thel' impact on the calculated uncertainties. The use of conservative assumptions and inputs to address uncertainties should be svolded since inflated values of f ailure probabilities can give unwarranted inspection priority to components at the expense of other components that may actually have greater safety significance. Tne uncertainty distributions for the calculated f ailure probabilities should be addressed in the PRA analysis.

• F FLAW i WALL CRACK DEPTil TillCKNESS GROWTil

-., FLAW ASPECT PIPE n. FLOW RATIO RAplUS STRESS 1 h,1) + te-VLTIM ATE DEAD STRESS l'R E SSU R E t,o A n 4 I TilERM A L NUMBER GF CYCL.lc STRESS STRESS CYCLES LEVEL Figure A1.2 Example Of Major Parameters That Can influence Calculated Pipe Failure Probability A19

A1.3.17 Realistic Versus Conservative Calculations Structural reliability calculations should be based on realistic considerations rather than assumptions and inputs that ensure conservative estimates. The introduction of conservatisms on a selective and/or ronuniform basis for particular components or particular f ailure mechanisms wi!! ht"ic the undesired offect of biasing the importance categorizations. The result can be inappreenely low categorizations for some pipes that are truly more risk significant. The ute of conservative assumptions (to address uncertainties) should be part of the sensitivity studies. Results of such sensitivity studies should go through a rigorous quality assurance (OA) process or an expert panel as a potential basis for adding locations to the category of high safety significant ISIlocations. Although there may be large uncertainties in the estimated f ailure probabilities, the relative values (e.g., from location to location in a given system) are generally calculated with a higher level of confidence. However, even relative values can become increasingly uncertain, when comparisons are made from one system to another (due to different failure mechanisms, pipe sizes, materlafs/ fabrication practices, and operating environments), and for comparisons of different failure mechanisms within a given system. Sensitivity studies can be usefulin evaluating potentialimpacts on risk categorizations due to systematic blasing of estimated f ailure probabilities from one system to another. A 1.3.18 Consideration of Failure Mechanisms The failure mechanisms of most concern for reactor piping are the initiation and growth of , f atigue and/or stress corrosion cracks, and wall thinning by erosion corrosion. Each of these mechanisms will be addressed by separate structural mechanics models, either within a single computer Code or by separate computer codes. The mechanism of fatigue is a concern for both ferritic and stainless steel piping. Stress corrosion cracking is limited to stainless steel piping, whereas erosion corrosion needs to be addressed only for ferritic steels having susceptible material compositions and operating under specific flow conditions.

                                                                                                    ~

Calculations of failure probabilities are conaogent on the availability of a corn'pUter Code that addresses the dominant failure mechanism for the piping segment of concern. The first decision, before any calculations are performed, is that of the adequicy of thG selected Code to model the identified failure mechanism (s). The model mii t not only address the l relevant failure mechanisms, but the scope of the model mus cover the s'.nh material i type and grade, and the relevant operational conditions (tempmme, cherned) eir ironment, flow velocities, material heat treatment, etc.). inappropriate applications of structural mechanics model; will result in calculated f ailure probabilities of no value for rish informed purposes. Submittals should provide justification that the scope of selected computer codes addresses the components, operating conditions, and failure mechanisms of concern. Alternative methods should be used to estimate failure probabilities when there are no applicable computer codes. ' A1 10

D A1.3.19 Materials Considerations The governing failure machanisms and associated f ailure probabilities are impacted by the particular types and grades of materials used to f abricate the pipe of concern, Some material considerations, .tuch as yield and ultimate strength levels, are addressed by user provided inputs to the probabilistic calculations. Because materials related inputs are seldom known with pror.lsion, computer codes must simulate the uncertainties in these input parameters which are associated with the scatter in material properties. Probabilistic structural mechanics codes must address material parameters that are beyond the knowledge base of the expected Code users. For example, predictions of growth rates for f atigue and stress corrosion cracks are a chaitenge even to researchers working in this specialized area of fracture mechanics. Therefore, the users of SRRA codes must usually rely on the validity of def ault or hardwired values for crack mwth parameters, or use the guidance and/or examples given in documentation for the cumputer codes. Acceptable SRRA computer codes should provide technically sound and documented approaches to predict crack growth rates. Applications of crack growth relationships should not require specialized knowledge of fracture mechanics, but should permit sufficient flexibility to permit more knowledgeable users to refine predictions of fracture mechanics models. A1.3.20 Consideration of Component Geometries Probabilistic structural mechanics codes are generally based on Monte Carlo simulations, which involve repeated deterministic calculations to calculate f ailure probabilities. The large number of calculations dictates that the models be limited to relatively simple geometries, such as straight lengths of pipes with circumferential or axial cracks. Applications of the simplified models to more complex geometries involves assumptions and approximations. For example, inputs can specify stresses for simplified models to numerically approximate the level and distribution of stress from a more detailed stress calculation performed with a finite element Code outside the framework of the probabilistic model. Acceptable SRRA codes should address appropriate geometric considerations fo the f ailure mechanisms of concern. For f atigue and stress corrosion mechanisms, the models should address intert:81 surf ace circumferential cracks, with the ability to approximate the axial crack case. Erosion corrosion models should address piping f ailures associated with enhanced levels of hoop stress due to wall thinning. A1.3.21 Deterministic Structural Mechanics Models Since probabilistic models are based on the repeated application (e.g., Monte Carlo simulations) of deterministic models, the validity of predicted f ailure probabilities depends on the correctness of the undctlying deterministic model. As indicated above, deterministic models in probebilistic structural mechanics codes are generally limited to relatively simple structural geometries, with effects of more complex geometries addressed through suitable manipulations of the inputs that prescribe the levels and distributions of the stresses. A1 11

The critical features of the deterrninistic fracture mechanics models are as follows:

 +        calculation of crack tip stress intensity f actors as function of crack depth, crack length, crack orientation, applied stress level, through wall variation in stress, and residual stresses
 +

models for predicting subcritical crack growth (or wall thinning) as a function of stress intensity f actors, material properties, and operating conditions (temperature and chemical environmenti

 +

models for predicting critical crack sizes and critical depths of wall thinning that correspond to piping failure by leaks or breaks A1.3.22 Selection of Probabilistic Variables Once the deterministic structural mechanics model has been defined, it is then necessary to select those variables that will be simulated in the probabilistic calculations as opposed to those variables that will be treated as single valued deterministic parameters. Variables selected for simulation should be limited to those with the most significant uncertainty due both to lack of knowledge and/or limited base of data or due to known variability (as indicated by scatter in data). In probabilistic structural mechanics calculations a typical division between deterministic and probabilistic variables is shown in Table A1,1. Table A1.1 Determination vs Probabilistic Variables Deterministic Parameters Probabilistic Parameiers Pipe Diameter Stress Level initial Pipe Wall Material Strength Thickness Fracture Toughness Location of Fabrication Crack Growth Rates Flaws Number of Fabrication (Surf ace or Buried) Flaws Chemical Environment Sizes of Fabrication (Air, Water, Oxygen Flaws Content, etc.) (Depth and Length) Operating Temperature in many cases it will be necessary and appropriate to address certain probabilistic variables outside the framework of the structural mechanics Code. For example, the probabilities or frequencies of loading cases (e.g. pressure temperature transients for pressurized thermal shock accidents) may be the subject of ongoing detailed evaluations, Such decomposition of the f ailure probability calculations into a set of conditional failure probability cases can also facilitate sensitively calculations and the independent reviews of f ailure probability estimates. A1 12

      ,  Documentation for probabilistic structural mechanics codes should clearly state which variables are treated as deterministic parameters, and which variables are simultted in the probabilistic calculations. The documentation should also state the distribution function (s) used to describe each simulated variable, along with user defined parameters fe.g. mean, standard deviation, trurication of distribution tails, etc.) and any distribution function that has been

• hardwired" es part of the probabilistic model.

A1.3.23 Numerical Methods The accuracy and computational efficiency of computer codes are impacted by the numan:al approaches used to implement the probabilistic structural mechanics model. The most Lommonly used approach is that of a Monte Carlo simulation, since it has general applicability to complex physical phenomena involving interactions between variables and discontinuous behaviors A Monte Carlo approach is also relatively straight forward to program and does not require advanced mathematical knowledge of probabilistic and statistical methods. Resulting computer codes will be relatively robust, but may lack in the numerical efficiency desired for the calculations where very low values of failure probabilities are of interest. There are a number of acceptable numerical techniques to enhance the speed of f ailure probability calculations For example, the pc PRAISE Code (Ref,4) uses stratified sampling, and the Westinghouse structural mechanics Code (Ref, Si uses importance sampling. In both cases the more sophisticated sampling procedures are used as an enhancement to the underlying Monte Carlo simulation. Care must be exercised in applications of enhanced sampling methods to ensure that the . methods are correctly implemented and are not applied to model situations with complex probabilistic structures. For example, stratified sampling is precluded in the pc PRAISE Code for stress corrosion cracking because pc PRAISE models multiple crack initiation sites and treats crack interacticns and coalescence. In all cases, the validity of enhanced sampling methods and their implementation should be verified by comparisons of numerical results with those from conventional Monte Carlo simulations. The documentation for the computer codes should include guidance on selecting the user inputs that control sampling procedures. Complex sampling procedures should be avoided if an unreasonable level of statistical insight is required on the part of now, occasional, and inexperienced users of the Code. A1.3,24 Assignment of input Parameters The user of a probabilistic structural mechanics code has the responsibility of assigning the inputs for the calculations that address particular pipe segments. This task has as large an impact on the credibility of the f ailure probability estimates as the development of the computer Code itself, Much of the discussion in this appendix bears directly or indirectly on issues related to the inputs for the calculations. l

    )

A1 13 i

it is not the intent here to repeat or summarize guidance provided elsewhere in this Regulatory Guide. However, the following steps will further the objective of consistent values for the input parameters.

• Documentation for the Code should provide detailed guidance for assigning input parameters.
• Example calculations should be presented along with a narrative describing considerations used to arsign input paramotors and the sources of data that support the assigned numerical values.
• Developers of the codes should provide training sessions for new users of the Code, should be available for consultation, and should organize workshops to permit interactions among the Code users.
• The Code documentation should provide guidance of a more prescriptive nature for 130se input parameters (e.g. flaw size distributions, crack growth equations, fracture toughness correlations, etc.) that are either outside the expected knowledge base of the Code users or where the expected variations in judgments made by several users could result in dif fering/ inconsistent inputs.
• To further the objectives of the above bullet, a consensus process should be followed to develop the guidelines on suitable numerical values for the more dif ficult-to define irW qarameters used in the structural reliability calculations. The objective wouk ha to enhance the level of uniformity and consistency in the calculated f ailure probabilities that are used to support risk informed inspections.

A1.3,25 Supporting Data Bases Certain inputs for probabilistic calculations are outside the knowledge base of expected users of the SRRA codes. Examples of such inputs are flaw density and size distributions and material characteristics related to crack growth rates and erosion corrosion rates. An essential part of developing a Code is to make a selection of suitable inputs available to the Code user, either as a menu of

• hardwired" options or in the user documentation as recommended default values for consideration by the user.

A major part of developing a probabilistic structural mechanics Code should be the compilation of data bases for use in quantifying parameters of the model. An equally important task is the development of statistical correlations of the data into such a form that it is suitable for the computation mooels. Documentation of computer codes should describe the data and statistical correlations used to support the model along with the approaches used to derive the statistical correlations. A1.3.26 Documentation and Peer Review Probabilistic structural mechanics computer codes should be ' sented and subject to peer review prior to widespread dissemination and applicat.. i fisk informed inspection. The scope of the recommended Code documentation is address.id throughoJt this appendix, A1 14

Documentation is essential to permit peer reviews of the technicas :!h hr the structural mechanics codes, and is also essential to permit correct and appropriate applications of the Code by the user community. Part of the peer review process should be trial ca lculations by independent outside users of the codes. Such applications will result in improvt;.1 insights regarding the strengths and limitations of the computer codes and their associated documentation. A1.3.27 Identification of Code Limitations It is essential to identify limitations of structural mechanics models to avoid inappropriate applications or falso levels of confidence in calculated f ailure prebabilities, Guidance should identify altuations for which the codes are expected to give the most accurate absolute values for failure probabilities, as well as other situations for which the calculations should be used as indication of relative f ailure probabilities. The Code docume'tation should state the assumptions made in the structural mechanics models, and the expected impacts of these assumptions on the calculated f ailure probabilities. Limitations should be specifically stated regarding f ailure mechanisms addressed along with the applicable operating conditions in terms of temperatures, operating environments, material types. A1.3.28 Benchmarking with Other Computer Codes % The predictions of probabilistic structural mechanics codes should, whenever possible, be ") benchmarked against results from other computer codes that have gone through peer review and validation, such as the pc PRAISE Code. Differences in calculated f ailure probabilitles should be identified, and the reasons for any significant differences in the numerical results should be reconciled. Acceptance of a particular Code in the light of numerical differences should be technically justified, if these differences are due to improved modeling approaches or improved sources of supporting data. Advances continue to be made in the field of probabilistic structural mechanics. Therefore codes will often not be available to support benchmarking of new and improved computer ._ codes In these cases, other approaches can accomplish the benchmarking objectives as follows:

• A matrix of demonstration calculations to cover a wide range of input parameters which result in predicted f ailure probabiliti0s covering the range from very high fl.e.

approaching unity) to very low (e.g less than 10' over the design life of the component), Sensitivity calculations covering allinput parameters to demonstrate that changes to input values result in consistent changes in calculated f ailure probabilities, Selected benchmarking calculations that address consistency with operating experience in accordance with the discussion of Section A1.3.29 below. These

            - calculations should cover both normal or design conditions, and also cases of actual
.i A1 15

7 (but unanticipated) operating conditions that have resulted in component f ailures or service related deDradation. A1.3.29 Consistency with Operating Experience Failure probubilities for most structural components are very low, such that f ailures are not expected to occur over the intended operating life of individual components. Few (if any) f ailures are expected to occur even if a large population of similar components is considered. This sparsity of data on actual f ailures, provides the incentive to use probabilistic structural mect nics models as a method to estimate f ailure probabilities, in this regard, probabilistic models predict component f ailure probabilities rMing use of the better known data on the individual variables (e.g. flaw occurrence rates, flaw sizes, crack growth rates, material strengths and fracture toughness properties) that govern the component f ailure probabilities. However, there are large uncertainties regarding the assumptions and input data. Therefore, predictions from probabilistic structural mechanics models should be compared for consistency with trends from operating experience. The following approaches are recommended for establishing the consistency of model predictions with the limited amount of data regarding f ailures available from operating experience:

     +        in many cases there will be no reported f ailures corresponding to the conditions addressed by the structural reliability calculations. The calculations can be validated in the sense that the predicted f ailure probabilities are indeed very low, and are shown not to be inconsistent when no f ailures have occurred for a known population of components over a defined span of operating years.
      +       While operating experience may show no failures by the mode of pipe rupture, the data may indicate other more common occurrences of pipe leaks and/or of detected cracks. Such data should be used for consistency checks of calculated probabilities for pipe leaks and for crack growth to detectable depths. The occurrences of stress corrosion cracking and erosion corrosion at nuclear power plants have been relatively frequent, and can providt a basis for validating predictions of structural mechanics codes.

• There are documented cases where unanticipated operating conditions le g. thermal fatigue and erosion corrosion) have caused reactor pipes to become severely degraded (cracking and wall thinning) over relatively short periods of operation.

Such reports of service experience can be used to test the ability of a probabilistic structural mechanics models to predict component performance under limiting situations of severe operating conditions.

• The literature documents studies in which piping specimens have been tested under conditions of f ati0ue and stress corrosion cracking. Such data can be used to evaluate the capability of the stru;;tural mechanics models to predict the conditions that result in relatively high probabilities of f ailuro.

I A1 16

L

    ,)  A1.4 Formal Process for Validating and Updating SRRA Codes As previously stated, this regulatory guide does not require or endorse any particular SRRA cc.1puter coce. However, if such codes are used, a formal process for validating and updating the codes should be in place to ensure they represent, and continue to represent, the best engineering fracture mechanics knowledge available at the time of their use. The process will also contribute to the uniformity and consistency of estimated failure probabilities for identical or similar components as calculated by different codes and/or by different organizations, and thereby enhance the credibility of the ranking and selection methodology. While the specifics detailing the formalized process for validating and updating an SRRA code are the responsibility of those owning the code, the formalized process should contain the following general attributes.

The primary means of code validation should be by direct comparison of the code's results with applicable historical and experimental data (both generic and plan-specific) for each failure mechanism modeled in the code. Implicit in this is that such a source of historical data exists, collected, periodically updated as new information becomes available, and that mechanism 4pecific failure probabilities have been determined or can be determined from the data. A secondary means of code talidation is to compare a code's results with other codes that har already been successfully validhted. As new information becomes available, either additional f ailures for known failure s _) mechanisms, failures attributable to here to fore unknown failure mechanisms, or new calculational techniques, this information should be incorporated into the code in a timely fashion such that results from the updated code once again reflects the best current knowledge basis in the areas of fracture mechanics and numerical quantification. The code's (Mcumentation identifying the failure mechanisms modeled, describing the underlying analytic / engineering models, identifying the parameters that are i simulated as random variables, describing the input for these variables, and

        --- describing the numerical methods (e.g., Monte Carlo simulation) used to calculate failure probabilities should be updated as new information, models, or techniques are incorporated into the code.

A1 17 l

r u _. _ - . _ _ a _ _ . _. _ _ _ I A1.5 References for Appendix 1"'

1. " Evaluation and Refinement of Leak Rate Estimation Models," USNRC, NUREGICR-5128, Revision 1. June 1994

2. O.J.V. Chapman, " Simulation of Defects in Weld Construct!on," PVP Vol. 251,

                       " Reliability And Risk in Pressure Vessels and Piping," The 1993 Pressure Vessels And Piping Conference, Denver, Colorado, July 25 29, 1993 American Society of Mechanical Engineers,1993.

3. M.A. Khaleel and F.A. Simonen, "A Parametric Approach to Predicting the Effects of Fatigue on Piping Reliability," Service Experience r,1d Reliability improvement:

Nuclear, fossiland PetrochemicalPlants, ASME PVP Vol. 288, pp.117125,1994 4 D.O. Harris and D.D. Dedhia, " Theoretical and User's Manual for pc PRAISE, A Probabilistic Fracture Mechanics Computer Code for Piping Reliability Analysis," USNRC, NUREG/CR 5864. July 1992.

5. B.A. Bishop and J.H, Phillips, "Prioritizing Aged Piping for inspection Using a Simplified Probabilistic Structural Analysis Mode," ASME PVP Vo. 25. Reliability and Risk in Pressure Vessels and Piping, pp. 141-152 American Society of Mechanical Engineers,1993.

Copies of Comrmsion policy statements. EPRI and WC AP reports referenced herem are ava%ble for inspection or copying for a fee from the NRC Public Document Room at 2120 L street NW.. WasNngton. DC; the POR's mailing address is Mail stop LL 6. Washington. DC 20555: telephone (2021634 3273; f ax (2021634 3343. Copies of NUREGs are available at current rates f rom the U.s. Government Pnnting of f co. P.o. Don 37082. WeeNngton. DC 20402 9318 (telephone (2021512 2249); or from the National Technical Information Lervice 4 v wntmg NTis at 5285 Port Royal Road, spnngf: eld. VA 22161. copies are available for inspection or copymg for a fee from the NRC Public Document Room at 2120 L street NW.. Washmgton, DC; the PDR's mailing address as Mail stop LL 6. Washmgton. DC 20555; telephone (2021634 3273; fax (2021634 3343. Requests for single copies of draf t or active regulatory guides (which may be reproduced) or for placement on an automatic distribution list for smgle copies of futu'e draf t guides m specif.c devisions should be made in wntmg to the U.s.

              ..uclear Regulatory Commission. Washingtou. DC 23555 0001, Attention: Pnntmg. Graphics and Distribution Branch. or by tax to (301)415-5272.

l A1 18 '

 -}            Appendix 2:                                                 USING PRA TO EVALUATE THE CHANGE IN RISX ASSOCIATED WITH CHANGES TO AN ISI PROGRAM This section discusses the characteristics of a PRA that are t.cceptable for use in developing risk informed ISI programs. The PRA provides the basis for calculating the impact of structural f ailures on the CDF and other risk measures, and thereby provides a risk basis for establishing appropriate ISI programs. Traditional PRA approaches are generally suitable for this evaluation, with some added refinement to address the passive failures of pipes.

The general methodology for using PRA in regulatory applications is discussed in Draf t Regulatory Guide DG 1061 with reference to draft NUREG 1602 (Ref.1), which provides puidance on the minimum requirements that a PRA must satisfy to be suitable for risk-informed regulatory applications _ General PRA issues specific to the development of a risk-informed ISI program are discussed in Section 4.2. Detailed discussions on an acceptable quantitative approach are provided below.

      -The development of risk informed ISI programs consists of two major elements. The first element quantifies the_ total risk impact that result from the proposed changes to the existing design basis ISI programs. Once the total change to public risk is evaluated, compared with the acceptance guidelines (decision metrics), and found acceptable, the second element will then incorporate risk insights (e.g., by use of importance measures)in the selection of pipe locations for inspection. Since the selection of pipe locations to be inspected is required to calculate the change in total risk impact, the process, by its nature, is iterative. One acceptable approach for performing the PRA analyses to assess the impact s     of the risk informed ISI programs is shown in Figure A2.1. The procedural steps to accomplish this include:

Determine Scope - This defines the scope of piping to include in the plant PRA model.- -lSee Section 4.2.1 for guidance on this step.)

                                             ' Develop PRA Model- This defines acceptable approaches for modifying PRA models to include models for passive components and their associated leak and break probabilities. (See Section 4.2.2 through 4.2.5 for general guidance.)- More detailed discussions are provided below.

Develop Risk Impact of ISI Changes - This determines the collective impact i on risk from changes to inspection intervals, locations and methods for the plant piping. The risk calculated using the revised inspection programs is evaluated according to the decision guidelines discussed in Section 4.4 to determine if the revised inspection programs are acceptable. (See Section - 4.2.6 for generalguidance./ More detailed discussions are provided below. As noted in Draft Regulatory Guide DG-1061, one principle that must be met to demon-strate the acceptability of a risk informed submittalis a comparison of the plant's risk with the acceptance guidelines (decision metrics) contained in Draf t Regulatory Guide DG 1061. Thus, at a minimum, the licensee must perform an analysis that is capable of showing that any increase in the calculated risk is consistent with those guidelines. The licensee also has

    )

A21

an option of performing a Level 2 and a Level 3 PRA to demonstrate compliance with the decision matrix if such an analysis would prove useful to the risk informed ISI program. Changes to the ISI program are not expected to have an impact on the accident progression analysis or the performance of the containment structure. However, ISI program changes could affect failure probabilities for piping in containment systems (containment sprays, etc.) and containment bypass probabilities (f ailure of inter f acing piping). However, these can be modeled simply by assigning new f ailure probabilities to the affected piping. Thus, changes to the ISI program do not impact the performance of the Level 2 analysis except to address the failure probabilities assigned to pipes. Furthermore, the methods for parforming a Level 3 onalys!s are not affected by changes to ISI since the objective of a Level 3 analysis is to estimate the consequences of events modeled during a Level 1 and Level 2 analysis. Thus, Level 2 and Level 3 methodologies are not further discussed in this document. Those ISI related changes that impact the Level 1 PRA are discussed below. DETERMINE SCOPE

                                  . Identify SystemWiping to include
                                  . Identify Initiators to include DEVELOP PRA MODEL
                                 . Develop PRA Models for l'assive I

Components

                                 . Assess Likelihood of Passive Component Failures
      ~-

ASSESS RISK IMPACT OF ISl CilANGES

                                 . Assess Change in Risk from Collective ISI Changes
                                 . Perform Sensitivity /Uncertaints~

Studies Figure A2.1 Process for probabilis$ic analysis for risk-informed ISI. For the PRA to provide proper insights to the decisionmaking, there should be a good functional mapping between the piping associated with ISI and the PRA basic event probability quantification. Part of the basis for the acceptabiliiy of any RI ISI program is a demonstration by use of a qualified PRA that established risk rNasures are not significantly increased by the proposed extension in inspection intervals or reduction in the number of inspections for selected pipes. To establish this demonstration, it is necessary that the PRA includes models that appropriately account for the change in reliability of the components A2-2

3 as a function of inspection interval (or frequency), the number of elements inspected, and

           !  degradation mechanisms, When feasible,it is also desirable to model the offects of an enhanced inspection method. For example, enhanced inspections might be shown to improve or maintain component reliability, even if the intervalis extended or the number of inspections reduced. That is, a better inspection method might compensate for a fewer number of inspections and/or longer interval between inspections. Licensees who apply for increases in inspection interval and/or decreases in the number of inspected elements are expected to address this area,i.e., to proactively seek improvements in inspections that would compensate for the increased intervals under consideration and/or decreased number of elements inspected. Licensees are encouraged to employ enhanced inspection techniques to improve detection of degraded components. This includes both conscious efforts to improve inspections according to state of the art guidance, and, for licensees who wish to invoke credit for detecting degraded components, improvements in reliability modeling of a basic event probability as a function of the inspection programs.

As part of developing the risk linpact of an ISI change, the following steps should be performed:

             -(1)      Identify all RI ISI systems, and components.

(2) Identify all affected cut sets and RI ISI related basic events. (3) Review the method used to assess each affected basic event. Most fundamentally, the process should consider the effect of inspection strategy (interval and inspection method) on unavailability. (4) Assess the effects that the changes have on the base case CDF and LERF. Address degradation mechanisms.

   ]

j (5) (6) Address uncertainties. (7) Address NRC's defense-in depth considerations. A2.1 Modeling Passive Systems in PRA Pipe leaks and breaks are traditionally modeled as initiators in PRAs (e.g., loss of-coolaSt accidents (LOCAs), Nedwater line breaks, floods), but the f ailures are not normally modeled in detail. The PRAs focus on the system responses necessary to prevent core damage, rather than a detailed treatment of the probability of the initiator occurrin0. That is, they do not usually model individual pipe segments or the structural elements within the pipe segments. However, since the goal of risk informed ISI is to detect flaws so that f ailures are averted in those structural elements that have a significant impact on plant risk, it will be necessary to use models that are more detailed than traditional PRA models. The PRA will need to be modified so that a more detailed treatment of the probability of pipe failures and the influence of such f ailures on other systems are incorporated into the model. Acceptable approaches for addressing pipe f ailures in a PRA are summarized in this section and illustrated in the flow chart shown in Figure A2.2. A2.2 Determine Consequences of Pipe Failures i The direct and indirect effects of pipe failures need to be characterized so that the appropriate f ailure mechanisms and dependencies can be incorporated into the PRA model. One acceptable means for incorporating pipe f ailures in a PRA is to consider three types of postulated pipe f ailures:

           }

A2 3 l

 .. . _   _u_-          . . c                        - - -
                                                                        = -                     ------              -          - - - - -

l l (1) leak, (2) disabling leak, and (3) break. Each f ailure mode has a likelihood for degrading system performance through direct and/or indirect effects. For example, leaks can result in moisture intrusion through jet impinge-ment, flood, and sprays. Disabling leaks (larger break area than for leaks) can result in similar dama0es as described for leaks, in addition to an initiating event and loss of system function. Breaks can result in all of the above-mentioned damages, including damages resulting from pipe whips. For each break size. the analyst calculates a f ailure probability and consequences resulting from the postulated failure. A failure modes and effects analysis (FMEA) with system walkdowns identify the f ailures required for the PR A calcula-tions. The f ailure probability changes (decreases) as the break area increases (in most cases). Fracture mechanics computer models can be used to calculate f ailure probabilities. Acceptable methods for calcul<ng f ailure probabilities of pipes are addressed later. PE8LFORM rWE A TO DETEILMINE CONSEQUENCES OF FitlNQ F AILUkES r., r u.,i.

                                                   . u...rn ie.               ..i.3ni            wa.
                                                   .       L... .t L.. n..n.r.iy i.,                   r.., sni
                                                   . Lu. .t a.r..i., w . , s ... T on ISTABUSH PIPE SE0MENTS/ BOUNDARIES
                                        . r.,- .ir...                 . w u.a.... A.,r.. o. .....
                                           **:::.*i v                 d". . .. .. . . . ,. . ca...

o. . o. ... ,,,. . .. ,.... a. .

                                                                                                             . ..        u ..,,.i OMION 1 OPTION 2 i.. , . . , u. . . . .
                           . T ... . w                                                                     r. w.u.       ....c ,-.. r            .

u. t,..,.. . t .... T,

                                                           ,                                                u... . ru . ... . ... .

a. i r,.. rir. .a.... r <i....ini i. r ,. r.a....

Figure A2.2 Process for Modifying PRA to include Passive Components Examples of direct effects that can result from pipe f ailures include:

              +

f ailure that causes initiating events such as a LOCA or a reactor trip,

              +

failure that disables a single train or system.

              +

f ailure that disables multiple trains or systems, and

              +

failures that cause a combination of the above situations. A2 4

Table A2.1 illustrates direct consequences postulated for several pipe segments, considering possible operator actions and their impact on the consequences for the plant examined in Reference 2. Indirect effects include failures to additional equipment (including equipment in other systems) as a result of pipe whip, jet impingement, or flooding. An examination of indirect effects must also include a determination of how operator actions can be aff t.cted by improper instrument indications that could result from equipment f ailures/ malfunctions caused by a pipe failure. A FMEA is an acceptable structured approach that can be used to catalogue these possibilities. The evaluation should also consider the potential actions that plant personnel can take to recover from a pipe break event. An example FMEA, adapted from (Ref. 2), is summarized in Table A2,2. Additional sources of information regarding the effects of pipe breaks that should be considered include the plant hazard evaluations performed to meet requirements of NRC's Standard Review Plan (Ref. 3), and any internal flooding analysis that has been performed at the plant'". Table A2.1 Examples of direct consequences from pipe segment failures. Segment 10 Segment Description Postulated Consequence Postulated Consequence (without operator action) (with operator action) A_4 ECCS-0 RWST to l'- Oplit to LPSI, Loss of refueling water Loss of RWST HPSI, and Charging MOVs storage tank (RWSTI 8812A,88128 LCVs 112D,112E. V8884 and MOV 8806 ECCS1' From CV8819C and Loss of RWST*

• Loss of all RHR and HPSI

        #                                CV8818C to CV8847C ECCS 5'                  Flow from SI CV 8847A and                                      Loss of RWST                                      Loss of all RHR, HPSI and ACC CV 8956A to join to                                                                                           one accumulator CV 8948A RCS 7                   LPSI connection from Loop                                      Large LOCA with loss of                             Large LOCA with loss of A cold leg tee to CV 8948A                                      HPSI, LPSI, and ACC                                HPSI, LPSI, and ACC iniection to one cold leo                          insection to one cold leo FWS-1                   Main feedwater flow from                                        Feedline break initiator                           Feedline break initiator MOV35A to cate valve FCV510 The oni, op reto, .ciion ih. could b. t. ken would .uniin cio.ur. of Mves3s (no MPsi to nv p.th.) .nd closur. of Mves09A o, e Ho.. of two LPsi p. thel. Howev*,. giv.n th. hort t.m. .v.d bi. to t k. op., .O. .cten. followino . LoCA wh.,. LPsl i. quw.d. no
                  .....i , .ci on could b. cree.i.e with eso..no Mveaos A o, e to .. iwo irv.cuen paths. Ho..                                               . cio.ur. at MvesosA lo, ei 4o..
                     .uit in pr.v.nimo e io.. ei nwst.
              " Dunne ih. is i..m et .. ,i m..imo.. in. po.iui.i.e con.. u.nc. iw.iwui oper.t , ci n> w.. ch.no.o io a io . os awst m .e.

coni..nmen. .unma 6n en ..,i.., i,.n.i., io recneui.i.on .no th. io.. e > en. mi.ci.on .th An op.,.io, e.co ., .ci.on eouse not be i.a.n so. to km.i.e i.m. .no the e.ev. con, m e..on ..no th. .ciu.i soc.i.on et ih. b,... au..no . t oc A.

              'Section 2.2 of draf t NUREG 1602 describes the attributes of a traditional flooding analysis. The maior difference between an 151 analysis and a traditional flooding analysis is that in the ISI analysis the direct and indirect effects of each pipe segment must be considered and incorporated into the PRA model-no screening of flooding sources or propag tion paths takes flace.

A2-5 1 I l

l l l ) Table A2.2 Example FMEA (Adapted from (Ref. 4)) Pipe Segment Failure Faitre Recovery l Remarks (location and Mechanism Consequence Action pipe obel RWST to

• Concern with
• Loss of HPl
• Cross Tie to
• RWST is the crimary source Valve 1-CS 25 chloride SCC Mode Unit 2 RWST for the LPI and HPl tall locations) systems during injection
• 6 Welds
• Loss of Low
• Follow EOPs mode
• Movement of Head S1 Pump
• 2 Elbows tank during Suction seismic event (16* diameter) (at elbow
• Loss of RWST nearest to tankt A plant walkdown is required to assess the potential for indirect effects. Prior to a plant walkdown, existing documents (e.g., flooding analyses, etc.) that can provide insights into possible indirect effects should be examined. Possible sources of indirect effects can be obtained from the plant's equipment qualification program, hazards review program, and other documents that examine local ef fects of pipe breaks for the systems in the ISI program. Systems and trains affected by a break in the a.ea should be identified. The plant layout drawings, for areas not covered by the documentation review, should be examined.

Plant areas for which documentation was not clear or specific equipment not listed should be identified and resolved. One good practice for pre-walkdown preparation is to develop summary sheets that examine the effects of spray wetting, flooding, temperature, pipe whip, jet impingement, rotating machinery, and pressure boundary ejected missiles. Development of such summary sheets should take advantage of the experiences gained from the ASME's Validation and Verification pilot programs (e.g., Code Case N577 Virginia Power's Surry plant). The hazards evaluation should include the examination of the emergency safety features building, the auxiliary buildi.ng, the diesel generator building, the fuel building, the recirculating and service water pump house, the turbine building, the containment building, and the hydrogen recombiner building. The personnel performing a walkdown should include representatives from the following organizations or groups:

• PRA
• Piping
• 151
• Operations
• Engineering The following is an example of the results from a walkdown performed for the reference plant Reference 2:

1 A2-6

The walkdown of the turbine building resulted in several areas needing further consideration for the PSA modeling. The turbine building component cooling water has a small surge tank and virtually any pipe break / leak will eventually fail the system which willlead to reactor trip. The three plant air compressors are located side by side near the condensate pump discharge header. A postulated break in the header could potentially f ail all three compressors which eould cause a reactor trip. The location of the motor driven and 2 turbine driven pumps makes the system susceptible to losing all pumps due to a pipe break. Hazards evaluation concludes pipe break will not target cable trays, but should further investigate effects of losing cable tray, No additional interactions found. Train B valves located away from postulated break locations, Pipe break will only effect FWA Train A. Need to consider the CCP , interaction for inclusion in the segments analyzed. An example of a walkdown worksheet documenting the information gathered is presented in Table A2.3. A2.3 Pipe Segments One acceptable method for ; ideling a run of pipe in a PRA is to divide (segment) the pipe-run such that a failure at ac. .n the pipe segment results in the same consequences. Distinct segment boundaries .. ~,entified at branching points or size changes where a significant difference in consequence (e.g., where pipe materials change), or the break probability is expected to be markedly different due to environment or other factors. An example of a system and some of its defined pipe segments is shown in Figure A2.3. In this example, ECCS pipe segment #1 is defined as a pipe-run between check valves 1 SI-241,1-SI-235, and 1 SI-79. Failure / break of this pipe segment is postulated to result in the loss of the inventory of the refueling water storage tank (RWST) inside containment. Similarly, ECCS segments 2, and 3 are defined for the other injection points into the RCS cold legs. Another example of a pipe segment shown Wn Figure A2.3 is LHI pipe segment #1. This segment is defined as a pipe-run between check valves 1 SI-46B,1 SI-47, and 1 SI 50. Failure of this pipe segment is postulated to result in loss of RWST outside containment, resulting in the loss of allinjection and recirculation. The number of pipe segments defined for an ISI analysis will be plant-specific. For the application described in Reference 2, the total number of segments defined and the systems are shown in Table A2.4. Given that system boundaries involve system functions and may also involve interactions between different systems, the definition of these boundaries requires a careful, logical approach. Allinterfaces must be identified to ensure that there is consistency between the defined boundaries, when viewed from the systems on either side of each boundary, and that no safety functions are overlooked. A2-7

        ;__._ . _ - . . . . -                    m=m-- =                                 - - -      -
                                                                                                              ~    ~

Table A2.3 Example of walkdown worksheet, Adapted / rom Table 3.4 2 of Reference 2 INDIRECT EFFECTS WALKDOWN WORKSHEET lieml; 5 Building: ESF CubicielAtea. 011 Ocvation- 21* 6* Indirer, rf ver, nf r'anearn: Loss of Train A equipment due to any pipe break in area (aux. feedwater suction or discharge peping), including a CCP pipe. Components / Equipment in Cubicle / Area System Comp. Type Tag.No. Train Needed for Safe Support Shutdown? System? FWA Pump 3FWA'PA A Y N FWA Valve 3FWA' HV310' A Y N FWA Valve 3FWA'HV31 A' A Y N FWA Valve 3FWA

• V4' A Y N FWA Valve 3FWA' AV61 A8 A Y N FWA Valve 3FWA' AV23A3 A Y N FWA Valve 3FWA ' HV31 CB' B Y N FWA Valve 3FWA' HV31 C' .B Y N FWA Valve 3FWA' AV62B' B Y N rnmmente Cable tray numbers listed in Harards Evaluation did not match those marked on the overhead trays in the room. Additional checks needed.

f'nne h itinne Apparent discrepancy with cable tray identifiers noted. Hazard Eval. concludes pipe break will not target cable trays, but should further investigate ef fects of losing cable tray. No additionalinteractions found. Train B valves located away from postulated break locations. Pipe break will only affect FWA Train A. Need to consider the CCPinteraction for inclusion in the segments analyzed.

1. Located at f ar side of room from unisolable break

2. Near pump

3. Located at postulated break location

4. Located at f ar end of room away pump and postulated break 1

A2 8

j 1l jl i !lI)!!illlI1ll 4i!ll ! j g 9 5 r 7 '58 g . 8 a 3 3 N7* 3 2 8 em. 4 2 E- e* 2 E-w- t E 1 1 s s m 3 E 1 ,

                                                                                        %>                    N>-

e -

• m1 2 3 , t 3 m2 4 4 2

4 t e e, gt5

                                                                '   2 E-                k                       N>           t n -

A5 t 1 , pl 0 : : e eap e ip ip v v r

                                                                                                              -             3 s s c c e                                 s C c c                                 e h                                                                 E      E s                          l p
                                                                                                                    ,>-                                           m e                                                                                  t           %                                               a ts
                                                                                           -                                                                      x Q                                                                        e m

e ne t Midi AtceS oue TSHN or ( N,# h us j C". ,x n e m g 9-

                                                                                        ~

e 2 V ~ , s e A t 4 t' 2' p 9' i p

                                                                                        -  ) } _*I.. .=                                C T                         m R OS                        e p .*I.p S

gl

                                                                                                                            .          C E Tw  R t

s y l

                           >      ,                   9                                       -
                                                                                                                   =                   R S

a 6 mr >t-0 n - r oe oidI NtcaS Y ~"~ ' 5- 1 g 3 oue TSHW i '#)b Lp S P )" g 2 A l L T e o g t f N r f f g 7 4 e - u f e g i t n 8 S-

• I>l Mwp Om i F

9 1 s u 1 RAu S n FTs

                                                                                             '                                             N mjf3                                                              I\                   O
                                                                                                     ,                  -                  C
                                           ,        e 0
                                           .        o e

ip w %_ p 2 . O H ._ - L 3 3 e.; I$ S i M H ,i".II 3' O T T S W ^A ,' R t ll lll

l Table A2.4 Example list of piping segments System Number of Segments BDG (SG Blowdown) 4 CCE (CHS Cool) 2 CCI (Si Cool) with SlH CCP (CCW) 14 CHS(CVCS) 23 CNM (Condensate) with FWS DTM (Turbine Plant Drains) with MSS ECCS' 9 EGF (DG Fuell 4 FWA (Aux Feed) 15 FWS (Feedwater) 19 HVK (Control Bldg Chilled Water) 1 MSS (Main Steam) 30 OSS (Quench) 5 RCS 66  : RHS (RHR) with SIL RSS (Recirc) 11 SFC (Fuel Pool) 4 SlH (HPI) 10 SIL (LP11 13

                                                                   ~~

SWP (SW) 29 TOTAL 259

• ECCS system was created to capture piping common to several systems including SlH. OSS, and Sil.

A2.4 incorporate Pipe Segments into PRA biodel To adapt the PRA model for risk-informed ISt. the initiators will need to be refined to reflect the direct and indirect effects of pipe breaks, if such breaks introduce new initiating events. Similarly, events for pipe breaks that occur subsequent to an initiator should also be analyzed. The effects of inservice testing of standby systems should also be addressed. These refinements can be made through various approaches. One acceptable approach involves direct modeling of the pipes in the PRA fault trees (Option 1 in Figure A2.2). An acceptable alternative (used in (Ref. 4)) involves using " surrogate components" that capture the effects of the pipe f ailures (Option 2 in Figure A2.2). i A2-10

If Option 1 is used, new initiators may need to be added to the PRA mNel to reflect failures of the piping segments if such failures introduce new initiating events. If the pipe segment failure yields the same consequences as,some other initiator already included in the PRA (e.g., a large LOCA),it could be accounted for by increasing the frequency of the initiator that is already included or by directly incorporating the pipe segment into a model (i.e. f ault

     - tree) of the initiating event. The importance of the pipe segments can be separated out at the end by considering the fraction of the initiator frequency due to that particular pipe segment failure or by grouping all cutsets with a particular pipe segment basic event. If the FMEA for the pipe segment identifies effects not included in any other initiator (e.g., spray effects that fail additional systems), then a new initiating event should be incorporated into the PRA. Event trees will need to be constructed for any new initiators that are added.

Guidance for identifying initiating events and developing appropriate event trees is provided in draft NUREG 1602. When selecting Option 1, the PRA fault trees should be modified to model events corresponding to pipe segment f ailures. The segment f ailure events can be included *' as basic events in the fault trees, i.e., incorporated as additional f ailure mechanisms for the event (s) impacted by the pipe segment f ailure. When using the second option to address pipe segment failures in a PRA, the PRA is not actually modified, but instead the impact of pi, e segment f ailures is calculated by modifying the results of an existing PRA. For this approach, surrogate components are identified whose failures capture the effects of pipe segment failures. The risk corresponding to a revised ISI plan is then calculated by adjustin0 the frequencies of sequences or cut sets containing these surrogate components. Section A2.6 discusses the calculations that are __)

 ..,    performed to obtain these results.

Pipe failure frequencies will need to be determined for each pipe break initiator included in the PRA. Similarly, pipe segment f ailure probabilities will be needed for events included in the system models. These failures can reflect either f ailure probabilities (on demand) and failure rates (per hour or per year), and care must be taken to ensure that the correct units are applied. Acceptable methods for calculating failure probabilities for piping are discussed in Section A2.5. Pipe segment failure rates for normally operating systems are analogous to active component failure rates used in PRAs, where the rate is the number of observed failures divided by the number of years of operation. A failure rate is used for events such as initiating events (e.g., LOCAs and steam line breaks) and for systems that are continuously operating (i.e., not demand based, such as a pump failure to run for a desired mission time). The demand based piping failure probability is analogous to the active component failure probabilities that are used in PRAs, where the probability is the number of observed f ailures over the number of demands (such as a pump failure to start on demand). The demand-based piping failure probability is used for events in which a piping segment / system is in standby and is called upon to function given an event.

        'Some PRA codes allow the user to transf orm an existing f ault tree basic event into the original event plus some combination of other basic events (e.g. pipe segment f ailures). Use of such a Code f eature 15 an acceptable        [
   /     alternative to actual f ault tree modification.                                                                     l A211 o

   -...: 2=.      . = . = = -. .. . = = : - .. - . ;                     -
                                                                                                             ~^

l l A2.5 Piping Failure Potential The process of estimating component failure probabilities is at the heart of a quantitative risk informed ISI program. Failure probabilities and f ailure rates of pressure boundary components are required as inputs to the calculation of CDF and risk. It should be noted that quantification of failure probabilities (i.e., estimating the impact of ISI on reducing failure probabilities)is also part of developing a risk-informed ISI program. A7.5.1 Overview of Estimation Procedure Figure A2.4 shows the process for estimating failure probabilities. The steps are described d as follows: Identify locations of high failure probability and their associated f ailure , modes / mechanisms. The failure probability should be for a break size that can degrade a system from fulfilling its mission. It may be a leak that results in secondary failures, such as an electrical bus, a disabling leak, and/or a break. Review and revise the initial selections for high failure probability locations as well as the failure modes / mechanisms for these locations. This review may make use of a technical group (i.e., a panel) of individuals with specific areas of expertise in plant operations and maintenance, fracture mechanics, and PRA.

                     - Assemble the detailed data needed to estimate failure probabilities, including piping      -

design data, loadings, materials, and operating experience. Estimate failure picbabilities of criticallocation(s) for each pipe segment using historical failure rate data, structural reliability computer codes, or expert judgment elicitation if expert judgment elicitation is required, then it should be performed generically through the ASME or industry group and incorporated into the structural

reliability computer Code. (NRC should be informed of such activities.)

Estimate relative f ailure probabilities for other less criticallocations within the piping segments using the probability estimated for the criticallocation(s) as the reference value. 1

             +

Calculate the overall failure probability for each system and the combined probability for all plant systems. Review calculated failure probability estimates. This review could be performed by the ISI team or by an independent panel. Tabulate final estimates of failure probabilities for use in PRA calculations to estimate the CDF anolor risk associated with each pipe segment and/or structural element. Perform sensitivity studies to evaluate potentialimpacts of modeling and input data uncertainties in failure probability estimates on estimated failure probabilities. A212 L -

                                                                                       . Identify locations and failwc
        ;. - -                                                                                                                 modes I

Reviewlocaticostrailwe nales 1 Assemble data 1 Estimate failwe probabilities for criticallocalions 1 Estimate failwe probabilitics for other locations

                                                                                                                             - Calculate failwe probabilitics                      !

e L_...-...._ $ 1 Review probabihty estunates 1 I Final.ize probabihty I estimates  ; E m..._.... . . _ . _ _ . _ . . _y

                                                                       '-                                                     Perfonn sensitiviiv               !

i stmhes .I I Figure A2.4 General process for estimating failure

            'i                                                     probabilities.
        .J A213

l l i Detailed considerations that should guide the f ailure probability estimation process are provided below. A2.5.2 General Guldance on issueu Realistic Versus Conservative Estimates The objective of risk informed calculations is to make realistic estimates of failure probabilities rather than conservative or non conservative estimates. The introduction of conservatism on a selective and/or nonuniform basis for particular components or particular f ailure mechanisms will have the undesired ef fect of biasing the CDF or risk estimates and the inspection locations. Effects of ISI For CDF and/or risk calculations (LERF, ACDF), pipe segment failure probabilities should be estimated assuraq that ISIis performed during the plant's licensed period (e.g.,40 or 60 years). Structural nvchanics calculations should include ef fects of inservice inspections. For segment categoritation (discussed in this Chapter), no credit for ISI should be taken, in the application of historical data from operating reactor experience, it can be assumed that past ISI programs for most components have had only modest impacts (if any) Secause the selection criteria focused on locations of high stress /high fatigue usage (among other criterion) on component failure probabilities, while at the same time leading to unnecessary personnel exposure to radiation. One exception would be a situation where augmented ISI programs have been implemented (e.g., inspections for stress corrosion cracking of BWR piping, and inspections of piping for erosion corrosion for both PWRs and BWRs). . Aging Effects - The effects of aging mechanisms on failure rates should be included in estimating failure probabilities. Specific aging mechanisms known to be of concern to nuclear pressure boundary components are irradiation induced embrittlemen' for reactor pressure vessels and for vesselinternal components, and thermal aging fo; cast stainless steel. It should be noted that statistical analyses have not identified increasing f ailure rate trends, based on component failure data, as a function of component age (Ref 5) and (Ref. 6). Such trends are consistent with results of computer calculations. Structural Reliability / Risk Assessment (SRRA) models of fatigue and stress corrosion cracking for typical operating conditions have indicated that failure rates should be very low, and that aging will not increase failure rates until well beyond the design life of the components. However, aging effects should be considered for those locations at which service induced structural degradation (cracking or wall thinning) is present. Credit for Leak Detection - Leak detection ca.i provide advance warning of pipe degradation prior to break. For calculating the change in core damage frequency that results from changes to the inspection program, leak detection should be credited. However, when calculating the relative risk importance of a segment, leak detection should not be credited. The present defense in depth process includes ISI programs, operator walkarounds, leak detection systems, system tests, and pressure tests. These should not be credited in the importance measure calculations used for classifying a pipe as high- or low safety significant, l A2-14

D Failure Probability Calculation Applying the guidelines outlined above (including additional criteria addressed later in this report), the f ailure frequency is normally calculated as a cumulative f ailure probability over th0 40 or 60 year license of the plant (as justified) and divided by the number of years (40 or 60 ) to obtain the average rate of failure in any one year. This process addresses aging effects calculated by the computer Code and results in an average failure rate on a per year basis. (See Section A2.5 for additionalimplementation details.) Failures on Demand Versus Fallure Frequencies - The term "f ailure probability" refers to both demand-elated and time related probabilities Section A2,6 of this regulatory guide addresses the use of these measures of failure probability in the calculation of CDF and/or risk, and recommends methods for relating demand related probabilities to f ailure frequencies. Failures of components in standby systems will have safety consatquences only if the piping fails or is in a f ailed state during the limited time periods when the system is required to mitigate an accident or to otherwise maintain the plant in a safe condition. Failure proba-bility estimates should be apportioned to exclude pipe failures that occur and are detected during other periods, such as standby and testing modes, and are subsequently repaired. However, structuralintegrity evaluations should account for structural degradation (e.g., corrosion) th3t can develop during these non-demand periods, because such degradation can subsequently itad to failures when maximum loads are applied to the degraded components for a demand situation, ^ Evaluations of scandby systems should establish the likelihood of piping f ailures during periods of demand as opposed to failures during standby periods or during periods of operability testina for which failures will not impact plant safety. It can be assumed that structural failures during standby periods or during testing will be detected, such as by visual observation of gross leakage, and that the failed components are promptly repaired. The failure mechanisms and frequency should be compared with the calculated results. Identification of Failure Mode and Mechanism As stated above, it is important to identify the appropriate f ailure mode (leak, disabling leak, or full break) for each individual component, so that the failure mode corresponds to the consequence addressed by the probabilistic risk assessment. In most cases a pipe break is the failure mode of concern, although in some cases a pipe leak (for jet impingement) or a disabling leak (for loss of system function) can also have safety consequences. While failure modes corresponding to a pipe leak may not be of concern from the standpoint of safety consequences, such modes , would be of concern from the standpoint of plant availability, economic impacts (which are outside the scope of this regulatory guide), or public perception (safety concern), Operating experience on leaks and cracking, as well as other detectable modes of degradation, are significant to the risk-informed ISI process. Such observations are of ten associated with conditions (i.e., design and material deficiencies, f abrication errors, unanticipated stresses, aggressive environments, etc.) that could cause a pipe break at another location in the system and/or during future periods of operation. This information shculd be used for estimating pipe failure probabihties. h A215

                                                                                - -        -          -                    ~   ~~ ~

} Information on observed degradation mechanisms should also influence inputs to structural reliability calculations and used for benchmarking, such as done for the computer Code, pc-PRAISE (Figure A2.5). For example, structural reliability models predict (in eddition the pipe break probability) probabilities of leaks and significant crack growth and/or wall thinning. Uncertainties regarding inputs and modeling assumptions can be addressed by calibrating the structural reliability codes to the trends of service experience, for example, as for modeling of stress corrosion cracking with the pc PRAISE Code (Ref. 7), and (Ref. 8). 10 . - .

                                                                             ~~ ~~

a-C,,- Ti

• 105 " N

                    ,                                    ,                                  an.. . .i rmaim o
                                                  /

s' *

                    $y,                   /            8         N r
                    .E e       4        /
                                         /8*3                                o= au

a. - 10 f,g. .

                                  /

s*

                                  ,,                                                       sma ev e6m 3   . ,                        ,

t _ _: - 0 4 6 17 10, 20 24 2B 02 38 40 , Plare, ADe. Years Figure A2.5 Example Code vs. Service Experience. The estimation procedure should address each component (e.g., pipe segment) and structural element (e.g., weld), and should assign: a dominant failure mechanism (e.g., fatigue cracking at the inside surface), and a numerical value for the f ailure probability. Identification of f ailure mechanisms is a significant step. This information is an important input to the subsequent step of developing inspection strategies, since different failure mechanisms will dictate different inspection methods to detect the presence of structural degradation and damage. Common Cause Failures - Special situations that can result in CCFs should be identified as part of the failure probability estimation process. For example, extending the inspection intervals could make CCFs more important. CCFs are of concern only if the failures occur within the same time period, as for example, during the course of a given accident scenario. The method of segmentation of pipes and requiring one element be inspected in each segment that is categorized as high safety significant can reduce the likelihood for CCF by detection. l A2-16 l

Situations that could result in CCFs that occur within the same time period include:

• Piping that is not subject to routine pressure testing to verify its integrity. Such piping could experience long term degradation (corrosion / wall thinning), resulting in multiple f ailures when it is suddenly pressurized during a critical demand period of an accident scenario. ,
• Degraded piping that is subject to routine pressure testing to verify its integrity, but is subject to over pressure conditions (e.g., interfacing system LOCA or waterhammer loads) during a critical demand period of an accident scenario.
• Degraded piping subject to severe loads from external events such as a seismic event.
• Multiple pipe f ailures caused by indirect effects from pipe breaks (e.g., a broken pipe swings and impacts an adjacent pipe causing the impacted pipe to break).

Undefined Failure Mechanisms In some pipe run locations it can be difficult to identify any failure mechanism (either from plant service experience or from SRRA calculations) that etn result in other than very small failure probabilities. The arbitrary assignment of a zero failure frequency is unrealistic and could bias the ISI process by eliminating from consideration locations that have relatively high consequences of f ailure. The technical approach shoutc, include a procedure for estimating zero frequencies (i.e., approximately 10' - 10~' f ailures per year) for such locations to account for modeling limitations associated with very low values of calculated probabilities, and/or to account for uncertainties regarding unidentified

   )     failure mechanisms. The assignment of such low f ailure frequencies is consistent with an expectation that plant operation is unlikely to experience significant material degradation. A potential f ailure mechanism should also be assigned to these locations to provide a basis for developing inspection strategies.

Failure Probabilities for Other Locations - Given the number of structural elements within each pipe segment, it is not practical to perform detailed evaluations for each location (e.g., element or weld). The recommended approach is to identify the criticallocation(s) within each pipe segment which has the highest expected failure probability, and to focus the detailed evaluations on these locations, it may not always be clear without detailed evaluations which of the structurallocations within a segment has the greatest failure probability. In these cases, detailed structural mechanics evaluations should be performed for each location. Additional evaluations can also establish relative differences in f ailure probabilities within the segment, and thereby provide an improved technical basis to assign probabilities. Having estimated the range of expected failure probabilities for critical structural elements within a segment, the failure probabilities can be estimated for the other less critical locations. Typical estimates in pilot applications (Ref. 9) have assigned at least 50% (and typically 90% or more) of the overall segment f ailure probability to a critical !ocation. It is important to make f ailure probability estimates for the other structural locations to determine if a large number of small contributions from such locations contribute significantly to the overall f ailure probability of the segment.

    )

A2-17 l

i ! l l- l l  : l l Total Failure Probabilities for Systems A total f ailure probability _is calculated for each system based on the probabilities estimated for the individual segments that make up the l- systems. The total failure probability for pipe segments within a system is the sum of the individual pipe segment f ailure probabilities. These totals should be reviewed by the licensee to facilitate the review of the failure probability estimates. Such system levelinformation is more readily benchmarked with the limited data regarding pipe failures from plant specific and industry wide experience. Unreasonably large or small system level probabilities, when compared to data, should be cause to modify the inputs and/or assumptions used to

   . estimate the segment level f ailure probabilities. Total system level f ailure probabilities should also be reviewed to look for reasonable and consistent trends regarding relative contributions of particular systems and failure mechanisms to overall plant wide f ailure l    probabilities. All assumptions in the calculations should also be reviewed and revisions made as appropriate.                                                                                            >

A2.5.3 Methods for Estimating Failure Probabilities-l This regulatory guide describes three acceptable methods for estimating f ailure probabilities

  - for piping, it is recommended that these methods be used in combination. _ in typical.

applications, some aspects of all three methods will usually be used although one method may be the primary method. For example, while the primary method may be application of structural reliability computer codes, some inputs to the computer model will be based on l experts where data is lacking. Similarly, experts make use of available data, including l results from computer models. Furthermore f ailure probability estimates, from both experts and computer models, are always subject to " reality checks" by comparisons of the estimated probabilities with plant specific failure experience and industry wide historical , data on failure rates. The degree to which one relies on one method or another is predicated on the availability of experts and applicable structural reliability models. Approaches for estimating failure probabilities include: Historical Data - Studies by Bush (Ref.10)(Ref.11)(Ref.12), Jamall (Reference 5), Thomas (Ref.13), and Wright et al. (Ref.14) have estimated break probabilities for systems and components based on data from the few documented occurrences of pipe breaks along with additional knowledge of the relevant number of years of plant operation. While such data bases will not fully reflect plant specific f actors (e.g., operational conditions, service experience, materials selection, design features, etc.) neerled for an individual plant evaluation, the information can serve as useful baseline data to guide estimates. Table A2.5 lists a number of sources of failure data that can be used to guide the estimation of l _ piping f ailure probabilities. l SRRA Calculations - Structural reliability risk analysis (SRRA) computer codes use models based on probabilistic structural mechanics methods and can be applied to estimate f ailure probabilities for important components. SRRA estimates can take into account a higher level of component specific information than methods based on historical data or expert , elicitation. SRRA models can be particularly useful for estimating relative values of failure l probabilities to permit locations within a system with higher values of failure probabilities to be identified. A218 i _ m . . .

I i - Table A2.5 Sources of Failure Data Th:st can Be Used To Guide Estimation

    ~}                                          of Failure Probabilities.

est.b.ee N.r,siiv. 4.eeripii.n commeni m f.r.nea NPRDS Computerited database Contains component hardware - maintained on behalf of electric reliability. Covers esiperience on utihty industry by (NPO maintenance, mapection and repair of nuclear plant components LERs Computented database Contains informat on submitted by - maintained by NRC operating plants. Small fraction of reports deal with component / structural degradetion and f eiture. Extensive i screerung required to locate 4 information relevant to memtenance end inspection Plant recorde Maintained by indmdual plent and Usef ul inf ormation. Contains .- vendors of plant operstmg inspection memtenance, and repair esperience ' formation. Accessing this m information mvolves commitments of j time and money for visits to plants Esport Developed by NRC and national Contains f ailure probabihties and rates (Ref.15) *

;                     oficitatiott      laboratones. Provides useful             of pressure boundary components and       (Ref.16) mformation on undocumented field         structures. Contems estimates of          (Ref.17) 4                                        exponence                                important safety parameters useful f or i                                                                                 perf ormmo PR As

! NPAR Summary conclusion of NRC Describes service f ailures and (Ref.18) ' research on age. degradation of degradetion et operstmg plants pressure boundary components 1 Assessment of Utility 6ndustry prepared through identifies degradation potentially - plant life NUMARC. Each report addresses important to plant safety outonsion issues for a particular type of ) component (e.g., primary coolant

     .                                  system components)

ASME Task Special ASME. Section XI Task A comprehensive review of operstmg (Ref.19) Group on Group report. Reviews f atigue of esperience, and describes occurrences Fatigue nuclear power plant components of crackmg and makes recommendations to ASME, Section XI NRC Pipe Crack Formed by the NRC to evaluate identifies potential solutions f or (Ref. 20) the causes of unexpected cracking ohmmetmg or maligetmg reactor pipmg (Ref. 21) of reactor pipmo systems systems crackmo EPRI EPRI-sponsored study on metenal Contems inf ormation relating to (Ref, 22) degradation and environmental . labnestion processes that contnbute ! effects on components for plant to degradation, identifies flaws m LWR life extension c omponents EPRI Computer soflware developed by Widely used by utihties (Ref. 23) EPRI to predict pipmg locations suh!ect to erosion / corrosion EPRI A compdation of date on nuclear includes estimates of genene f ailure (Ref. 51 pipinO f ailures probab.hties for particular systems INEL Summary of pipe break accidents. Inf ormation miended to use m (Ref.14) l probabihstic risk assessments (Ref. 24l l Bush Review and interpretation of data Author bemos perspective of Code and (Ref. 101 on pipmg failures and service regulatory issues. (Ref.11) related cegradation (Ref. 121 l (Ref. 25) tRet 6) I l 1 , -) ( A219 i l

        .s._..___..                                                                                          - x-- -

.._..m SRRA models also predict the progress of degradation and/or crack growth as a function of time while quantitatively accounting for the impact of random loadings, such as earthquakes, These results can be useful for selecting appropriate intervals over the service life of the components for periodic ISI examination, Section A2,5.4 of this regulatory guide , provides example guidance on the application of SRRA models to the development of risk

         -informed inspection programs.

The following steps should be applied in application of SRRA models for estimating f ailure probabilities.-

          +
                  ' Select a structural reliability model(s) that addresses the materials, operating conditions, and failure mechanism (s) that apply to the structurallocation of concern Gather detailed data needed as input to the SRRA modelincluding pipe dimensions, materials and welding parameters, operating temperatures, operating pressures, cyclic loadings, chemistry / flow rates for fluids, and operating stresses for normal and upset conditions.                                                                 .

Use design basis stress analysis as a source of stress data. Use plant operating staff knowledge to address input pa ameters such as susceptibility to IGSCC, wall thinning, and thermal high cycle f atigue, Neglect effects of inservice inspections when defining inputs to the SRRA calculations which will estimate the failure probabilities to be used in the PRA. (

                  . Review finalinput data for_an appropriate SRRA, and follow guidance provided in Section A2.5.1 of this regulatory guide.

• Calculue the f ailure probabilities, Assess values for calculated f ailure probabilities for consistency with operating experience and expert judgment. Identify inconsistencies in predicted probabilities for detectable degradation, leak probabilities, and break probabilities. Benchmark SRRA calculations with operating experience and expert input.

Document SRRA calculations by providing details of input data, modeling assumptions, and resulting values of calculated f ailure probabilities.' Expert input - Elicitation of experts has gained acceptance as a means to quantify input to PRAs and risk based studies. A systematic procedure, as described by References 9,16, and (Ref 15), has been developed for conducting such elicitations to address major industry safety issues. Application of the procedure has been demonstrated in a research program that estimated f ailure probabilities for use in a pilot application of PRA methods to inservice inspection (Ref. 26) and Reference 6. (See Appendix 3.) The expert elicitation process is (as a generic .athodology) applicable to any issue where there are large uncertainties, data are lacking, or predictive models are not well validated. As such, the methodology need not be applied directly to make estimates of structural A2 20

failure probabilities, but can be applied to address needed inputs to structural mechanics models. A full scale expert judgment process as described in References 16 and 25 can be laborious and normally requires staff and expertise outside utility capabilities. Therefore,if expert judgment elicitation is required,it should be performed generally through the ASME or an industry group and incorporated into the structural reliability computer code. (#ellence and conclusions from en expert elicitellon program should be documented in a licensee's subm/ttel to the NRC.) For example, inputs for crack growth rates, loading conditions, and flaw distributions could be addressed through an elicitation process, with full documentation of the process and results. A2,5.4 Structurel Reliability Computer' Codes Structural reliability computer codes are useful tools for estimating failure probabilities of piping components. These codes make use of probabilistic structural mechanics methods to model the uncertainties and variability in such parameters as material properties, mechanical loadings, operating environment variables, and flaw distributions. Some of the ber.efits of using such codes are: . The .ubjective nature of estimating failure probabilities is decreased. The judgmental aspect of the estimation process is reriuced to a series of smaller decisions regarding some specific inputs to a structural mechanics model rather than being combined into a single judgment needed to assign a failure probability.

• A greater level of consistency and uniformity to the process of estimating f ailure probabilities is achieved. This adds credibility to the risk ranking process. Regulatory reviews of f ailure probability estimates are facilitated since the methodology and associated computa' codes need only be reviewed once thereby limiting reviews of plant specific evaluations to address only the inputs used for calculations.
• Structural mechanics models, by simulating the range of uncertainties in governing input parameters, provide an improved technical basis to conclude that particular failure mechanisms can only make relatively small contributions to failure probabilities.

         -          Structural mechanics codes model the physicalinteractions of the various factors that impact failure probabilities. As such, the calculations can give good predictions for relative numerical differences in failure probabilities from segment to segment within a given system, and thereby enhance the credibility of the categorization process (see Section A2.7).

• lt has been demonstrated that structural reliability calculations can be performed relatively ef ficiently. Therefore, the time and costs to estimate f ailure probabilities can be significantly reduced compared to alternate approaches such as with the formal conduct of an expert judgment elicitation.
• Structural reliability computer codes provide reproducible results by independent parties.

A2 21

• Knowledge gained from plant operating experience regarding observed degradation mechanisms and fritures by leak or break (or lack of such observations) should be incorporated into u structural reliability computer codes on a continuous basis.

There are limitations to structural mechanics computer codes, which must be recognized by the user:

• A structural mechanics code may not be available to address the particular failure mechanisms or materials of interest. Inappropriate application of existing codes could give misleading predictions of f ailure probabilities. Code users must be fully aware of the code's limitations and resort to other estimation mt.thods, as needed.

The new estimates should be validated, incorporated into the code, and reported to the NRC.

• There can be a lack of information to assign inputs to the computer codes. This means that expert judgment will be used in assigning input parameters to calculations rather than in a direct manner to estimate f ailure probabilities. The results of the experts should be fully documented, incorporated into the code, and reported to the NRC.
• As with any technical computer program, a false sense of confidence can be attached to calculated f ailure probabilities, since many of the physical assumptions and numerical pacemeters used in the calculations are not evident to most users. For example, most users will have little basis to evaluate the applicability and reasonable-ness of parameters associated with crack growth rate correlations and density and size distributions for flaws. A quality assurance program should be in place to ensure the proper selection of input parameters.
• There are uncertainties in the modeling of structural failure mechanisms and the quantification of the inputs to the models. Therefore, a review of the estimated failure probabilities should be performed to determine if the probabilities are consistent with plant specific and industry experience regarding expected contributions from specific systems and f ailure mechanisms.

The applicability of the available structural reliability code models should be evaluated along with the feasibility of adequately defining the needed inputs to the model on the basis of available plant specific data, in those cases where none of the proposed modeling approaches are capable of calculating credible results, other methods for estimating failure probabilities, based on historical experience and/or expert judgment, should be performed, incorporated into the code and reported to the NRC. It is recommended that calculations of f ailure probabilities with structural reliability models be performed vr5en suitable models are available to address the component of concern. A number of suitable codes based on probabilistic fracture mechanics codes have been applied in the past, such as the pc-PRAISE Code (Ref,27) and (Ref. 28). Simplified models (e.g., SRRA computer Code) have also been developed (Ref. 29) and (Ref. 30). In general, these simplified models have been built from more detailed models, such as the pc-PRAISE Code. A2-22

3 /vaendix 1 provides a detailed discussion of structural reliability codes. The following summarizes the criteria for evaluating the acceptability of computerized structural reliability codes for estimating f ailure probabilities of piping components: Addresses the f ailure mechanisms under consideration. Addresses the structural materials under consideration. Structural mechanics model based on suitable engineering principles and the approximations used in the model are appropriate. Prob 6bilistic part of the structural mechanics model addresses those parameters with the greatest variability and uncertainty.

• The inputs to the codes must be within the knowledge base of the experts applying the code.

Internally assigned parameters and probability distributions are documented and supported by available data and knowledge base. Documentation of technical basis of modelis available for peer review. Limitations of code are identified and cautions provided for cases when alternative structural mechanics models and/or estimation methods should be utilized. Benchmarked with codes considered acceptable by the NRC such as pc-PRAISE.

• Benchmarked with applicable data and operating reactor experience, b

The development of the computer code, documentation and application was conducted in accordance with approved quality assurance procedures. A2.5.5 - Screening and Sensitivity Studies for the Purpose of Categorizing Pipe Segments Screening and sensitivity studies should be performed to eliminate pipe segments from further consideration and evaluate the change in the calculated failure probability estimetes and their potentialimpacts on the pipe segment prioritization or categorization process. Uncertcinty in the calculated piping segment failure probabilities will contribute to uncertainties in the calculated CDF and LERF. Thus, while performing the sensitivity calculations identified in (Ref. 2) are necessary, additional calculations should focus on those aspects of estimating pipe segment failure probabilities and other PRA related activities which could significantly affect the categorization of pipe segments, thareby impacting the estimate of a plant's CDF anci risk. Particular emphasis should be placed on i identifying and understanding the screening and sensitivity studies that would move a segment from a lower risk category to a higher risk category and vice versa. j The objective of the screening and sensitivity calculations is to remove from consideration pipe segments to be included in the list of high safety significant segments. The following calculations can provide usefulinsights on how pipe segment categorization can be affected A2 23

 .__ ...__.._._.-_.--._.---.r-                                     --       ' - - - ' - ~ ~-                   ~-

1 l by changes in a pipe segment's estimated failure probability. Other screening calculations should be considered as appropriate. In some cases the calculated failure probabilities for pipe segments will be, for all practical purposes, zero (incredible events), in such cases, a small probability will be assigned to account for unknown / undefined f ailure mechanisms. This is done to ensure that a pipe segment is accounted for in the PRA and categorization calculations. In the Westinghouse Owners Group study (Ref. 2), this minimum (bounding in the sense that no degradation mechanism can be identified) probability for pipe segments was taken to be a cumulative probability of 10* for a pipe rupture over the 40-year design life of the plant. Screening calculation should be performed to address the issue of truncation limit affects on categorization by assigning an even lower f ailure probability. This lower probability can be based either on the actual calculated probability (assuming that the numerical approximations gave a non zero number), or on an assigned probability with a lower value (say by factor of 100 lower). If tlie results confirm a low risk from these segments, categorize as low.

• Because estimated probabilities for certain failure mechanisms could be systematically high or low, a number of screening calculations addressing systematic biases in estimating pipe segment f ailure probabilities should be performed. To perform these calculations, the failure probabilities should be increased by a f actor of 100 for all affected pipe segments, and the probabilistic model could be recalculated to eliminate the problem of truncation owing to the increased f ailure probability, The following areas of concern have been identified:

                                                                                                                  \

• Segments for which erosion corrosion is the f ailure mechanism of concare.
• Segments consisting of small pipe sizes.
• Segments containing ferritic steel, and
• Segments exposed to a common set of environmental conditions.

If stilllow risk, categorize low. Estimates of leak probabilities (through wall cracks) can be made with higher level of confidence than the corresponding estimates of pipe break probabilities. Probabilistic structural mechanics codes calculate both leak and break probabilities. Therefore a sensitivity calculation should be performed that replaces all disabling leak and break probabilities for each pipe segment with the leak probability for the segment. In addition, leak probabilities could be selectively used for segments governed by degradation mert..:sms that tend to promote the development of leaks (e.g., intergranular stress corrosion cracking). If still low, categorize low. Because operator actions can be important in mitigating the effects of a pipe break, sensitivity calculations should be performed that remove credit for all operator actions incorporated into the PRA in response to specific pipe segment f ailures (e.g., operator terminates inventory loss from the reactor water storage tankl. Addition-ally, a sensitivity study should be performed that increases the failure probability by a factor of 10 of all operator actions to account for the possible additional stress associated with responding to a pipe f ailure. If stilllow, categorize low. A2-24

)   '

If the initial pipe segment f ailure probabilities were calculated assuming no credit for ISI programs, then a sensitivity study should be preformed where credit is taken for these programs, if low risk, categorize low, The effects of the above screening and sensitivity studies 3hould be integrated in the decision making process for categorizing segments as high or low safety significant. A2.6 Risk Impact from Proposed Changes to the ISI Program Applying a PRA model developed in accordance with the guidelines outlined in t. is chapter, the risk impact of the proposed changes in the ISI program can be evaluated. The acceptability of the change in risk due to the change in the ISI program is addressed in Section 4.4. To aid in that assessment, uncertainty and sensitivity analyses will be needed. General guidelines for these analyses are provided in Draf t Regulatory Guide DG 1061 and draft NUREG-1602. ISI specific uncertainty and sensitivity analysis guidelines are addressed in the following sections of this document. When using the first approach (Option 1 Figure A2.2) for incorporating pipe segment failures into the PRA (i.e., incorporating basic events represenung phe segment f ailures into the f ault trees), the risk corresponding to a revised ISI plan is cal ' , ad by simply requentifying the PRA using g,;pe segment f ailure probabilities / frequencies appropriate to the revised ISI plan. For the second approach (Option 2), using surrogate components, the risk is calculated by adjusting the base PRA results to reflect the new initistors and events that

 ,. simulate the consequences of a postulated pipe f ailure. This Option 2 process is outlined in Figure A2.6. The calculations and the equations required by this approach are described

. . later in the section (Ref. 2). In order to evaluate the risk impact from proposed changes to the 151 program, one first uses the Option 2 approach with the pipe f ailure rates calculated with credit for the current ISI program, and then with the proposed changes to the ISI program. The risk impact is the

      - difference between the sum of the piping f ailure contributions to the core damage frequencies as calculated with the two different ISI programs. Realistically one should consider, when considering the risk impact from proposed changes to the ISI program, the appropriate operator recovery actions for isolating the pipe breaks, with the appropriate human error probabilities.

The equations used in the Option 2 approach can also be used to find the contribution to the core damage frequency from each piping segment for prioritization or risk categorization purposes. For this case, the pipe f ailure rates without the inspections one is considering eliminating should be used, but other inspections can be included. The following discussion provides additional clarification on this subject. Estimation of Failure Probabilities for Risk Categorizations When using fracture mechanics codes to estimate f ailure probebinties, the following conditions are used for risk categorization calculations: A2 25

.        For piping segments that are included in augmented programs (such as erosion-corrosion and stress corrosion cracking programs), the calculated f ailure probabilities with ISI but without leak detection are used,

• For other piping segments, the f ailure probability without ISI and without leak detection are used.

Basis for Not Crediting Leak Detection and Operator Walkarounds la Risk Categorization Most fracture mechanics codes can calculate a f ailure probability which credits leak detection at the defined leak rate entered as an input to the model. This leak detection assumes immediate detection of the leak and subsequent repair / shutdown. In addition, operator walkaround can also be credited to identify leakage. However, the purpose of RI ISI programs is to identify degradation prior to leakage and/or rupture. Therefore, taking credit for these f actors would mask important piping segments that should require non destructive examination (NDE) inspection to identify the degradation prior to f ailure. Leak detection systems and operator walkarounds are recognized as additional mechanisms that ensure defense in depth in maintaining the pressure boundary prior to piping f ailures that lead to initiating events or mitigating system f ailures. Yes I D . rip. ar..t c.. o.h .. i. awn.s .v..i'

                                                                               %                                                 Use Initiating Event Eqn. A21 CDFisme FR,,w,

• CCDPu.,4

                                  ) ( No                                                           y,,

u... rip. a,..k Afini 0.h himg.u.g sy.t..? Use Mitigating System Eqn. A2-2

                                                                                 ~

CD F,, = FP,,

• CCD F,,

1 (No y , ,- n... Pig...s c.... +

                                    .u. .. . 4 at aus..u.~~~ h IE/Mi4:tig Smem Ew G3
                                                ~

CDF,, = FR,, a CCDP ,w.. 3 (No e.. . . s ..io nyA..v.ai. n.i.r....c.r. D.m.ge Fr.q.e.ry 4l Special Cases Figure A2.6 Core Damage Frequency Calculation Process (Adapted from Figure 3.6 2 of Reference 7,2). 1 A2-26

] CDr Calculations for Surrocate Component Approach initiatina Events: For a pipe whose f ailure is an initiating event, the portion of the PRA model that is impacted is the initiating event and its fre.luency: CDFa.ug = FR,g.ug

• CCDPg ug (EON. A21) whero C DFa,,,g = CDF from initiating event associated with f ailures of pipe segrnent I (events per year)

F R,,,,g = pipe segment I f ailure rate (events per year) that results in the initiating event, assuming the appropriate 151 for the given case: for risk prioritiration, as discussed above in the paragraph entitled " Estimation of Failure Probability for Risk Categorizations"; for the current ISI program, the failure ratos with the current ISl; and for the revised ISI case, the f ailure rates with the revised ISI program. CCDPg,ug = Conditional core damage probability for the initis;or for pipe segment I (determined f om the accident sequences and associated minimum cut sets given the pipe f ailure as the initiating event,) FRc.ug , the pipe segment f ailure frequency (in events per year), is normally calculated T using an appropriate SRRA computer Code, such as PRAISE, or other applicable codes, for 1 the appropriate ISI case. However, the SRRA codes typically provice cumulative f ailure probabilities ov6r a specified time interval (40 or 60 years for this application). To obtain the f ailure rate, one only needs to divide the cumulative f ailure probability by the number of years the plant ic licensed: FRg,,,g = FPg.ug / EOL where FPg,ug = pipe segment f ailure probability that results in the initiating event for the appropriate ISI case EOL = number of years the plant is licensed (e.g.,40 years, if remaining years of plant license is <40 years, such as 20 years, then 20 years may be used as long as it accounts for aging / degradation effects over the 40 years of plant operation) . The conditional core damage probebility is determined from existing PRA results or from

  - solving the PRA model-if necessary tc ir.!nimlre truncation problems (see draft NUREG-1602).

Mitigating _ System (s) Consequence: For pipe f ailures that cause only mitigating system (s) degradation or loss. the core damage frequency for the pipe segment is determined by the following equation: A2 27

CDFm = FP

• CCDF. (EON, A2 2) where CDF, = CDF from a pipe failure (events / year)

FPm = Pipe break failure probability h mensionless), for the appropriate ISI case CCDFn = Core damage frequency (CDF),in events / year, given that the segment is f ailed (PB = 1), mmus the CDF, given that the segment is not failed (PB=0h CCDF, = CDFm., CDFm., When calculating the pipe failure prob 6bility, FP , the contribution of inservice testing of pumps should be addressed. An exposure time should be evaluated for a pipe segment and incorporated into the analysis. Exposure time is defined as the down time for the failed systems / trains, or the time the systems / trains would be unavailable before the plant is shutdown,11is a function of the test interval, the detection time, and allowed outage time (AOTL Two types of pipe f ailures may be distinguished, for which tests of active components'may be usefulin their detection, in the first type of failure, the pipe fails while the system is in standby, but the pipe failure is not detected until the next test, in the second type of pipe failure, the pipe degrades to the point where, on the next demand, either true demand or test demand, the pipe fails. In this second case one can call the pipe degradation occurring between tests a "letent" f ailure. The pipe does not f ail until the stresses caused by the test or true demand occurs. in addition, pipe failures mty be detected immediately in certain cases, and not require a test to reveal the failure. Examples are normally operating systems, such as the charging pump system. The key attributes in determining the exposure time are the system states when the pipe f ailure is expected to occur (standby, test, or teat demand), and the time required for the break detection (means available to detect diversion of the flow) (Ref. 31). The failure may be detected by different types of tests, ar.d this should be taken into consideration. For example, some piping f ailures will be detected by monthly or quarterly pump surveillance tests; others will be detected only by full flow system tects occurring during refueling. The exposure time, when multiplied by the pipe failure rate, gives the probability that an accident sequence initiating event, occurring at a random time, will occur with the pipe failed, or in a latent failure condition, so that it will fail on demand. There is a second contribution to the increase in core damage frequency caused by a pipe break. Here, an initiating event occurs, and then the pipe break occurs during the mission time for the-mitigating system (say,24 hoursl. The probability of the pine break here is the product of an operating system pipe failure rate times the mission time. The pipe break failure rate

                   .when the system is operating may be ditferent than the pipe break failure rate when the system is in standby.

Two cases are distinguished, in the first case the system is normally in standby, and detection occurs during a test of an active component in the system. In the second case, the system is normally operating; detection is assurned to be immediate. A2 28

p+ . Pisine Failures in Standby Systems Here, one obtains CDF,, = (FP,, / EOL)

• Tax,om ' CCDF.

where I FP,, is the cumulative f ailure probability over the number of years the plant is licensed to operate for the appropriate (St case. EOL is the number of years the plant is licensed to operate (e.g.,40 years) Tg ,om = 0. 5

• T,,,n,,,,,,,, + O T 1 The term OT (outage time) here may refer to the Allowed Outage Time (AOT), if the plant would, for the particular piping failure be maintained at power for the allowed outage time, but this term may also be the mean repair time for the piping segment, if the pipe is repaired in less than the AOT, or it may be only the time necessary for a controlled shutdown,if this is what would be done for the particular piping f ailure. The contribution I of the pipe failure during the system mission time, af ter an initiating event has occurred, is ,

e,omhted. Because the mission time is short compared to the test interval, this term will a small cgfribution.

  -         To calculate the CCDF,,, a surrogate component (basic event or set of basic events, such as a pump or valve) that is already modeled in the plant Pl% is identified in which the                                                                                           ,

consequence tNWqpect on the CDF matches the postulated cons $quence for the piping failure. The surrogate component is assumed to f all with a f ailure probability of 1.0 and the PRA modelis solved to obtain a new total plant core damage frequency. This is the conditional plant core damage frequency, given that the pipe is f ailed, denoted by CDF..,. One also needs the plant core damage frequency, given the pipe is not f ailed, denoted by CDF,.... However, since the piping component was not modeled in the PRA (very likely), this is just the base case PRA, so that CDF,,,, = CDF.. . In any event, even if the pipe f ailure probability is in the base case PRA, its contribution is pkely_very small, and the CDF obtained is litt6 ; 'ent than the CDF with the pipe assumed not to f ail. Therefore, i Cd D F,, = C D F,,, , . C D F,,,, Alternatively, one can calculate CCDF,, by isolating the cutsets associated with the pipe segment, and quantifying them (with the condition that the pipe segment f ailure probability equals unity). The second method, the method of isolating the cutsets, permits one to perform an uncertainty analysis directly, if, instead, one calculates CCDF,, as CDF,,,, CDF,,,,, then, in performing an uncertainty aaelysis, one must take into account the correlations between CDF,,,, and CDF,,,,, arising from f act that the same basic events occur in both calculations, and, although there may be uncertainty in the values of the f ailure probabilities for these events, the uncertainty distributions are completely correlated; for example, even though the failure probability of a high pressure injection pump may be uncertain,it has

    }

A2 29 6 i

l exactly the same f ailure probability in both cases. The correlations can be taken into account by performing correlated Monte Cstlo calculations. i Systems Continuously Operatina: O For systems that are continuously operating before an initiating event occurs and are j required to respond to the initiating event, the unavailability calculation may be calculated ., as: FPm = FR * (T.+ OT) }J l i Where: >

                                                                                                                 ,    1 FPm is the f ailure probability for the appropaw ISI ca&                                              f FRa ls the f ailure rate (in events per unit time)

T.,,is the total defined mission time (e.g., 24 hours) OT, the outage time,is defined as for standby systems From the fracture mechanics computer calculations, the f ailure rate (in hours)is estimated y by: 4 FRm = FP a / (EOL years

• 8760 hrs / year) i

                                                                                                               ]

This equation can also be applied to piping segments that are continuously under constant static pressure and are attached to storage tanks. Thus, the f ailure is identified by alarms and the segment unavailability is imrnediately recognized, thereby eliminating the need to g consider detection time; the exposure time consists only of OT, the time between detection ' and repair or shutdown. j The distinguishing characteristic of continuously operating systems is the immediate detection of the pipe break. Also, since the system is continuously operating, it is T legitimate to identify the operating f ailure rate as the pipe f ailure probability at the end of lifetime, divided by the plant lifetime. For standby systems, which spend most their time in 9, standby, and not operation,it may not be possible to do this. For such systems, as was -[ done above, the standby f ailure rate is the f ailure probability at the end of life, divided by q the plant lifetime, and it would be more dif ficult to estimate the operating f ailure rate, w However, as mentioned above, the term involving the contribution of the pipe f ailure during j the system mission time is, for a standby system, small, and the difficulty in estimating the 1 operating f ailure rate for such a system does not introduce any real difficulty in estimating 3 the contribution to the core damage frequency of a pipe break in a standby system.

                               .c                                                                                       s initiatino Event and Mitigating S_ystem Degradation Consequence:

For piping f ailures that cause an initiating event and mitigating system degradation or loss, core damage sequences involving both events simultaneously must be evaluated. To evaluate this case, the event treo for the initiator which is impacted by the piping segment f ailure is toquantified with the surrogate component for the mitigating system assumed to be f ailed (that is, with a f ailure probability of unity). For piping f ailures that cause an initiating event and system degradation, the following equation is used:

                                                                                                                         .I A2 30                                                                 'I

       - -. . . . ,       .,   ...           . . _ . . . , . _ . . . - - . . . . . _ . . . . . _ .       - - _m       - - = - = = - - . - - - - -

1

     )                              CDF, = F R.

• C C D Pg 3, , ,, (EON. A2 3) where

, CDF. = Core damage frequency from a pipe f ailure (events per year) N% = Pipe f ailure rate (events per yearl CCDP.. ., = Conditional core damage probability for the initiator with mitigating system component assumed to be f ailed The conditional core damage probability for the initiator is determined by the following equation: CCDPa... ,= CDFg.,,,,,, / FREOg where C D F(,,, , , , = CDF from the initiating event with segment f ailed FREO, = Initiating event frequency Mecall that the f ailure probability calculated with an approved fracture mechanics Code is cumulative for the licensed period of the plan, and that the f ailure rate, for the appropriate  ; ISI case,is therefore calculated as: FR I+ FPn/EOL

                    $pecial Casest                                                                                                                 ;

When applying surrogate component methodology, cases may arise where not all of the pipe break locations fit into the three categories described above and on Figure A2.7. Each ' pipe segment is analyzed separately to determine the best calculational method. Some pipe locations may f allinto several of these categories depending on the circumstances. For example, a f ailure in the piping segment 'n the charging system is postulated to result in a reactor trip and subsequent loss of RWST. This segment has two separate cases considered that are then added together to obtain the total core damage frequency for the segment. First, the segment is modeled as a reactor trip and loss of RWST using equation A2 3; then the segment is modeled as a loss of RWST for the remaining initiating events using equation A2 2. Total Pressure Boundary CDF Each piping segment within the scope of the program is evaluated to determine its CDF due ( to piping f ailure. Once this is computed, the total pressure boundary CDF is calculated by summing across each individual segment. This provides the baseline from which to determine the risk importance measures of the segments that can then be used to categorize the segments within ISlissue. The total pressure boundary CDF provides a measure of the risk associated with the ISI program. The difference between the CDP (.alculated using the existing licensing basis program and the RI ISI program describes a

         )

A2 31

_3 i measure of the change in risk. For consistency, the base PRA should include the realistic pipe f ailure rates established for the RI ISI pipe segments. A2.7 Selection of Locations To Be inspected This section provides guidelines and describes OWNER an acceptable approach for selecting pipe EN"' swum E3N$7 u [gynT Tiua l segments and structural elements (e.g., wulds) i sggN tocArioN for inspection in accordance with the risk-informed inservice inspection programs. The outy sysitu tautNT selection of locations should be based on the Q@','jRE {RISSU ETLST NI N following considerations: stoMLNT tumxr stucTiow ExAurNATioN M cCtss

• The selected group of pipe segments and structural elements identified in the ISI tow sArtTV man.sArrry programs should continue to meet the N ANT wi j8fgg8[.7 llfo gcpT intent of all existing deterministic '

requirements for structuralintegrity, such as defined by 10 CFR 50.55a, Appendix ELEM ENT 2 (Continued) A to 10 CFR Part 50, and the ASME ' Pressure & Vessel Code, Section XI.

• The proposed inspection program, including the set of selected ISIlocations, should meet the probabilistic criteria as described in Section 4.4.

To meet the intent of existing requirements, the program should identify a set of inspection locations for which:

• Failures will have greatest potentialimpact on safety, and
• There is a greater likelihood of detectable degradation and consequently a greater 7 potential for identifying piping degradation prior to f ailure.

Section A2.7.1 describes one acceptable method fit classifying pipe segments. Section A2.7.2 describes guidelines for categorizing structural elements within pipe segments based on the likelihood for failure and safety classification associated with each pipe segment. Section A2.7.3 discusses one acceptable strategy for inspections based on performance measures. A2.7.1 Methods of Selocting Pipe Segments for inspection To maintain consistency with the intent of current regulatory criteria for inservice inspection programs, the selected pipe locations for inspection should address:

• Locations where failures would have greatest potentialimpacts on safety, and

     +

Locations where detectable degradation and consequently potential pipinDf ailures are more likely to occur first. A2 32 l

l N For some segments, welds in certain locations are known to be more vulnerable to developing flaws or increasing the flaw size than other welds, if some welds are known to be more vulnerable than others, the welds with the higher conditional probability or frequency for a flaw growing to a leak should be sampled first (e.g., in a straight run of pipe, the degradation and fluid conditions may be similar for all elements, or welds. However, structural mechanics analyses may be able to identify a subset of the elements as exhibiting relatively greater stresses and potentially greater (though still minimal) likelihood for identifying degradation when compared to all the elements in the segment). While this procedure is biased compared with random sampling.Tt1s biased in a conservative direction, provided only that the average flaw probability of the welds In the sample is larger than the z average flaw probability of all the welds in the segment if there are some welds which are never sampled because they are inaccessible, the bias that is introduced by this constraint can still be conservative, provided that the average flaw probability condition stated above still holds. Risk importance and Categorization This section identifies an acceptable approach to incorporate risk insights for selecting inspection locations. Quantitative calculations of risk contributions, as identified in previous sections, are used to demonstrate that the risk contribution criterion is satisfied. To augment engineering calculations and engineering judgment traditionally used by licensees to select pipes for inspection, this section identifies one acceptable approach to incorporate quantitative risk insights in categorizing pipes in terms of f ailure potential and safety significafice. These guidelines are based on quantitative information from PRAs and calculated failure probabilities for pipes. The calculations provide the input needed to apply

   }   risk importance measures, which provide a means for categorizing pipe segments and structural elements in terms of their associated risk to the public. This regulatory guide does not imply that licensees can only base the selection process on calculated risk importance, although the use of such measures can f acilitate the selection of an optimum set of ISIlocations commensurate with risk.

For ISI prioritization or categorizing, a modified Fussell.Vesely (FV)importance measure (FVol can be used to categorize components (i.e., pipe segments) selected for ISI examination. Use of importance measures generally-requires the determination of the total CDF or LERF. For ISIimportance measures, the total CDF or LERF used in calculating the modified FV importance measure should be determined by summing the contributions of all pressure boundary f ailures in the plant piping systems. This ansures that the categcrization of the pipe segments for ISI consideration is focused, such that the ISI programs developed from this categorization will ensure that important pressure boundary f ailures in plant piping , systems do not becomt major contributors to total plant risk (i.e., CDF or LERF) as a result of unexpected or age degradation mechanisms. Failure Potential Estimation In this method, historical or service cata, deterministic insights (e.g., material, fluid chemistry, loadings, and inservice experience from the pant and industry) expert judgment, and/or structural reliability / risk assessment calculations are used - to estimate pipe segment and structural element f ailure probabilities. The preferred approach is to use structural reliability codes validated with applicable data. As highlighted in Section A2.5.3, if an expert judgment elicitation process is required, then it should be performed generically through the ASME or an industry group and incorporated into the A2 33 l 4

t, P structural reliability computer Code. Use of expert elicitation should be reported to the NRC for Informat/on. The guidance of Section A2.5.3 applies to the estimation of failure probabilities. The use of conservative assumptions in estimating f ailure probabilities (to W address uncertainties) should only be used as part of sensitivity studies to assess the impact on categorizing components. Results of such sensitivity studies should be addressed in the decisionmaking process. Importance Measures General guidelines for risk categorization of components using importance measures and other information are provided in Appendix A to draft Regulatory Guide DG 1061. These general guidelines address acceptable methods for carrying out categorization and some of the limitations of this process. The basic elements to be considered when implementing importance measures include: l

a. Truncation Limits

b. Different Risk Measures

c. Completeness of Risk Model

d. Consideration of all Allowable Plant Configurations and Maintenance States

e. Sensitivity Analysis for Component Data Uncertainties

f. Sensitivity Analysis for Common Cause Failures

g. Sensitivity Analysis for Recovery Actions

h. Multiple Component Considerations .

l. Relationship of importance Measures to Risk Changes J. SSCs not included in the Final Quantified Cut Set Solution in calculating risk importance measures for the categorization process, the failure probabilities used for~each pipe segment should not credit ISIinspections or leak detection, i except for those in an augmented inspection program. (Note, this is not the case when evaluating the change in the CDF and LERF. as addressed in Section 4.2.) Guidelines that are specific to the ISI application are given in this section. As applied here, risk

• categorization refers to the process for grcuping ISI components into LSS and HSS categories.

Risk importance measures from the PRA may be used as one of the inputs to the I categorization process. Some components of interest to RI.lSt may not be addressed in the existing PRA, and so there is no quantified risk importance information for these components. When feasible, adding these components to the PRA should be considered by a the li9see, in cases where this is not feasible. detailed discussions should accompany the application request that addresses how traditional engineering analyses and judgment (e.g., integrated decisionmai.ng process) were applied to determine if a component should be categorized as LSS or HSS. In addition to component categorization efforts, the determination of safety significance of components by the use of PRA determined importance measures is important for several l other reasons: l When performed with a series of sensitivity evaluations. it can identify potential risk outliers by identifying ISI components which could dominate risk for various plant configurations and operational modes. PRA model assumptions, and data and model uncertainties. l A2 34

              +                importance measure evaluations can provide a useful means to identify
     ]

t improvements to current ISI practices during the risk informed application process. l

• System levelimportance results can provide a high level validation of component l level results and can provide guidance for categorizing ISI piping not modeled in the PRA.

While categorization is an essential step in defining how the RI.lSi program will be implemented, it is not an essential part of ensuring the maintenance of an acceptable level of plant risk. The sensitivity of risk importance measures to changes in ISI strategy (i.e., proposed for RIISI) can be used as one input to the overall understanding of the effect of this strategy on plant risk. However, the traditional engineering evaluation, augmented

               .vith the calculation of change in the overall plant risk, provide the major input to the determination of whether the risk change is acceptable or not.

Criterion"for Selection Table A2.0 summarizes the guidelines used in the identif; cation of high safety sipificant pipe segments to be used in making the final selection of inspection locations. The total CDF or LERF in the risk significance evaluation should only account for those contributcrs associated with pressure boundary f ailures in piping systems. Pipe segments that exceed the FVss i importance measure guideline rangein Table A2.6 are classified as ha eing a high safety significance. (Note: for this application, the denominator in the FV importance is limited only to the cumulative contribution of all pipe segments. It does not include contributions from other system components.) Those segments with a value less than the range given in Table A2.6 are classified as having a low safety sigriificance (LSS). The risk measures are then supplemented by sensitivity studies to

      )        provide estimates in the variability of these measures. The final categorization into HSS and LSS is performed using additional deterministic and qualitative insights and information.

Plant design and operating features and their relationship to component categorization should be explored and understood; in some cases, this will result in changing a component's ranking or category from what it might otherwise have been if based solely on the PRA results, and allow categorization of components not t.nalyzed in a PRA. The use of the Risk Achievement Worth (RAW)is an important measure that provides the risk impact from a pipe segment f ailure. It is the conditional core damage probability or conditional core damage frequency calculated for the pipe segment depending upon whether the pipe f ailure causes system unavailability degradation or an initiating event. The RAW identifies pipe segments whose failure has high risk impact and high safety impact and which needs consideration, ilpi The categorization, where the judgment of the ISl team of experts is needed, is reached by consensus. Although most decisions of the ISI experts will be reached by 100% consensus.

 ;              there will be times when dif fering professional opinions will exist. These differences must be documented.
                 'The criterion in Table A2.6 is provided as guidance. Other criteria can be proposed by a licensee, it such criteria are proposed, the licenste must provide suf ficient justglication to ensure that important p# essure j          boundary f ailures in plant piping systems do not beCome major Contributor $ to total plant risk a$ a re$utt of f          unexpected or age degradation mechanisms.

W A2 35 l

Table A2.6 Approach to Overall Risk Significance Determination for Alternative Risk. Informed Selection Process for Inservice inspection Risk importancs Measure _ Pipe Segment Quantitative Measures: Modified FV importance Measure (FV,,,) > 0.001 - 0.005 l The utility's submittal should identify a RAW value such that if RAW r a utility defined value for either CDF and LERF, the pipe segment could be i Risk Achievement considered as important Worth (RAW) If RAW < the defined value, then the pipe segment could be considered as less important

• Sensitivity Studies Uncerts nties j ltems to be considered in the establishment of qualitative criteria l
• Level of Redundancy
• System Trains
• Groupin0s of Components into Supercomponents for modelinD Qualitative Input purpos,s
• Truncation limits during quantification
• Operational Histories
• Others
• These example criteria apply to the use of a total CDF , or LERF,,,,, which is the total CDF or LERF n

attributed to pressure boundary failure in plant piping systems, A range of values is provided. The basis for the final selection criterion used in the submittal should be justifjed The process used to categorire the segments should be documented in r licensee's submittel to the NRC. Cumulative Risk Contribution in addition to the criterion of Table A2,6, the approach identified in this regulatory guide requires a supplemental calculation at the pipe segment level. This calculation should demonst' ate that the risk informed analysis of piping identified the piping that contributed 95'/o of the plant risk CDFnnuo AND LERFnowo, Figure A2,7 is provided as an illustration of a cumulative CDF risk diagram for a plant's piping. A2 36 f ._ _ _ _ . _ _ _. . .__ ._ _ _ _ _ _ . _ . . . _ _ _ __ __ _ , _ . , _

100- - - - - - - ~- - - - - - 80 -- 5

m. 60-1, a, _______________

• 20 -

                              /
                                        /        -
                               /

0 1' ' ' ' ' ' ' ' ' ' ' ' Pipe Systems , Risk-informed inspection Program Current Section XI Requirements Figure A2.7 Cumulative Risk Contribution of a Plant's Piping Engineering Considerations While risk importance can guide the selection process, there are other deterministic considerations that should be integrated into the decision making process to ensure that the results of the selection process continue to meet the existing criteria, such as 10 CFR 50.55s and the ASME Section XI. Such engineering considerations include:

• Early Detection of Degrad6 tion Mechanisms A goal of inservice inspection is the early detection of new and unexpected degradation mechanisms. Accordingly, the selection of ISIlocations should include locations where degradation is first expected to develop.

These locations may or may not be the same locations with the greatest risk contributions as identitled by calculations of risk importance based on estimated consequences of f ailures and break probabilities. The risk selection process should include a sample of representative locations within each piping system identified as contributing to risk, thereby enabling the detection of degradation mechanisms that may be active within the system. These locations should, in part, correspond to locations for which the probability of degradation is considered greatest, independent of the calculated risk importance parameters.

• l.eak Versus Break Probabilities The selection process, including the calculations of risk importance, should use leak probabilities. Consideration of leaks is appropriate since the risk importance is only intended for use in the categorization and selection process to

       ]

A2 37

                                                                                                                     ~

Indicate priorities based on the relative benefits to be gained from inspecting a partk location. Use of leak probabilities to augment the selection of inspection locations is also

            ' consistent with the stated objective of early detection of degradation mechanisms. In this context a pipe leak criterion serves to establish a definition for a significant level of degradation.

1 it is also acceptrMa to use leak probabilities because the uncertainty for calculated leak i probabilities is less tren the uncertainties for calculated break probabilities. Similarly there is less uncertain y in the estimation of leak probabilities versus break probabilities. Structural mechanics models of ten calculate very low probabilities that through wall defects will result in breaks rather than pipe leaks. However, the associated fracture l cn mechanics calculations are based on many uncertain modeling assumptions and inputs l (i.e., inputs for the defect sizes, defect growth characteristics, and leak detection capabilities) which can significantly impact the likelihood for pipes to break rather than to leak. The use of leak probabilities in the categorization and selection process minimizes the effects of this issue. If the calculated leak and break probabilities are similar for 6 pipe segment and the pipe segment is not found to be important from a risk viewpoint, but is on the borderline, then consideration should be given to add the pipe segment to the list for inspection due to non probabilistic considerations. Operationalinsights Reviews of the selected pipe segments should ensure that the proposed inspection program includes insights from operational and maintenance 7,Gg experience, using both information from the plant and relevant information from other plants. Defense in-Depth Reviews of the selected pipe segments should identify any proposed relaxations of inspection requirements from prior practicos and assess that effect on plant safety. Relationship to Augmented Inspection Programs Mandated programs for augmented piping inspections (e.g., boiling water reactor piping for stress corrosion cracking and balance of plant piping for wall thinning by erosion / corrosion) should be taken into consideration when selecting locations for inservice inspection, it is acceptable to coordinate otherwise independent inspection programs by selecting common locations to the extent possible. This regulatory guide does not eliminate the need to comply with the requiremenis of eulsting augmented inspection programs in effect at the plant. A2.7.2 Structural Element Selection Within Pipe Segments The plant ISI engineering team reviews all pertinent information and determines the final l safety classification for each pipe segment included within the scope of the risk informed ISI program. The team uses qualitative and quantitative information associated with PRA and f ailure probability calculations in combination with classic engineering insights and design basis information to develop the final classification categories of high safety-A2 38 H_ _

   }    significant and low safety significant pipe segments. This information is then used to
      / develop a matrix to assist in the selection of structural elements for examination, as shown in Figure A2.8, for all pipes included in the risk in*stmed ISI program.

The criteria for determining how many structural elements should be selectr

• for examination are based on the safety significance of the segment and the f ailure likelihood within that segment.

The risk calculations used to support the safety significance determination involve combining consequences with pipe f ailures that are initiating events and/or with pipe failures that occur on demand as a result of a plant event. Engineering insights and design basis information also provide input to the classification of a segment as high safety-significant, in addition, the process is well established for the plant's engineering team, or expert panel (if used), to confirm that the segments were properly classified as either high-or low safety significant. The probability for pipe f ailure directly drives the need for an ef fective examination . method (s). This attribute is categorized by a demarcation of "high f ailure potential" (HFP) versus " low f ailure potential" (LFP) (see Figure A2.8) using the following definitions: High failure Potential As determined by the engineering team,"' a segment is of high f ailure potentialif it has either an active f ailure mechanism that is known to exist, which may be currently monitored as part of an existing augmented inspection program, or alternatively is analyzed as highly susceptible to a f ailure mechanism, which could, in

   ],/            the future, lead to a leak or break. The ISI team applies engineering insights such as material, fluid chemistry, loadings, and inservice experience from the plant and industry experience to make this determination. Examples of failure mechanisms that would typically result in this classification are excessive thermal f atigue, corrosion cracking, primary water stress corrosion cracking, intergranular stress corrosion cracking, microbiologically influenced corrosion, erosion cavitation, high vibratory loadings on small diameter pipes, and flow accelerated corrosion.

Low Fal/ute Potential. As determined by the engineering team, a segment meeting this description would not meet the above criteria for a high failure potential segment. Examples that would typically result in this classification would have no known f ailure mechanisms other than f atigue based upon normal and design basis loadings. Probabilistic insights from SRRA results are used to confirm the engineering team's determinations. A segment should be considered to have a "high failure potential"if at any element in that segment exceeds ariy one of the two following criteria:

         *The engineering team, which es sometimes Called the

• engineering subpanel
• the *coreponent ISI team,* or

         *locused structural element empert panel.* consists of the following expertise:

• Inservice inspection program
• Non-destructive esamination methods
• Piping stress & materials

      )                e       Planthndustry f ailure, repair & maintenance emperience A2 39 l

                                    ~.                           .-      .     ---.                             - ..

HIGH FAILURE OWNER SUSCEPTIBLE POTENTIAL SEGMENT OEFINED ELEMENT ELEMENT LOCATION (Degradation mechanism INSPECTION PROGRAM (100% inspection or usually present) (Incorporates Augmented NRC Approved Owner Pau > 10 ' - 10'* or inspection Programs) Inspection Program) Pw u > 10' 104 per 40 year operating life 3 1 ONLY ELEMENT INSPECTION 4* LOW FAILURE SYSTEM PRESSURE LOCATION SELECTION POTENTIAL SEGMENT TEST & VISUAL ELEMENT PROCESS (Oegradation mechanism EXAMINATION for NRC Approved not usuallypresent) Ownerinspection Program) 4 2 l LOW. SAFETY HIGH. SAFETY l SIGNIFICAN T SIGNIFICANT SEGMENT SEGMENT Figure A2,8 Structural element selection matrix (1) Puu > 105 - 10 per 40 year operating life (2) Pwu > 10 ' - 104 per 40 year operating life SRRA sensitivity stud %s have been performed which have shown that pipe locations with failure probabilities below these values are essentially benign, Piping systems that do not exhibit a leak before break attribute could exceed the above break probability criteria even if the lesk proDability is determined to be less than the leak probability criterion, In such cases, the break criterion would dictate that the segment be classified as *hlgh failure potential. ! Figure A2,8, illustrates a four region matrix for identifying locations for periodic examinations, The safety significance matrix is based on the probabilistic categorization of the pipe segments"', The f ailure potential matrix applies SRRA tools, as appropriate, Each of the four regions has an examination rule base as follows: Region 1 All susceptible locations in the segment identified by the engineering team as likely to be affected by a known or postulated failure mechanism, must be inspected, Exceptions include existing augmented programs'* or other inspection programs approved by the NRC,

         'While the initial categoritatior, of pipe segments is based on probabahstic considerations, the utikty is f ree to increase the safety significance of any pipe segment f or reasons of their own choosing.
         ' Segments with failure modes that have estabbshed augmented programs (e.g., flow assisted corrosion, intergranular stress corrosion cracking) would be inspected in accordance with that existing program.

A2 40

           - - - , - - - , - - - . . - . . - - . - , . _ , _ - -                    e. . - _ _ - _ . - -                   - . - .    - . . - - - - .                 .  ,p        - c u-r

3 Region 2 The engineering team selects locations for examination in these segments based on the guidance provided in Section A2.7.3.2. In this region, a low f ailure potential was identified, in most cases, f atigue is anticipated to be the f ailure mechanism. Based on the guidance provided, portions of the pipe segment that would experience the highest loads or highest degradation potential, would generally be selected for inspection. if the degradation potentialis equally dispersed among the elements in a lot, then a random element (s) may be selected. At a minimum, one element will be examined to account for uncertainty and unknown degradation mechanisms in the segment or lot, and to guard against CCF. The NRC wi// consider other owner inspection programs, as justified. Region 3 All susceptible locations in ths sagment identified by the engineering team as likely to be affected by a known )r postulated f ailure mechanism, and that are not already in an augmented program, will be examined in accordance with an Owner Defined Program and reported to the NRC (if not already reported). While f ailure of these segments would have a minimal safety impact, the impact on plant operations may be significant in terms of unplanned outage time, repair costs, and other consequentialimpacts. Region 4 Only system pressure tests and visual examinations are required for segments of low f ailure potential and low safety significance. System pressure tests and visual examinations are performed for pipes in Regions 1,2, and 3, as well.

       #    Guldelines for Selection of Locations in Regions 1 and 2 The risk informed selection process includes assessments and evaluations of the pipe structural elements in each of the high safety significant pipe segment. These structural elements include the following examination items:
            . all pipe welds, including those to nozzles, valves and fitting such as elbows, tees, reducers, branch connections, and safe ends

• areas and volumes of base material and ex3mination zones such as weld counterbore areas and fitting material, as appropriate, Welded attachments and pipe supports are not included in the assessment and evaluations.

For the high safety significant pipe segment exhibiting low f ailure potentials, at a minimum, one location in each pipe segment must be inspected. The number of inspection locations s is based on a statistical sampling technique outlined in Section A2.7.3.2 and Appendix 4. Shov a pipe segment (categorized as high safety significant and high f ailure- + potelve Region 1) consist of several elements (e.g., welds), of which the majority of the elements exhibit low f ailure-potintial, then the licensee may consider separating the elements into two lots. One lot requiring 100% inspection (HSS and HFP lot) and the other

        )

A2 41 l 4

                            .           ..   .     .     ..    .- =          z=-             .;nz-:n--;

lot (HSS and LFP lot) requiring an inspection program similar to that required for Region 2. Such separations should be justified and documented in the Al ISI submittal to the NRC, Simplified P&lDs showing the segment boundaries are reviewed along with piping isometrics, plant and industry operating experience, the previous pipe segment evaluations performed to determine the high safety significant pipe segments and system design, f abrication, and operating conditiens. Based on the postulated failure mechanism and the loading conditions for the pipe segment, the areas in which this failure mechanism is most likely to occur are identified considering the following factors: Con //puration Dependent. This f actor considers the effect of piping layout and support arrangement. For example, piping with low flexibility for thermal expansion will experience high bending moments which, in turn, can drive crack growth. Component Dependent. For example, socket welds have low resistance to sustained vibration. Elbows or piping immediately downstream of valves, which add turbulence to the flow, are locations susceptible to erosion corrosion wear. Mater /a/s/ Chemistry Dependent, intergranular stress corrosion cracking (IGSCC) and dissimilar metal welds are examples of how materials and chemistry can play a role. Loads Dependent. An example of this is the number of cycles seen by the piping segment. Another example is piping where inadvertent operation may lead to water hammer events. Seismic events are also included in this category. Determination of the inspection location (s) within a pipe segment is dependent on the above f actors, in general; Component dependent f ailure modes are usually localized to a single or small number of locations. Materials dependent or operations dependent mechanisms are of ten present throughout the segment. In such cases, interactions with other effects must be considered for determining the location (s). Load dependent f ailure modes typically involve undetected preexisting flaws or degradation that could fail under high loads. The high loads could arise from dynamic (seismic, water hammer) events, large thermal expansion loads (configuration dependent), or externalloading. Locations where such loads could have the greatest impact can of ten be determined. Table A2.7 provides some additionalinsights based on postulated failure mechan:sms that assist in identifying the susceptible areas of pipes. A2.7.3 Inspection Strategy Reliability and Assurance Program

      ,.The previous sections focused on: assessing the changes to public risk by modifying existing ASME Section XlISI programs with risk informed ISI programs; and categorizing pipe segments as high and low safety significant with high and low f ailure potential. An acceptable structural segment selection matrix guideline is illustrated in Figure A2.8. Once a pipe segment is categorized via the selsetion matrix guidehne, different inspection A2 42

                                                                                    ** Y
      }          programs are applied based on their safety significance. As illustrated in Figure A2.8 the order from most to least safety significance is: Region 1,2,3, and 4. This section addresses Rec 5n 2, a segment categorized as high safety significant with low f ailure potential.

Any proposed inspection strategy should:

1. Define a reliability goal for piping systems;

2. Define a method that strives to meet the reliability goal:

3. Quantify the existence of a flaw or probability for a leak in a weld;

4. Consider that the inspection technique is not perfect;

5. Consider that not overy wold will be inspected

6. Consider the implication for calculating corifidence or assurance that the inspected sample contains non of the defective welds in the lot; and

7. Demonstrate that the final results provide reliability and assurance that the reliability goal will be achieve.

The target reliability goals are addressed later in Section A2.7.3.3. One acceptable method for addressing the above seven elements is discussed in Appendix

4. This method is consistent with the ASME Code Case N577, Case A. The method integrates statistical techniques with input from fracture mechanics calculations and/or data for flaws.

A2.7.3.1 Risk. Informed t.ot Selection and Element Selection for inspection in the previous sections, seven elements were identified for consideration when developing a statisticalinspection sampling program. One acceptable application of a weld sampling technique was identified in Apper' dix 4. This sampling process is used in Region 2 of Figure A2.8 matrix, where the ISI engineers are unable to differentiate the elements (welds) within a pipe segment as having significantly different probability for degrading. How does one inspect a pipe segment categorized high. safety significant and high failure potential where only one element (weld)in the segment experiences an active degradation mechanism, and the balance of the welds have similar low failure potential? One acceptable method is to place the outlier element in one lot, requiring 100% inspection, and subsume the balance of the elements in a separate lot for statistical sampling. as described in the previous sections. The concept of a lot can be broadened into more than one pipe segment. That is, several pipe segments with similar elements (e.g., same low f ailure potential, no known degradation mechanisms, same environmental conditions, etc.) may be subsumed within one lot for purpose of statisticalinspections. An example may be all welds attaching the cold legs to the reactor vesselinlet nozzles. Any collapsing of segments or elements within a segment into one lot will require NRC review and approval. A2.7.3.2 Sequential Sampling This section addresses the guidance for additional examinations should an inspection identify unacceptable degradation in a pipe. The Assurance Level Sampling or Global method, addressed in Appendix 4 identifies the number of welds that should be mspected. The RI-ISI engineers select the limiting weld or the weld most likely to degrade first, as the

         }

A2 43

Table A2.7 Insights for identifying inspection Locations Failure General Criteria Susceptible Areas Mechantam Thermal Fatigue Areas where hot and cold fluid mix, areas Nozzles, branch pipe of rapid cold or hot water injection, areas of connections, safe ends, potentialleakage past valves separating hot wolds, heat offected and cold water zones, base metal, oress of concentrated stress Corrosion Areas exposed to contamination and arers Dese metal, wolds, and Cracking with crevices; high stresses (residut', heat effected zones steady state, pressure), sensitized material (304 SS) and high coolant conductivity are all required lack of stress relist or cold springing could also lead to residual stresses Microbiologically Areas exposed to organic material or Fittings, welds, heat-In fIu e n c e d untreated water effected zones, crevices corrosion Vibratory Fatigue Configurations susceptible to flow induced Welds, branch pipe vibration and flow striping or for vi'uratory connections resonance with rotating equipment (pump) frecuencies 4 Stress Corrosion Areas of high oxygen and stagnant flow Austenitic steel welds and Cracking heat af fe.ted zones Flow accelerated Areas of low chromium material content, corrosion high moisture content, and high pH, high pressure drop or turtsing losses Low cycle f atigue Areas with high loads due to thermal Equipment nozzles and expansion for heat up and cool down other anchor points, near thermal cycling, snubbers, dissimilar metal joints Others? first weld to be inspected. Presumably, this would be the weld that was used in the classification of the segment as a low f ailure potential. Next, the f ailure frequency attributed to this limiting weld is then conservatively assumed to apply to all the other welds in the lot, so that a conservative estimate of assurance (by use of the binomial distribution)is generated. The only time a random selection of a weld would occur is when engineering analysis can offer no guidance as to which element is most likely to degrade, if the inspection uncovers a flaw, then the " Additional Examinations" requirement of Section XI (IWB-2430, page 82) would still be applied (paraphrased): l A2 44

        )    '
                     +    If no flaws are found in the first sample (s), then stop (note that this implies a "rero defect accept 6nce criterion" as discussed in Appendix 4).
                     +    If one or more flaws are found, then take another sample equalin sire to the first sample.

• If one or more new flows are found, inspect the rest of the lot.

The risk informed process is consistent with the experience gained from the ASME Code. One ecceptable performance guideline is striving for a 95 percent probability that the occurrence of a leak would not exceed a frequency of 1E 06/yr/ weld, if that performance guideline is not met, then a root cause analysis is performed and the inspection period and number of locations will be recalculated based on the new information, implementing this approach in the eight element example in Appendix 4,if only one of the , eight elements has a high f ailure potential, then that one element is allocated its distinctive lot and the balance is combined into a separate lot for inspection purposes. Thus, the one-element lot will be inspected (Section 1 of Figure A2.8 100% inspection or NRC approved owner program) and the remaining seven elements (if not combined with elements from other segments) will be sampled based on the guideline of a 95% probability tht the development of a leak will not exceed a frequency of 1E 06/yr/ weld. A2.7.3.3 Historical Failure Data and Target Reliability Matrix Guideline Criteria Studies performed by Dr. Spencer Bush indicate that the frequency of leaks from pipes at

         ..)          nuclear plante has shown some decreasing trends over the years of plant opt. rations. For the exiting population of plants in the U.S. (approximately 11'.., the industry observes a
         /

total of about 100 leaks per year. These leaks are primarily from the balance of plant systems, such as corrosion type f ailures due to poor quality water in copper nickel tubing. In safety related systems (including the RCS) the small number of f ailures appeared to be focused at small diameter branch piping, such as a vent line near an RCS pump whose f ailure mechanism is vibration f atigue. The ratio of leaks to breaks is a function of the f ailure mechanism involved, among other f actors, and can be as large as 1:1 for erosion / corrosion to 1000:1 or less for intergranular stress corrosion cracking. On the everage, there are about 10,000 welds (or structural elements)in pipes at a typical plant. From this estimate, a leak frequency of (100 leaks per year)/(110 plants)/(10.000 welds / plant) or - 1E 04 leaks per weld per year can be calculated, This would include pipes of all sizes, all systems and all f ailure mechanisms. The RCS pipes (Class 1), however, have experienced lower leak rates than the overallleak rate for all of the plant's pipes. Estimates for pipe f ailures for a PWR RCS are less than 1E-06 per weld per year. This ,nerformance standard is a conservative representation of the operating experience for Class 1 pipes under the existing ASME requirements and is one acceptable target goal for RI ISI application for high safety significant pipe segments. Applying the above data, the following trends for pipe leak frequencies have been observed: All pipes - 1E 04 per weld per year

        -                        RCS pipes                 -
                                                                 < 1E 06 per weld per year A2 45

                                                                                                               , , , , .. .c.,..
                                                            'n Further analysis of nuclear power plant operating experience has led to categoririn0 detectable piping leak rates, as identified in Table A2.8.

Table A2.8 Operating Experience insights to Leak Frequencies LEAKS 1965 1996 MAIERIAL PltLSlIE LOILFA1 LURES LEALEREQUINCY (lcaklyn.ncid) sental... se..I s .lmeh $46 e E.e6 Ferrie see.1 s!.lach die 13 E.06 se.l.t...sseel mi s 4 3te se E.66 Ferric steel >154 136 4 E.06 l l se.h.l...si.el >4 1e s E.e6 Ferrie steel >4 3s3 8 E.e6 l l I Referring back to the statistical sampling technique described in Appendix 4. Table A2.9 provides an example of a potential matrix guideline for implementing RI.lSI programs on h/ph safety.s/pni// cant pipes, it is anticipated that these goals such as these would be schleved with a 95% assurance level for only that part of the system categorized as high. safety significant. For example,if a system consists of 20 segments,10 of which are categorized as high. safety significant, the leak target goal would only apply to the 10 segments as a system. A licensee should identify and justify the leak target goals it intends to monitor. Table A2.9 Target Detectable Leak Frequency Goals _ LEAK TARGET GOALS MAIEJLIAL PJP.E. sign TARGET _ LEAK FREQUENCY (leaklyr weld) stelless steel < 1.inth <1 E.05 Ferrie steel 51. inch <1 E.es stolmiens Steel >l < 4 <1 E.es j Ferric steel >1s4 <1 E.46 l st.laless Steel >4 < 1 E.66 I Ferrie Steel >4 e s E 06 1 _ A2 46

           --m                    .s              ._,_m ;            .m            .; 7 _. ,

l l l 1 As addressed in Appendix 4, an input for the binomial distribution in the Assurance Level

Sampling Method is the probability of a finw. One acceptable definition of a flew is to apply Me ASME definition I e.g., a flaw whose depth exceeds about 10% of the wall thickness fst> O.1H, This does not imply that the flaw is unstable and willlead to a through the well crecA. It is a flaw that requires additional analyses. For example, a typical probability for en unacceptable flew for a large pipe in a PWR RCS may be on the order of 3E.

03/ycarlweld, For a weld containing such a flaw, the probability of a detectable leak is on the order of 4.3E 08 per year por weld, for a disabling leak it is 5.1E.10 per year per weld,

                                                                                                                             ~

and for a break it is 3.0E.13 per year per weld. The probability of a flaw is calculated with the structural mechanics model, discussed in Appendix 1. Application of the sampling model should account for the uncertaintles in the calculated probability of a flew per weld i per year, and account for that part of the system categorized as HSS, using appropriate posts for each segment to achieve the system performance target goal. , The above matrix guideline is conservative in that a detectable leak is used as the figure i merit. Meeting these guidelines maintain, as a minimum, the current level of safety provided by the existing ASME Section XI Code, and.would likely result in increased safety as the Ml process expands the regulatory scope of inservice int,pection to other systems not currently addressed by Section XI, and potentially a decrease in radiation exposure to plant personnel.. A2,7.3.4 Inspection Location Summary This section addussed one acceptable method for pipe segment classification (hlgh versus

     -         low safety significant classification; high versus low f ailure potential; etc.), it discussed the use of a statistical procedure for selecting the number of welds to be inspected (e.g., the Assurance Level or Global method for high safety significant with low f ailure potential),it addressed (through reference to Appendix 4) one acceptable method for incorporating uncertainties in the inspection technique (probabikty of detection), and it addressed                               :

sequential sampling where the initial testing identified potential flaws. Tocusing our attention on the high safety significant with low failure potential Woments, once the number of enestions to be inspected (among the total number in a given log) has bsen established, the next step in the procedure is to select the actualinspection locations. - 11 should again be noted that alllocations for the lots of interest will have inw f ailure I potentials, and that the number of sample locationL on a percentage basis will be small. The objective for the sample inspections is to detect degradation using a strategy that inspects those locations where degradation is first most likely to occur, along with inspections of different types of structural elements (welds, fittings, etc.), thereby providing

         ,     diversity to the sample set.                                                                                        -

The estimated f ailure probabilities for th110w f ailure potential elements will typically have been assigned to a common small value (L.g., the limiting element in a lot) for purposes of risk categorizatioi' calculations. Nevertheless, the selection of sample locations for inspections should Le based on a location where degradation is most likely to occur. These evaluations can be based on consideration of f actors such as identified in the previous sections, as well as th) f ailure mechanisms and susceptible areas listed in Table A2.5, Results of proteabilistic structural mechanics calculations and data from operating experience can also guide the selection. When f atigue is the f ailure mechanism of concern,

       )       the criteria from ASME Section XI can also provide useful guidance by directing attemion to A2 47

terminal ends, locations of high calculated stress and f atigue usage f actors, and dissimilar metal welds. For high safety significant elements with high f ailure potential,100% inspection or en NRC approved owner's program is required. An example of an NRC approved owner's program is the erosion corrosion program. Final Selection Process 11 is the responsibility of a licensee to ensure that the categoriration of elements and the location of inspections are performed in accordance with sound engineering practices and licensing requirements. This regulatory guide does not endorse one method over another, in other risk-informed prograrro (i.e., maintenance, inservice testing, technical specifications, graded quality assurance, etc.), the industry incorporated the use of an expert panel for providing plant management the information it requires to render its decision. Whether en expert panolis used or not, the issues that an expert panel addresses need to be addressed in the process. These issues include:

• Concurrences that the systems included in the scope of the program are correct and that no other systems should be included / excluded

               +    Verification that the system boundaries are adequate
               +    Verification that the consequences assumed for each piping segment are accurate (both direct and indirect effects)

• Concurrence that shutdown risk, containment performance, operational history, etc.

have been appropriately considered in the analysis ,

• Verification that appropriate operator recovery has been considered (i.e., consideration of available indications, timing, and alternate actions)

                +    Upgrading the safety significance of a pipe segment based on economic or other considerations that are outside the regulatory program through a consensus process and documenting the basis for such an upgrade

• Concurrence that the structural elements selected for examination and the type of examination method selected meets the requirements of the program

                 +   integrate the insights from other risk informed programs for consistency and proper coverage.

A review group or panel cannot downgrade a high safety significant pipe to a low safety-significant (LSS) pipe if it comports with the guidelines in this report. In rendering the final decision, the licensee ensures that the program solicits experts in the areas of PR A and engineering disciplines to develop a finallist of high safety significant pipe segments. As indicated above, the licensee can select to inspect pipes for f actors other than the decision criter!a identified in this chapter. Such f actors might include economic considerations that have no safety impact or other non safety considerations as deemed appropriate by the utility, inspections based on non safety considerations (upgrading pipes no ranked high safety significant), are not considered under this regulatory guide. A2 48

...-_-.-____;- - _ , - - ___----m----- _ - - _ - - - _ _

                                                                               , - - - - - - - - m, .- .---;---; - - - . - - -

For consistent application of risk informed programs,it is recommended that the licensee incorporate the insights gained from the Maintenance Rule and other risk informed programs at the plant. The licenses should solicit its experts in the areas of:

• plant engineering, operations, maintenance, and maintenance rule coordination;
• plant work, planning, and control;
• piping design and stress analysis;
• Inservice inspection;

                 .*   NDC, e   structural design and support engineering;

• welding and materlats test engineering;
• Industry f ailure, repair and maintenance history;
• safety analysis; and
• probabilistic safety assessments.

The licensee should build upon the Industry's documentation format developed for the RI lSi pilot demonstration plants. These documents help lead the ISI teams to consider the major issues for each step of the program. 4 A2 49

A2.8 References for Appendix 2*'

1. USNRC, *The Use of PRA in Risk informed Applications,' draf t NUREG 1602, June 1997.

r 2. K.R.Balkey et al.," Westinghouse Owners Group Applic.ation of Risk Based Methods to Piping inservice inspection Topical Report,' WCAP 14572, March 1996.

3. USNRC, Stenoord Review Plan, NUREG 0800.

4. ASME Research White Paper,

• Risk Based Alternative Selection Process For Inservice inspection d LWR Nuclear Power Plant Components," American Society of Mechanical Engineers Center for Research and Technology Development, Suite 906, 1828 L. Street, NW., Washington, DC, November 9,1995.

5. K. Jamali,

• Pipe Failures in U.S. Commercial Nuclear Power Plants," EPRI TR 100380, Prepared for Northeast Utilities Service Company and the Electric Power Research Institute, Palo Alto, California, prepared by Halliburton NUS, Gaithersburg, MD, 1992.

6. T.V. Vo et al.,

• Expert Judgement Elicitation on Component Rupture Probab;lities for Five PWR Systems," PVP Vol. 251, " Reliability and Risk in Pressure Vessels and Piping," pp. 115 140, American Society of Mechanical Engineers.1993.

7. D.O. Harris et al.,

• Probability of Failure of BWR Reactor Coolant Piping: Probabilistic Treatment of Stress Corrosion Cracking in 304 and 316NG BWR Stainless Steel Piping Weldments," USNRC, NUREG/CR 4792. Vol. 3 Decembn 1986.

B. M.A. Khaleet et al.,, *T3 ( empact of Inspection on Intercranular Stress Corrosion Cracking for Stainless Steel Piping,* ASME PVP Vol. 266/ SERA Vol. 3, pp. 411422,

• Risk and Safety Assessment: Where is the Balance," 1995, 9, American Sciety of Mechanical Engineers," Risk Based Inspection Development of Guidelines,' Volume 2 Part 1, " Light Water Reactor (LWR) Nuclear Power Plant Components.* CRTD Vol. 20 2. ASME Research Task Force on Risk Based inspection Guidelines. Washington, DC,1992,

10. Bush,

• Reliability of Piping in Light Water Reactors,' Nuclear Safety, Vol.17, No.

  ' Cop,es of Commission policy statements. [PRI and WCAP reports referenced herem are sveilable for mspection or copymg for a fee from the NRC Public oocument ricom et 2120 L street NW., Washington. DC: the PDR's meilmg addeess es Mail stop LL 6. Washmoton, oc 20555; 2Ahone (2021634 3273: f aa (2021634 3343.

Conies of NUREGs are available et current rates f rom the u.s. Government Pemtmg of fice. P.o. Boa 37082 washmoton, oC 20402 9328 (telephone (2021s12 2249); ce f rom the Nationel Techcolinf ormation ser oce by wntmg NTis et s285 Port Royal Road, sprmpfield, v A 22161. Cop.es are available for mspeedon or copymg toe a tee from the NRC Pubhc occument Room et 2120 L street NW., Washmgton oC; the PDR's me.hng address is Me.1 stop LL 6. washington, oC 20L55; telephone (2021634 3273: tem (202)634 3343. Requests for singie copies of drott or ochve reguietory guides (which may be reproducedi or for placement on en automatic distribution nist for smgle copies of future drott guides m specif c desions should be made m wntmg to the u.s. Nuclear Regulatory Commission. W eshington. DO 20555 o001. Attention: Pnntmg. Graphics and Distobution Branch, or by fem to j (3o1141s s272. A2 50

17, Sept. Oct.,1976. 3

      )

11. S.H. Bush,' Statistics of Pressure Vessel and Piping Failures," Journalof Pressure Vessel Technology, Vol.110, pp. 225 233, August 1088.

12. S.H. Bush,

• Failure Mechanisms in Nuclear Power Plant Piping Systems
• Journal Presture Vessel and Piping Technology, Vol.114, pp. 3B9 395, November 1992.

13. H.M. Thomas,

• Pipe and Vessel Failure Probability,' Journal of Beliability Engineering, Vol. 2, pp. 83124 Elsevier Applied Science, London and New York,1981.

14. R.E. Wright, J.A. Steverson, and W.F. Zurof f,

• Pipe Break Frequency Estimation ior Nuclear Power Plants,' USNRC (prepared for NRC by Idaho National Laboratory).

NUREG/CR 4407, May 1987

15. USNRC,

• Severe Accident Risks: An Assessment for Five U.S. Nuclear Power Plants, Final Summary Report," NUREG 1150, December 1989.

16. T.A.- Wheeler et al.,

• Analysis of Core Damage Frequency from internal Events:

Expert Judgment Elicitation," NUREG/CR 4550, Volume 2. USNRC (prepared by Sandia National Laboratories), April 1989.

17. T.V. Vo et al., " Estimates of Component Rupture Probabilities: Expert Judgment Elicitation," Nuclear _Iechnology, Volume 94(1), American Nuclear Society, La Grange Park. Illinois,1991,

18. V.N. Shah and P.E. Mcdonald.

• Aging and Life Extension of Major Light Water Reactor Components,' Elsevier Science Publishers, New York,1993.

19. American Society of Mechanical Engineers, ' Metal Fatigue in Operating Nuclear -

Power Plants-a review of Design and Monitoring Requirements. Field Failure Experience, and Recommendations to ASME, Section XI Actions,' New York,1990.

20. USNRC, ' Pipe Crack Experience in Light Water Reactors," NUREG 0679,1980.

21.. USNRC, ' Investigation and Evaluation of Stress Corrosion Cracking in Piping in Light Water Reactor Plants." USNRC, NUREG 0531,1979. 4 V A2 51

22. J.F. Copeland et al.,

• Component Life Estimation: LWR Structural Materials Degradation Mechanisms,' Electric Power Research Institute. Palo Alto, California, 1987.

23. V.K. Chexal and J.S. Horowitz,

• Flow Assisted Corrosion in Carbon Steel Piping, Parameters and influences,* Proceeo*ings of the d'* Symposium on Environmental Degredation of Materials in Nuclear Power Plant Systems, D. Cubicciotti (Editor),

National Association of Corrosion Engineers, Houston, Texas, pp. 91 to 912,1990.

24. S.A. Eide et al., ' Component External Leakage and Rupture Frequencies,' EEG SSRE.

9039, DE92 012357, Idaho National Laboratory, Idaho Falls, idano, prepared i J.S. Department of Energy,1991.

25. S.H. Bush, " Wall Thinning in Nuclear Piping Status and ASME Section XI Activities,'

PNL SA 16973, Pacific Northwest National Laboratory, Richland, Washington, Post SMIRT Conf erence, Monterey, CA, August 1989.

26. T.V. Vo et al.,

• Estimates of Component Rupture Probabilities: Expert Judgment Elicitation,' fatigure, fracture, and RisA, PVP Vol. 215 The American Society of Mechanical Engineers,1991.

27. D.O. Harris, E.Y. Lim, and D.D, Dedhia,

• Probability of Pipe Fracture in the Primary Coolant Loop of a PWR Plant, Vol. 5: Probabilistic Fracture Mechanics Analysis,"

USNRC, NUREGICR 2189, Volume 5, August 1981.

28. D.O. Harris and D. Dedhia,

• Theoretical and Users Manual for pc PRAISE, A Probaailistic Fracture Mechanics Computer Code for Piping Reliability Analysis,'

USNRC, NUREGICR 5804, July 1992.

29. O.J.V. Chapman, and G.A. Davers,

• Probability Risk Ranking.' Transactions of the 9'*

Intemational Conference on Structural Mechanics in Reactor Technology, Lausanne, 1987.

30. B.A. Bishop and J.H. Phillips, *Prioritiring Aged Piping for Inspection Using a Simplified Probabilistic Structural Analysis Model,* ASME PVP.Vol. 25. Reliability and Risk in Pressure Vessels and Piping, pp. 141 152, American Society of Mechanical Engineers,1993-

31. Electric Power Research Institute " Risk. Informed inservice inspection Evaluation Procedure,' TR 106706, interim report, June 1996.

A2 52

Appendix 3: ESTIMATION OF FAILURE PROBABILITIES USING EXPERT JUDGMENT ELICITATION (Ref.1) A3,1 Introduction In pilot applications of risk informed ISI methods (Ref. 2) and (Ref. 3), expert judgment was selected as a method for estimating f ailure probabilities of piping system components. This appendix describes the elements of the formallred procese for conducting an expert judgment elicitation. For plant specific applications there are time and cost limitations that will usually preclude application of this process in its entirety Nevertheless, much of the guidance provided in this appendix can be applied to making the many judgmental decisions involved in estimating failure probabilities, whether by application of data bases or by application of probabilistic structural mechanics computer codes, In other cases it may be appropriate to systematically apply the expert judgment elicitation process to address generic issues related to structural reliability. Industry is encouraged to make such generic applications to estimate baseline f ailure probabilities for particular systems, materials, and operational conditions and incorporate that knowledge in the structural mechanics computer codes to increase the consistency and uniformity of plant specific f ailure probability estimates, However,in practice it will be necessary and appropriate to modify any such generic estimates to address plant specific conditions. A3.2 Background _ As in any scientific endeavor, expert engineering and scientific judgment (of ten referred to as expert opinion)is an essential aspect of any method (including application of historic

      -         data and structural mechanics computer codes) selected for estimating f ailure probabilities.

In identifying the systems and components to be studied, expert judgment can be used to e precisely define what is meant by a f ailuie e formulate a mathematical f ailure mode e identify and assess relevant data

                        +                                 combine all of these elements to obtain the desired results in a useful format For such tasks, expert judgment is usually applied, but in an informal and unstructured manner.

For many such problems, this approach yields satisf actory results in an efficient manner. However, an informal and unstructured approach may be unsatisf actory when relevant data are sparse or nonexistent, or wher' the issue studied is complex or likely to receive extensive review and criticism. A formal expert judgment process has a predetermined structure for the collection, processing, and documentation of expert knowledge. The s advantages and drawbacks of using such a process, as opposed to an informal process, are cuttined in Bonano et al.,1990 (Ref. 4). The advantages include:

• improved accuracy and reliability of the expert judgments A3 t

a reduced potential for critical mistakes leading to suspect or biased judgments e enhanced consistency and comparability of procedures e improved scrutability and documentation for ammunication and externcf review The drawbacks include: e an increase in the resources and time required to carry out the process e a reduction in the flexibility to make changes in the ongoing process e en increased vulnerability to criticism due to the relative transparency provided by a re formal documentation of the procedures end findings, including differences expressed by the various experts. Reference 4 cautions that, while a formal process of ten requires more resources and time than an informal process initially requires, a f aulty process that f ails to withstand criticism  ; or must be redone because of inappropriate design or improper execution may end up failing i to satisfy the project objectives and cost more in both time and resources. The potential for further costs in an informal study should be considered when evaluating the need for an fortnal process. The formal use of expert judgment has been extensively applied to a number of recent major studies in the nuclear probabilistic risk assessment area l(Ref. 5), (Ref. 6), and (Ref. 7)). Although scientific inquiry and decisionmaking have always relied on expert judgment, the formal use of expert judgment as a well documented systematic process is a relatively new development. However, because of the many potential pitf alls in using expert judgment, it is essential that analysts be f amiliar with the state of the art and utilire the services of experienced practitioners in order to avoid wasting time and resources. Useful discussions of potential pitfalls and approaches to overcoming them may be found in (Ref. 8). (Ref. 9), and (Ref.10). The expert judgment process used in NUREG 1150 (Reference 5)is presented in (Ref.11) and outlined in (Ref.12). This methodology was developed in response to criticisms of the previous Reactor Safety Study (Ref.13) and an earlier draft of NUREG 1150. The history of this development underscores the importance of basing the expert judgment process on state of the art techniques and of making use of experienced practitioners in this difficult area. A3.3 Expert Judgment Elicitation Process A flowchart of the expert judgment process is given by Figure A3.1, taken (with minor changes) from Reference 12. The expert judgment process has 10 steps, outlined below. This process, with some modifications, was used to estimate break probabilities for selected components at Surry 1, as discussed in References 2 and 3. Specific techniques for the elicitation, use, and communication of expert judgment may be found in References ((Ref. 3), (Ref. 7), (Ref. 8), (Ref.15), and (Ref.14)]. A3 2

                                                                          ....................u..u..                g.......un...u.....=

Frei M eeting second Meeleg 8 Wee l

               ---~~
                                                                - %              t hchation Traming
                                                                                                              - - >8          Ponentates.

of Technical _{ A Evidence Project ' a. : =a.aa. @ j y stalT Presentation and j

               '- - - - ] gehelion         ot u.ues
                                                            -'- ->! Preparation t of u..n               j k-*                . Review of hsuts          :

I

                                                                                                                    .i.................................e    j j                                                                   = .u . ..:

Third Mestes Preparation Discussion of Ebcitation - --- of Analyses hauss and Analyses g i.= =.=  ;;.. = =e i i y l l Recomposition _ ; Foal Review by Aggngstbn and Documentation Experta 4 - - Documentation _... l  ; L --..,_..w i Figure A3.1 Expert judgment process. A3.3.1 Selection of issues The initial selection of issuer. should be made by the project staff and is used to guide the selection of the experts, Two primary criteria for the issue selection are as follows: (1) The issue has significant impact on the rish and/or uncertainty. (2) Alternative sources of information such as experimental and observational data. or validated computer models are not available. 4 A3.3.2 Selection of Experts Experts are selected on the basis of their recognized expertise in the areas of interest and chosen to ensure a balance of viewpoints. To address the issues of concern to the nuclear

power industry. experts from reactor vendors, utilities, the federal government, national I laboratories. consultant ar'd academia should be included. The goal is to obtain multiple and diverse input so that th0 issues can be thoroughly examined from nany viewpoints.

There are two ways to organize tha axperts by panels or by teams. The panel approach was used in NUREG-1150 (one panel for cch of six groups of related issues) and the Lawrence Livermore seismic hazard study (one seismicity panel and one ground motion panel) described in Reference 6. The team approach was use by the Electric Power

   }

A3-3

Research Institute seismic hazard study (1x balanced teams, each containing seismicity cnd ground motion experts) described in Reference 7. In addition to the experts to be elicited, substantive and normative experts are needed to f acilitate discussions, make presentations, and train the experts. The substantive expGus) must be knowledgeable about decision theory and the practice of probability eliritation. A3.3.3 Elicitation Training The purpose (,1 elicitation training is to help the experts learn how to encode their knowledge and beliefs into probabilistic or other quantitative forms. Elicitation training can significantly improve the quality of the experts' assessments by avoiding psychological pitf alls that can lead to biased and/or overconfident assessments. Training should include informeCon about the methods used to process and propagate subjective beliefs, introduction to the assessment tools and practice with these tools, calibration training using almanac questions, and an introduction to the psychological aspects of probability elicitation. The training should be conducted by a normative expert with assistance by a substantive expert. For NUREG4150, the elicitation training took place at the first meeting and required a half day. Depending on their f amiliarity with elicitation techniques, some experts may require less or more than a half day of training. It is recommended that training occcc at the beginning of the process so that the experts can f amiliarize themselves with the types of assessment they will be making before they decide on the specific issues to be addressed. However, when the training session takes place, it is important that it not be abbreviated due to time pressure. A3.3.4 Presentation ant' Review of issues The initiallist of issues selected by the project staff should be sent to the experts before the first meeting for review. Relevant data sources, models, and reports shoulo also be included. The experts would be invited to propose additions deletions, or modifications to the list. When the experts meet, substantive experts present the issues to the expert panel. The purposes of the presentation and review are'

                +

to ensure that a common understanding of the issues is addressed to ensure that the experts respono to the same elicitation questions to permit unimportant issues to be excluded and important issues to be included to allow modification or decomposition of the issues to provide a forum for the discussion of alternative date sources, models, ano forms of analysis An essential aspect of issue presentation is issue dr. composition, which allows the experts to make a series of simpler assessments rather than one overall assessment of a complex issue. This step should be executed with great care, as the decomposition of an issue can A3-4

d very by expert, thereby significantly affecting its assessment. Care should also be taken to present the issues so as to minimize potential biases in their assessment.

 )

A3.3.5 Preparation of Analyses The experts should be given sufficient time and resotarces to analyze the issues before the clicitation session. This step may entail support by the project staff, e.g., by performing computer calculations or other requested analyses. Some experts may choose to alter the proposed decompositions or create new ones. While many calculations necessarily bear on the probability assessments that the experts make in the elicitation sessions, the experts should be cautioned to avoid making any subjective probability astt.ssments until the clicitation. This is necessary to avoid making any subjective probability assessments until the clicitation and to avoid the psychological bias of anchoring (Reference 8). A3.3.6 Discussion of Issues and Analyses Prior to the elicitation session, the cy,erts should present the results of their analyses and research. The goal of this step is to ensure a common understanding of the issues and the database. It is not to reach agreement on the issue decompositions and the elicitation variables. To take advantage of the diversity of apptcaches,it is essential that each expert analyze each issue according to his/her own interpretation, and use the decomposition and elicitation variables with which he/she is most comfortable. A3.3.7 Elicitation

 )    The elicitation sessions should be held immediately follow the discussion of issue analyses.

An elicitation team should meet separately with each expert. This avoids the pressure to conform and elides the other group interactive dynamics that may arise if the expert judgments are elicited in a group setting. The elicitation team should consist of a substantive expert, a normative expert, and a recorder. It is also useful to add as a fourth member the person who will prepare the final documentation, The elicitation sessions serve two purposes. The first is to obtain the decompositions and quantitative assessments for each issue from each of the experts insof ar as possible, the uncertainty of each quantitative assessment should also be elicited. The second purpose is to obtain the rationales for the decompositions and assessments. The experts should be questioned about their stated beliefs and asked to reflect on and explain the reasoning behind the decompositions and quantitative assessments they have provided. Much of the documentation of the experts assumptions and reasoning can be completed during the elicitations. Hawever, some follow-up work is usually necessary to fill voids in the logic provided by the experts or to obtain missing assessments. A3.3.8 Recomposition and Aggregation Each expert's assessments must be recomposed by the normative and substantive experts to organize them into a common form for each issue. Recomposition is necessary because the assessments for the elicitation variables in the decomposition for each issue must be combined into an assessment for the issue as a whole. Since each expert may have

   '    employed a unique decomposition, the end result for each expert must be in a common A3 5 l

form suitable for aggregation. This will typically be a subjective probability distribution for a parameter of interest. Af ter the recomposition of each expert's clicitation, the results shoulo be aggregated to yield a final assessment for each issue, it is essential that the aggregation reflect the uncertainties as expressed by the experts. There are two general classes of aggregation methods; methods that tend to consensus and methods that tend to preserve the variability among the experts. Genest and Zidek (Ref.15) provide informative reviews on the meny proposed aggregation methods. When variability among the experts is greater than the uncertainty for each expert, a simple aggregation method is sometimes used. Each expert's assessment is replaced by a central value (the realistic estimate) and the central values are plotted. Converting the plot of central values to a box and whisker plot (Ref.16)is a convenient way to summarize the assessments that reflects the uncertainties. This method was used in Reference 2 to estimate component break probabilities. While consensus methods are of ten easy to implement (e.g., averaging over the experts), they should not be automatically applied without careful consideration. Because one of the primary goals of the expert judgment process is to reflect the state-of the art uncertainty as expressed by the diversity of expert judgments, an aggregation method should not be used if it tends to mask the diversity of expert judgment. For example, consider a case where half the experts judge the probability P of a phenomenon to be close to zero while the other half judge P to be close to one. Averaging over the experts is equivalent to the case where all experts judge P to be approximately %. These two case 3, however, are quite different since there is no disagreement among the experts in the second case, while there is a great deal of disagreement among the experts in the first case. In the second case, a decision maker would have high confidence that Pis approximately %, while in the second case, he/she does not know what value to assign to P. If he/she would make one decision when P = 0 and another decision when P = 1, premature averaging in the first case might deprive the decision maker of essentialinformation, in general an aggregation method should be used only if a sensitivity study indicates that it does not destroy information that might significantly affect the options of a decision maker. A3.3.9 Review by Experts Following the initial recomposition, aggregation, and documentation, written analyses of each issue should be distributed to each panel expert, substantive expert, and normative expert for review. A substantive (and nonvoting) expert might be an individual from the plant technical staff with detailed knowledge of plant design and/or operations, whereas a normative expert might be an individual with knowledge of probability and statistics who could assist the other experts in translating their engineering knowledge into numerical edmates cf failure probabilities. The purpose of this review is to provide the experts with the opportunity to revise their earlier assessments, and ensure that potential misunderstandings are ident.fied and resolved before final documentation. The revised assessments are then recomposed and reaggregated. To prevent an expert from arbitrarily changing his/her assessment so as to influence the aggregated assessment in a preferred direction. the experts should be required to provide a rationale for any significant reassessment. 1 A3 6

       .,..         ...~..c                       . - - - - - -
                                                                . =a.=,.;---      a--,--    - - - - - - - - - - - - - - = - - :--- - - - - - - -

A3,3,10 Documentation Documentation has a number of important purposes First, clear comprehensive documentation is essential to ensure that the expert judgment process is accepted as credible. Second, documentation can be used by the experts involved to provide assurance that their judgments are correctly reflected. Third,it can be used by potential users of the process to enhance their understanding. Fourth,it can be used by peer reviewers of the process to provide an informed basis for their review. Finally, documentation can be extremely useful to update the analyses when future research provides additional information.

              - A3,4 Example Application to Nuclear Piping Systems Since elicitation of expert opinion was recognized as an acceptable means to quantify input to PRAs and rin based studies, this method was selected for estimating pressure boundary failure probabilities for use in a pilot application of risk based ISI methods performed by Pacific Northwest National Laboratory (PNNL). The systematic procedure, as described in References 11 and 5, guided the elicitation process. The following paragraphs summarize
              -the procedures as indicated by Figure A3.2 and describe sample results obtained. Detailed discussions of the procedures as well as the complete results can be found in References 2 and 3.

PNNL conducted two expert judgment elicitation meetings. The meetings addressed only structural f ailures that were perceived as important to plant risk, or that could significantly 3 affect core damage frequencies. The specific objective was to develop numerical estimates

       'J.      for the probabilities of catastrophic or disruptive f ailures for the selected pressure boundary systems and components at a PWR plant.

Experts at these meetings included specialists in the areas of materials science, structural mechanics, inservice inspection, data bases on service experience, plant operational practices, and plant specific knowledge of the plant. The first meeting on May 8 10, 1990, at Rockville, Maryland, addressed f ailure probabilities for the reactor pressure vessel, reactor coolant system, low pressure injection system, auxiliary feedwater system and accumulators (Ref. 2). The second meeting occurred on February 3 6, 1992, in Washington, DC. This meeting addressed the high r,ressure injection system, residual heat removal system, service water

               -system, component cooling system, and power conversion system (Reference 3).

The panel of experts brought to bear a large base of experience with structural integrity issues at operating plants as well as an understanding of the response of structural materials to service environments. The experts consisted of knowledgeable representatives from utilities, vendors, federal government agencies, and consultants. Prior to the workshop, reference materials were sent to the experts, including data sources, reports, and recent PRA results. Panel members were asked to study these materials and formulate initial estimates of f ailure probabilities. To resolve issues thoroughly from many viewpoints, the elicitation was designed as a f ace-g to-f ace meeting. A formal presentation was provided for each system of interest. The f presentations discussed technical descriptions, historical component f ailure mechanisms, A3 7

elicitation statements, suggested approaches, questionnaire forms, and any supporting materials. The issues were presented in a manner to avoid preconditioning or biasing responses. All experts were encouraged to get involved in subsequent discussions. Knowledge from experts regarding plant design and operation, f ailure history, and material degradation mechanisms was brought to the discussions. Since the process was designed to take advantage of the diversity of the 1.nowledge, each expert provided an independent estimate. No effort was made to seek a consensus among the experts on estimated break probabilities. Each expert completed Questionnaires addressing location specific break probabilities for the systems of interest. This data covered realistic estimates of probabilities, uncertainty estimates, and the rationale for these estimates. Following the elicitation meeting, information provided by the expert panel was recomposed and aggregated. The written analyses of each system, including the recomposition and additional plant specific data, were then returned to each er. pert for review. This review provided the experts with an opportunity to revise their earlier a:;rsessments, and ensured that potential misunderstandings were identified and resolved and that the documentation correctly reflected the experts' judgment. The revised analyses were then again recomposed and aggregated to provide a single composite judgment for each break probability. p__ __ _ l C' Data from  ! PR A Resuka sad listorical  ; 7,,,,, y , , g, Other Relevant Inrormation Tallure Data g,,;p,,  ; (systun. component prontizatma.

                                                                                                             ,                  sysum desenptions, etc.)

t. i . .. . _ . . ._ - - - - - Y _ . . .. E spert Judgment Additional Informatma Lt.eitate m and 4_ - - ~ - (additional plant-specific Inseussion inform ation. etc.)

                                                                                    .__. Y.,               ,

Estraaied kupture Probabl.tus Figure A3.2 Procesi for estimating f ailure probability using expert judgment. A3-8

t . I I Figures A3.3 and A3,4 are samples of estimated f ailure probabilities obtained from the expert judgment approach.- The probabilities are expressed as f ailures per year. Because, f as in most expert judgment applications, the data set was not symmetric about a single peak, the median was used. Unlike the mean, the median is not influenced by extreme values. -The interquartile range (75th percentile minus the 25th percentile) is used to describe variability in the data set. As shown in the figures, the realistic estimates obtained from the population of experts are summarized in a series of box and whisker plots. These plots of the distribution associated with the expert population display the following features: (1) the " whiskers" identify the extreme upper and lower bound values; (2) the box is determined by the 25 and 75 percentiles (i.e., the lower and upper quartiles). Its length is the interquartile range (IOR). (3) the middle 50% of the data points lie within the box: (4) the circles indicate the median of the distributions. The experts provide a wide range of responses regarding failure probabilities. This range is entirely consistent with the large uncertainties associated with the performance of the components being addressed. Since no attempt was made to seek a consensus from the expert panel, the median of the experts' estimates was suggested as a realistic probability for use in the risk based studies. The evaluation should incorporate an uncertainty analysis, as illustrated in Figures A3.3 and A3.4. For the systems selected for study, the extreme values of the f ailure estimates varied

      /
        ) between 1.0E-09 and 1.0E 03 f ailures per year. For a given component within a particular system, the inter quartile range generally represented variations between a f actor of 10 to 100. The component medians within a given system generally vary within a f actor of 10, with the notable exception of the control rod drive mechanisms and the instrument lines of the reactor pressure vessel.

In summary, the data appeared to be reasonable and generally agree with the PWR plant operating experience. Typical areas of high-break probabilities correspond to such factors as high-cycle thermal stresses (e.g., places where mixing of fluids with large temperature differences occur) and places where erosion or corrosion effectsare active. A tremendous amount of technicalinformation was gathered from the exchange of information between the experts and the observers, and the elicitation greatly enhanced the realism and credibility of the plant analyses.

        }

A3 9 I

                                        ._--y_
                                               ------,z-.----.----,   . _ - ; ; _ - - - ;, _

SO'a First teoletkw) Vahe (W Person. H 4; SG to MW FWt isola 1km Vah  ; 9  ; rret to Second leciamon Vale  ; 4  ; Conenanmovt Penetraton to second % v s  ; c; From Unit 2 AFW Purrpe  ; o 1 P5e Segment Beween , Coneninment Isoisson Vaws I D i AFW Purm Omtwge Henders H $ l From Urd 2 AFW Srstem 1 0 l MO Pump Omeharge l 0 l TD Pump Dechar0* i @ I SG to Turtnne Orrn for TOP I O l AFW Pump CST Renam W l 9l AFW TDP Sucson i $ l TDP io CSTt i$ l AFW MDP Neuon i C l MDP m CST 1 IQ l CST) l $ l CSTt to CST 2 l C l GD l 3 l Emergency MO to AFW MD Pumpa l C I Emergetry Wu m AFW TD PumDe l C h

                                           !          t              i               !                                                          i                !  e
                                          -9         -Sit           -7            -e                                                         -5                 3 log 10 (FadurseNear)

Figure A3.3 Failure Frequency Estimates for the Auxiliary Feedwater (AFW) System Components A3-10

Figure A3.4 Failure frequency estimates for the reactor pressure vessel Wald 1 y we t . C h en w w w.uoser ones to imemmean ehei Wolo 2 H @ h Weid 2 - C w wenlwe, Wee 3 l & I "*** * ""*** w,:w 3 Chnderwesi weld. Irww Wo6d 4 l 9 ,

                                                                      "                               shes (temare eepong Weed 5                              l             @      h                  * * * * *

• C*#
• Wu5 botom heed Weld 6 H 9 h-* Wolde 6 Imermedme and lower Weid7 O "' **' W ****

(benane egen ) Wald O l @ > wetoe 10 Noute to woemel woes

             **I                                                                   d              .

Come too erw Weid to Q- macnonoms w ee 11 8 Weid 12 Q Wold 13 @ Wed 14 Q Wee 15 Q Nonle Forgirgs Intet ( $1

        .)   Nonle Forprgs Outlet                  ( $            l
                     -                                              3 vessel Shed - Outs 40s                C            l Upper Head                             '
                                                                &H Lower Head                    -
                                                   @              F-.

veneelnenes  ; e ; Enooswo Head Ratge i C F-* voud stume H o - cs m . H 4  ; hstrument une l 6 k Perstremone , , , , ', ,

                                          -0       -6                 -7             -6         -5             -4         -3 tog 10 (Fakase/ Year) i A3-11

i A3,5 References for Appendix 3

1. . Risk Based Inspection . Development of Guidelines, " Volume 2 - Part 1, Light Water Reactor (LWR) Nuclear Power Plant Components, ASME paper CRTD Vol. 20-2, 4

American Society of Mechanical Engineers, New York,1992. 2.- T.V. Ve et al., " Estimates of Rupture Probabilities for Nuclear Power Plant Components: Expert Judgement Elicitation," Nuclear Technology, Vol. 96 American Nuclear Society, LaGrange Park, Illinois,1991.

,           : 3.       T.V. Yo et al., " Expert Judgement Elicitation on Component Rupture Probabilities for Five PWR Systems," Reliability and Risk in Pressure l'essels and Piping, PVP-Vol. 251, pp.127,140, American Society of Mechanical Engineers,1993.

4. E.J. Bonano et al.," Elicitation and Use of Expert Judgement in Performance Assessment for High Level Radioactive Waste Repositories," USNRC, NUREG/CR 5411 (Prepared  !

for NRC by Sandia National Laboratories, SAND 89-1821), May 1990. t

5. USNRC," Severe Accident Risks: An Assessment for Five U.S. Nuclear Power Plants, j- Final Summary R ort," NUREG-1150, Volume 1, December 1990.

6. D.L.J.B. Bernreuter et al. " Seismic Hazard Characterization of 69 Nuclear Plant Sites East of the Rocky Mountains," USNRC, NUREG/CR 5250 (Prepared for NRC by

Lawrence Livermore National Laboratory,UCID 21517), January 1989.

7. "Probabilistic Seismic Hazard Evaluations at Nuclear blant Sites in the Central and Eastern United States: Resolution of the Charleston Earthquake lssue," NP-6395-D, Electric Power Research Institute, Palo Alto, California,1989.

8. M.A. Meyer and J.A. Booker, " Eliciting and Analyzing Expert Judgement," USNRC, NUREG/CR-5424 (Prepared for the NRC by Los Alamos National Labora:ory), January 1990. --

9. A. Mosleh et al.," Methods for the Elicitation and Use of Expert Opinion in Risk Assessment, USNRC, NUREG/CR-4962 (Prepared for the NRC by Pickard, Lowe and Garick, Inc., PLG-0533), August 1987.

10. . O. Svenson, "On Expert Judgement in Safety Analyses in the Process Industries," Journal, Reliability Engineering andSysicm Safety, Vol. 25, pp. 219-256, Elsevier Applied Science, London and New York,1989.

11. T.A. Wheeler et al.," Analysis of Core Damage Frequency form Internal Events: Expert Judgement Elicitation," USNRC, NUREG/CR-4550, Volume 2, (Prepared for the NRC by Sandia National Laboratories. SANDS 6-2084), April 1989

12. -N.R. Ortiz et al., "Use of Expert Judgement in NUREG-1150f Proceedings of the International Topical Meeting of Probability, Reliability and Safety Assessment, American Nuclear Society, LaGrange Park, Illinois,1989.

A312

    -s-  13. USNRC," Reactor Safety Study _- An Assessment of Accident Risks in U.S. Commercial i

Nuclear Power Plants," WASH 1400 (NUREG 75 014), October 1975,

14. J.P. Kotra et al.," Branch Technical Position on the Use of Expen Elicitation in the High-Level Radioactive Waste Program," NUREG-1563 November 1996.

15. C. Genest and J.V. Zidek, " Combining Probability Distributions: A Critique and en Annotated Bibliography," Statistical Science, Vol.1, No.1, pp. I 14-148,1989.

16. J.%'. Tukey," Exploratory Data Analysis,"' Addison-Wesley, Reading, Massachusetts, I

i-4-- I A313

^ Appendix 4: INSPECTION STRATEGY-RELIABILITY AND ASSURANCE PROGRAM The purpose of this appenoix is to illustrate one acceptable method for identifying the nurnber of welds (as well as other structurallocations) to be inspected in a risk-informed inservice inspection program, This appendix relies on statistical sampling techniques. As such, certain terms typically used by statisticians should not be confused with those used elsewhere in this regulatory guide. For example, the term consumer risk, or risk, as used in this Appendix,is not to be confused with the plant risk (CDF or LERF) used elsewhere. The plant risk used in the previous sections focused on: assessing the changes to public risk resulting from replacing existing ISI programs with the risk-informed ISI programs; and assessing high and low safety significant pipe segments. This appendix uses the term risk as used by statisticians when applying statistical sampling techniques. Here, risk refers to the probabinty of experiencing a detectable leak in a pipe (versus a break). Keeping this distinction in mind, the following provides one acceptable process for iffentifying the number of pipe elements to be inspected in a RI ISI program. This process incorporates reliability, confidence, and the probability of detection (POD) of the inspection procedures to identify degradation prior to tak. This method is extracted from a paper by Perdue (Ref.1) and augmented by Dr. Lee Abra.r%n (from the NRC), through the ASME Research program on RI ISI. For reference, we will refer to this method as the Perdue Abramson method. The Perdue Abramson method focuses on two analyses. The first analysis focuses on flaws and the potential that a flaw exists and develops into a leak. The second analysis focuses on the global operating experience that directly compares observed leak frequencies with the target leak frequency. Combined, the process provides a check and balance. The following sections will:

• Introduce the concept of statistical risk for quantifying the adequacy of an inspection plan.
• lliustrate a general method that can be applied to calculate risk for any reliability demonstration under the implicit assumption of perfect ability to detect a flaw given that the flaw is in the sample drawn.

         +        Incorporate how to address less than perfect ability of detecting a flaw given that the flaw is in the sample.

• Assess the implications for calculating the confidence / assurance that the srmpling plan achieves the desired level of risk.

A4.1 The Concept of Statistical Risk Consider a hypothetical pipe segment that consists of eight potentially inspectable elements (welds) that have not been previously inspected. Assume further that no risk informed or other information is available so that, from the plant ISI team's perspective, the eight elements are clones of each another. Assuming that we stay within the current Section XI rules, one quarter (25%) or 2 of the eight elements in this segment can be randomly selected for inspection in an upcoming outage. I A41

if we inspect the 2 elements, what confidence can we place that the other elements within the segment are of similar condition? The question is similar to asking what " risk"is attached to this particular sampling plan? Risk is a concept from the field of statistical acceptance (or inspection) sampling that can be defined as follows. Assume that one specifies that a minimum reliability level for a lot is X defects, if a sample drawn from that lot is inspected and the whole lot is judged to be " acceptable"if the sample contains no defects, then risk is the probability that the lot wiii nave more than the X permissible defects, whenever the sample contains no defects. Equivalently, risk is the probability that the inspection plan willlet a lot (consisting of the elements of interest) be accepted with an unacceptable level of defects. Acceptance sampling or reliability demonstration is concerned with developing plans that " demonstrate" specified levels of risk or, equivalently,

  " confidence" (= 1 rninus riskL To calculate risk, one needs to define:

Lot size

  .       Sample size

• Flaw or defect Acceptance number (i.e., number of flaws found that willlead to rejection of the lot)
• A priori probability that a lot contains X defects

  .        Minimum allowable reliability level to be demonstrated.

The ASME Section XI can be said to provide definitions or guidance for all but the last item, the minimum reliability level to be demonstrated in particular, the current code implies acceptance number of zero (more about this later). As for the minimum reliability to be demonstrated, it is useful to show the confidence associated with various postulated ' minimum reliability levels. A4.2 Calculation of Risk The measure of the minimum acceptable reliability levelis the f ailure rate, where 'f ailure' is typically defined as a pipe break. Inspection, however, is concerned with finding " flaws" before they turn into leaks and breaks and, hence, there is a need to translate the f ailure rate measure into an equivalent number of (code defined unacceptable) flaws. Information for a representative system may indicate, for example, that only four out of every 100 repairable flaws can be expected to propagate to a leak and only 1 in 1000 of the latter to a rupture over a 40 year interval. Such information, which is potentially obtainable from the combined exercise of structural reiiability and risk assessment models, and probabilistic encoding of caqineering judgment, can be used to translate a specified f ailure rate into an equivalent numaer of flaws or vice versa. For illustrative purposes only, returning to the simple hypothetical example of 8 elements in a pipe segment, the following assumptions are made:

           +

Probability of a flaw exceeding 10% of the pipe well thickness in any one of the eight welds = 0.0065

           +

Conditional frequency that a flaw will grow to a leak /yr/ weld is 3E-5 Civen a probability of .0065 that any element will turn up flawed, the binomialdistribution for N = 8 and p = .0065 can be used to calculate the probability that 0,1,2 et cetera flaws will exist in the lot of 8 prior to inspection. This is illustrated in column 3 of Table A4 2

A4.1 rom spressheet model (Ref.1, where, for example, the probability of precisely zero 1 defects in the lot is 95%,1 defect = 5% and so on. Column 2 of Table A4.1 contains the failure rate for each number of flaws as calculated by fracture mechanics methods. Thus, given that one flaw has 3E 5/yr chance of becoming a leak, then 2 such flaws have about 6E 5/yr chance of producing a leak ano so on. Column 4 contains the cumulative counterpe't of the binomial distribution in column 3. Thus, for example, the value of .999 in column 4 = 0.949 + 0.0497 from column 3 and can be interpreted as "the probability of observing 1 or less flaws-or, equivalently, le probabl/ity of a leak frequency of 3E 05 orloweris 99.9%." This cumulative distribution is dubbed the Pre-/S/ Probability Curve. It indicates, for example, that there is a 99.9% chance of finding one or fewer flaws or, equivalently, thPt there is a 99.9% probability that the failure rate would be no more than 3E 5/ year in the absence of inspection. This, of course, implies a 0.1% chance that the probability of a leak would be more than 3E 5/ year. This 0.1% is the risk in the absence of inspection. Interpreted within the context of Bayes' theorem, the distribution in column 3 of Table A4.1 can be called the " prior to inspection" distribution. Column 5 is called an " operating characteristic" or OC curve in acceptance sampling. For purposes of Bayesian reliability demonstration, however,it can be interpreted as a " likelihood" function because it shows < the likelihood or probability of accepting the lot-given that said lot has the number of flaws - indicated in Column 1. Like any OC curve, this one is calculated by using the hypergeometric distribution, which is tabulated in (Ref. 2) and is also built into a number of software packages (e.g., EXCEL), Keep in mind that the specified acceptance number for this example is zero: that is, the lot will pass only if zero flaws are found in the sample of 2 elements. Thus, referring to the second row in column 5, for a lot size N = 8, sample size n'= 2 number of defects in lot k = 1, the hypergeometric distribution can be used to calculate that the probability of finding x = 0 flaws is 0.75. The analogous probability for k

         = 2 and x = 0 is 0.536 and so on. If the acceptance number had been say,1 flaw, then

! the calculations - would use x = 1 and proceed to find the probability of (8,2, k 1) for different values of k. If a dif ferent sample size, say 3, had been used then the probability to look up wculd have been ( 8,3 k, x). Given the prior and the likelihood function, the next step in the application of Bayes Theorem is to simply multiply the two columns (i.e., column 3 times column 5) to get column 6. The latter column is not itself a proper probability distribution because it does not sum to unity. This is fixed by summing column 6 and then dividing each of its elements - by the column sum to get the post-Inspection" probability distribution in column 7. The cumulative counterpart of the latter distribution. called here the " Post /S/ Assurance" distribution is column 8. i To examine the effect of the target leak frequency goal, assume that the minimum allowable reliability is associateo with a f ailure rate of 1E-6 per year for the lot (not per element but rather for all 8 elements that make up the 101). Assume further (for the moment) that if a flaw appears in the sample, the inspectors will see it (POD = 1). Column 8 of Table A4.1 indicates that if the sample passes the inspection (i.e.. if no defects are found), then we have 96.2% confident that the reliability is no worse than the maximum allowable failure rate of 7E-6/ year. Equivalently, the " risk" probability associated with this

     )

1 A4-3

inspection plan is 1 .962 = .038 or 3.8 percent. Once a specified level of risk" is defined, dif ferent inspection strategies can be evaluated by the above method until one is found that meets the goal. Table A4.1 Evaluation of Risk for N = 8, n = 2, and Zero Defect ._ Acceptance Criterion sw1Nr AG c20;X- . 3- . jL v

                                                                          <ei3         -d     61   -
                                                                                                           -73       M at 91 No. of      Condinonal    Benoimal Protxd=ht) 15c ISI (i c.. No     OC Curve       Col. 3 x       Post-        SPost tSI 7 Ftaws (k)in Leal Frequency of L 1 laws in the lot ISI) Probabihi>   1lypergeon,etric    Col 5     Inspechon     ; Amurance A N Elements     leak /yr/ Lot  (Prob ofa Daw >      of L or f ewer      Dutribuhon                Probabihty      Probability ofk
      "          Given a Daw        U.11 hnknen of Ilaws in 1 he loi                               That L Hsws of fewer Flaws MtI Wall        The Pepe Wall

• Probabihty That 0 are m the lot Thie'.ncss 6.51; 3'ucid)

[.]NnblStM-llaw s are in the and Given J(Ct Sample of 2, None are in Sum of Col:7) Conditional on L the Sampic . n2r <

                                                                       ! laws in the 1.ot              (Col 6 /          '

K (0 L.O it) Sum Col 6) ;Q;, y3 0 0 0.949 0 949 0.949 1 0.962 70.962i 1 0 00003 0 0197 0.999 0750 0 0373 0 0377 10 999 1 2 0.00006 0.00114 1.000 0 536 0 00061 0.00062 i1.0007 3 0.00009 0 00001 1.00000 0 357 5.3 E-06 5 4E.06 El000} 4 0.00012 0.00000 1.00000 0 214 2.6E-08 2.6E-08 1 000 # 5 0.00015 0 00000 1.00000 0.107 6.RE 1I 6.9E 1I + V1.'000% Col. 1.00000 0.987 c ' Total ' ' Key: N = Lot (population) size (8) n = Sample size (2) k = Number of defects in lot (18) x = Number of defects in sample (0) A4.3 Correction For Imperfect Detection Table A4.1's OC curve in column 5 implicitly assumes that the nondestructive evaluation (NDE) techniques used to find flaws are perfectly accurate -i.e., if a flaw ends up in the sample, then it will be detectec and properly sized. The OC curve can be corrected to reflect any hypothesized or real NDE level of accuracy (usually expressed as the probability of detection or POD). Figure A4.1 illustrates the logic for an imperfect detection process where it is assurned that one flaw exists in a lot. The outcome of a sampling process could:

1. Detect the flaw if it is in the sample. and reject the 101

2. Not detect the flaw even if it is in the sample (due to the inaccuracy of the detection process), and accept the lot, or A4 4

i

3. Accept the 101 because the flaw was not in the sample selected for inspection.

11 is assumed that there are no f alse detections, i.e., NDE never calls an item defective when it is not. 4 Detect Ftw Reject lot M ' 111w in Sample

                                                                        . [\

Do Not Detect Sw m Arsep tot I Ww n bt ,

                                       .~

No Ww in Sample Accep let

                                                                       -5                      i Figure A4.1      Single Sample Plan Logic Only for the case where the flaw was within the sample and detected, would the lot be rejected. The lot would be accepted if the flow was in the sample and not detected or if the flaw was not in the inspection sample. Thus, the probability of detection can have an important role in the analysis and needs to be addressed in the analysis.
   )   The probability of accepting a lot, given that one flaw exists in the lot, is the sum of the probability of all the paths identified in Figure A4.1. Applying the hypergeometric distribution function to this process, the probability of accepting the lot is:

HYPGEOMDIST(0,2,1,8) + HYPGEOMDIST(1,2,1,8)*(1-0.65) Where: HYPGEOMDIST(0,2,1,8) signifies the probability of getting zero flaws in a sample of 2, given that the lot has one flaw in a lot consisting of eight elements, and HYPGEOMDIST(1,2,1,8)is the probability of getting one flaw in a sample of 2. given that the lot has one flaw. The term (10.65) is the probability that the flaw will not be detected by the detection technique (1-probability of detection). Note that in practice, the probability of detection depends on both the mechanical detection technique as well as on the capability of the inspector performing the inspection. The existing Section XI of the ASME Code calls for a double sampling plan. As an example, a double sampling plan can be summarized as follows: Take a sample of 1 and accept the lot if no flaw is found in that sample. Otherwise, take another sample of 1 and reject the lot if a flaw is found and accept the 101 if no flaw is found. In general, if a flaw is detected in the sample, then take another sample of equal size. If a flaw is found in the second sample, then reject the entire lot. The logic for this is more complex, as illustrated in Figure A4.2.

   )

A4 5

l Let us follow an example for the case leading to accepting the lot. The application of the hypergeometric distribution function takhs on the following representation for 2 flaws in a lot with an initial sample of 1: Deseet Flew Reject L+t ; Fhw h / T 1md Sasaple Fine nn - Desert Floe / \ Don't Detect Flew 5***''

                                                                      \    No Flaw in 2nd Semiple                                                      Accept Let es Samiple [
                                                     \ Don't Detect Flaw                                                Accept Let
                      ,No Flew ta 1se seample                       Accept Los                                         ;

E , Figure A4.2 Double Sample Plan Logic HYPGEOMDIST(0,1,2,8) + (HYPGEOMDIST(1,1,2,8))*(10.65) + ( 1 H Y PG E O M DI ST (0,1,2,8))

• 0.65 ' H Y PG E O M D I S T(0,1,2 1,8 1 ) +

( 1 HY PG E O M DiST(0,1,2,81)

• 0.65( 1 -0.65) * ( 1 -HY PG E O M DIST(0,1,2 1,8 11)

The results of the above hypothetical example are listed in Table A4.2, A4.4 System Assurance Example Calculation The methodology described above (applied to select a sampling plan for a single lot or segment) can be cpplied to provide a suitable level of confidence that a target leak frequency would not be exceeded. The NRC finds 95 percent confidence or assurance that the target leak frequency goal will be met as an acceptable c clive for the system in question (e.g., summation of all the HSS segments in a system). However, achieving a 95 percent comidence for each segment of a system does not insure 95 percent confidence that the system itself will meet the target leak frequency, it is important to remember that selecting a single segment sampling plan on the basis of achieving a confidence of at least 95 percent will often necessitate choosing a sampling plan which yields considerably more than 95 percent confidence. This is demonstrated in Table A4 2, which adapts results from the Surry pilot plant, presented at a public meeting of February 12,1997 (Ref, 3). Two segrnents RC-41 and RC-42,43, could achieve the 95 percent confidence level only with 100 percent of the elements were inspected; thus producing (to 5 decimal places) 100 percent confidence in each segment that the leak frequency will be greater than or equal to the target rate. Suppose that none of the remaining nine segments are inspected because, in each case, their Pre ISI Confidence meets or exceeds 95 percent (this is " Plan A" in the second column of Table A4-2). The resulting RC SYSTEM confidence level actually l { A4-6 l

1

                                                                                                                                                           ?. -

_ 'v q

                                        'I alife A4.2                     Evaluation of Risk Using Bayes Theorem for Perfect (POD =1) and Impes tcct (POD-0.65) Prohafiility of Detectiots Cases 9                     in                       33                 II                     11                         TJ 1                   2                    3                      J                     $           6             7             R

b. 4.t Ingleal limi=*wat l' c t%I es c. <K'Cowse Cal 4s Ibt- IWW 4 'C Cears e ('el %% Cel ' ' (Ibt1%I Dewl4e M S M le %M Sede $mi (And4c.14 kne i rsdi samrW2. (Pe w P i t re.+ f,MD 6 0 61) i l m. l eat se f .e l%Al.ith W Sal %I) Col ? Ingwie we %2 ente 11Isw. Pr.htality texta = ample- 2 ) I%%bt.es) .IB D 4 65)~ dk ce twee . PbA4L ce :

en : rs.J. b.lo3 el itau, Tc.c fl L c Isc, (Cal 6 h amrle ' t i 8.c4 la Pech s(L er. m s i et of R I laws Cet69 tw at t SamCet te Temer Tim

                                                                                                                                                    " f e"tr                                                                                       ,-
                                                                                                                                                                                                                                                     ,,       :G  -

l'I .n. . I=

                +           o                   o                 es 9-39               ft 949                    I        es 949        ft 949       o 949                               I              e 9 39                      et 939              09W                   't 9f 2                    f'#97
               -J 0 992                                             0 f t$97                    (J ft 217
                                                                                                                                                                                                                                                      ' ft,949 #               0 999                 A ft 1779 l            resawatt               vp f t 997             e a's9                    9       0ft197        () U197                                           1 0 9t9     '900t!?        O fwlll2       I f7#1                        0 929              o fwe109                    O rwtif**             IfMW9'                I fMW)                     I O8W1 2             o f unP w.           ft fMll l J              IfMW) 1 1f '89                    % 13 fet             s fp10^                t fwyv               ~ t itrwp 4            vi ewwwrs            fl ewwNil                114w)                 0 999      0 44W901      fi fwww'l       1880f1                       O R *O l tww)                       0 73R              M 7I'J)W                    W 7I "M              'I000'                  I fwY                   ~ 1 GEW '

4 Hfe'Wil? O(NHWwl 1 fWut O 9ff9 0 fMF) f1 fw)fwMJ 0 000 ofwwwwt I fwwl 0 564 9 67-80 16f 14 ~ 1.W 1W IM 4 ft 8wWtl 4 fi fM M WND $4wN) 09 1

                                                                                                                                                                                                                                                  ^"           ^<

rI I fywwwi j-I twe I fwwvio I (wws r j f.eal in

                                                                                                                                                                                                                                                                                                                                   ')

4 k l r!

                                                                                                                                                  '        ' ' - ' - ' ' - ' ' - -' ' " ' - - ' '       5' J. - . _ . . . ' '  ,.:,:Y      '- . . - .

1 demonstrated is the probability that no segment will exceed its target leak frequency, and this is equal to the product of the individual segment confidence probabilities in the third Column: SYSTEM Confidence = [] (Segment Confidence Probabilities) (Equation A4 U which comes to 98.3 percent. Thus, even though no single segment is required to demonstrate more than 95 percent confidence, the resulting RC system confidence exceeds 95 percent (for the " safety significant" segments of interest). This will not always be the case, but the system result can always be checked by taking the product of the segment confidences associated with the sampling plans actually chosen. Table A4 2: Surry RCS Segment Results Segment (with Plan A: Number Plan A: Plan B: Number Plan D:

        # of elements    of Elements                         Confidence          of Elements                                    Confidence in the         Inspected                      (probability leak        Inspected                                 (probability leak Segmera)                                        frequency below                                                    frequency below target)                                                            target)

RC 44,45,51 0 1.000 1 per segment 1.000 (42) RC-41 (3) 3 1.(MM) 3 1.(XX) RC-42,43 (6) 3 per segment ( = IJkN) 3 per segment 1.000 6) RC 18 (7) 0 1.000 1 1.(KKl RC 16.17 (14) 0 1.000 1 per secment 1.(K)0 RC 37,3S,39 0 0.999 1 per segment 1.000 (17) RC 19 (7) 0 1.(KK) 1 1.(K K) RC-27,28,29 0 0.984 1 per segment 1.(K)0 (51) RC-10,11,12 0 1.000 1 per segment 1.000 (6) RC 13,14,15 0 1.000 1 per segment 1.00() (12) RC-07,08,09 0 1.000 1 per segment 1.000 (30) RC SYSTEM 9 0.9S3 31 1.tKK) Assuring an Acceptable System Confidence Assume that the system product f alls short of the 95 percent threshold (or assume that the product of alt relevant systems f alls short of the required Plant-wide confidence). " Plan B" in the Table could represent a second iteration in which the licensee would return to augment Plan A by selecting a minimt.m of one element to inspect from each segment. This produces an increase in RC system confidence to essentially 100 percent. Plan B is in fact the approach actually recommended for the Surry RC. Based on this analysis, the following process can be used to assure acceptable system confidence:

                     ,. .                  _ . _,. _g- ,; _ _ . . -   . _ _ _          , _
           - 1. Select a sampling plan for each segment that achieves at least 95 percent confidence (no.more than 5% risk of exceeding target leak frequency), subject to the constraint that at least one el ment will be inspected in each high safety significant segment..

2. Calculate system confidence as the product of the segmant confidences associated with the sampling plans initially chosen, if system confidence is below 95 percent .

then tank order the segments and proceed to augment inspection plans in the worst

             - segments until the requisite system confidence (that no lot will exceed its target leak frequency)is achieved.

A4.5 The Global Analysis The following presents the global analysis of the Perdue Abramson method for calculating the number of inspections and for monitoring adherence to the leak frequency targets or

    . goals. The global analysis assures that a specified target leak frequency is not exceeded for a given system of high safety significant/ low f ailure potential pipe segment. The target leak frequency is specified in terms of the frequency of leaks per year per weld. The analysis
    - consists of the following steps, as shown in the flow chart in Figure M 3.

1. Calculate the lesix frequency for the given system without inspection.

2. If the calculated leak frequency does not exceed the target leak frequency, then no -

inspection is necessary, except for one weld to satisfy the defense in depth ..) consideration.

3. .lf the calculated leak frequency exceeds the target leak frequency, then some inspection is necessary. Specify an inspection plan and recalculate the leak frequency.

4. If the recalculated leak frequency is less than the target leak frequency, then implement the inspection plan.

5. If the recalculated leak frequency exceeds the target leak frequency, then a more stringent inspection plan is necessary. Modify the inspection plan in step 3 and recalculate the leak frequency.

6. Iterate through steps 4 and 5 until the inspection plan results in a leak frequency which is less than the target leak frequency.

Assuring the Target / Goal by the Global Analysis The target is to assure a maximum acceptable leak frequency per weld in a system consisting of N welds. For most cases of interest this leak frequency is sufficiently small so that the chance of more than one leak in the system in a year is negligible. Therefore, it is assumed that at most one leak will occur. (The methodology can be extended if this assumption is not valid.) Accordingly, the leak frequency for the system of N: welds is simply the probability that one of the welds will develop a leak.

i Denote the maximum acceptable leak frequency per weld by r, Then the maximum A4-9

g -

• m wy 'wp 1 m+ 4.y7' 2

                       's & * ' ..          L' \ '               >                                                                                      -

t' >- 6 , qg ~ - . s'y ' c-

     /f

p. +:,+

                    ' SYSTEhl                                       '[

v. .. . . -

l NO INSPECTION pggggy 39 3 * ; wp , T ; 4[I / TS gO (TES; g. M EETTARGET E W  ? '

                                                                    & TAR 5ET?);                                                      ~#'
                                                                                                                                                               ' (OTi
     ,,,                , , , . ~
                                                                   ,\                             myy                                       . <               yog    ,l,ER       gyggSg            111AN
     ;y ' _ [ _ _
                                                                          %.d                                                                      ,
                                                                                                                                                      ,           IN 1)EPTH)

FREQUENCY OF - + + t.;;g A LEAK W/O - / 3

e. INSPECTION -

wd- '

          ;c;                                                                                                                         s

_r ,

                                                                                                                                                                              ,                    ,y;        a W                                                                                                yI (n  ;9           ..          .   .

NO: 4 SPECllY -

4 ' E " INSPECTION

              ?
         . AE :. PLAN y-                                                    .                                                               m.
                  ,.k[              ')y'                                                                                                             '

3. N. - i IMPLEM ENT -

e dMEETS [. - ygy' S . INSPECTION 1l-THE.?

i LEAK RATE ' PLAN.

                                                                    ] TARGET?][

k

            +

n .~ / .

             *~

A;%;; ;;, > . yo. ' l# . . ,

                  'i.6 W ,                   ,

Figure A4.3 acceptable leak frequency for the system is Nte . Equivalently, the maximum acceptable probability of a leak i'1 the system is Nro. The purpose of insptction is to assure that the maximum acceptable leak frequency et or Nro is not exceeded. The inspections considered here attempt to identify flaws which, if not repaired, have the potential to develop into leaks. For any given system. its leak frequency depends on the number of flaws remaining af ter inspection and the probability that a flaw will develop a leak. In the discussion below, it is assumed that ai! welds in the system have the same probability of (i) having a flaw, and (ii) having the flaw result in a leak. We will then show how the analysis can be generalized to the case where these probabilities are not constant. First, consider the case where no inspection is performed. Let A4-10

       };                                          p = Probl a weld has a fisw}                                          ;

! q = Probl a flaw will develop a leak}. Then the probability that any given weld will develop a leak is pg. The leak frequency for ' the system is the probability that one of the welds in the system willleak and is equal to Npg. Comparing this with the target of Nr o, we conclude that: If pq s to, no inspection is necessary to meet the target goal. j If pq > to, inspection is necessary to meet the target goal. , if inspection is performed, then the leak frequency will depend on the initial distribution of flaws and on the probability that one or more flaws will escape detection, Let k be the-number of flaws in the system. Then k has a binomial distribution with parameters N and

p. Conditional on k and on an inspection strategy S. let G (k) = Probl no flaws are detected l k , S .

Denote the leak frequency for the systern by R. Then R = Prob lone leak in the system}

                                      =      Prob (k) G,(k) Prob (leaklk) 3 k.o u r  g s
                                      =[n.o r k  s p * (1 -p)" G,(k) ky
                                      =g[Np(1 -p)N G/ l) +N(N- 1)p2 (; .p)x-: gjg)#,,,)                  {1}

As an example, consider a system with N = 8 welds and p = 0.0065. Let S =-{ inspect 2 out of 8 welds and accept the lot if no flaws are found in the sample of 2}. Then Prob {k) and G (k) are given by the binomial and hypergeometric distributions, respectively, ) k Prob {k) G.{k) , l 0 0.949 1. 1 0.0497 0.750 1 2 0.00114 'O.536 l 3 0.00001 0.357 A4-11

Substitution into Equation 1 yields: R = 0.0385 g (2) This must be compared with the maximum acceptable leak frequency Nto= 6t, Accordingly, the inspection scheme S meets the target provided qs 207.8 to (3) For example, if to = 10-' , then any q < 2.1 x 104 meets the target. Generbilzation of the Global Analysis in many cases, tne probability of a flaw and the probability that a flaw will result in a leak may differ from weld to weld. If there are N welds in a system, let p, = Prob { weld / has an unacceptable flaw) q, = Prob { weld i will result in a leak, given that weld i has an unacceptable flaw) for i= 1.,2,..., N. If no inspection is pertoimed, the leak frequency for the system is: N O $)h,'

                                           ,,i Comparing this with the target of Nr o, we conclude that:

If Ro s Nr o, no inspection is necessary to meet the leak frequency target, if R, > Nr , inspection o is necessary to meet the leak frequency target. if inspection is necessary, set p' = max { p,, p,, ... , pu} and o' = (max q,, q, , ... , q,). A conservative approach is to assume that all welds have the same probability, p', of having an unacceptable flaw and the same probability, c' , that the flaw will result in a leak. Equation 1 can then be used to calculate an upper bound, R' , on the leak frequency by replacing p by p* and q by n' . R' can toen be compared with Nto . If R' s Nro , then the inspection strategy S meets the target. Otherwise, a more stringent inspection strategy is needed to meet the target, s A412

       !-                                                           A4,6 References for Appendix 4

1. R.K. Perdue,"A Spreadsheet Model for the Evaluation of Consumer Risk Associated with Inservice inspection Plans," attached to USNRC," Meeting Summary ASME Research Meeting on Risk triformed ISI: Statistical Sample Method of WELDS," January 8,1997.

2.- G.J. Lieberman and D.B. Owen, *lables of the Hypergeometric Probability Distribution, Stanford University Press, Stanford, CA,1961.

3. A. McNeill et al.," Example Applications of WOG RI ISI Process to Surry RCS,"

USNRC, Attachment to Meeting Summary," Meeting Summary - ASME Research Meeting on Risk-li formed ISI: Pilot Plant Preliminary Results," February 25,1997. A4 13

Appendix 5: RISK INFORMED INSPECTION PROGRAM DEVELOPMENT The methods discussed in Chapters 3 and 4 can be applied to support the development of improved inservice inspuction plans (e.g., what to inspect, where to inspect, when to inspect, and by what method) by integrating risk insights into the program. In this regard, the development of a risk informed inspection plan can be viewed as a three step process:

       .                  Step 1 - Selects the particular structural elements or locations that will be inspected; this selection should be made to ensure that the selected piping location 0 are those with higher f ailure probabilities, with greater impacts on plant safety, and those locations not expected or anticipated 30 years ago during the original design of a plant but identified through operating experience.

• Step 2 Define inspection strategies for the selected locations, such that the NDE methods and inspection frequencies provide desired levels for detection of degradation and reductions of f ailure probabilities.
• Step 3 Augment steps 1 and 2 to accommodate defense in depth review for unexpected degradation mechanisms.

The ris,k categorization study and the element selection process, described in Chapter 4, focuses on the first step. These methods can be applied to evaluate various inspection "T strategies to identify combinations of inspection methods (e.g., POD, sizing accuracyf and

  ')    frequencies at selected locations that can be effective in maintaining or reducing the f ailure probabilities of passive reactor components. To accomplish this target, the inspection strategies must address the f ailure mechanisms of concern, and have sufficiently high probabilities of detection and sizing accuracy so that the expected damage can be detected (given various frequencies of inspection) and the components repaired before structural integrity is impacted When analyzing the piping networks for f ailure degradation mechanisms,it is useful for the analyst to have a checklist table of degradation mechanisms, identification of materials susceptible to those degradation mechanisms, potentiallocations that are susceptible to the degradation mechanisms, and the contributing causes. The checklist, such as illustrated in Table A5.1, provides added confidence that the analysis takes into consideration the various degradation mechanisms and potential locations. The analyst also needs to consider acceptable approaches for determining the number of locations to be inspected (size of inspection sample) and the desired reliability and frequency of the inspections to be performed at these locations. Since several potential inspection stratefes may provide the desired maintenance or reductions in f ailure
       ' probabilities, the final selection can be based on other important considerations including man rem exposures to inspection personnel and cost effectiveness.

A51

Tcble AS.1 Check List af Degradation Mechanisms for Inspection of Piping Systems Susceptible Materials Susceptible Locations contributing causes Degradation Mechanism All materials Terminal ends Operating transients Low Cycle Fatigue Dissimilar metal welds High thermal expansion i Near snubbers ' stresses Near component nozzles Stress concentrations . Fittings Construction defects Mixing of hot and cold fluids Valve leakage Thermal Fatigue All materials Hot or cold water injection Therm %1 stratification valves (downstream from t, leakage) d Feedwater nozzles ) Counterbores I Horizontal lines 'i Vibratory Fatigue All materials Small diameter piping (e < 2- Rotating equipment [i inch) zi Terminal ends Socket welds I Elevated temperatures i Intergranuler Stress Stainless steels Welds Corrosion Cracking Heat affected zones High coot. ant conductivity ') Sensitized base metal materials High carbon grades of SS BWR piping Elevated oxygen levels PWR piping (CVCS systems) Residual stresses

                                                                              .        Cold springing stresses Staonant fluids               {p l                                                                                                                     r l-6.
                                                                                                                     +

4

                                                                                                                     ?

A5-2

                      .w
                                                                                                                    ._s!
                                                                                                                                )

Degradation Mechanism Susceptible Materials susceptible Locations Contributing causes Transgranular Stress Stainless steels Bolting High carbon or low carbon Corrosion cracking Iron-nickel-chromium materials alloys High oxygen High welding stresses Severe cold working Presence of chlorides or , sulfates Brackish environment Insulation materials with + chlorides

                                                                                                                               . Il
                                                                                                                                 'I Crevice Corrosion     Stainless steels Cracking              Iron-nickel-chromium                                                                      ,

alloys

                                                                                                                               -1 Primary Water Stress  Iron-nickel-chromium Corrosion cracking    alloys Intergranular Attack  Iron-nickel-chromium alloys
                                                                                                                                 !I Wet steam                          ;

Flow Accelerated Ferritic steels Elbows Reducers Single phase (water) flow l Corrosion Tee fittings Low alloy content  ; (erosion / corrosion) Low oxygen High Ph . I High flow velocities j li slurry Erosion All materials Raw water systems Sand or solids in raw water [ I ti All materials Pumps and valves Phase change }i cavitation wastage Hichiv localized areay Droplets [ 0 9 1 I, AS-3

O

                                                                                                                                            .1 P

Degradation: Mechanism Susceptible Materials- ' Susceptible Imcations contributing causes-i . JJ Microbiological 1y- All' materials Buried piping (external Exposure to organic materialm , Influenced corrosion- surfaces). Exposure to raw water l 1 ) (MIc)~ Other piping (internal Lack'of coatings' .

;                                                           Surfaces)                                 Lack of cathodic protection"                [

!. Welds Fittings i Heat affected zones i crevices General corrosion Ferritic steels Secondary systems Calvanic/ electrolytic

• Austenitic steels ~ Service water systems corrosion i (occasionally) Dissimilar materials (galvanic crevice corrosion effects) Acid attack.  ;

Raw water Salt water corrosion Brackish water corrosion Boric Acid corrosion Ferritic materials Primary systems Leak of boric ecid solutions O Pitting Ferritic materials PWR feedwater nozzles Leakage at thermal sleeves / joints *' t Structural Damage All. Materials Small diameter piping Water Hammer. compression fittings Impact crushing f Over Pressure ' I l Maintensnee errors y l i [ l-

                                                                                                                                         ,h l!

d r A5-4 , In

                                                                                                                                                 )
                                                                                                                                             !b

An inservice inspection strategy can be dafined by the following elements: Element 1: Sampling Strategy The sampling strategy is defined by the selection of structural elements that are proposed for inclurlon in the inspectinn program. The selectio' of structural elements should bs guloed by the calculations of risk categorization and should include additional elements to address defense in depth for lower risk components, and to address unanticipated generic failure mechanisms that have not been detected of that have not yet occurred. The strategy should incNde immediate expansion of the sample when flaws are detected during on ISI through sequential sampling based on feedback from 151 findings and operating experience. The structural elements (or locations to be inspected) should be appropriately defined, such that the defined volume of metal for the elemer's includes the criticallocations where degradation is mort liAe/y to ocest. Structural elements will be the basis for the

• examination volumes" to be addressed by the detailed NDE procedures, in many cases, th6 structural elements should include base metallocations well removed from the weld heat affected tones to ensure that the NDE covers locetions of stress concentrations, such 4 as weld counter bores.

Element 2: Inspection Method Inspection methods are selected to address the degradation mechanisms, pipe sizes and

 ' )      materials of concern. The inspection method includes the basic technique itself (e.g.,

ultrasonics) along with the particular equipment and the proceduies to be applied for detecting and sizing flaws. Candidate inspection techniques for piping include ultrasonic testing, surface examinations with dye penetrants (or magnetic particles), visual examinations, and radiography. In a larger context, monitoring methods such as leak detection, thermal transient monitoring, and acoustic emission monitoring can be used to supplement or replace nondestructive testing methods. Detailed aspects of equipment, procedures, and personnel qualifications are sigriificant f actors Nt govern the reliability of the inspections. The risk hformed inspection concept requires that the reliability of the. inspection method be established in order to justify the selection of a particular inspection strategy, Based on materials, environments, loads, and degradation mechanisms, probabilistic fracture mechanics calculations can establish the probability of detection, the sizing accuracy, and the frequency of inspection needed to meet targets for passive reactor component f ailure probabilities (see Chapter 4), Element 3: NDE Reliability and Performance Demonstration Qualification of the NDE system (personnel, procedure and equipment)is an important element of an inspection program, inspection systems with known reliability are needed to achieve the desired levels in f ailure probabilities consi: tent with the goals of the risk-informed inspection process, A risk informed inspection program should justify the , inspection reliability using data from pe formance demonstration programs,

      )

/ A5 5 \ .

Element 4: Time of Inspection The inservice inspection strategy must define when the inspections are to be performed. In most cases inspections are performed periodically at regular intervals such as with the 10 year interval of the existing ASME Section XI. A risk informed inspection program will identify the appropriate inspection intervals, such that the insp?ction program provides the desired maintenence or reductions in component friture probabilties. Inspection intervals must be sufficiently short so that degradation too small to be detected during one inspection does not grow to an unacceptable $1re before the next inspection is performed. This chapter discusses one approach for determining the appropriate examination methods, frequency, and level of qualification for the structural elements selected for examination in Regions 1 and 2 of Figure A2.9. As mentioned previously. SRRA tools have been and can be exercised to evaluate the effectiveness of a given examination method, frequency, and level of performance. Whereas Chapter 4, Section 4.3 of this regulatory guide focused on the selection of pipe segments and the number of structural elements to be inspected, this chapter addresses the select /on of /nspect/on strateples. Guidance is provided to ensure that inspections are performed in a manner that ensures that the f ailure probabilities of passive piping components remain acceptably low. To accomplish thic objective, the inspection strategies must address the f ailure mechanisms of concern and have a sufficiently high probabi'ity of ti etecting the expected damage before structuralintegrity is impacted. Section A5.2 discusses acceptable approaches for determining the reliability of the inspections to be perfortned at these locations, and the frequencies of the inspections. Since several potentialinspection strategies could provide a desired reduction in f ailure probabilities, the final selection by licensees can be based on other important considerations such es cost effectiveness and man rem exposures to inspection personnel. As mentioned previously SRRA tools have been and can be exercised to evaluate the effectiveness of candidate inspection strategies. A5.1 Elements of Inspection Strategies An inservice inspection strategy may be comprised by use of the inspection strategy table in Figure AS.2. This is accomplished by selecting one option within each category identified in Figure AS.1 (Ref.1). The fohowing address some of the major categories identified in Figure A5.1. Inspection Method Inspection methods are selected to address the degradation mechanisms, pipe sizes. and materials of concern. The insp3ction technique includes the basic technique itself (e.g.. ultrasonics) along with the particular equipment and the procedures to be applied for detecting and sizing of flaws. Appropriate inspection techniques for piping include ultrasonic testing, surf ace examinations with dye penetrants (or magnetic particles), visual examinations, and radiography. In a larger context, monitoting methods such as leak detection, thermal transient monitoring, and acoustic emission monitoring can be used to supplement or replace nondestructive testing methods. \ A5 6

5 Deta%d aspects of equipment, procedures, and personnel qualifications are significant I factors that gover4 the reliability of the inspections. The risk informed inspection concept requires that the reliability of the inspection method be estabi..hed in order to justify the selection of a particular inspection strategy. Time of Inspection The inservice inspection strategy must define when the inspections are to be performed. In most cases, inspections are performed periodically at regular intervals sucn as with the 10 year interval of ASME Section XI. The risk informed inspection program willidentify appropriate inspection intervals, such that the program provides the desired component f ailura probabilities (consistent with the PRA assumptions), inspection intervals must be sufficiently short so that degradation too small to be detected during one inspection does not grow to en unacceptable size before the next inspection is performed. Some techniques (e.g., acoustic emission monitoring) perform the inspections on a continuous rather than periodic basis. In other cases, the strategy may require inspections only after an unanticipated or a significant loading event has occurred, such as a severe thermal shock or a water hammer. Some inspections may be performed on a One time-basis, as for example, to verify that a degradation mechanism experienced at a similar plant is not occurring at the plant of concern, of to otherwise support continued plant operation, such as part of a license renewal process. NDE Qualification + Oualification of NDE (method, procedure, and personnel)is an important element of an inspection program, particularly for those components having high f ailure probabilities or safety significance. For such components, highly reliable inspections may be needed to achieve the desired f ailure probability goal. ~ A risk informed inspection program should have a technical basis for the inspection reliability inputs that are used in structural reliability calculations of estimated f ailure probabilities for proposed inspection strategies. Such a basis can be provided by NDE performance demonstration programs. Generic data from studies of NDE reliability can also be useful. Such generic data are available from NDE round robin exercises. The reliability of any inspection is dependent on the specific qualifications and skilllevel of the inspection personnel. In addition, the reliability can be enhanced by the use of inspection teams having qualifications that meet industry codes and standards, and by the use of methods and procedures with accepted capabilities.

    .)

AS /

Figure A5.1 Inspection strategy table. 3 Inspres6uH Tinie er N tW. l Aaestie.Hs Ort elespmrHe ha6Hpl6Hg NeNteep hlesheds insperthe Qualmrati.e. er Mrmetg3 hiethed NDl; hiethuds i

                                             \T.1                                               to Years          Perunswl                            Weide         cucumiratum            1%          TV canwres crocung'                                                                          Vuual hurtstes                                                                   Quahrwaiiasi                            hults              New            Yorums           Devers ledeiigue           Ordnum
                                            \T.3                                              Heruelmg         l'erromance                          I'lesurn             Irene     or 1. 2. A ) Helow  suhmaruws Orues                                        12 24 numtla         Denmauttati m                                             scratch Danape'                                                                                                         surraca'                                 No        kunnie Tools         ,

surface Cuisinuum lhsturical interraces New sequeidial ' Data hirategv in sne Renute' surgwwt 1.rdanced Occme botam Whaleser Renwived Vaual kawwal 6. Irwn ihmel Aweushis Vessel Ultramic Alla i e. Tesimg sis mre. aid

1. ion tientwiiW Ne lmpedien llawd a Ammn Monitarmg l'erronnnewe Degradaine Neuuan 0a.1 Noise Olvetives 1) Initial site Peru 2)seguential kune Renude 3)Clunce Repheatnn orsang>hng lxaisan!

Mechanical l'eriod Measurenwnts Metallurgical LAaniuntemi Development of NDE Methods This element of the inspection strategy, as indicated in - Figure AS.1, addresses the possible oevelopment of new and improved NDE methods to achieve levels of NDE reliability which are consistent with the goals of the risk informed inspection program identified in Section 4.3 (e.g., frequency of a leaA < 1E 06 per we/d-year), in most ceses, special development effort will not be needed, since existing NDE methods can be utilized or adapted. As indicated by Figure AS.1, such activities as the industry funded Performance Demonstration initiative (PD3 can be considered an appropriate development effort, since it serves to enhance NDE reliability. Sampi .ig Strategy In the context of this regulatory guide the sampling strategy is defined by the selection of an appropriate number of structural elements as described in Section A2.7 and Appendix 4. Expansion of the sample size (i.e., through sequential sampling)is addressed in the implementation of risk informed inspection through feedback of 151 findings and other information on structural degradation gained from operating experience. Such information should impact the estimates of component f ailure probabilities, and will result in approprias changes to the inservice inspection programs. A5 8 7 * ---'gw-- ,, - - - ,- , g-- ,, w - ein, , - e ei-=wrww wwwww-

         'h  Dellvery Method The effectiveness of an ISI strategy can be enhanced by the use of improved methods that provide better access to the selected locations. Improved access and the use of remote systems can also provide benefits in terms of reduced radiation exposures to the employees.

A5.2 Failure Ptobability Considerations An Inservice inspection program should ensure appropriate f ailure probabilities for the inspected structural elements, thereby rninimizing their contributions to the risk as measured by core damage frequency or by other risk measures. The licensee should justify the basis for the selected sample sire, of locations to be inspected and justify the effectivene's of the inspections at these selected locations, inservice inspection programs for piping,in accordance with ASME Section XI and/or other requirements, are performed to maintain confidence in the structural reliability of pipes, in terms of risk informed inspection one objective of inservice inspections is to maintain the f ailure probabilities to an acceptable low value. This section describes how considerations of quantitative goats can guide the development of risk informed inservice inspection programs. For example, it is proposed below that a factor of ten reduction in calculated failure probability (over the probability of no inspection) can be used as a guideline to identify effective inspection strategies. Such a goal also hetps to eliminate ineffective inspection strategies for which the sampling plans, NDE methods, and inspection frequencies are inadequate to deal with the components and degradation mechanisms of concern, in other cases candidate strategies may be marginalin achieving s ) the goal, in which case modifications to the NDE methods or to the inspection frequencies can be identified. Service experience provides specific examples to demonstrate that inspections can reduce f ailure probabilities. There are cases of large and growing cracks, and of areas of wall thinning whereby inspection programs have provided timely detection of the damage such that repairs were performed before the defect sizes became critical. On the other hand there are other examples whereby ineffective inspection programs have f ailed to detect large defects which have eventually resulted in pipe leaks or pipe breaks. Such ineffective inspections, performed at considerable expense and often exposing personnel to radiation exposures, have not contributed to piping reliability. While service experience identifies many examples of direct benefits from inspections which have provided examples of the timely detection and repair of piping, inservice inspections also provide other important indirect benefits which are more difficult to quantify. For example, the detection of ongoing degradation at a specific location not only impacts the f ailure probability for the inspected location, but also provides valuable information to the plant technical staf f (and the industry in general) regarding materials performance issues and the structuralintegrity of similar piping locations. Therefore, the finding of degradation during a particular inspection can have a significant impact toward reducing f ailure probabilities for a population of similar pipe locations, in such cases, the findings of a single inspection can be a key f actor that leads to important corrective actions (e.g., additionalinspections in accordance with requirements for

        -  }

A5 9 i

I l expanded or sequential sampling, improved operational practices to reduce stress levels, replacement of pipes using improved materials and designs, etc.). At a minimum, an adequate sample size includes sufficient representative locations within each piping systems to permit the detection of degradation mechanisms that may be opt *> ting within the 5ystem. These locations should, in part, correspond to locations for wh' *he probability of degradation is consider greatest, independent of the calculated risk imporn

• 9 parameters.

For the selected locations, the 151 strategy should be based on an appropriately specified > level of effectiveness for detecting structural degradation. An effective inspection strategy is a one that detects degradation before it grows through the depth of the wall. Licensees should identify the level of inspection effectiveness adopted as a criterion for the development of its proposed inspection programs. As an example, the following is an acceptable rationale for adopting a criterion of a f actor-of ten reduction in calculated failure probabilities for the goal of the candidate inspection strategies.- SRRA calculations indicate that if pipe f ailure probabilities are estimated assuming no impact from ISI (e.g., no inspection) and then calculated assuming ISl has an impact (i.e., accounting for the probability of detection of defects and the subsequent repair or replacement of the affected pipe), reductions in the f ailure probabilities (i.e., ratio of f ailure probability without ISI over f ailure probability with ISI) are about a f actor of 10 (Ref. 2), (Ref. 3), (Ref. 4), (R6f. 5), (Ref. 6), and Reference 8. Calculated reductions of failure probabilities, greater than a f actor of 10, can of ten be dif ficult to justify, due to the I limitations and uncertainties in NDE flaw detection probabilities, and the need for relatively frequent inspections for cases where cracks can grow relatively quick between inspections. Inservice inspection locations for piping in ASME Section XI, are defined for individual structural elements. However, it is recommended that the desired reductions in f ailure probabilities be established in terms of total contributions from groups of the structural elements being addressed. This approach minimizes the impacts of uncertainties in the assimated probabilities for individual structural elements. A graded approach for reducing component failure probabilities is considered appropriate, such that the most aggressive inspection strategies focus on the top contributors from the risk categorization, with reductions short of the f actor of 10 being acceptable for the less critical structural elements. A5.3 Integration of Probabilistic Structural Mechanics Calculations The selection of an inspection strategy for a structural element requires that the effectiveness of the candidate strategies in detecting structural degradation and reducing the f ailure probability of the structural elements be estimated. The effectiveness is i governed by several f actors including the NDE reliability (e.g., probability of detection), l inspection frequency, and crack growth rates, in this regard, limited historical data on piping failures provides little information on the impacts of inspections on these probabilities, and it is therefore necessary to apply structural mechanics models to quantify the expected benefits of proposed strategies. Furthermore, the inspection strategies of I l A510

,- - . ~ . , . . _ _ _ _ . _ . . . . . . _ , _ _ . . _ _ s 3 i interest are usually ones that will be newly implemented, and therefore an extended period of future operating experience would be needed before the f ailure rate data could indicate the offectiveness of a proposed strategy. Even then, data on structuralfailures willbe very limited, because actual failures (with or without inspections) are expected to occur only very infrequently. Efforts to calculate inspection related reductions in f ailure probabilities should cornpliment and build on the knowledge gained in recent years from ongoing work within the nuclear power industry by specialists in the area of NDE technology. This work has quantified the ability of NDE methods to detect and size defects in piping, and has resulted in new and improved requirements for p?rformance based demonstrations of the NDE methods, precedures, and personnel which are used to qualify the pipe inspections pttrformed at nuclear power plants. Applications of probabilistic structural mechanics calculations, as described below, are an extension on the current industry studies of NDE tells.bility. The calculations integrate considerations of NDE reliability (i.e., as measured by probabilities of flaw detection and sizing errors) with considerations of degradation mechanisms and inspection intervals. The calculations model the degradation mechanisms of concern to pipe reliability, and use probabilistic fracture mechanics methods to simulate the effects of periodic irgervice inspections. Results of these calculations provide a basis for screening candidate inspection strategies and identify the strategies that are the most effective in detecting growing flaws before such flaws become through wall cracks and/or cause pipe breaks or large leaks. Structural reliability models can be used to address the various f actors that govern the N ability of ISI to detect degradation and reduce f ailure probabilities. !'or some situations, j knowledge of only the probability of flaw detection for the proposed inspection method may be sufficient to estimate the effectiveness of a proposed strategy. However, this is seldom the case because the following additional f actors govern the effectiveness of ISI:

                   +        Detection probabilities are a function of flow size, if small flaws are important to structuralintegrity, many NDE methnds willlack the needed sensitivity. Therefore the expected sizes of f abrication and service induced flaws must be addressed by the structural reliability models.
  ' " ~ '
                   +

Flaws can grow in size over time when active degradation mechanisms are present. A structural reliability model must simulate the flaw growth rates, predict the sizes of growing flaws, and simulate the detection probabilities for the flaw sizes that are likely to exist when the periodic inspections are performed.

                   +

Small detected flaws need not be repaired if they are less than the acceptable sizes as defined by the ASME codes. Some of these unrepaired flaws will contribute to pipe f ailures.

                   +

in some cases there can be errors in measurements of flaw sizes. such that oversized flaws which should have been repaired are allowed to remain in service. Structural reliability models should simulate the above factors to evaluate the benefits of inservice inspections. The models should simulate initial distributions of f abrication flaws in terms of their numbers and sizes, and also consider the possibiht/ that degradation AS-11 l l

I mechanisms can initiate new flaws during the service life of components at locations that were originally free of defects. For example, the initiation of new flaws should be addressed for those cases that calculations indicate that failures can occur for even the smallest sizes of the fabrication flaws. The structural reliability model should simulate the population of flaws of various sizes over the service life of the component, and predict the flew sizes that could be present at the times when inservice inspections are performed, if particular flaws are detected and repaired, the model should then assume that these detected flaws no longer contribute to the f ailure probability, Probabilistic models of inservice inspection should address the following:

 +       The primary consideration is a representation of a probability of detection curve that corresponds to the specific NDE method / procedure / personnel, degradation mechanism, matetici, pipe size, and component geometry of concern. Sectlen AS 6 provides guidance on estimating the parameters for the curves for probability of detection (POD) as a function of flew size.
 .       Consistent with the realistic approach used by the structural mechanics codes to simulate other parameters, the POD curve used to simulate ISI should be based on realistic curves without consideration of confidence levels in POD values. Separate uncertainty analyses can deal with concerns regarding confidence levels.

• The combined effects of a sequence of periodic or repeated inspections should be appropriately simulated. The detection (or nondetection) of a given flaw by successive inspections, or by inspections using different NDE methods are not usually independent events. Those random factors (excluding flaw size) which prevent detection for one inspection will also tend to preclude detection for the next inspection. For conservative calculations, the combined effects of repeated inspections can be bounded by taking credit only for the inspection having the greatest likelihood of detecting the flaw (e.g., the periodic inspection corresponding to the maximum size of a growing flaw, or the NDE method with the maximum POD capability).

                                                                                                                          ~ ~

• The simulations can address the effects of pre service inspections on f ailure probabilities by treating this inspection as an inservice inspection performed at time equals zero within the service life of the component. However, the simulation of preservice inspections should be consistent with the assumptions made in estimating the distributions of initial f abrication flaws in the component, because pre service inspection is a consideration in estimating distributions of initial flaws. Double counting of pre service inspection effects can result if the simulated pre service inspection was already addressed in estimating the initial flaw distribution. Pre-service inspections should be included in the calculations only if the inspections are in addition to those used as part of the fabrication process, and then only if the NDE method provides an enhanced level of NDE reliability.
• The simulations of inservice inspections should address the f act that detected flaws (more specifically small flaws) are not repaired if these flaws are smaller than ASME code flaw acceptance criteria.

AS12

The structural reliability calculations can be performed using the same computer code as used to estimate failure probabilities for the PRA calculations and risk importance measures, in many cases the benefits of proposed inspection strategies can be estimated by reference to prior generic calculations (e.g., from the literature) for the f ailure mechanisms, component designs, operating conditions and inspection strategies of concern (References 2, 3, 4, 5, and 6). One potential benefit from risk informed inservice inspection programs is the possible reduction of radiation exposure to personnel from reduction in the number of locations of inspections of radioactive pipes. Applying the NRC's ALARA and defense in depth principles, the NDE method used in locations where the number of inspections was significantly reduced should be optimized in terms of its probability of detection capabilities. Part of the steps to identify optimum detection methods include:

• Select a structural mechanics model that addresses the cortponent, f ailure mechanisms, and inspection strategies of concern: '

  +        Define the rel; ability of the candidate inspection methods;

• Calculate the f ailure probability of a component assuming no inservice inspections are performed:
• Calculate the f ailure probability of a component for each of the candidate inspection strategies:
• Calculate effectiveness of candidate inservice strategies as the ratio of f ailure probabilities, with the baseline being either no inspection or the current inspection strategy.

The calculations described above should make use of leak probabilities where the leak probabilities are used as a measure of inspection effectiveness, and as a surrogate for estimating the effects of ISI on reducing the probabilities of pipe breaks. The application of leak probabilities have significantly less uncertainties and is consistent with the regulatory philosophy of preventing breaks. It also avoids a large number of assumptions and uncertainties associated with calculations of pipe break probabilities. The numerical difficulties of calculating very small values of probabilities for pipe breaks can also impose excessive computational demands, which are largely avoided if the focus is directed to calculating leak probabilities. One acceptable approach is to quantify the benetits of inspection strategies in terms of a relative f ailure probability, which can be expressed by various terms such as "f actor of improvement" and *insp6ction efficiency" as follows: Factor of improvement = P,/P inspection Ef ficiency = 1 P/P, P, = Failure Probability with baseline inspection strategy (e.g., no inspection) A513 1

. .:. ;2== .. = : = = .:= . = - w ., . . = = - - P = Failure Probability with inspection Strategy of Interest These calculations of relative f ailure probabilities, that compare allnative inspection strategies, have been found to be relatively insensitive to such f actors as uncertainties in the operating stress levels that govern the absolute values of f ailure probabilities. 1 If the baseline strategy is no inspection, the values of inspection efficiency can rt.nge from j between 0.0 and 1.0 with a value of 0.0 corresponding to no ISI or a totally ineffective ISI strategy (i.e., the same as no ISlh A value of 1.0 corresponds to perfect inspection, inspection efficiency is roughly correlated to the POD of flaws, and becomes the same as POD for the limiting case for which: '

             +         the POD that is independent of flaw sire, and

• all flaws are repaired without regard to their measured size.

The values for a f actor of improvement can range from between 1.0 and infinity with a ' value of 1.0 corresponding to a totally ineffective ISI strategy (same as no ISI), and a value of infinity corresponding to a perfect inspection. A5.4 Example Probabilistic Structural Mechanics Calculations The selection of inspection program requirements for key locations in piping systems can be supported by SRRA evaluations. The literature provides many examples of such calculations, including the work of Khaleel and Simonen in Reference 5. This particular study was performed with the pc PRAISE computer code as a series of sensitivity calculations for piping systems impacted by f atigue crack growth degradation. In this section we will present the results of both the individual SRRA calculations, and trend curves derived from the overall series of calculations. We will also describe how a selected inspection strategy (method and frequency) can be supported by the example trend curves, f Table AS.2 provides input parameters for the baseline case (no inservice inspection) of a 6-inch diameter pipe subject to f atigue cycling, which results in a calculated inak probability of only 6.0E 08 (cumulative probability per weld at 40 years). This modest level of f atigue cycling corresponded to a "Q Factor" of 1.0, where the 0 Factor is a measure of the magnitude and number of stress cycles for the piping location being addressed. The series of f ailure probability calculations of Reference 5 covered a wide range of 0 Factors corresponding to more severe conditions of stress cycling giving results as follows: Loading Condition 0 Factor I.eak Probability Low 1.0 10' = 1.0x104 Medium 108 108 = 1.0x 10

• High 10' 105 = 1.0x104 A514 3 y--
• g, . - - ..,.,ingmyp,__ y,., m .p , , _ _ _ _ _ _ _ , , _ , , . _ , , _ , _ _ _ _ _ . , , . _ , , _ , , _ _ _ _ , . _ _ _ _ _ .

         .       .       .  .                   .       .              .-... -        .w=---------------------- - - - - - - - - '

Table AS.2 PRAISE model of 1.Pl system: baseline case flaw Depth oistribution imponential (Mean Depth = 0.00 inch) Flaw Aspect Ratio Lognormal(Parameter = 0.689) Stress Through Wall Thickness Unitorm Tension Cyclic Stress Amplitude 16 Ksi / 6 cycles per year daldN Curves As given in pc. PRAISE Documentation Threshold AK for daldN 0.00 Flow Stress Normal (Mean = 43 ksi, C.O.V.' = 0.0977) Pipe inner Radius 2.76 inches Pipe Wall Thickness 0.662 inch Pressure 2.260 ksi Dead Weight Stress 3 ksi Thermal Espansion Stress 10 kai int nr+t inn rl$ PRf nnM fla tRt ,

            ' c.o.v. = coethcieni of vanadon = standard deviation t mean The low O Factor should relate to all piping segments in Region 2 of Figure A2.9. The medium and high 0 Factors should relate to sus:eptible locations in pipe segments Region

1. The remaining locations in those Region 1 segments should have low O Factors, as for segments in Region 2.

Required inspection frequencies can be established using the trend curves such of Figure AS.2 which were developed from a set of probabilistic structural mechanics colculations as described in Reference 5. For example, let us assume thet a licensee wants to reduce the probability of a leak by a f actor of 10. The curves of Figure AS.2 are for an ultrasonic inspection method designated "very good," with a probability of detection curve (POD) having a 50% probability of detecting a crack with depth 10% of the wall thickness and a probability of 90% in detecting flaws greater than 50% of the wall thickness. The objective is to determine the time interval between inspections that will detect 90% of the growing cracks which could become through well depth before the end of the 40-year design life. The curves of Figure AS.2 indicate that an inspection frequency of 10 years with the first inspection at 5 years (5/10) can achieve the f actor of ten reduction in f ailure probability. This reduction applies to a wide 'ange of cyclic stress conditionr (0 factor from 1.0E +0 to about 1.0E + 3 corresponding to 40 year leak probabilities of 1.0E 7 to 1.0E 1). The inspection efficiency decreases for higher values of f ailure probabilities, because the rates of crack growth are so high that the 10 year interval between inspections is inadequate. Fo' very low valuer. of the 0 Factor, the f ailure probabi;ities are also very low, because those failures that do occur are very early in life and are due to large f abrication defects which are not detected with the normal post weld inspections. These defects are best addressed by a high quality preservice inspection. The resultr of Figure AS.2 show that improved NDE methods (that is, methods having the ability to detect smaller defects) can justify the use of longer time intervals between periodic inspections. Application of such improved NDE methods, even with longer inspection intervals, can decrease f ailure probabilities compared to less sensitive NDE A515

method. The reduced number of inspections can also reduce radiation exposures to the workers performing the inspections. The relationships and/or tradeoffs between detection capabilities and inspection frequencies can be explained in terms of the sequence of events that lead to structural f ailures. This sequence consists of the initiation of small cracks, an extended time period of slow crack growth, and a final period of rapid crack growth. An effective inspection program detects small cracks before the crack growth rates increase to Unacceptably high levels. The maximum allowable time interval between inspections is dictated by consideration of the crack growth rates. This time intervalis governed by the difference between the smallest crack size that can be detected and the larger critical crack size that can result in a structural f ailure, with the optimum inspection interval corresponding to the time period needed to grow from the undetectable size to the critical size, For many cycle st'ess levels the small cracks at the detection threshold will not grow to critical size over the plant operating life, in such cases one high quality inspection early in life is the most effective, strategy. In cases of high cyclic stresses, the growth rates for these small cracks will b6 much greater. Therefore, depending on the crack growth rates, severalinspections before during the plant life are req ired to ensure that cracks do not grow to critical size. In summary, these results can give on indication of what type of program may be necessary to achieve an Improvement Factor that maintains the f ailure probability of a given pipe segment below an acceptable level. For those elements that have estimated leak probabilities above acceptable threshold values (e.g.,1x105 per weld lifetime for smallleaks and/or 1x104 per weld lifetime for disabling leaksi, inspection programs can be defined that will yield the necessary improvement Factors. in terms of defining an appror ate examination method (si for various geometries and postulated f ailure modes, Table 4.1 1 in (Ref. 71 provides a comprehensive place to start in selecting appropriate examination mathods. A5.5 Additional Considerations for Selectny Strategies Additional f actors should be addressed by licensees during the selection of inspection strategies beyond those related to effectiveness of the inspection methods to achieve goals for f ailure probabilities. Considerations related to safety and structural reliability are as follows:

    +

Exposure of inspection personnel to hazardous environments, including man rem exposure from radiation (reactor Molant system piping and fittings), hazardous materials, dangerous heights or climbing of scaf folds and unsteady platforms, rotating equipment or machinery, and f alling objects. Man rem exposure has the potential to not only impacts personnel health and safety, but also impacts on the overall costs of pe forming the inspections. Al. ARA considerations should be followed to deve'op strategies that reduce man rem levels, in some cases, it may be A516

60 y J C .. isi tti 40 O O g 151 2/2 0 b O 30 o ist sis c 0 j , e 20 t <

                                                                                                 #        U isis /to         -

O O ,,

                           ,     ,          .                        1  a             ,     a        [ . .T     V         a 0

8 8 10' 10' 10 10 10' 10' Q factor Figure A5.2 Improvement factors for four inspection interval (NDE performance level for POD = "Very Good"). justified to reduce the number of inspections that have marginalimpacts on risk but with large contributions to manrem exposure.

• Damage to components can occur as a result of the inspection itself. h some cases the inspection requires that equipment be taken apart _to gain adequate access to permit inspections of the structurallocations of concern. The degree of success in reassembling systems and components that have to be taken apart or taken off line to do the inspection (e.g., reactor vessel closure studs, steam generator manway covers, piping supports and attachments, pumps, valves, turbine generator casings) should be a consideration.

       +.       Movement of large equipment or structures (e.g., reactor vesselinternals, reactor closure heads, large pipe supports, and restraints) can damage adjacent equipment and structures.

Concerns with disassembly or movement of components will not be a f actor for most piping inspections. However, when such situations do occur, inspections should be coordinated with other maintenance needs that require the needed disassembly or movement operations, in other cases,it may be prudent to minimize such inspections unless the ISIlocations are from the highest categories of the risk categorization scheme.

   }

A517 l __--_.________.__m _ _ _

A5.6 Quantification of NDE Reliability Evaluations of inservice inspection strategies require quantitative inputs to describe the reliability of NDE methods to be used. A primary input is a POD curve for the piping locations that are to be inspected Other considerations include flaw sizing accuracles and the fisw acceptance criteria governing which sizes of flaws must be repaired versus flaws that are permitted to remain in service. Factors Governing ND2 Reliability The POD curves and flaw sizing accuracies are related to the particular NDE method / procedure / personnel, degraJation mechanisms, materials, pipe stres, and component geometries being addressed. This section describes acceptable approaches for estimating POD curves and other parameters of the inspection process. Additionalinformation on these topics is available in the literature, and has been summarized in Section 11 of the Probabilistic Structural Mechanic , Handbook (Ref,7), in estimating the reliability of a candidate inspection strategy the following factors should be addressed:

      .         NDE Method Visual examination, liquid penetrant testing, magnetic particle testing, radiographic testing, addy current testing, ultrasonic, testing, acoustic emission monitoring
      .        Flaw Dimensions Depth, length, opening / crack tightness I
      +         Flaw Orientation Normal or parallel to surf ace Material Type Stainless steel, ferritic steel, cast or wrought, fine grained or coarse grained
      +        Access to inspection Lecation Inside or outside surface, near or far side access to welds, presence of physical obstructions, need for disassembly l

• Surface Conditions Surf ace roughness, contamination / deposits, weld deposits, cladding Extraneous Signals Large grained materials, geometric reflectors, weld roots, counter oore geometries l

     +         Human Factors Inspector experience and training, motivational f actors, low t

tolerance for f alse calls, time restraints, hostile environments (heat, humidity, poor lighting, confined spaces, protective clothing)

     +

Qualifiestion/ Performance Demonstration Equipment, procedures and personnel, ASME Appendix Vill, detection and sizing capabilities l NDE Reliability Studies There have been ongoing research efforts on a national and internationallevel to develop data to better characterize the reliability of NDE methods for detecting representative service type defects (cracks). Such efforts have included a number AS 18

,}        of round robin studies to determine the reliability of NDE as practiced in the nuclear power industry, and to take actions to improve NDE reliability.

Table AS.3 lists studies of NDE reliability which have provided information On the probabilities of detection for flaws in nuclear piping and other componento (Ref. 7). These studies cover a range of componente, inspection methods, and damage mechanisms. Early findings showed a relatively low level of NDE reliability, even though the in:,pection methods were of ten consistent with the minimum standards of existing codes as published by such organizations as the American Society of Nondestructive Testing (ASNT) and the ASME. Subsequent efforts have produced changes in codes and standards which were directed to improving the reliability of NDE as applied at nuclear power plants. The usual approach in NDE reliability studies has been to use specimens with representative service type defects (i.e., cracks) for training and for demonstrations of capability. The round robin data have shown large team to team variations in the detection and sizing of flaws. As shortcomings have been noted, the nut. lear industry has responded with steps to strengthen minimum requiremerits such as in the ASME Code to improve the inspection of reactor pressure vessels and piping ystems. Performant.t Demonstrations . ASME Section XI has adopted Appendix Vill (Ref,8) which follows a performance demonstration approach, through which inspection organizations must qualify the performance of equipment, procedures and personnel. In the new approach, inspection teams must achieve passing scores in tests of their capabilities to detect simulated service type flaws in a matrix of samples that simulate conditions in reactor pressure vessels and piping. A passing score requires detection of a statistically

   ,      significant fraction of the flaws in the sample set, while maintaining an acceptably low frequency of false calls. The performance demonstrations also require that a team attain passing scores on flaw sizing capability.

Performance demonstrations provide a basis to identify those NDE methods that are most reliable, and those whose reliability is unacceptable. However, current performance demonstrations in the ASME Section XI Code require only a specified POD level for the collection of flaws in the sample set. The sample sets have a range of flaw sizes, beginning with the smallest size that is considered to be structurally significant. As now practiced, performance demonstrations are not designed to generate a full POD curve as a function of fla.w depth as is needed for purposes of probabilistic structural mechanics calculations. To obtain a ittatistically based POD curve. additional detection data beyond the minimum demanded by current performance demonstration tests are required. Lacking such a com-plete set of data, POD curves for field inspections must be estimated based on engineering judgment and by making use of the currently available base of detectior, data as generated from inspection round robins and performance demonstration efforts. Modeling of NDE Uncertainties Consistent with the practice for simulating other param-eters in probabilistic structural mechanics calculations, the POD curves used in simulations of ISI should be selected to represent mean values of POD without consideration of confidence levels. Arbitrary conservatism should not be applied in estimating the POD curves to be used in the probabilistic structural mechanics calculations, because such conservatism. if not applied uniformly. could improperly bias the selection of inspection strategies. While realistic mean values of PODS should be used as input to the structural A519

i i i Tatde A5.3 Reliability studies of NDE for 'ew;- C.; ; of nucloor piping and other components. laepeetlose MM0eed

                             ^

f- Dessiego Medieniasse Deepeme h C ,_ ^ ReGubSey of W Re8essere Bettane et fleecter Peeeewe (Necesenies eseeng essenwes Croc6ing eestedded weten. Ptsca grosse beepection Steasing Deeectesso espahapy ==ee essesgwise emot 9p , Veseet ,-- _ ;; and poet A38pE be stdc6 aces et place ConounPesel. Espeposse C . _ hese$e tres esembee t$tese for the peered- !l Secteoso N1 peecticos for Eeenossde C- , _ .:-_ end eeos used be se=e echeogisese FISC-II ji C- . _ i.e.e fWrfane end enorrhoe of PWft tMttecenses 98eer surface creening P15C-E PWgeene for bespectnese of Or acetiese ve8iebery setetise8r good. tetef_ tog

. forectee P eseuse vessete coweed by r ,- - et - Steve C- ; . c.; Eweseese oiring capsbety seteesee8v pee,

! we4d e4eddung vedwaietsee Ogonerse6ese for fees =esume I weed d=4ects. weeds. and Ceeperceiese end C,- .  : wee's pe'eeity e-- ;4 R of et'see .- ,- - - enc 9udwig U S. 8oweteer steg.desery i C -- __. fWtt.ne#'Imes of menctes , tmeesenics, eneeng e.96ww#e Crocte e=ce, weooet innee 9hsee, Nechoer taberseesies. festoy. ENactswe 4Hectiese veestsibey and EM t 19 f%esseere Vesset psetea**d me eN e4 surfere, ered unttisse Urteed EW

• DeGect h goed siring repM expose ~

j ebae for greg.,s, segutosery c edda,g a feis se gODT) - - _ -- _: . : i s - -- ..s ! f*Wft f%.nory rensene Pyneg. taveescewes Fmgese cemeteg *ecific Nerthuseet toebeamsery far U S. Very gead echelpary FOO > 90%9 eM 129 , Ceeben See s 98vcerer 8tegideoery Cose==eween- - - _. -- by es A _ , teeme l Peiry h*epection Mound moban eWa P p g. Wee.she es, esse see b egeenide,n e l St _s S-snee.ePo e,neseeschbeneve. Es,ey see-se, of -e -ve-g ene t perf 1ss 1

,                                                                   _..g                                                                            e _ e                           ,c.peb    y 1    BWR Pe=$. Weenght                  theaterwes                   be***ges, wsne et. css          recesic psenthumpet Lebersecry fe U S.          C9y the beet teeme : .                      .a   ode-Stende,s Steel                                                                                                                                                                                         fetet 148 l                                                                    cenes-m erecteg                 Nweepw 8tegideoery Con ==eeies-IWre6            esetev; . "_- _                   in deocteg 9towe.

Steund He*wo the seesta=dy of teesses had esnectoresben t i y-. _ .. . As teesne we=e wesense se t eneWagstowe i PWM Pewies y Centene f'igwng. t eres,ee,re F ee.gu. coortog Peret.e toesthewest tabeeeeer, tae U % ' *sene e' the re encipahng emessee des ==== fees eesce 12 , Ceewedsseene Cast Stewisees Nwe4eer Argetateey C_ _a strated se6etehe detect gwe for the coere. , Stece ge ' d onesee. set 1 4 Saeem Geeeeemne fed eng idefy Coseeent tf it Aene Peteg, welt thmeewig Paed.e Mes=hwest tabneeegwy tw U $ 8tetehwety gend se6ebAty toe WHect=m tetf SS$ . ( eA*eseswes eewt peaueneevey te,nte, e,g g.eetsng Necteer 84*g detery Cen== Sewn east vr=4 e' est thana==g and FM e j to e eed eetent 84eterswe8v pees sete 'ery for eeee+=1 e I j tvenne Geamemee testmung (*9vly Comers SM-se corressen PISC Ut #4egeese for t>=epeeerve of %W yeer eMest adh muered when 6 1 eeselwig bie=*seenu8er St**E C, . :J Ees eree o te**=v esnderway i ettack, esattege, petweg Orgesteratiere for Ecceerwenc ! Cerecesteere and C; . L- ' Steam Geneemer tubeng tody cement We# 99eesnsng. perten9 Electose Peuwer Hesensch bottaewte Fueere deep w.1B be besad est e stone d m al=ete=g. crecteg eve sac e., _ _ _

                                                                                                                                                                                        ,e, etog ET 1

Sg* ele SFem eM eteene g89%eeeW

                                                                                                                                                        ,w,     . . , . - ,

Vee.ne., anec4ene and em tReresenses Ceectang. slog inciarentee Pec.8be Secrebsweet tabersecry few U $_ A w de eenge et eeEsbWy be deseer+ f5tet 182 neeefear ; - , _ .:s esenc4=ned seeectane enet feweieer ftegedetery Conveneesen and wr=g is bedece**d by date ese teme et"eae types et des eete , _ - . - - _ - _ sesrwe, emeest A-eeeft ,*oetwee

• Uneseenie. C,ect. e, festenne *.epe tec*,.e4 - oe. gee Co ,.e, ==h e-n tee-se :- -_ :a : eneo.v.

eenphes e en festence purvte p.-L. y , ,, A- of Aa Forev . - - . . . - , A m.but to ge teenteteege facihtwo A leege eeele beospeteert was,etiewee uses, seceed 4 eeund nein popuses, maewse se hove coache wiB teevel".

                                 ,                       -                                   -            . , - ~ --                              ,

T I reliability code, the uncertainties associated with the POD should be accounted for in any calculation. Characteristics of POD Curves Probability of detection is defined as the ratio of the number of flaws actually detected to the number of flaws that would be detected given a perfect NDE system. An example of a POD curve that has been used in probabilistic fracture mechanics calculations with the pc PRAISE code (Ref.18)is shown in Figure AS.3. This schematic form is typical of POD curves that have been described in a number of other studies including (Ref.19). As indicated, flaws must have some minimum size or threshold before detection becomes possible. Above this threshold size, detection increases rapidly as the size of the flaw becomes larger. The POD curve eventually attains a maximum value at which non detection is governed by other f actors (e.g., human errors) that come to dorninete the detection processes. 31.0 u..w. g , O - E 0.8 - v., o.w

                                                  $ 0,7 u                              -f
                                                   $ 0.o O

Metas' O 0.5 - o CA -

     .-)                                           $                                 -
                                                   'g- 0.3 m 0.2                             -

2 CL 0.1 0.0 d' ' ' ' ' ' ' ' ' O.0 0.1 0.2 0.3 OA 0.5 0.6 0.7 0.8 0.9 1.0 Crack depth / wall thickness (a/h) Figure AS.3 Example POD curve used in pc PRAISE. Example POD Curve The specific functional form used in pc-PRAISE is given by P,,o(a) = c + % (1 c) eric (v in (A/A*)) where P,,o is the probability of non detection. A is the area of the crack. A' is the area of crack for 50% P,,3. c is the best possible P for very large cracks, and v is the " slope" of P,,o curve. Based on measured performance for PNNL's mini round robin teams (Reference 13), a range of estimates for A' (crack area for 50% POD) was provided by the NDE experts. (Ref.

18) assumed that the " slope" parameter v is 1.6. Several POD curves from PNNL studies were analyzed, and it was determined that a value of v = 1.6 is both reasonable and consistent with published curves. While the assigned v61ue of the slope parameter v was held constant, the actual slope of the plotted curves becomes more steep for better POD A5 21 l

curves. Thus, the slope of the POD is correlated to the detection threshold parameter A*, The value of c was assigned such that a smaller value of A' also implies a smaller value of c. Example Parameters for POD Curve An approach taken for the evaluations of candidate inspection strategies has been to consider a range of POD curves that bound the range of performar.ce expected from inspection teams that might actually perform inspections in the field (Ref. 5). This range of POD curves was established in consultation with NDE experts with extensive knowledge of the trends of NDE teliabikty studies and the performance levels l needed to be successfulin meeting the criteria of performrince demonstration testing. The , basic premise was that all teams had passed the ASME Section XI Appendix Vill performance I demonstration, it should, however, be recognized that a population of inspection teams (all of which have passed the performance demonstration) operating under either the testing environment of performance demonstration trial or under field conditions can still exhibit a j considerable range of POD performance, even .iugh all such teams have successfully j completed a performance demonstration. The ; .rformance demonstration serves to ensure a minimallevel of NDE reliability. The NDE experts were asked to define POD curves by estimating parameters for the specific form of a POD function used in the pc PRAISE code given by the above equation. Three POD curves with increasing levels of performance were defined as indicated in Table AS.4:

   .         Level 1 Performance: This curve corresponds to a team that has a level of performance needed to pass an Appendix Vill performance demonstration.

• Level 2 Performance: This curve corresponds to the best teams. Such teams significantly exceed the minimum level of performance needed to pass the test.

                                                                     ~
   .         Level 3 Performance: This curve corresponds to a team that has a level of performance significantly better than expected from any teams that have to date passed an Appendix Vill type of performance demonstration.

Table AS.4 Parameters of POD curves for three performance levels, inspection Performance

• a (% alt) c v Level 1 40'4 0.10 1.6 Level 2 15'ec 0.02 1.6 Level 3 5'4 .005 1.6 AS.7 Alternative Strategies To Reduce Failure Probabilities it may be determined in some cases that none of the candidate inspection strategies can provide an adequate reduction in f ailure probabikty, or that strategies other than inservice inspection are more cost effective. Some degradation mechanisms can develop unexpectedly, and cause structural f ailures within time periods shorter than the proposed A5 22

inservice inspection intervals. Examples are vibrational f atigue and thermal f atigue. New sources of vibrational stresses can develop due to imbalances that develop in rotating equipment or due to changes in the effectiveness of piping supports. Thermal f atigue stresses from the mixing of hot and cold fluids can develop over the life of a plant due to new sources of leakage at valves and thermal sleeves. The needed frequencies for inservice inspections can become unreasonable to detect impending structural f ailures associated with such new sources of f atigue related stresses. In these cases the rnost effective strategy can be to monitor the systems for piping vibrations and/or for temperature conditions that indicate the development of thermal f atigue stresses. Continuous methods involving acoustic emission monitoring or leak monito ing can be used to supplement or replace periodic inservice inspections as a means to detect the progress of degradation in piping system components. Such methods are particularly useful when concern becomes focused on one specific location where degradation is known to exist, and the objective is an early indicatiun that degradation is growing. Such continuous monitoring avoids the need to perform inspections at unreasonably smallintervals, such as when calculations and/or measurements of damage (e.g., stress corrosion cracking or erosion / corrosion) indicate potentially high rates of degradation. s A5 23

A5.8 References for Appendix 5"'

l. K.R. Balkey et al., " Demonstrated Application of Risk Based Technologies for Development of a Nuclear Reactor Internals inspection Program," ASME SERA Vol.

1 Safety Engineering and Risk Analysis, American Society of Mechanical Engineers, 1993.

2. D.O. Harris and E.Y. Lim, " Applications of a Probabilistic Fracture Mechanics Model to the influence of in Service inspection of Structural Reliability," Probabilistic Fracture Mechanics and fatigue Methods: Applications for Structural Reliability and Maintenance, ASTM STP 789, pp.19 41,1983.

3. F.A. Simonen, "An Evaluation of the impact of Inservice Inspection on Stress Corrosion Cracking of BWR Piping,' In Codes and Standards and Applications for Design and Analysis of Pressure Vessel and Piping Components, pp. 187 193.

ASME PVP Vol.186, American Society of Mechanical Engineers, New York,1990.

4. F.A. Simonen and H.H. Woo. " Analysis of the Impact of Inservice inspection Using a Piping Reliability Model," NUREG/CR 3869 (Prepared for the USNRC by Pacific Northwest Laboratory), August 1984.

5. M.A. Khaleel and F.A. Simoilen "The Effects of Initial Flaw Sizes and inservice inspection on Piping Reliability," PVP Vol. 288, Service Experience and Reliability improvement: Nuclear, Fossil, and PetrochemicalPlants, American Society of Mechanical Engineers,1994.

6. F.A. Simonen and M.A. Khaleel, "A Model for Predicting Vessel Failure Probabilities Due to Fatigue Crack Growth," ASME PVP Vol. 304, fatigue and Fracture Mechanics in Pressure Vessels and Piping, pp. 401 416, American Society of Mechanical Engineers,1995.

7. F.A. Simonen, " Nondestructive Examination Reliability,* Probabilistic Structural Mechanics Handbook, C. Sundararajan, editorr Chapman and Hall, New York, pp.

238 260,1995, s

8. D. Cowfer " Basis / Background for ASME Code Section XI Proposed Appendix Vill:

Ultrasonic Examination Performance Demonstration," In Nondestructive Evaluation: NDE Planning and Application, pp.15, ASME NDE Vol.5, American Society of I.iechanical Engineers, New York,1989,

9. PISC, " Analysis of the PISC Trials Results for Alternative Procedures." P/are Inspection Steering Committee Report No. 6. EURATOM Report No. 6. EOR 6371

          ' Copies of NuREGs are available et current setes from the u.s. Government Print.ng office P.o. Bom 37082. Washmgton.

oC 20402 9328 tielephone (2021512 2249); or from the National TechnicalInformr.h.... service by writing NTis et 5285 Port Royal Road, springf. eld. vA 22161. Copies are available f or inspection or copying for a fee Irnm the NRC Public occument Room et 2120 L street NW. Washmgton. oc: the PDR's mailing address is Me.1 stop LL 6. Washington. DC 20555: telephone (2021634 3273; fen (2026634 3343. A5 24 l

ED, Published by the Commission of the European Communities, Directorate General

  }

• Xil,Information Technologies and ind astries and Telecommunications, Luxembourg, 1980.

10. R.W. Nichols a-1 S. Crutten, E Jitrasonic Inspection of Heavy Section Steel Components: The PISC II,~in, eport, Elsevier Apr.'Jed Science, London and New York,1988.

11. B.K. Watkins et al., "Results Obtained from the inspection of DDT Plates 1 and 2,"

Paper presented at UKAEA DDT Symposium, Silver Besc.) Conference Center, Birchwood, Warrington, U.K., October 7 8,1982,

12. G.J. Dau, " Ultrasonic Sizing Capability of JGSCC and its Relation to Flaw Evaluation Procedures," Electric Power Research institute (NDE Center), North Carolina,1983.

13. S.R. Doctor and P. G. Hessler, "A Pipe Inspection Round Robin Test," Proceedings of the G'* International Conference on NDE in the Nuclear Industry, American Society for Metals, Metals Park, Ohio,1984,

14. P.G. Heaslet et al., " Ultrasonic inspection Reliability for Intergranular Stress Corrosion Cracks: A Round Robin Study of the Effects of Personnel, Procedures.

Equipment and Crack Characteristics," NUREG/CR 4908 (Prepared for the USNRC by Pacific Northwest Laboratory), July 1990. ~') 15. R.J. Kurtz et al., " Steam Generator Tube Integrity ProgramlSteam Generator Group j Project-Final Project Summary Heport," NUREG/CR 5117 (Prepared for the NRC by Pacific Northvvest Laboratory, PNL 6446) May 1990.

16. S.fi. Bush, " Reliability of Nondestructive Examination," USNRC, NUREG/CR 3110 Vol.13, (Prepared for the USNRC by Pacific Northwest Laboratory),1983.

17. B.W. Boisvert et al., " Uniform Qualification of Military and Civilian Nondestructive inspection Personnel," LG81WP1254 003, Lockheed Georgia Company,1981.

18. D.O. Harris and D. Dedhia, " Theoretical and Users Manual for pc PRAISE, A Probabilistic Fracture Mechanics Computer Code for Piping Reliability Analysis,"

USNRC, NUREGICR 5864. July 1992.

19. W.D. Rummel, " Considerations of Quantitative NDE and NDE Reliability improvement," Review of Progress in Ovantitative Nondestructive Evaluation - p Volume 2A. ed. D.O. Thompson and D.F. Chimenti, pp.19 35, Plenum Press, New York,1983. ,

f 5 i w>w A5 25

. . - . . . ~ . . - . . - - _ . . . . . ._; .  ; ;---- : - - -- - _ Appendix 6: EXISTING DETERMINISTIC APPROACH AND

  ]                                                 REGULATORY REQUIREMENTS A6.1 Introduction The traditional deterministic ISI program requires extensive examination of the reactor coolant pressure boundary (RCPB), a moderate amount of examination of emergency core              f cooling and accident mitigation (ECC/AM) systems, and relatively little examination of support systems. Each f acet of the examination strategy; level of detail required to define the parts examined, examination method, acceptance standard, and the extent and frequency of examination,is more tightly defined for the RCPB, than for the ECC/AM and support systems. The framework and philosophy of this approach is very prescriptive and is based on the assumption that the RCPB is more "important," and other systems are progressively less important as one moves away from the RCPB.

The basic requirements for deterministic Isis for a boiling or pressurized water nuclear reactor f acility, including inspection intervals, are contained in Section 50.55a, " Codes and 4tandards," of 10 CFR Part 50, " Domestic Ucensing of Production and Utillration Facilities" (Ret.1). The requirements specified in 10 CFR 50.55a will remain in effect after develeament and implementation of the risked informed methods. Thus, the latter will

             ;mvir,e an optional method for performing inservice inspections. The deterministic method cr.a still be used, if the licensee chooses.

The primary objective of 10 CFR 50.55a is to ensure that " Structures, systems, and

 ....)
 .s components shallbe designed, fabricated, erected, constructed, tested, andinspected to quality standards commensurate with the importance of the safety function to be performed."

A6.2 Deterministic Decisionmaking Criteria The sources of requirements for deterministic ISls are specified in several documents referenced in 10 CFR 50.55a. These documents are listed below and described very briefly. For deterministic analysis the decision criteria are referenced by the requirements. For example, the ASME Boiler and Pressure Vessel Codes Section XI provides acceptance standards that are used to determine if the inspection requirements have been met, a .- ASME Boiler and Pressure Vessel Code Section XI of this code provides most of the inspection requirements and acceptance criteria for deterministic 151.

b. Technical Specifications For some components, the inservice inspection requirements 6.*e governed by the plant Technical Specifications rather than the ASME Boiler and Pressure Vessel Code, in addition, the Technical Specifications require amendment if the ISI program revisions required by 10 CFR 50.55a create a conflict.

c. Regulatory Guides In order to implement the requirements of the ASME Boiler and Pressure Vessel Code " Code Cases" have been developed by the ASME to explain the intent of the code or provide for alternatives under special circumstances.

A61

d. Nuclear Regulatory Commission Requirements . The Commission may require the licensee to follow an augmented ISI program for systems and components which they decide require added assurance of structural reliability.

For nuclear power plant components, conservative design practices have been successfulin precluding anticipated modes of f ailures. For example, the ASME Boiler and Pressure Vessei Code identifies the following modes of f ailure:

             +

excessive elastic deformation, including clastic instability

             +       excessive plastic deformation
             +       stress rupture / creep deformation (inelastic)
             +       plastic instability incremental collapse
             +       high strain . low cycle f atigue Operating reactor experience has raised the issue that other causes not addressed in the design, by the ASME BPVC calculations or otherwise, are most hkely to cause structural             I failures, The two most common examples are intergranular stress corrosion cracking (IGSCC)         !

of stainless steel piping and arosion corrosion wall thinning of carbon steel piping. Table A6.1 lists a variety of f ailure mechanisms or causes that should be considered. The licensees should review industry experience of pipe failures. Available sources of information include NRC documents, EPRI documents, IAEA documents, INPO (Nuclear Plant Reliability Data System) NUMARC (Assessment of Plant Life Extension), ASME BPVC reports, etc. As this data is generically applicable to risk informed regulatory activities, the industry might want to consider consolidating the information on a computerized rystem that is updated by individual utilities as they experience f ailures, detect service related degradation, and identify operational conditions not addressed in the design of the piping components. Referencing the use of such a data base would provide the NRC assurances that industry experiences are appropriately addressed. A6.3 Documents with Deterministic Requirements As stated in Section C.1, the overall re,quirements for deterministic ISI are specified in Section 50.558, " Codes and Standarrit" '~ CFR Part 50. Section 50.55a, in turn, references the following documents tnat cvntain the detailed requirements: ASME Boiler and Pressure Vessel Code The primary inspection requirements and intervals are contained in Section XI, " Rules for Inservice inspection of Nuclear Power Plant Comoonents." Fvision 1 of this document contains the requirements for light water cooled reactorr Regulatory Guides To implement the requirements of Section XI of the ASME Boller and Pressure Vessel Code, " Code Cases" have been developed by the ASME to explain the intent of the code or provide for alternatives under special circumstances, in some cases the plant Technical Specifications will affect the ISI program. The (current / deterministic ISI requirements are described in more detailin the following section. l A6 2

)                                    Table A8,1 Example Failure Causes for LWR Nuclear Power Plant Components (From Ref 2) o strees Corrosion cracking                         o improper of degraded over pressure protection o intergrenular attack u Operation et loads or pressures o Thermal f atigue crackmg related tot                       onceedmg design limite
                                                 . ettatification of fluide
                                                 . leeking volve seate                    o Eocessive rates of heetmg or cooling
                                                 . thermal sleeve failure                          (thermal shock) o Vibrational fatigue cracking                     0 structural damage from outernal forces o Motorial or weld defects o improper or degraded ouoports for
                                                 =

o Flow essisted corrosion componente lorosion/corrosioni o Defective enuobers restraining o Cavitation and wet steem erosion thermal empensions o slurry erosion (rew water imes) o Loose parte . weer and impact damage o General corrosion o Loose or missing festeners ,. - 0 Pstting o Structural damage from maintenance

o Corrosion due to leeking boric acid o improper repaire or etterations o Microbe induced corrosion o improper design and f abrication o Fretting o Embrittlement from neutton o Water hemmer irradiation o .Over preneure of system due to o Embrittlement f rom thermal oping leaking or misaligned volves ~-

o improper heat treatment (of botting o violeiions of pressure temperature maioriais) lemite A6,4 Inservice Inspection Requirements Section 50.55s, " Codes and Standards," of 10 CFR Part 50, " Domestic Licensing of Production and Utilization Facilities," requires, in part, that each operating license for a boiling or pressurized water. cooled nuclear power f acility and each construction permit for a utilization f acility be subject to the conditions in paragraph (g), " Inservice Inspection Requirements," of i 50.55a. Paragraph (g) requires, in part, that ASME Code Classes 1,2 g and 3 components and their supports meet the requirements of Section XI, " Rules for J Inservice Inspection of Nuclear Power Plant Components," of the ASME Boiler and Pressure A6 3 l

 , .. . ..         .     .   , . _ . _ -    . _ _ _ _    m. . _. _

m _ _ _ . Vessel Code or equivalent quality standards. Paragraph 50.55a(b),in part, references the latest editions and addenda in effect of Section XI of the Code and any supplementary requirements to that section of the Code. Definitions of the ASME Code Classes are given in (Ref. 21. Generally, ASME Code Class 1 includes all reactor coolant pressure boundary (RCPB) components. The RCPB refers to those pressure containing components of BWRs and PWRs, such as pressure vessels, piping, pumps, and valves that are part of, or connected to, the reactor coolant system. ASME Code Class 2 generally includes systems or portions of systerns important to safety that are designed for post accident containment and removal of heat and fission products. These ' systems include the reactor shutdown, residual heat removal, and steam and feedwater systems extending from the steam generators to the outermost containment isolation valve. ASME Code Class 3 generally includes those system components or portions of systems important to safety that are designed to provide cooling water and auxiliary feedwater for the front line systems. l Footnote 6 to i 50.55a references the ASME Code Cases that have been approved for use by the Commission. The footnote also states that the use of other Code Cases may be authorized by the Commission upon request pursuant to paragraph 50.55a(s)(2)(ll) which requires that proposed alternatives to the described requirements or portions thereof provide an acceptable level of quality and safety. The Code Cases applicable to deterministic 151 are l contained in Regulatory Guide 1.147, " Inservice inspection Code Case Acceptability ASME Section XI, Division 1." Paragraph (g)(E)(i) of Section 50.55a requires that the ISI program for a boiling or pressurized water cotted nuclear power f acility be revised by the licensee, as necessary, to comply with Section XI of the ASME Code, if this revision conflicts with the Technical Specification for the facility, paragraph (g)(5)(li) requires that the licensee apply to the Commission for

  ,         amendment of the Technical Specifications so that they will conform to the revised program.

If the licensee has deterrnined that conformance with certain code requirements is impractical, the licensee must notify the Commission per paragraph (g)(5)(iii) and submit, as i specified in s 50.4, information to support the determinations. l l Paragraph (g)(6)(ii) of Section 50.55a states that the Commission may require the licensee to follow an augmented ISI program for systems and components which they decide require added assurance of structural reliability. General Design Criterion 1 " Quality Standards and Records," of Appendix A. " General Design Criteria for Nuclear Power Plants,"_ to 10 CFR Part 50 requires,in part,_that structures, systems, and components important to safety be designed, fabricated, erected, and tested to quality stanoards commensurate with the importance of the safety function to be performed. Where generally recognized codes and standards are used. Criterion 1 requires that they be identified and evaluated to determine their applicability, adequacy, and sufficiency and be supplemented or modified as necessary to ensure a quality product in keeping with the required safety function. A6 4

A6.5 References for Appendix 6'" 1

1. Section 50.55a,

• Codes and Standards," of 10 CFR Part 50,
• Domestic Licensing of wv Production and Utilization Facilities."

2. USNRC, " Risk Based inspection . Development of Guidelines," Vol. 2, Part 1 (Prepared for the NRC by the American Society of Mechanical Engineers),

NUREGlGR 0005, July 1993. a

               ' Copies of NUREGs are available at current rates from the U.S. Government Printing Office, P.o. Bos 37082 Washington, DC 20402 9328 (telephone 12021512 2249): or from the National TechnicalInformation Serwce by writsng NTIS at 5285 Port Royal Road, Springfield, VA 22161. Copies are ava.lable for inspection et copying for a fee from the NRC Pubisc Document Room at 2120 L Street NW., Washington, DC; the PDR's maileng address is Mail Stop LL 6, Washington, DC 20555: telephone (2021634-3273: f as (2021634 3343.

A6 5

i

       ]                                      Regulatory Analysis i

1. Statement of the Problem '

During the past several years, both the Commission and the nucles Wlustry have recognized that probabilistic risk assessment (PRA) has evolved to @e point that it can be used increasingly as a toolin regulatory decisionmaking. In August 1995, the Commission published a policy statement that articulated the view that increased use of PRA technology would (1) enhance regulatory decisionmaking, (2) allow for a more efficient use of agency l resources, and (3) allow a reduction in unnecessary burdens on licensees, in order for this change in regulatory approach to occur, guidance must be developed describing acceptable I means for increasing the use of PRA information in the regulation of nuclear power reactors.

2. Objective To provide guidance to power reactor licensees and NRC staff reviewers on acceptable approaches for utilizing risk information (PRA) to support requests for changes in a plant's

current licensing basis (CLB). It is intended that the regulatory changes addressed by this

! guldance should allow both industry and NRC staff resources to be focused on the most imrortant regulatory areas while providing for a reduction in burden on the resources of licensees. Specifically, guidance is to be provided in several areas that have been identified 4 as having potential for this application. This application includes risk informed inservice inspection programs of piping. 1

       .. 3. Alternatives The increased use of PRA information as described in the draf t regulatory guide being developed for this purpose is voluntary. Licensees con continue to operate their plants under the existing procedures defined in their CLB. It is expected that licensees will choose to make changes in their current licensing bases to use the new approaches described in the draft regulatory guide only if it is perceived to be to their benefit to do so.                    <

4. Consequences -- -

3* ' Acceptance guidelines included in the tiraf t regulatory guide state that only smallincreases in overall risk are to be allowed under the risk informed program. Reducing the inspection

 ;          frequency of piping identified to represent low risk and low f ailure potential as provided for i

under this program is an example of a potential contributor to a smallincrease in plant risk. , However, the program also requires increased emphasis on piping categorized as high safety significant and high f ailure potential that may not be inspected under current programs.

,           This is an example of a potential contributor to decreases in plant risk. An improved prioritiration of industry and NRC staff resources, such that the most important areas associated with plant safety receive increased attention, should result in a corresponding contributor to a reduction in risk. Some of the possible impacts on plant risk cannot be
  ,         readily quantified using present PRA techniques and must be evaluated qualitatively. The staff believes that the net effect of the risk changes associated with the risk informed RA 1 4
                                            +.c.-

e,,-, rn,.--, , ~- , , , - , , , , - - - -

programs, as allowed using the guidelines in the draf t regulatory guide, should result in a very smallincrease in risk, maintain a risk neutral condition, or result in 3 net risk reduction in some cases.

5. Deelslon Rationale 11is believed that the changes in regulatory approach provided for in the reguistorY guide being developed will result in a significant improvement in the allocation of resources both for the NRC and for the industry. At the same time,it is believed thdt this program can be implemented while maintaining an adequate level of safety at the plants that choose to implement risk informed programs.

6. Implementation it is intended that the risk informed regulatory guide on inselv. s inspection of piping (DG-1063) be published in final form by early to mid 1998.

RA 2 l

I t 7 - g$jgs 3 yI wki! is da y* 4 $g

 ) Eis j{

5 i 1

          .    -}}