ML20205P081

Technical Elements of RISK-INFORMED Inservice Inspection Programs for Piping

ML20205P081
Person / Time
Issue date:	01/31/1999
From:	NRC OFFICE OF NUCLEAR REGULATORY RESEARCH (RES)
To:
References
NUREG-1661, NUREG-1661-DRFT, NUDOCS 9904200015
Download: ML20205P081 (165)

Text

pgg Adema

. g 6 c issu NOREQ BEPcRTs Technical E ements of Risk-InfornTcd"I1Yservice Inspection If*rograms MAR -4 P2 :24 for Piping Draft Report l

Mz U.S. Nuclear Regulatory Commission g' ~'*%

Office of Nuclear Regulatory Research i, ' " ' 1 -

Washington, DC 20555-0001  %, ,.

99J42000gg990131 1661 R PDR

l l

AVAILABILITY NOTICE i Availability of Reference Materials Cited in NRC Publications NRC publications in the NUREG series, NRC regu- NRC Publi: Document Room ,

lations, and Title 10, Energy, of the Code of Federal 2121 L Street, N.W., Lower Level Regulations, may be purchased from one of the fol- Washington, DC 20555-0001 lowing sources: < http://www nrc. gov /NRC/PDR/pdr1.htm >

1 -800-397-4209 or locally 202-634-3273

1. The Superintendent of Documents Microfiche of most NRC documents made publicly U.S. Government Printing Office available since January 1981 may be found in the cal Mc Domment Noms pW bcaN in shington DC 20402-9328 the vicinity of nuclear power plants. The locations

<http://www. access.gpo. gov /su docs >-

of the LPDRs may be obtained from the PDR (see 202-512-1800 previous paragraph) or through:

2. The National Technical information Service <http://www.ntc. gov /NRC/NUREGS/

Springf: eld, VA 22161 -0002 SH1350/V9/lpdr/html>

< http://www ntis. gov /ordernow>

703 -487-4650 Publicly released documents include, to name a few, NUREG-series reports; Federal Register no-tices; applicant, licensee, and vendor documents The NUREG series comprises (1) technical and ad- and correspondence; NRC correspondence and I ministrative reports, including those prepared for internal memoranda; bul'etins and information no-international agreements, (2) brochures, (3) pro- tices; inspection and investigation reports; licens-ceedings of conferences and workshops, (4) adju- ee event reports; and Commission papers and dications and other issuances of the Commission their attachments.

and Atomic Safety and Licensing Boards, and (5) books Documents available from public and special tech-nical libraries include all open 1:terature items, such A single copy of each NRC draft report is available as books, joumal articles, and transactions, Feder-free, to the extent of suppiy, upon written request al Register notices, Federal and State legislation, as follows: and congressional reports. Such documents as theses, dissertations, foreign reports and transla-Address: Office of the Chief Information Officer tions, and non-NRC conference proceedings trey Reproduction and Distribution be purchased from their sponsoring organization.

Services Section ,n a Copies of industry codes and stanuards us U.S. Nuclear Regulatory Commission substantive manner in the NRC regulatory pivcess Washington, DC 20555-0001 are maintained at the NRC Library, Two White Flint E- mail: < GRW1 @NRC. GOV > Nor1h, 11545 Rockville Pike, Rockville, MD Facsimile: 301-415-2289 20852-2738. These standards are available in the library for reference use by the public. Codes and j A portion of NRC regulatory and technical informa-tion is available at NRC's World Wide Web site; standards are usually copyrighted and may be purchased from the originating organization or, if ey are Ametan Nabonal SaMads, kom-

<http://www.nrc. gov >

American National Standards Institute All NRC documents released to the public are avais- 11 West 42nd Street able for inspection or copying for a fee, in paper, New York, NY 10036-8002 microfiche, or, in some cases, diskette, from the < http://www. ansi.org >

Public Document Room (PDR): 212-642-4900 DISCLAIMER The report was prepared as an ao:n. int of work sporsored by arry legal liabihty or resporsibikty for any third party's (se, or tre an agercy of the Uruted States Govemrrert Nefther the United results of such use, of any dudut appratus, product, or States Gmemment nor any agerry thereof. nor any of treir em- process dsckr,ed in thn report, or represents that its use by ployees, makes any warranty, expressed or impled, or assumes such third party would not intnnge pnvetety owre ; nghts.

I

,.o r

d: NUREG-1661 8

0

~

Technical Elements of Risk-Informed Inservice Inspection Programs for Piping Draft Report

~

i Manuscript Completed: December 1998  !

I Date Published: January 1999 l l

Division of Systems Technology Omce of Nuclear Regulatory Research j f

U.S. Nuclear Regulatory Commission Washington, DC 20555-0001 pf ~*%

I l - _ - _ - - - .

• O ABSTRACT During the last several years, both the U.S. Nuclear Regulatory Commission (NRC) and the nuclear industry have recognized that probabilistic risk assessment (PRA) has evolved to become more useful in supplementing traditional engineering approaches in rewtor regulation. After publication of a policy statement on the use of PRA in nuclear regulatory activities, the Commission directed the NRC staff to develop a regulatory framework that incorporated risk insights. That framev ork was articulated in a November 27,1995, paper to the Commission. This NUREG, which addresses the elements of risk-informed inservice inspection of piping (RI-ISI), was developed in parallel with Regulstory Guide 1.174 and 1,178, and discusses some of the technical issues to be considered when developing a RI-ISI program.

Since limited information was provided by the Electric Power Research Institute (EPRI) of its methodology, the elements in this NUREG that complement the EPRI methodology may not be complete. For that reason, this NUREG is published as draft. Following the NRC review and approval of the EPRI methodology, the staff will consider updating this documert in final form.

The elements of a RI-ISI program as described in this report are not considered to be the only acceptable approach to implernenting a RI-ISI program. They can be implemented in total or in part, with supplemental activities that conform to the guidance of RG 1.174 and 1.178.

I 1

iii DRAFT NUREG-1661 l

J

0 2 TABLE OF CONTENTS

1. INTRODUCTION . . . . ... . . . .. ..... . .. . . ...... ... .... ... . ... 1-1 1.1 Background . . . ... .. . ... ... . ...... .. . .............. .. .. .1-1 1.2 Objective ... .. ... .. . .... . ........... . ... ..... ....1-1 1.3 Organization of this Repon . . . . . . ... ............ .. ... ... . . 1-2

2. EVALUATING TIIE CHANGE IN RISK ASSOCIATED WITH CllANGES TO AN ISI PROGRAM . . . .. ... .................2-1 2.1 Determine Scope . . . .... . ...............................2-3 2.2 Develop PRA Model . . .. . .... ... ....... .. .. .... . . ... .. 2-4 2.2.1 Options I and 2 . . ... . .. .. . . . . . . .. ... .. .. 2-5 2.2.2 Option 3. . ... . ... ... .. ... . . . . .. . . . . . 2-6 2.3 Develop Piping Segments . . . ... ... . .... . . . . . . . . . . . 2-6 2.4 Determine Consequences of Piping Failures . . . . .. . .. .. . .. ...27 2.5 Assess Piping Failure Potential . . . . .. .. .. ... . .. . .. 2-12 2.5.1 Options 1 and 2 .. .. .. . .. ... .. ... . . . . . 2- 12 2.5.1.1 Overview of Estimation Procedure . ....................2-12 2.5.1.2 General lssues . . . .. . ... .. . . . . 2-15 2.5.1.3 Methods for Estimating Failure Probabilities ... . .. . . . . . 2- 19 2.5.1.4 Structural Reliability Computer Codes .... . . .. ... . 2-24 2.5.1.5 Uncertainty and Sensitivity Studies for Categorizing Piping Segments . 2-26 2.5.2 Option 3. . .. . .. . . .. .. . ... .. .. .2-27 2.6 Assess Consequence for Failure of Each Piping Segment ... . . . ... . .... .2-27 2.6.1 Options I and 2 . ... . ... .. . .. . .... . 2-28 2.6.2 Option 3. . .. . . .. ... .. ... . . . . . . . . 2-36 2.7 Categorize Piping Segments and Select Piping Locations for Inspection . . . . . . . . . 2-3 9 2.7.1 Hir". or Lou Safety-Significance Categorization-Options 1 and 2 . .... . 2m 2.7.1.1 Use ofImportance Measures . .. ... . .. .. . .. .:

2.7.1.2 Criteria for Determination of Safety Significance . . . . . . 2-43 2.7.2 liigh or low Failure Potential Categorization-Options 1 and 2 . . . . . . . . . 2-45 2.7.3 Stmetural Element Selection Within Piping Segments-Options 1 and 2 . . . . . . 2-46 2.7.3.1 General Guidelines for Selection oflocations in Regions 1 and 2. . . 2-50 2.7.3.2 Detailed Inspection Strategy for Region 2. . . . . . . . . . . . . . . . . . 2-5 1 2.7.4 Structural Element Selection-Option 3 . . . . . . . . . . .... . . . . . . . . . . . 2-5 6 2.8 Assess Change in CDF and LERF . . . . . . . . . . . ... . .. ...... . . . . 2-56

3. ESTIMATION OF FAILURE PROB ABILITIES USING EXPERT JUDGMENT ELICITATION .. 3-1 3.1 Intmduction . . . . . .... ......... . . ... ............. ... .. ....... 3-1 3.2 Expen Judgment Elicitation Process . . . . ... . . ... ..... . . . . . . . . . . 3 -2 3.2.1 Selection of Issues . . . . . .. .. .... ... ....... . . . . . . 3-3 3.2.2 Selection of Experts ..... .... ...... ... .. . . . . . . . . . . . . . . 3-3 3.2.3 Elicitation Training . . . ..... .. ............ . ..............3-4 DRAFT NUREG-1661

t 0 1

l i

Table of Contents, Figures. Tables  !

3.2.4 Presentation and Review ofIssues . .... . . ............ .. . . . . . . 3-4 3.2.5 Preparation of Analyses . . . .... ... . . ..... . . . ... . .. .. 3-5 3.2.6 Discussion of Issues and Analyses . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-5 l 3.2.7 Elicitation . . ....... . ...........................3-5 3.2.8 Recomposition and Aggregation . . .... .... . ............ . . . . 3-0 3.2.9 Review by Experts ... ... ... . .. ..... .. .. .. .. . 3-7 3.2.10 Documentation . . . .. .... .... . ........ . . . . . . . . . . . 3-7 3.3 Example Application to Nuclear Piping Systems . ........... .... ...... 3-7 i

4. PROBABILISTIC STRUCTURAL MECIIANICS COMPUTER CODES FOR ESTIMATING FAILURE PROBABILITIES . . . . .. . . ... . ..... ..... ... 4-1 i i

4.1 Introduction . . . ... . . .. . .. .. . ... .... ... ...... 1-1 i 4.2 Areas of Structural Reliability Code Review . .. ....................4-1 4.3 Selected Structural Reliability Code lssues . ... .. .. . . . . . . . 4-2 4.3.1 Imads and Stresses . .... . . ... .. .. . . . . . . . . 4-2 l ,

4.3.2 Vibrational Stresses . . . . . . . .. .. ... ... . ....... 4-3 4.3.3 Residual Stresses . . . . .. . . . ..... .... 4-4 4.3.4 Preservice Inspection ... .. .. . .... .. .. .. ... 4-4 4.3.5 Proof Test . . . . . .. . ... .. .. .... . . . .. .4-5 4.3.6 leak Detection .. . .. . ... ... . ...... .. ... . . . . 4-5 4.3.7 Failure Modes (12ak versus Break) . . . . . ........ . . . . . . . 4-5 4.3.8 Service Environment . ... . .. .... ....... ... . . . . . 4-5 4.3.9 Initial Flaw Size Distributions . . . . .. .. ... . .. . .... 4-6 4.3.10 Flaw initiation . . . . . .. . . .. .. .... ... . . .4-11 4.3.11 Crack Growth Rates . . . .. . .. .. . . .. ...... . . . . . . . . 4- 12 4.3.12 Variability in Material Properties .. .. .. . ...... . .. ... .. .. 4-12 4.3.13 Comparison with Service Expericace ..... . . ..... .. . . 4-12 4.3.14 Effects of Inservice Inspection (CDF vs. Imponance Measure Calculations) . 4-13 j 4.3.15 Cumulative Effects of Repeated or Periodic Inspections . . . . . . . . . . . . . . 4- 13 :l 4.3.16 Review and Treatment of Uncertainties . . . . ............... ....... 4-13 4.3.17 Realistic versus Conservative Calculations . . . . ................. ... 4-14 4.3.18 Consideration of Failure Mechanisms . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-15 4.3.19 Materials Considerations . . . . . . . . . .

.. . ......... ..... ...... 4-15 4.3.20 Consideration of Component Geometries . . ......................4-16 4.3.21 Deterministic Structural Mechanics Models . . . . . . . . . . . . . . . . . . . . . . . 4- 1 6 1 4.3.22 Selection of Probabilistic Variables . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4 16 4.3.23 Numerical Methods . . . . . . . . . . . . . .. . . ........................4-17 4.3.24 Assignment of Input Parameters . . . . . . . . . . . . . . . .. ............ . 4-18 4.3.25 Supporting Databases . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4- 19 4.3.26 Documentation and Peer Review . . . . . . . . . ..... ...... .. ...... .. 4-19 4.3.27 Identification of Code Limitations . . . . . ..........................4-19 l 4.3.28 Benchmarking with Other Computer Codes . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-19 l DRAFT NUREG-1661 vi

)

1 i

• a Table of Contents. Figures. Tables 4.3.29 Consistency with Operating Experience . . . . ... ... .. ..... ... 4-20 4.4 Exr.mple Uncertainty Analysis . . . . . . . . .... .. . . .. . . .. . . . 4-21 4.4.1 Sensitivity Calculations . .. . . .. ... .. ... . ..... . .. .. 4-21 4.4.2 Uncertainty Calculations . . ...... . .... . ... ... . . ... 4-22 4.4.3 Inputs for Calculations ... . . . .. . . . ... .... . ... . 4-23 4.4.4 Computational Approach . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-25 4.4.5 Results of Uncertainty Calculations . . . .. ... .. ... .. ... . 4-25 4.5 Formal Process for Validating and Updating SRRA Codes . . . . . . .... . . . . . . . . . 4-29

5. INSPECTION STRATEGY-RELIABILITY AND ASSURANCE PROGRAM ... ..... . . 5-1 5.1 rhe Concept of Statistical Risk . . . . ....... ..... .... . 5-2 5.2 Calculation of Risk . . . .. . . . . . . .. . ... .. .5-2 5.3 Correction for Imperfect Detection . . ... . . ... ... .. . . 5-5 5.4 The Global Analysis ..... . . . . .. . . . . .. . .. .. .5-7 5.5 Discussion . . ... . . ... . .. . . . ..... . . . . . . . 5-12

6. DEVELOPMENT OF A RISK-INFORMED INSPECTION PROGRAM . .......... ... .. .. 6-1 6.1 Step 1: Select . . ... . . . . . .. . . ... . 6-1 6.2 Step 2: Inspect .. .. . . . .. .. . ... . 6-4 6.2.1 Objective . . .. . .. . . .. . . .... . .. 6-4 6.2.2 Time ofInspection .... .. . . .. .. ..... ... .. . . . 6-4 6.2.3 Inspection Methods . . .. .. . . .. ... . ...... .. .6-4 6.2.4 NDE Qualification .... . . . ... ... ...... . ..... . 6-5 6.2.5 Development of NDE Methods . . . . . . . . . . . . . . . ... . ...... .. 6-6 6.2.6 Sampling Strategy . . . ...... .. . .. .... ... . 6-6 6.2.7 Delivery Method ... . . .. . .... .. . .... . 6-6 6.3 Failure Probability Goals . . .. ... . .. . . .. .. , . . . . 6-8 6.4 Application of Probabilistic Structural Mechanics Calculations . . . . . . . . . . ...... 6-8 6.4.1 Rationale .... . ..... . .. ... . ... ..... . ........ ... . 6-9 6.4.2 Guidelines ... ...... . .. .. ..... .. ... .. ..............69 6.5 Examples of Probabilistic Structural Mechanics Calculations . . . . . . . . . . . . . . . . . 6-13 6.6 Additional Considerations in Selecting Strategies .. . . . . . . . . . . . ....... . . 6-16 6.7 Quantification of NDE Reliability . . .... . . .. ..... .......... 6-17 6.7.1 Factors Governing NDE Reliability . . . . . . . . . . . ... .... ... . .. 6-17

6. 7.2 Performance Demonstrations . . . . . . . . ..... . ..... . . . . . . . . 6- 18 6.7.3 Modeling of NDE Uncertainties . . . . . . . . . . . . . . . .. ...... . . . . . 6-18 6.7.4 Characteristics cf POD Curves . . .. . . ..... ..... .. . . . . . . . . . . 6- 19 6.8 Alternative Strategies to Reduce Failure Probabilities . . .... .. . ........... 6-21 i

APPENDIX A COMMENT RESOLUTION . . . . . . . . . . . . .. ...... . . . . . . . . . . . . . A- 1 vii DRAFT NUREG-1661 j

.g .g ~

Table of Contents. Figures. Tables LIST OF FIGURES 2.1 Process for probabilistic analysis for risk-informed ISI . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-2 2.2 Process to account for passive components . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-4 2.3 System piping segment examples . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-7 2,4 General process for estimating failure probabilities . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-14 ~

2.5 Example of code versus service experience . . . . . . . . . ................................2-18 2.6 Core damage frequency calculation process . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ._ ., . 2-30 '

2.7 Piping segment categorization matrix . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2 ,

2.8 Matrix for selecting structural elements . . . ......................................2-49 2.9 EPRI Categorization matrix structure . . . . . . . . . . ...... ....... ..... ............. 2-57 3.1 Expert judgment process . . . . . . . . . . .........................................3-3 ,

3.2 Process for estimating failure probability using expert judgment .........................3-8 3.3 Failure frequency estimates for the auxiliary feedwater (AFW) system components . . . . . . . . . . 3-11 3.4 Failure frequency estimates for the reactor pressure vessel . . . . . . . . . . .................3-12 j 4.1 Median flaw depth and shape parameter for manual metal arc welds (MMAW) . . . . . . . . . . . . . . 4 9 4.2 Median flaw depth and shape parameter for tungsten inen gas (TIG) welds . . . . . . . . . . . . . . 4- 10 4.3 Example of major parameters that can influence calculated piping failure probability . . . . . . . . . 4-14 4.4 Distribution of calculated leak probabilities (Q = 100) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-26  ;

4.5 Comparison of uncenainty and best-estimate calculations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-26 4.6 Uncertainty bounds related to values of calculated failure probsbilities . . . . . . . . . . . . . . . . . .. 4-29 l 5.1 Single-sample plan logic . . . . . . . . . . . ... . ...... ................ .............. 5-6 5.2 Double-sampling plan logic . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5-7  :

1 5.3 Global method analysis. . . . . . . ........... .... ..... .... ......... ........ . 5-9 i 6.1 Impmvement factors for four inspection interval (NDE performance level for POD = "Very Good") . . . . . . . . . . . . . . . .... ............................. ...... 6-15 6.2 Exampic POD curve used in pc-PRAISE. . ................... . . . . . . . . . . . . . . . . .. 6- 1 9 )

l

. 1 1

1 1

i I

i CRAFT NUREG-1661 viii I i

e ,e Table of Contents. Figures. Tables LIST OF TABLES 2.1 Example list of piping segments . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-8 2.2 Examples of direct consequences from piping segment failures .. .. .. ... . . . . . . . 2- 10 2.3 Example FTCA . . . . . . . . . . . . . . . . . . . . .. ...... .. ...... .... . 2-11 2.4 Example of a walkdown worksheet . . .. . .. .. ...... .... .. ... . . . . . . . . 2- 13 2.5 Sources of failure data that can be used to guide estimation of failure probabilities . ......... 2-21 2.6 EPRI system for evaluation of pipe rupture potential . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-27 2.7 Consequence categories for initiating events ... . ... ... .... . .. ...... .. 2-37 2.8 Consequence categories for loss of mitigating ability ... . . . ... . . . .........238 2.9 Consequence categories for containment degradation ... .. . .......... .... . . 2-38 2.10 Consequence categories for combinations . . . . . . ... ......... . ...... . . . . . . . . 2-3 9 2.11 Example approach to overall determination of risk significance for an alternative risk-informed selection process for inservice inspection .. ... .. .. . ... .. .. ... . .... 2-44 2.12 Insights for identifying inspection locations . . . . .. . . ..... . . . . . . . . . . . . 2 -5 2 2.13 Operating experience insights on leak frequencies, 1965-1996 .. ... . .. . . 2-55 2.14 Target goals for detectable leak frequency . . .. ... . .. .. .. .. 2-55 4.1 Flaw densities for piping welds that have been inspected by RT . . . . . . . . . . . . . . . . 4- 1 1 4.2 Deterministic versus probabilistic variables . . . . .. .. .. . . . . .. .. . .. .. 4-17 4.3 Inputs for baseline case . . . . . . . .. . .. ...... ......... . ...... .. . 4-23 5.1 Evaluation of risk for N=8. n=2. and zero defect acceptance criterion . ...... . . . . 5-4 5.2 Evaluation of risk using Bayes' Theorem for perfect (POD =1) and imperfect (POD =0.65) probability of detection .... . . .. . . ..... . ... . ..... .. 5-8 6.1 Check list of degradation mechanisms for inspection of piping systems . . .. . .. . . 6-2 6.2 Inspection strategy table . . . . .. ... . . .. .... .... ..... . ... . .. 6-5 6.3 Reliability studies of NDE for inspection of nuclear piping and other components . . . . . . . 6-7 6.4 PRAISE model of LPI system: baseline case . . . . . .... ..... . . . . . . . . . . 6- 14 6.5 Parameters of POD curves for three performance levels . . . . . . . . . . . . . . . . . . . . . . 6-20 ix DRAFT NUREG-1661

,o ,o EXECUTIVE

SUMMARY

Risk-informed inservice inspection (RI-ISI) programs of piping intecate traditional engineering evaluations with insights gained from probabilistic risk analyses (PRAs). Two basic elements that identify the risk from piping failures are failure frequency and consequence from piping failures. Once the risk of piping failures is identified, the piping can be categorized into two or more groups, such as high safety significant (HSS) and low safety significant 0 SS). From a regulatory perspective, the HSS piping would receive oversight that LSS piping would not. This NUREG addresses some of the technical issues that should be considered when developing a RI-ISI program.

The first element of an RI-ISI evaluation is the estimation of failure probability or frequency of a piping segment. For piping that experiences active degradation mechanisms, use of service experience may be adequate for estimating failure probabilities since applicable data could be cataloged and analyzed. However, for piping that does not experience active degradation mechanisms, data may not be adequate or may not exist from which to estimate the failure frequency of a piping element. For situations where applicable data are not available, qualified structural reliability and risk analysis (SRRA) computer codes can be used to estimate the failure probability of a piping segment. SRRA programs can also be used to identify criticallocations where signs of degradation would first occ ir, thereby minimizing the number of non-destructive examinations (NDE) I for assessing the integrity of piping systems. The technical elements that should be considered when applying SRRA codes are addressed in this NUREG.

An alternative approach to estimating the probability of a piping segment failure is use of an expert elicitation process. This process was applied to selected systems at the Surry Nuclear Power Plant and documented in NUREG/CR-6181, Rev.1. This process could be applied to estimating the failure probability of a piping segment or to selecting input to SRRA computer codes for specific configurations and conditions. The pilot plants used in support of American Society of Mechanical Engineers (ASME) Code Cases (e.g., N-577 and N-578) did not require use of an expert elicitation process. The elements of an expert elicitation process are addressed in this NUREG for completeness .

The second element of an RI-ISI evaluation is estimation of the consequences of piping failures. This esti. nation can be readily obtained from a plant's PRA. The technical elements of t pplying a PRA, in terms of modeling the failures within the PRA or applying the PRA for surrogate component analysis, are derribed in ,

this NUREG.

This NUREG makes reference to RG-1.174 and RG-1.178. These regulatory guides provide guidance on developing technical programs that integrate risk insights. This NUREG augments those guidance documents by addressing some of the technical issues that should be considered in development of an RI-ISI program.

f Selected public comments, including those from the Electric Power Research Institute (EPRI), received in l respmse to an October 15,1997, Federal Register Notice on draft regulatory guide DG-1063 (predecessor to RG-1.178), identified concerns over the technical viability of applying probabilistic fracture mechanics computer programs to estimate the behavior of flaws in piping. Subsequently, EPRI, in a letter dated September 29,1998, stated that,"It has been brought to our attention that there may have been unintended consequences of the EPRI comments. Therefore, to address the potential that our comments have been i

xi DRAFT NUREG-1661

Executive Summary misunderstood, we provide herewith a number of clarifications regarding the intent of our comments. EPRI stated that its recommendations were not critical of the use of structural reliability or probabilistic fracture mechanics methods and "should not be misconstrued as a criticism of any specific risk-informed application.. "

in an NRC Commission Paper, SECY-98-139, dated June 11,1998, the staff informed the Conunission that responses to public comrnents on the Appendices of DG-1063 would be provided in this NUREG. While EPRI's letter of September 29,1998 resolves the technical concerns raised over the Appendices of DG-1063, j I

the staff continues to believe that for completeness and closure of issue, the major technical comments should be formally addressed. The comments and responses to the Appendices of DG-1063 are included in Appendix A of this NUREG. '

I I

I l

l 4

i DRAFT NUREG 1661 xii I i

i

yd g A ACKNOWLEDGMENTS This document builds upon the knowledge base described in NUREG/CR-6181, Rev.1, dated February 1997 (T.V. Vo et al.,"A Pilot Application of Risk-Informed Methods to Establish Inservice Inspection Priorities for Nuclear Components at Surry Unit 1 Nuclear power Station"), in the guidance provided in Regulatory Guides 1.174 and 1.178, and experience gained from the ASME initiatives (Code Case development and pilot plant activities: N-560, N-577, and N-578).

The technical elements of a risk-informed inservice inspection program of piping, as addressed in this report, were developed over several years of research performed by the USNRC and industry. The authors of this document include: Jack Guttmann, Deborah Jackson, Lee Abramson, and Anhur Buslik of the Nuclear Regulatory Commission, Donnie Whitehead of Sandia National Laboratory, and Fred Simonen of Pacific Northwest National Laboratory. In developing the elements of a RI-ISI program, this document builds upon the technical discussions held at public meetings with the ASME-Research Task Force on Risk-Based Inspection Guidelines. Representatives from ASME-Research included, but were not limited to, Raymond Art Kenneth Bailey, Nancy Closky, Alex McNeill, Ernest Throckmorton, David Bucheit, Ray West, Bruce Bishop, and David 11arris. International input was provided by Victor Chapman of Rolls-Royce Associates.

Insights on the use of imponance measures were provided by William Vesely. Peer review was provided by W. Trevor Pratt, Mohamad A. Azarm. Tsong-Lun Chu, of Brookhaven National l>Aoratory; Prabhat Krishnaswamy, of Battelle, Columbus; and 11arry Martz, of Los Alamos National Laboratory.

l l

l l

l I

xiii DRAFT NUREG-1661

Abbreviations ABBREVIATIONS ALARA As Low as Reasonably Achievable AOT Allowed Outage Time BWR Boiling Wate. Reactor CCF Common-Cause Failure CDF Cor- Damage Frequency EP.11 Electric Power Research Institute FTCA Failure Type and Consequence Analysis liFP liigh Failure Potential liSS liigh Safety Significant IGSCC Intergranular Stress Corrosion Cracking INPO Institute for Nucleai Power Operations ISI Inservice Inspection LERF Large Early Release Frequency LFP low Failure Potential LHI Low-head injection LOCA Loss-of-Coolant Accident NDE Nondestructive Examination NRC Nuclear Regulatory Commission NUMARC Nuclear Management and Resources Council PNNL Pacific Northwest National Laboratory PRA Probabilistic Risk Assessment PWR Pressurized Water Reactor RAW Risk Achievement Worth RCS Reactor Coolant System RG Regulatory Guide RI-ISI Risk. Informed Inservice Inspection RT Radiographic inspection RWST Refueling Water Storage Tank S10 Swedish Nuclear Power Inspectorate SRRA Structural Reliability and Risk Analysis I

l l

I l

xv DRAFT NUREG-1661

1. INTRODUCTION

1.1 Background

There is specific evidence from service experience that regular inspections of equipment and components can reduce failure probabilities. There are cases, for example, of large and growing cracks, and of areas of wall thinning in which inspection programs have provided timely detection of the damage so that repairs were made before the defect sizes became critical. On the other hand. there are other cases where ineffective inspection programs failed to detect large defects that eventually resulted in piping leaks or pioing breaks. Such

' ineffective inspections, performed at considerable expense and often exposing personnel to radiation, have not contributed to piping reliability.

While service experience has many examples of direct benefits of the timely detection and repair of piping, inservice inspections (ISIS) also provide other important indirect benefits that are more difficult to quantify.

For example, the detection of continuing degradation at a specific k> cation not only affects the failure probability for the inspected location, but also provides the plant technical staff (and the industry in general) with valuable information on materials performance issues and the structural integrity of similar piping locations.

Therefore detection of degradation durhg an inspection can make a significant contribution toward reducing failure probabilities for similar piping locations. In such cases, the findings of a single inspection can be a key factor that leads to important corrective actions (e.g., additional inspectiora in accordance with requirements for expanded or sequential sampling, improved operational practices to reduce stress levels, or replacement of piping using improved materials and designs).

To address the issue of improving inservice inspections, the Nuclear Regulatory Commission (NRC), on October 15,1997, published draft regulatory guide DG-1063 (Ref.1.1) for public comment. Its principal focus was on the use of probabilistic risk assessment (PRA) findings and risk insights in suppon of those proposed changes to a plant's design, operatimis and other activities that require NRC approval. The regulatory guide (RG) described acceptable approaches for integrating insights from PRA techniques witn traditional engineering analyses into ISI programs for piping. The draft document was discussed during a public workshop held on November 20-21,1997, and was peer reviewed. While the public comments and peer teview of the document were generally positive, the staff concluded that in the interest of optimizing limited resources, the appendices should be removed from the RG and incorporated in a draft NUREG report (i.e. this document).

1.2 Oh,lective The objective is to develop a document designed to assist licensees in planning, developing, and implementing a risk-informed inservice inspection (RI-ISI) program for piping components so that the program meets the guidance identified in RG 1.178 and RG-1.174 by incorporating the information contained in the appendices of P.eference 1.1 along with supplemental information that more clearly illustrates the PJ-ISI guidelines developed by the Electric Power Research Institute (EPRI)(Ref,1.2).

1-1 DRAFT NUREG-1661

, i Evalucie Change in Risk -

1.3 - Organization of this Report

. This report is divided into six chapters and one appendix; as follows:

Chapter 1. serves as an introduction, providing background information and the objective of the report.

Chapter 2 describes approaches to evaluate the change in risk associated with changes'to an ISI program.

Chapter 3 briefly describes the estimation of failure probabilities using expertjudgment elicitation and

, provides an example application to nuclear piping systems.

• Chapter 4 identifies areas of structural reliability code review and discusses selected issues associated with the appropriate vea of such codes. .

Chapter 5 describes methods for selecting the ninber of piping elements to be inspected in an RI-ISI program.

• Chapter 6 describes the development of an RI-ISI program.

Appendix A presents responses to selected comments received in response to an October 15,1997, Federal Register Notice on draft regulatory guide DG-1063 (predecessor to RG-1.178).

i'

- DRAFr NUREG-1661 1-2

a. ,o 1 Evaluate Cnange in Risk REFERENCES FOR CIIAPTER 1 1.1 USNRC,"An Approach for Plant-Specific, Risk-informed Decisiontnaking: Inservice inspection of Piping," Draft Regulatory Guide DG-1063. October 1997.

1.2 Electric Power Research Institute, " Risk-informed Inservice Inspection Evaluation Procedure," EPRI TR-106706, June 1996.

I

!l l

1 l

I i

i l

l l

)

1-3 DRAFT NUREG-1661 I

a a

2. EVALUATING THE CHANGE IN RISK ASSOCIATED WITH CHANGES TO AN ISI PROGRAM The general methodology for using probabilistic risk assessment (PRA) in regulatory applications is discussed in Regulatory Guide (RG) 1.174 (Ref. 2.1) while general issues specific to the development of a risk-informed inservice inspection (RI-ISI) program are discussed in RG 1.178 (Ref. 2.2). This chapter provides discussions on technical approaches for evaluating the change in risk associated with changes to an inservice inspection (ISI) program. There are eight steps, shown graphically in Figure 2.1. They include the following:

• Determine Scone - Define the scope of piping that should be included or assessed with the plant PRA model.

• Develop PR A Model - Define approaches for modifying PRA models, either internally or as surrogate components, or using PRA insights and knowledge to address passive components and their associated leak and break probabilities.

= Develon Pinine Seements - Define an approach for developing piping segments.

. Determine Conscauences of Pinine Failures - Define approaches for identifying the impact of each piping segment failure.

• Assess Pipinc Failure Potential - Describe an approach that accounts for the failure potential of a piping segment either quantitatively or qualitatively.

• Assess Conseauences of Each Pininc Seement Failure - Describe credible approaches for estimating the core damage frequency (CDF) and large early release frequency (LERF) for each piping segment.

• Catecorire Pinine Seements (as 11ich or Imw Safety Sienificant and liich or Imw Failure Potential) and Select locations for Inspection - Describe approaches for determining a piping segment's safety significance and failure potential and then use this information to help select locations for inspection.

• Assess Chance in CDF and I.ERF- Describe how changes in CDF and LERF are calculated or estimated.

As noted in Regulatory Guide 1.174, one principle that must be met to demonstrate the acceptability of a submittal of a risk-informed inservice inspection program is a comparison of the plant's risk with the acceptance guidelines (decision metrics) contained in that guide. Thus, at a minimum, the licensee must perform an analysis that is capable of showing that any increase in the CDF and LERF is consistent with those guidelines.

2-1 DRAFT NUREG-1661 l

l

i.

2 Evaluate Change in Risk mew ===vE score Namady ayuemm/Piphs se lectede DEVEMr rRA 3008E1, o m Appa.e sw Mamfytmen MasPEA udst f

Y oEvExar ramo sEcneEms M '#"*.8'8T.".".",*M*"'

l y

DETEmmsINE CONSEQUENCES Or FmMG FAILURES D E ==_uidashute n ==

l v

aemN etPING FAILUEE rOTENTIAL i

Y ASSESS CONSEQUENCES FOR EACE FIRING SBGBEENT FAILURE I

y cATEcOmIEE emmo sEGh4ENTS AS MBCN OR IDW SAFETY sicNmCAKr HIGN Ok URE r&rENTIAL AND c wnr- e , and unws. in =-- rm =

l v

l Assess CmAwc5 In Cor Axp LEmF ymOu m4SE CASE l l

l Figure 2.1 Process for probabilistic analysis for risk informed ISt.

f ChanFes to the ISI program are not expected to affect the methodology used in accident progression or containment performance analyses. However, ISI program changes could affect failure probabilities for piping in containment systems (containment sprays, etc.) and containment bypass probabilities (failure of interfacing i piping). If necessary, these can be modeled simply by assigning new failure probabilities (or failure I probability ranges) to the affected piping. Thus, changes to the ISI program do not affect the performance of the Level 2 analysis except to address the failure probabilities assigned to piping. The methods for performing .

a level 3 analysis are not affected by changes to ISI since the objective of a Izvel 3 analysis is to estimate the l consequences of events modeled during a Level 1 and level 2 analysis. As such, level 2 and level 3 methodologies are not further discussed in this document. Those ISI-related changes that affect the Level 1  !

analysis are discussed below.

i DRAFT NUREG-1661 2-2  !

S8 l$

~

2 Evaluate Chonge in Risk 2.1 Determine Scope Generally, changes to an ISI program for piping fall into two categories, partial and full scope. To adequately reflect the risk implications of piping failure, this document defines these categories as follows:

Partial scope - A subset of piping classes, for example, ASME Class I piping only. A partial scope evaluation should assess the risk significance of all piping within its category (e.g.,

all Class 1 piping), including piping exempt from the current requirements.

Full Scope - Includes:

• All Class I,2, and 3' piping within the current ASME Section XI programs, and

. All piping whose failure would compromise the following:

- Safety-related stmetures, systems, or components that are relied upon to remain functional during and following design-basis events to ensure the integrity of the reactor coolant pressure boundary, the capability to shut down the reactor and maintain it in a szfe shutdown condition, or the capability to prevent or nutigate the consequences of accidents that ccald result in potential offsite exposure comparable to 10 CFR 100 guidelines.

- Nonsafety-related stnoures, systems, or components:

. That a*e relied upon to mitigate accidents or transients, or are used in plant emergency operating procedures; or

• Whose failure could prevent safety-related structures, systems, or components from fulfilling their function; or l i

a Whose failure could cause a reactor scram or actuation of a safety-related system.

For both the partial and full-scope evaluations, the licensee must demonstrate compliance with the acceptance guidelines and key principles of Regulatory Guide 1.174. {

8 Generally, ASME Code Class 1 includes all reactor coolant pressure boundary (RCPB) components. ASME Code Class 2 generally includes systems or portions of systems important to safety that are designed for post accident containment and removal of heat and fission products. ASME Code Class 3 generally includes those system components or portions of systems important to safety that are designed to provide cooling water and auxiliary feedwater for the front line systems.

2-3 DRAFT NUREG-1661

w ..

l 1

5 2 Eyduate Change in Risk '

2.2 Develop PRA Model I

Piping leaks and breaks are traditionally modeled as initiators in PRAs [e.g., loss-of-coolant accidents - l

~

(LOCAs), feedwater line breaks, floods], but the failures are not normally modeled in detail. The PRAs focus on the system responses necessary to prevent core damage, rather than on a detailed treatment of the i probability of the initiator occurring. That is, they do not usually model individual piping segments or the -

structural elements within the piping segments. However, since the goal of RI-ISI is to detect flaws so that the potential for failures is minimized in those structural elements that have a significant impact on plant risk, it will be necessary to use models that are either more detailed than traditional PRA models or to use a more qualitative approach that makes use of PRA-based and piping-degradation-based knowledge to identify those structural elements having the most impact on plant risk. ,

Regardless of the approach taken, each must be able to account for a more detailed treatment (i.e., either. .

quantitative or qualitative) of the probability of piping failures and the influence of such failures on other systems. Suitable approaches for addressing piping failures are summarized in this chapter and illustrated in Figure 2.2.

I DE1TJtMINE -J CONSEQUENCES OF PIPING FAILIDLES For essapie.

• Lees of b's e- kdeetion mode

• Loss oflow head safety hyecame pump suction a taas of ssfheling water storags tank ESTABLISH PIPE SEGMENTS / BOUNDARIES For ammapie:

• Parties of pipe run for which inihms at any point gins sense m-

+ Generally divided at branchmg poimes, sine changes, or where namesnel verishes gives di5sremt pipe break prhm==

• Other appbcabis definitions (cuassenet with applied masbodology)

I Orr10N 1 OrDON3 OFI'lON 2

• • "*'""'* insigha ham and anstagPRA "d.is.u.h _a,ia,,,, ' - - e., -

Figure 2.2 Process to account for passive components.

l i

- DRAIT NUREG 1661 '2-4 j 4

l i

2 Evoluate Change in Risk 2.2.1 Options 1 and 2 To adapt the PRA model for RI-ISI, the initiators will need to be refined to reflect the direct and indirect effects of piping breaks, if such breaks introduce new initiating events. Similarly, events for piping breaks that occur subsequent to an initiator should also be analyzed. The effects of inservice testing of standby systems should also be addressed. These refinements can be made through various approaches. One approach involves direct modeling of the piping in the PRA fault trees (Option 1 in Figure 2.2). An alternative approach

[used in (Refs. 2.3 and 2.4)] involves using " surrogate components" that capture the effects of the piping failures (Option 2 in Figure 2.2).

If Option 1 is used, new initiators may need to be added to the PRA model to reflect failures of the piping segments if such failures introduce new initiating events. If the piping segment failure yidds the same consequences as some other initiator already included in the PRA (e.g., a large LOCA), it could be accounted for by appropriately modifying the frequency of the initiator that is already included or by directly j incorporating the piping segment into a model (i.e., fault tree) of the initiating event. The importance of the piping segments can be separated out at the end by considering the fraction of the initiator frequency due to that particular piping segment failure or by grouping all cut sets with a particular piping segment basic event.

If the assessment of the failure modes and effects for the piping segment identifies effects not included in any other initiator (e.g., spray effects that cause additional systems to fail), then a new initiating event should be incorporated into the PRA. Event trees will need to be constructed for any new initiators that are added.

When selecting Option 1, the PRA fault trees should be modified to model events corresponding to piping 2

segment failures. The segment failure events can be included as basic events in the fault trees, i.e.,

incorporated as additional failure mechanisms for the event (s) affected by the piping segment failure.

When the second option is used to address piping segment failures in a PRA, the PRA is not actually modified, but instead the impact of piping segment failures is calculated by modifying the results of aa existing PRA.

For this approach, surrogate components are identified whose failures capture the effects of piping segment failures. Just as with Option 1. new initiators may need to be added to the PRA model to reflect failures of the piping segments if such failures introduce new initiating events. The risk corresponding to a revised ISI plan is then calculated by adjusting the frequencies of sequences or cut sets containing these surrogate components.

Section 2.9 discusses the calculations that are performed to obtain these results.

Piping failure frequencies will need to be determined for each piping break initiator included in the PRA.

Similarly, piping segment failure pmbabilities will be needed for events included in the system models. These can reflect failure on demand or operating failures, and care must be taken to ensure that the correct units are applied. Credible methods for calculating failure probabilities for piping are discussed in Section 2.5.

'Some PRA codes allow the user to transfonn an existing fault tree basic event into the original event plus some combination of other basic events (e.g., piping segment failures). IJse of such a code feature is an acceptable alternative to actual fault tree modification.

2-5 DRAIT NUREG-1661

2 Evaluate Change in Risk Piping segment failure rates for normally operating systems are analogous to active component failure rates used in PR As, where the rate is the number of observed failures divided by the number of years of operation.

A failure rate is used for events such as initiating events (e.g., LOCAs and steam-line breaks) and for systems that are continuously operating (i.e., they are not demand based, such as the failure of a pump to run for a desired amount of time).

The demand-based piping failure probability is analogous to the active component failure probabilities that ]

are used in PRAs, where the probability is the number of observed failures divided by the number of demands (such as a pump failure to start on demand). The demand-based piping failure probability is used for events in which a piping segment or system is in a standby condition and is called upon to function during an event.

2.2.2 Option 3 Option 3 is an more qualitative approach (Ref. 2.5 and 2.6) that makes use of insights from PRA and piping-degradation-insight-knowledge to identify those structura3 elements having the most impact on plant risk without necessarily having to modify or quantify a plant-specific PRA. In this approach, rather than modifying or using a surrogate component from the PRA, each piping segment's consequences are determined by .ne l appropriate design-basis initiating event category, the number of unaffected backup systems and exposure tirne, or some combination of these two. The failure potential of each segment is determined by identifying the degradation mechanism (s) active within the piping segment. If no mechanism is known to exist, the failure l potential is classified as low. I 2.3 Develop Piping Segments One method for modeling a run of piping for all three options identified in Figure 2.2 is to divide (segment) the l run so that a failure at any point in the piping segment results in the same consequence' . Distinct segment I l

boundaries are identified at branching points or size changes where a significant difference in consequence or failure probability occurs, or the break probability is expected to be markedly different due to environment or other factors (e.g., where piping materials change). As always, other methods for defining piping segments I may be found acceptable.

An example of a system and some of its defined piping segments is shown in Figure 2.3. In this example, I emergency core cooling system (ECCS) piping segment 1 is defined as a piping run between check valves i 1-SI-241,1-S1-235, and 1-SI-79. A failure or break of this piping segment is postulated to result in the loss of the inventory of the refueling water storage tank (R'w f) inside the containment. Similarly, ECCS segments 2 l and 3 are defined for the other injection points into the reactor coolant system (RCS) cold legs.

Another example of a piping segment shown on Ibgure 2.3 is low-head injection (LHI) piping segment 1. This I segment is defined as a piping run between check valves 1-SI-46B,1-SI-47, and 1-SI-50. Failure of this piping segment is postulated to result in loss of RWST outside containment, resulting in the loss of all injection and recirculation.

DRAIT NUREG-1661 2-6

2 Evaluate Change in Risk 1 46438 To Normal To Ahernato Sussion_p1 l '4_ Suellen AMmeI%

RWST Hemmer Heemog 14644t 141-7e

, l HHN HHSi

,_{ y, f g LNI Pipe segment #1 a niniu u l _ g x .

m.xy ,g

__ L u -

54 4=

14 43 LPI [N 1 46437 14447 g 1 46443 14648 4

LPI -> AW ' '

_ s s 1 4  %

g Q* -

+yy  ;

or n & \

.I I. >

~" acc8 Pipe mesment #1 samens l l FROGA RECIRC CONTAINIAENT TO ECCS Pipe Segment 33 ummuumme SUtsP RWST l

Figure 2.3 System piping segment examples.

(

The number of piping segments defined for an ISI analysis will be plant-specific. For the application described  ;

in (Ref. 2.3), the total number of segments defined and the systems are shown in Table 2.1.

Given that system boundaries involve system functions and may also involve interactions among systems, the defm' ition of these boundaries reauires a careful, logical approach Allinterfaces must be identified to ensure that there is consistency amon', the defined boundaries, when viewed from the systems on either side of each boundary, and that no safety functions are overlooked.

2c4 Determine Consequences of Piping Failures The direct and indirect effects of piping failures need to be characterized so that the appropriate failure mechanisms and dependencies can be identified and aither be incorporated into the PRA model (Options 1 and

2) or accounted for when determining the number of unaffected systems (Option 3). One credible means for characterizing piping failures is to consider three types of postulated failures: (1) leak, (2) disabling leak, nd (3) break.

2-7 DRAFT NUREG-1661

2 Evaluate Changein Risk Table 2.1 Example list of piping segments.

System Number of S.gments Auxiliary Feedwater 32 Blowdown (Steam Generator) 12 Component Cooling 66 Chemical & Volume Control 44 Condensate 9 Containment Spray 16 Circulating Water 16 Emergency Diesel Fuel 7 Fuel Pit Cooling 9 Feedwater 20 Main Steam 38 Reactor Coolant 96 I

Residuallleat Removal 11 Recirculation Spay 13 Accumulator Discharge 15 Emergency Core Cooling 8 liigh llcad injection 27 law Head injection 18 Service Water 54 Ventilation 2 Auxiliary Steam 2 TOTAL 515 i

Each failure type has a likelihood for degrading system performance through direct and/or indirect effects. A leak is a piping failure that does not directly result in the loss of system function. Instead, it produces indirect effects (i.e., loss of system / train / component and/or causes an initiating event) caused by the intrusion of DRAFT NUREG-1661 2-8 o_________ _____ __ - . - - --

. .. -1

v ,,

2 Evaluate Change in Risk moisture through jet impingement, flood, or spray. A disablir.g le ak (those with a larger break area than leaks) results in the direct loss of a system function and can result i.. damage similar to that dec.cribed for leaks. A break can result in all of the above-mentioned damage, plus damage from pipe whips.

I I

For each break size, the consequences of the postulated failure is determined. An assessment of the failure modes and effects can be made through system walkdowns to identify the failures.

Examples of direct effects that can result from piping failures incluele:

1

. failure that causes initieu.3 events such as a LOCA or a reactor trip,

. failure that disables a single train or system,

. failure that disables multiple trains or systems, and

. failure that causes a combination of the above situations.

\

r : Table 2.2 lists the direct consequences postulated for several piping segments, considering possible operator actions and their impact on the plant examined ir. (Ref. 2.3).

Indirect effects include failures of additional equipment (including equipment in other systems) as a result of pipe whip, jet impingement, or flooding. An examination of indirect effects must also include a 6 termination of how operator actions can be affected by improper instiument indications that could result from equipment

( failures or malfunctions caused by a piping failure. The evaluation should also consider the actions that plant j personnel can take to recover from a piping break event. An example of information for a basic element resulting from a failure type and consequence analysis (FTCA) adapted from (Rei. 2.4), is summarized in Table 2.3. Additional sources of information on the ef fects of piping breaks that should be considered include the p!am hazard evaluations performed to meet the requirements of the NRC's Standard Review Plan (Ref.

2.7), ano any internal flooding analysis that has been performed at the plant.

A plant walkdown is importard for assessing the potential for indirect effects. Prior to a w;lkdown, existing l

dosuments (e.g., flooding r ,.@a) that can provide insights into possible indirect effects should be examined.

Possible sources of indirect JNs c n be obtained from the plant's equipment qualification program, hazards review program, and other documents that examine the local effects of pipe breaks for the systems in the ISI  ;

l protram. Systems and trains affected by a break in the area should be identified. The plant layout drawings for areas not covered by the documentation review should be examined. Plant areas for which documentation I

was not clear or specific equipment not listed should be identified to ensure that the walkdown collects information from these areas.

2-9 DRAFT NUREG-1661

l ,, ..

2 Evaluate Change in Risk l

l Table 2.2 Examples of direct consequences from piping segment failures.

Segment ID Segment Description Postulated Consequence Postulated Consequence (without operator action) (with operator action)

ECCS-0 RWST to flow split to LPSI, less of refueling water less of RWST HPSI, and chargmg - MOVs storage tank (RWST) 8812A. 8812B, LCVs 112D, ll2E. V8884 and MOV 8806 ECCS-l' From CV8819C and Imss of RWST* Imss of all RHR and liPSI CV8818C to CV8847C l

ECCS-5' Flow from SI CV 8847A and less of RWS1+ less of all RHR,liPSI and ACC CV 8956A tojoin to one accumulator CV 8948A hCS-7 LPSI connection from loop A Large LOCA with loss of Large LOCA with loss of cold leg tee to CV 8948A HPSI, LPSI, and ACC HPSI, LPSI, and ACC injection to one cold leg injection to one cold leg FWS-1 Main feedwater flow from Feedline break initiator Feedline break mitiator MOV35A to gate valve FCV510 The only operator action that could be taken would result in cloare of MV8835 (no llPSI to any paths) and closure of j

M V8809A or 11 (loss of two LPSI paths). liowever, given the short time available to take operator actions following a LOCA i

w here LPSI is icquired, no operator action could be credited with closing MV8809A or B to save two injection paths.

Ilowever, closure of MV8809A (or II) does prevent a los, of RWST.

" DurinF the ISI team o' expert meetings, the postulated consequence (without operator action) was changed to a loss of

(

RWST inside containment, resulting in an earlier transfer to recirculation ar'd the loss of ore injection path. An operator l

i recovery action could not be taken due to limited time and the difficulty in diagnosing the actual location of the break during I aLOCA.

One practice for prewalkdown preparation is to develop rummary sheets thtt h the effects of spray wetting, flooding, temperature, pipe whip, and jet impingement. The summary sheet. auld address indirect effects on

! a systematic building-by-building basis. The development of such summary t.heets should take advantage of the experience gained from the ASME's Validation and Verification pilot programs (e.g., ASME Code Case N577. Virginia Power's Surry plant). In this study, the hazards evaluation included the examination of the emergency safety features building, the auxiliary building, the diesel generator building, the fuel building, the recirculating and service water pump house, the turbine building, the containment building, and the hydrogen recombiner building, etc.

DRAFT NUREG-1661 2-10

\ __- - ____- _-___

2 Evaluate Change in Risk Table 2.3 Example FTCA.

Piping Failure Failure Recovery Remarks Segment Mechanism Consequence Action (location and piping size)

RWST to . Concern with e l>>ss of HPI . Cross-tie w. . RWSTis the primary source Valve 1-CS.25 chloride SCC mode Unit 2 for the LPI and HPI systems (all kications) RWST during injection mcxle 6 Welds . 12>ss of low

. Movement of head Si pump . Follow 2 Elbows tank during suctLn emergency

( seismic event operating 06" diameter) (at elbow . Loss of RWST procedure-nearest to tank)

Source: ( Adapted from Reference 2.4)

The personnel involved in the walkdown should include representatives from the following organizations or groups:

• PRA

• Piping

• ISI

• Operations

• Engineering The following are examples of results obtained from a walkdown of a plant (Ref. 2.3). For the auxiliary feedwater system:

"The walkdown of the turbine building resulted in several areas nxding further consideration for toe PSA modeling. The turbine building component cooling water has a small surge tank and Anually any piping break / leak will eventually fail the system which will lead to a reactor trip. The three plani air compressors are located side by side near the condensate pump discharge header. A postulated break in the header muld potentially fail all three compressors which would cause a reactor trip. The h> cation of the motor driven and two turbine driven pumps makes the system susceptible to losing all pumps due to a piping break."

For cubicle / area 011:

2 11 DRAFT NUREG-1661

s. .,

2 Evaluatt Change in Risk Tazards Evaluation concludes piping break will not target cable trays, but should funher investigate effects of losing cable tray. No additional interactions found. Train B valves located away from postulated break locations. Pipe break will only affect FWA Train A.

Need to consider the CCP interaction for inclusion in the segments analyzed."

Table 2.4 shows an example of a walkdown worksheet dccumenting the information gathered.

[ Note: the only difference between Options 1 and 2 and Option 3 is that the consequence information collected is used in Options 1 and 2 to modify the PRA either directly or indirectly, while for Option 3 it is used to identify the number of unaffected systems. In either case, the information collected should be the same.]

2.5 Assess Piping Failure Potential One of the distinguishing differences between Options 1 and 2 and Option 3 is that Options 1 and 2 determine a numerical piping failure potential while Option 3 uras a more qualitative approach (i.e., assignment to one of three degradation categories) to assess the failure potential of each piping segment. While each approach differs in its degree of"quantitativeness." both approaches requie the identification of the plant-specific degradation mechanisms active for each piping segment.

I 2.5.1 Options I and 2

)

The process of estimating component failure probabilities is at the hean of a quantitative RI-ISI program.

Failure probabilities and failure rates of p' c re boundary components are required as input to the calculation of risk (i.e., CDF and LERF). It should i -. acd that quantification of failure probabilities (i.e., estimating the impact of ISI on a reduction in failure probabilities) is also pan of developing an RI ISI program.

2.5.1.1 Overview of Estimation t rocedure Figure 2.4 shows the process for estimating failure probabilities. The steps are as follows:

+ For each piping segment, identify locations of high failure probability and their associated failure modes and mechanisms. The failure may be a leak that results in secondary failures, such as an electrical bus; a leak that disables the system (i.e., a disabling leak), as well as electrical components; and/or a break that can lead to the above failures plus damage from pipe whip.

• Review and revise the initial selections for high failure-probability locations as well as the failure modes and mechanisms for these hx:ations. This review may make use of a technical group (i.e., a panel) of individuals with specific areas of expenise in plant operations and maintenance, fracture mechanics, and PRA.

1 DRAFT NUREG-1661 2-12 m_ r- m mmem

e ,,

2 Evaluate Change in Risk Table 2.4 Exarnple of a walkdown worksheet.

INDIRECT ERECTS WALKDOWN WORKSIIEET llem #: $ Buildine ESF Q@icic/ Area: 011 Elevation: 21" - 6" Indirect Effect of Concern: less of Train A equipment due to any piping break in area (aux. feedwater suction or discharge piping), including a CCP piping.

Components /Equipnwnt in Cubicle / Area System Comp. Type Tag. No. Train Needed for Safe Support System?

Shutdcwn?

IVA Pump 3FWA*PA A Y N IVA Valve 3FWA*llV3]D' A Y N FWA Valve 3FWA* LIV 3] A' A Y N FWA Valve 3fMA*V4 2 A Y N FWA Valve 3FVA*AV61 A' A Y N FWA Valve 3FWA*AV23A' a Y N IVA Valve 3IVA* LIV 31CB' B Y N INA Valve 3FWA*llV31C' B Y N FWA Valve 3FWA*AV62H' B Y N Comments Cable tray numbers hsted in llazards Evaluation did not match those marked on the overhead treys in the room.

Additional checks needed.

Conclusions Apparent discrepancy with cable tray identifiers noted. Ilazard Evaluation concludes piping break will not target cable trays, but should further investigate effects oflosing cable trays. No additional interactions found. Train B valves located away from postulated break locations. Piping break will only affect 'MA Train A. Need to consider the CCP interaction for inclusion in the segments analyzed.

1. located at a far side of room from unisolable break

2. Near a pump

3. Located at postulated break location

4. Located at a far end of room away pump and postulated break Source: Adapted from Table 3.4-2 of Reference 2.3.

2-13 DRAFT NUREG-1661

i, ..

2 Evaluate Change in Risk identify locassons and failure modes A

Review locatnons/ failure modes 4

Assemble data 1

Estimate failure probabilities for criticallocations 1

Estimate failure probabilities for other locations 1

Calculate failure prohbilities 1

Review probability estimanes 1

Tabulate final probability estanates 1

Perform sensitivity stadas I

Figure 2.4 General process for estimating failure probabilities.

DRAFT NUREG 1661 2-14

2 Evaluate Change in Risk

• Assemble the detailed data needed to estimate failure probabilities, including piping design data, loadiq,s, materials, and operating experience.

• Estimate failure probabilities of critical location (s) for each piping segment using historical failure rate data, structural reliability computer codes, or expert judgment elicitation. If expert juchment clicitation is required, the industry may benefit if the elicitation is performed through a professional society such as the ASME or an industry group.

• Estimate relative failure probabilities for other less critical locations within the piping segments using the probability estimated for the critical location (s) as the reference value.

• Calculate the overall failure probability for each segment' and the combined probability for all plant systems to provide a summary. This summary should be used for companng estimated failure probabilities with plant operating experience and tiends of piping failure databases, and to otherwise assist in reviews of estimated failure probabilities.

• Review calculated failure probability estimates for consistency with expected conditions, degradation mechanisms, and where applicable, review the inputs used to estimate the failere probabilities. This review could be performed by the ISI team or by an independent panel.

• Tabulate final estimates of failure probabilities for use in PRA calculations to estimate the CDF and/or risk associated with each piping segment and/or structural element.

• Perform sensitivity an1 uncertainty studies to evaluate potential impacts of uncertainties in modeling and input data on failure probability estimates.

Detailed considerations that provide guidance for the estimation of failure probability are provided in the following section.

2.5.1.2 General Issues Realistic versus Conservative Estimates - The objective of risk-informed ca!culations is to make realistic estimates of failure probabilities rather than conservative or nonconservative estimates. The introduction of conservatism or optimism on a selective and/or nonuniform basis for particular components or particular failure mechanisms may have the undesired effect of biasing the CDF or risk estimates and the inspection locations. ,

Effects of ISI - For CDF and/or risk calculations (L.ERF), piping segment failure probabilities should be 8

Another approach that may be used to estimate a segment's break or leak frequency is to analyze and account for all the degradation mechanisms present in a segment and to account for the linuting stresses and conditions to which a segment will be subjected. Such a process allows for the determmation of a segment leak or break frequency in place of a structural element leak or bred frequency.

2-15 DRAFT NUREG-1661 l

2 Evaluate Change in Risk estimated by taking credit for the ISI performed during the plant's license period (e.g.,40 or 60 years).

Structural mechanics calculations should include the effects of inservice inspections. For segment categorization (discussed in this chapter), no credit for Section XI ISI should be taken. However, for piping segments that are already being examined in an augmented inspection program, credit can be taken for ISI.

Alternative programs that credit ISI should be documented and justified. This enables the analyst to identify the risk-significant segments that require inspections. In using historical data from operating reactor experience, it can b; assumed that past ISI programs for most components have had only modest impacts (if any) because the selection criteria focused on locations of design-basis high-stress /high-fatigue usage (among other criteria) while at the same time unnecessarily caposing personnel to radiation.

Aging Effects - The elfects of aging mechanisms on failure rates should be included in estimates of failure probabilities. Specific aging mechanisms known to be of concern in nuclear pressure boundary components are irradiation-induced embrittlement for reactor pressure vessels and vessel intemal components, and thermal aging for cast stainless steel. Other aging effects include, for example, fatigue, stress corrosion cracking age (Refs.2.8 and 2.9) and erosion / corrosion (e.g., secondary systems).

Credit for Leak Detection - Detection of leaks can provide warning of piping degradation before a break occurs, in calculating CDF, LERF, and the changes in core damage frequency and LERF that result from changes to the inspection program, leak detection should be credited. Ilowever, when calculating the relative risk importance of a segment for use in categorizing risks. leak detection should not be credited. The current defense-in-depth process includes ISI programs, operator wa% downs, leak detection systems, system tests, and pressure tests. These should not be credited in the importance measure calculations used to classify a piping segment as high or low safety significant (liSS or LSS) as described in Section 2.7.1. If the licensee chooses to credit leak detection, the submittal should document such credit and provide adequate justification for the credit.

Failure Probability Calculation - Applying the guidelines outlined above (including additional criteria addressed later in this report), for a plant, the failure frequency is normally calculated as a cumulative failure probability over the 40 or 60-year license of the plant (as justified) and divided by the number of years (40 or 60 ) to obtain the average rate of failure in any one yetr. This process addresses aging effects calculated by the computer code and results in an average failure rate on a per-year basis. (See Section 2.5 for additional implementation details.) If aging effects are found that were not incorporated in the calculated failure rates and probabilities, their impact on the RI-ISI program should be addressed.

Failures on Demand versus Failure Frequencips - The term " failure probability" is used generically to refer to failures that are either demand-related or time-related. Section 2.6 addresses the use of these measures of failure probability in calculating CDF and LERF, and describes a method for linking demand-related probabilities to failure frequencies.

l The failures of components in standby systems will have safety consequences only if the piping fails or is in a failed state during the limited periods when the system is needed to mitigate an accident or to otherwise DRAFT NUREG-1661 2-16

1

)

2 Svaluate Change in Risk maintain the plant in a safe condition. However, evaluations of structural integrity should account for the structural degradation (e.g., corrosion) that can develop during these nondernand periods, because such degradation can lead to failures when maximum loads are applied to the degraded components in a demand 1 situation. )

Evaluations of standby systems should establish the likelihood of piping failures during periods of demand as opposed to failures dering standby periods or periods of operability testing in which failures will not affect plant safety. Unless otherwise indicated by data it can be assumed that structural failures during standby l

periods or testing will be detected by visual observation of gross leakage, and that the failed components will be promptly repaired. The failure mechanisms and frequency should be compared with the calculated results.

Identification of Failure Type and Mechanism - As stated earlier,it is important to identify the appropriate failure type (leak, disabling leak, or full break) for each component, so that the failure type corresponds to the consequence addressed by the probabilistic risk assessment. In many cases a piping break is the failure type of concern, although in other cases a piping leak (for jet impingement-induced failures) or a disabling leak (for loss of system function) can also have safety consequences. The failure type of concern is plant-specific.

While failure types corresponding to a piping leak may not be of concem frorn the standpoint of safety consequences, such failure types would be of concern from the standpoint of plant availability, economic impacts (which are outside the scope of this document), or public perception (safety concern).

Operating experience on leaks and cracking, as well as other detectable modes of deFradation, is significant for the RI-ISI process. Such observations are often associated with ronditions (i.e., design and material deficiencies, fabrication errors, unanticipated stresses, and aggressive environments) that could cause a piping break at another location in the system and/or during future periods of operation. This information should be used for estimating piping failure probabilities.

Info mation on degradation mechanisms observed should also be factored into the inputs to the structural reliability calculations and used for benchmarking, such as that done for the computer code, pc-PRAISE (Figure 2.5). For example, structural reliability models predict (in addition to the piping break probability) probabilities of leaks and significant crack growth and/or wall thinning. Calibrating the structural reliability codes to reflect service experience can guide insightful refinements to model assumptions and inputs, for example, as f' or modeling stress corrosion cracking with the pc-PRAISE code (Refs. 2.10 and 2.11).

2-17 DRAFT NUREG-1661

2 Evaluate Change in Risk 10 . .

"?,,__--

g g 1

,,,, ,, . ..i a .i e. awn o

.s '

r -

s*.J N ... - .

,/ e cw i...

/

r,m aa Pio, s a g s _. . . .

0 4 8 12 16 20 24 26 22 36 40 P! art Age. Yean Figure 2.5 Example of code versus service experience.

]

i i

The estimation procedure should address each component (e.g., piping segment) and structural element (e.g., j weld), and should assign:

I

• a dominant failure mechanism (e.g., fatigue cracking at the inside surface), and j

• a numerical value for the failure probability. l Identification of failure mechanisms is a significant step. This information is an important input to the subsequent step of developing inspection strategies, since different failure mechanisms will require different inspection methods to detect structural degrr'ation and damage.

I Common-Cause Failures (CCF)- Special situations that can result in CCFs should be identified as part of i the failure probability estimation process. For example, extending the inspection intervals could make CCFs I more important. CCFs are of concem only if the failures occur within the same time period, as for example, i

during the course of a given accident scenario. The methods of segmenting piping and requiring one element to be inspected in each segment that is categorized as high safety significant (HSS) (as described in Section 2.7.1) can reduce the likelihood for CCF. '

Situations that could result in CCFs within the same time period include:

I Piping that is not subjected to routine pressure testing to verify its integrity. Such piping could  ;

experience long-term degradation (e.g., corrosion), resulting in more than one pipe failing when DRAFT NUREG-1661 2-18 1 i

. .. ......)

2 Evaluate Change in Risk systems are suddenly pressurized during a critical demand period of an accident.

• Degraded piping that is subjected to routine pressure testing to verify its integrity under normal conditions, but that is subjected to overpressure conditions (e.g., interfacing system LOCA or water hammer loads) during a critical demand period of an accident.

• Degraded piping that is subjected to severe loads from external incidents such as a seismic event.

Failure Probabilities for Other Locations - Given the number of structural elements within each piping segment, it is not practical to perform detailed evaluations for each location (e.g., element or weld). One approach is to identify the critical location (s) within each segment that has the highest expected failure probability, and to focus the detailed evaluations on these locations. Without detailed evaluations, it may not always be clear which of the structural h> cations within a segment has the greatest failure probability. In these cases. pmdence dictates that detailed structural mechanics evaluations be pe formed for each location.

Additional evaluations can also establish relative differences in failure probabilities within the segment, and thereby provide an improved technical basis for assigning probabilities.

Once the range of expected failure probabilities for critical structural elements within a segment is estimated, the failure probabilities can be estimated for the other less critical locations. Typical estimates in pilot applications (Ref. 2.12) have assigned at least 50% (and typically 90% or more) of the overall segment failure probability to a critical kication. It is important to make failure probability estimates for the other structural h> cations to determine if a large number of failures at such locations contribute significantly to the overall failure probability of the segment.

Total Failure Probabilities for Systems - When evaluating the results of the calculated failure estimates used in or with the PRA, it is important that the results be compared with operating data. Depending on the availability of data, a licensee might consider evaluating system-level failure probabilities as a global check of its methods and assumptions. A total failure probability is calculated for each system based on the probabilities estimated for the individual segments that make up the systems. The total failure probability for piping segments within a system is the sum of the failure probabilities for the individual piping segments. A review of these totals will facilitate the review of the failure probability estimates. Such system-level information may be more readily benchmarked using the limited data on piping failures from plant-specific and industry-wide experience. System-level probabilities that are unreasonably large or small when compared against data indicate a need to review and, if necessary, modify the inputs and/or assumptions used to estimate the segment. level failure probabilities. Total system-level failure probabilities may also be reviewed to detect reasonable and consistent trends in the relative contributions of particular systems and failure mechanisms to overall plant-wide failure probabilities. All assumptions in the calculations should also be reviewed and revised as appropriate.

2.5.1.3 Methods for Estimating Failure Probabilities This document describes three methods for estimating failure probabilities for piping. These methods are most 1 2-19 DRAFT NUREG-1661

a, .,

I 2 Evaluate Change in Risk useful when used in combination. In typical applications, some aspects of all three methods will usually be used, although one method may be primary. For example, while the primary method may be application of structural reliability and risk computer codes, where data are lacking, some inputs to the computer model may be based on expen judgments. Similarly, expens make use of available data, including results from computer models. Funbermore, failure probability estimates, from both experts and computer models, are always subject to " reality checks" by comparisons of the estimated probabilities with plant-specific failure experience and industry-wide historical data on failure rates. The degree to which one relies on one method or another is predicated on the availability of data from service experience, experts, or applicable structural reliability and 4 risk models.

l Approaches for estimating failure probabilities include:

IIistorical Data - Studies by Bush (Refs. 2.13,2.14, and 2.15), Jamali (Ref. 2.8) Thomas (Ref. 2.16), and l

Wright et al. (Ref. 2.17) have estimated break probabilities for systems and component = based on data from the few documented occurrences of piping breaks, along with additional knowledge of the relevant number of years of plant operation. While such databases will not fully reflect the plant-specific factors (e.g., operational conditions, service experience materials selection, and design features) needed for an individual plant evaluation, the information can serve as a useful baseline to guide estimates. Table 2.5 lists a number of ,

sources of failure data that can be used to guide the estimation of piping failure probabilities. l Industry databases exist or are under development, and these can provide additional sources of detailed  ;

information on piping failures. One such database is that developed by Dr. S.II. Bush and his associates for i the Swedish Nuclear Power Inspectorate (SKI) (Ref. 2.18). The scope of the SKI work has more recently been extended by Dr. Bush with suppon from the Electric Power Research Institute (EPRI). This more recent work has an objective of producing a computerized source of information for use in developing ISI programs. (

l t

The construction of the SKl/EPRI database includes information from over 1500 reported piping failures at U.S. nuclear power plants. A user of the data has available a detailed breakdown of failures in terms of failure mechanism, failure type (leak or break), reactor type [ boiling water reactor (BWR) or pressurized water reactor (PWR)], year of occurrence, pipe size, and the plant and system where the failure occurred.

Databases are an imponant source of information that can support the estimation of piping failure probabilities.

In some cases, it may be possible to estimate component-specific failure probabilities solely by direct application of failure data. liowever, there are factors that can limit the usefulness of databases, such as incompleteness (e.g., lack of root cause analysis and documentation), lack of data for specific degradation mechanisms, operating conditions, etc. To supplement existing databases, the analyst can apply structural mechanics models with engineering evaluations. The following identifies potentiallimitations of databases and provides guidance on estimating component-specific failure probabilities when applying databases:

I DRAFT NUREG-1661 2-20

2 Evaluate Change in Risk Table 2.5 Sources of failure data that ca'n be used to guide estimation of failure probabilities.

Database Narrative description Cornment Reference NPRDS Computenzed database maintamed on Contams component hardware reliabihty. Covers -

behalf of electric utihty industry by experience on masntenance, inspection and repair Insutute for Nuclear Power Operations of nuclear plant components (INPO)

LERs Computenzed database mamtamed by Contains information subnutted by operating -

NRC plants. Small frachon of reports deal with component / structural degradation and faPure.

Extensive screening required to locate informanon relevant to rnaintenance and inspection Plant records Maintained by indmdual plant and Useful informauon. Contains inspecuon. -

vendors of plant operating experience matntenance, and repair informahon. Accessmg this information involves commiunents of time and money for visits to plants Developed by NRC and nauonal Contams failure probabihues and rates of pressure (Refs. 2.19, Expert chcitation laboratones. Provides usefulinformauon boundary components and structures. Contains 2.20, and on undocumented field expenence esumates of important safety parameters useful 2.21) for performing PRAs NPAR Summary conclusion of NRC research on Desenbes service failures and degradauon at (Ref. 2.22) age deFradation of pressure boundary operating plants components Assessment of Uuhty industry prepared through the idenufies degradauon potentially important to -

plant hfe Nuclear Management and Resources plant safety extension Council (NUMARC). Each reprt addresses issues for a panicular type of component (e g., pomary coolant system componente ASME Task Special ASME, Sect 3on XI Task Group A comprehensive review of operatmg capenence, (Ref. 2.23)

Group on Fatigue report. Reviews fat 8Fue of nuclear power including occurrences of cracking plant components and makes recomnrndations to ASME,Section XI NRC Pipe Csack Formed by the NRC to evaluate the causes idenufies potential solutions for elimmating or (Ref. 2.24) of unexpected cracking of reactor pipmg nutigating cracking of reactor piping systems (Ref. 2.25) systems EPRI EPRI.spusored study on matenal Contams information relating to fabncauon (Ref. 2.26) degradation and environmental effects on processes that contnbute to degradation. Identifies components for plant hfe extension flaws in LWR components EPRI Computer software developed by EPRI to Widely used by utihties (Ref, 2.27) predict piping locations subject to crosion-corrosion EPRI A campilation of data on nuclear piping includes estimates of generic failure probabihties (Ref. 2.8) failures. for particular systems.

INEL Summary of pipmg bred accid;nts. Information intended for use in probabihsuc risk (Ref. 2.17) assessments . (Ref. 2.28)

Bush Reuew and interpretauon of data on Author bnngs perspective of ASME Section XI (Ref. 2.13) piping failures and service-related Code and regulatory issues (Ref. 2.14) degradation (Ref. 2.15)

(Ref. 2.29)

(Ref 2 Im 2-21 DRAIT NUREG-1661

4 2 Evaluate Change in Risk Databases provide valuable information that can support the estimation of failure probabilities and guide probabilistic structural mechanics calculations. For example, it is clear that failures do not always occur at welds and do not correlate with stress or fatigue usage calculations contained in j design reports. On the other hand, failures are highly correlated with identifiable degradation mechanisms.

The particular component of interest must have a sufficiently high failure rate so that one or more failures are contained in the compilation of data. Since most piping components have relatively high levels of reliability, databases will often show that no failures have occurred within the operating period covered. Given that no relevant failures have occurred, the data only permit bounding estimates of failure probabilities. In these situations one can use probabilistic structural mechani.

models to estimate the low failure rates that are outside the bounds of reponed operating experience.

Databases usually address the number of failures that have occurred, but do not provide the corresponding population statistics needed to estimate the number of components that did not fail.

The user of a database must estimate the population of components for the particular categories of components and failures covered by the database.

Databases are well suited for estimates of average failure rates on an industry-wide level for a particular class of component. However, it can be difficult to use such data to evaluate the plant-specific and component-specific failure rates that are addressed by a risk-informed inservice inspection program. The risk-informed inspection process requires detailed differentiation and quantification of failure probabilities for individual welds or structural elements within piping systems. Such differences are beyond the scope of databases, but can be addressed by inputs to structural mechanics models.

Application of databases and perhaps expert judgement, may be the only viable approach for estimating failure probabilities in unusual piping designs, materials (e.g. fiberglass piping), and service conditions for which there are no structural mechanics models.

SRR A Calculations - Structural reliability and risk analysis (SRRA) computer codes use models based on probabilistic structural mechanics methods and can be used to estimate failure probabilities for imponant components. SRRA estimates can take into account a higher level of component-specific information than

{

methods based on historical data or expen elicitation. SRRA models can be panicularly useful for estimating (

relative values of failure probabilities to mrmit identification of locations within a system that have a higher failure probability.

SRRA models also predict the progress of degradation and/or crack growth as a function of time while quantitatively accounting for the impact of random loadings, such as earthquakes. These results can be useful for selecting appropriate intervals over the service life of the components for periodic ISI examination.

Section 2.5.1.4 provides guidance on the application of SRRA models to the development of risk-informed inspection programs. -

DRAFT NUREG-1661 2-22

2 Evaluate Change in Risk The following steps are approaches to using SRRA models for estimating failure probabilines.

. Celect a structural reliability model(s) that addresses the materials, operating conditions, and failure mechamsm(s) that apply to the structural location of concern.

- Gather detailed data needed as input to the SRRA model, including piping dimensions, materials and welding pararacters, operating temperatures and pressures, cyclic loadings, chemistry and flow rates for fluids, and operating stresses for normal and abnormal conditions.

+ Use design-basis stress analysis as a source of stress data.

= Use plant operating staff knowledge to address input parameters such as susceptibility to intergranular stress corrosion cracking (IGSCC), wall thinning, and thermal high-cycle fatigue.

• Neglect the effects ofinservice inspections when defining inputs to the SRRA calculations that will estimate the failure probabilities to be used in the PRA.

+ Review final input data for an appropriate SRRA, and follow the guidance provided in Section 2.5.1 of this document.

. Calculate the failure probabilities.

. Assess the values for calculated failure probabilities for consistency with operating experience and expen judgment. Identify inconsistencies in predicted probabilities for detectable degradation, leak probabilities, aad break probabilities. Benchmark SRRA calculations against operating experience and expert input.

• Document SRRA calculations by providing details of input data, modeling assumptions, and resulting values of calculated failure probabilities.

Ewert input - Elicitation of experts has gained acceptance as a means to quantify input to PRAs and risk-informed studies. A systematic procedure, as described by (Refs. 2.12,2.18, and 2.19) has been developed for conducting such elicitations to address major industry safety issues. Application of the procedure has been demonstrated in a research program that estimated failure probabilities for use in a pilot application of PRA methods to inservice inspection (Refs. 2.30 and 2.9). This methodology is described in Chapter 3.

The expen elicitation process is (as a generic methodology) applicable to any issue where there are large uncertainties, the amount and quality of data are insufficient, or predictive models are not well validated. As such, the methodology nec ' he used directly to estimate stmetural failure probabilities, but can be used to address inputs needed for il mechanics models. A full-scale expen iudgment process as described in (Refs. 2.19 and 2.28) can : bborious and normally requires staff and expemse outside the capabilities of utilities. Therefore, if exper judgment elicitation is required, the industry may benefit if the elicitation is 2-23 DRAIT NUPEG-1661

o ..

2 Evaluate Change in Risk performed through a professional society or an industry group and incorporated, if applicable, into the structural reliability computer code.

Reliance and e.,melusions from an expert elicitation program should be well documented. For example, inputs for crack growth rates, loading conditions, and Haw distributions could be addressed through an elicitation process, with full documentation of the process and results.

2.5.1.4 Structural Reliability Computer Codes Structural reliability computer codes are useful tools for estimating the failure probabilities of piping components. These codes use probabilistic structural mechanics methods to model the uncertainties and variability in such parameters as material propenies, mechanical loadings, operating environment variables and flaw distributions. Some of the beriefits of using such codes are:

. The subjective nature of estimating failure probabilities is decreased. Thejudgmental aspect of the estimation process is reduced to a series of smaller decisions regardiseg some specific input to structural mechanics models rather than being combined into a single judgment needed to assign a failure probability. {

1

+ A greater level of consistency and uniformity in the process of estimating failure probabilities can be j achieved. This input is needed for quantifying the risk of piping in a PRA and categorizing piping segments in terms of their contribution to risk through importance measures, such as risk achievement l and risk reduction worth.

- By simulating the range of uncertainties in governing input parameters, structural mechanics modds provide an improved technical basis for concluding that particular failure mechanisms can make only relatively small contributions to failure probabilities.

• Structural mechanics codes model the physical interactions of the various factors that affect failure probabilities. As such, the calculations can give good predictions for relative numerical differences in failure probabilities from segment to segment within a given system and thereby enhance the credibility of the categorization process (see Section 2.7).

It has been demonstrated that structural reliability calculations can be performed relatively efficiently.

Therefore, the time and costs of estimating failure probabilities can be significantly reduced compared with alternative approaches, such as a formal expert judgment elicitation.

Structural reliability computer codes provide reproducible results by independent parties.

=

Knowledge gained from plant operating experience regarding observed degradation mechanisms and failures by leak or break (or lack of such observations) can be incorporated into the structural reliability computer axles on a continuous basis.

DRAFI' NUREG-1661 2-24

.. ,o j

2 Evaluate Change in Risk There are also limitations to structural mechanic computer codes, which must be recognized by the user:

• A stmetural mechanics code may not be available to address the particular failure mechanisms or j rnaterials of interest. Inappropriate application of existing codes could give misleading predictions of failure probabilities. Users must be fully aware of the code's limitations and resort to other estimation methods as needed. If an individual code user chooses to enhance the code to model new failure mechanisms or materials, the new estimates should be validated against existing historical data and fully documented.

• There can be a lack of information on inputs to the computer codes. This means that expen judgment will be used to assign input parameters for calculations rather than in a direct manner to estimate failure probabilities.

• As with any technical computer program, a false sense of confidence can be attached to calculated failure probabilities, since many of the physical assurnptions and numerical parameters used in the calculations will not be evident to most users. For example, most users will have little basis for evaluating the applicability and reasonableness of oarameters associated with crack growth rate correlations and density and size distributions for flaws. A quality assurance program should be in place to ensure the proper selection of input parameters.

• There are uncertainties in the modeling of structural failure mechanisms and the quantification of the inputs to the models. Therefore, the estimated failure probabilities should be :eviewed to determine if the probabilities are consistent with plent-specific and industry experience regarding expected contributions from specific systems and failure mechanisms.

The applicability of the available structural reliability code models should be evaluated along with the feasibility of adequately defining the needed model inputs on the basis of available plant-specific data. In those cases where none of the proposed modeling approaches are capable of calculating credible results, other methods for estimating failure probabilities. based on historical experience and/or expert judgment, should be used. These alternate methods should be clearly do:umented.

It is recommended that structural rehability models be used to calculate failure probabilities when suitable models are available to address the component of concern. A number of suitable codes based on probabilistic fracture mechanics codes have been applied in the past, such as the pc-PRAISE Code (Refs. 2.31 and 2.32).

Simplified models (e.g., the SRRA computer code developed by Westinghouse) have also been developed (Refs. 2.33 and 2.34). In general, these simplified models have been built from more detailed models, such as the pc-PRAISE Code.

Chapter 4 provides a detailed discussion of structural reliability and risk assessment computer codes. The following points summarize the criteria for evaluating the acceptability of structural reliability and risk anessment computer codes for estimating the failcre probabilities of piping components:

2-25 DRAFT NUREG-1661

2 Evaluate Change in Risk

• The code must address the failure mechanisms under consideration. l 1

. The code must address the structural materials under consideration.

. The structural mechanics model should be based on suitable engineering principles and the approximations used in the model should be appropriate.

. The probabilistic part of the structural mechanics model should address those parameters with the greatest variability and uncertainty.

• The inputs to the codes should be within the knowledge base of the experts applying the code.

. Internally assigned parameters and probability distribadons should be documented and supported by availatile data and knowledge base.

• Documentation of the technical basis of the model should be available for peer review.

• Limitations of the code should be identified and cautions pmvided for cases when altemative structural mechanics models and/or estimation methods should be applied.

{

. The code should be benchmarked with NRC-approved codes.

• The code should be benchmarked with applicable data and operating reactor experience.

. The development of the computer code, documentation, and application should be conducted in accordance with approved quality assurance procedures.

2.5.1.5 Uncertainty and Sensitivity Studies for Categorizing Piping Segments Robustness in the piping categorization results can be buttressed through the performance of uncertainty and sensitivity studies. While (Ref. 2.3) provides a general discussion on uncertainty and sensitivity issues, for RI-ISI particular emphasis should be placed on identifying and understanding those factors that would move a segment from a lower risk category to a higher risk category and vice versa.  ;

The objective of the uncertainty and sensitivity calculations is to identify those piping segments that are initially categorized as low safety significant, but because of uncertainty in some issue relevant to ISI, could (or should) be classified as high safety significant. The following areas of concern have been identified as examples of possible systematic biases:

• Segments for which erosion-corrosion is the failure mechanism of concern,

• Segments consisting of small piping sizes.

• Segments containing ferritic steel, and

• Segments exposed to a common set of environmental conditions.

DRAFT NUREG-1661 2-26

e n0 2 Evaluate Change in R.isk The effects of sensitivity studies should be integrated into the decisionmaking process for categorizing segments as high or low safety significant, as described in Section 2.7.1.

2.5.2 - Option 3 Table 2.6 ;4 used to assign segments to one of three general categories. In addition, if a piping segment is subject to one of the degradation mechanism and is found to be susceptible to water hammer, it is reclasr.ified as having a high rupture potential. [ NOTE: the table presented here is not the same as given in EPRI TR-106706 (Ref. 2.5). While the source reference (Ref. 2.34) provides a graph that presents the rupture frequency -

of the degradation rnect.anisms derived from data that indicates that the frequency for the high rupture potential degradation mechanisms is at least an order of magnitude higher than the other degradation mechanisms, it is unclear whether or not any plant specificity beyond the search for water hammer potential is .

considered.]

~

2.6 Assess Consequence for Failure of Each Piping Segment -

Consequences can be assessed using either a quantitative or qualitative approach. Either approach, if performed properly, can be used to estimate the change in risk of a proposed change in an ISI program. When evaluating the change in risk of a proposed change in an ISI program, the analysis should apply realistic (i.e.,

as-built, as-operated) conditions. However, when grouping piping segments into high and low safety-significant categories, other assumptions may be more appropriate for identifying those piping components that are risk significant (e.g.,ilSS).

Table 2.6 EPRI system for evaluation of pipe rupture potential.

I Pipe Rupture Potential Leak Conditions Degradation Mechanism liigh large Erosion corrosion (FAC)

Water hammer Vibration fatigue Medium Small Thermal fatigue Corrosion fatigue Stress corrosion cracking (IGSCC, TGSCC, PWSCC, ECSCC)

Corrosion attack (MIC, crevice corrosion, and pitting)

Erosion / cavitation Low None No degradation mechanism present Source: Reference 2.35 i

2-27 DRAFT NUREG-1661 l 1

1 l

o, .,

2 Evaluate Change in Risk 2.6.1 Options 1 and 2 The risk impact of the proposed changes in the ISI program can be evaluated by using a PRA model developed in accordance with the guidelines outlined for Options I and 2 in this chapter. It should be noted that piping failure rates are not constant over time. For piping segments that are inspected, appropriate repairs or operational changes maintain failure rates at appropriate levels. In deciding which piping segments to inspect, one method is to estimate the piping's failure potential, giving no credit for inspection. But this "no inspection" case is primarily for deciding which segments to include in high and low safety-significant classifications. Use of the average failure rate between plant startup and end-of-license period without inspection is a suitable approach. Moreover, it is possible to periodically update the calculations during the plant lifetime. For example, if the plant age is 25 years, one does a structural reliability and risk calculation from that point to the end-of-license period, and uses the average pipe failure rate over the remainder of the plant licensed life. At a later date, the calculations can be updated with input from operating conditions and the inspection program modified, if needed, based on the updated calculations.

The acceptability of the change in risk due to the change in the ISI program is addressed in RG 1.174. To aid in that assessment, uncertainty and sensitivity analyses will be needed. General guidelines for these analyses 1 are provided in Regulatory Guide 1.174. ISI-specific uncenainty and sensi'ivity analysis guidelines are )

addressed in the following sections of this document.

1 When incorporating piping segment failures into the PRA (i.e., Option 1 Figure 2.2, incorporating into the fault trees basic events representing piping segment failures), the risk corresponding to a revised ISI plan is calculated by simply requantifying the PRA using piping seFment failure probabilities / frequencies appropriate to the revised ISI plan. For the second approach (Option 2), using surrogate components, the risk is esiculated by adjusting the base PRA results to reflect the new initiators and events that simelate the consequencea of a postulated piping failure. This Option 2 process is outlined in Figure 2.6. The catalations and the egnations required by this approach are described late in the section.

In order to evaluate the risk impact from proposed changes to the ISI p:ogram, one first applies piping failure rates calculated with credit for the cunent ISI program, and then rates with the proposed changes to the ISI program. For purposes of this evaluation, the effects of inspections ma y be approximated by resctting the failure probability to a low value that corresponds to the replacement piping for those segments that are to be included in the inspection program. Normally, the replacement piping will address the root causes that led to the degradation, thereby approximating a "zero" failure probability for the inspected segment. The risk impact is the difference between the sum of the piping failure contributions to the core damage frequencies as .

calculated with the two different ISI programs. Realistically, when considering the risk impact from proposed changes to the ISI program, one should consider the appropriate operator recovery actions for isolating the piping breaks, with the appropriate human error probabilities.

The same approach can also be used to find the contribution to the core damage frequency from each piping segment for prioritization or risk categorization purposes. For this case, the piping failure rates without the (

inspections one is considering eliminating should be used, but other inspections can be included. The DRAFT NUREG-1661 2-28

2 Evaluate Change in Risk following discussion provides additional clarification on this subject.

Estimation of Failure Probabilities for Risk Catenorizations When using fracture mechanic codes to estimate failure probabilities, the following conditions are used to calculate risk categorizes:

• For piping segments that are included in augmented programs (such as erosion-corrosion and stress corrosion cracking programs), the failure probabilities csiculated with ISI but without leak detection are used.

• For other piping segments, the failure probabilities without ISI and without leak detection are used.

liasis for NoLCreditine I eak Detection and Oncrator Walkdowns in Risk Cateeorization Most fracture mechanics codes can calculate a failure probability that credits leak detection at the defined leak rate en6ered as an input to the model. This assumes immediate detection of the leak and subsequent repair or shutdown. In addition, operator walkdown can also be credited to identify leakage.

However, the purpose of RI-ISI programs is to identify degradation prior to leakage and/or rupture. Therefore, taking credit for these factors would mask important piping segments that warrant nondestructive examination (NDE) or other inspectior.s such as augmented inspection programs, to identify the degradation before failure.

Leak detection systems and operator walkdowns are recognized as additional mechanisms that ensure defense-in-depth in maintaining the pressure boundary prior to piping frilures that lead to initiating events or failures of mitigating systems.

2-29 DRAFT NUREG-1661 i

6, **

2 Evaluate Change in Risk Yes noe. p p b m k e. ..ty ..i.is.n.i m art + Use initiating event equation 2-1 CDFw = FRa,.,g

• CCDPw i N fo ya noe. pp bmt arreen ..ty man nen.s .yene=?

5 Use mitigating system equation 2-2 CDF,, = FP,,

• CCDF,, + OP,,

• CCDFor I fo N ya pe bre.k e...e imitator ..d mitigen.g Use IE/ mitigating system equation 2-3 CDFn = FRm

• CCDP,,,,, a l

pNo terrorm um itwty ...ly.6. te determi.e e.re

_d.m.strmi=e.er J 4 Specialcases Figure 2.6 Core damage frequency calculation process [ Adapted from Figure 3.6-2 of (Ref. 2.3)].

t fDF Calculations for Surrocate Component Approach Initiatine Event Case:

For a pipe whose failure is an initiating event, the portion of the PRA model that is affected is the initiating event and its frequency:

CDF:t s,, , = R it,3,,., x CCDPes,g (2-1) where CDFm,,g = CDF from initiating event associated with failures of piping segment I (events per year) fro,,g = piping segment I failure rate (events per year) that results in the initiating event, assuming the appropriate 151 for the calculation is being performed: for risk prioritization, as discussed in the paragraph entitled " Estimation of Failure Probability for Risk Categorizations"; for the current ISI program, the failure rates with the current ISl; and for the revised ISI case, the failure rates with the revised ISI program CCDPt s,g = conditional core damage probability for the initiator for piping segment I (determined from DRAFT NUREG-1661 2-30 i

2 Evaluate Change in Risk the accident sequences and associated minimum cut sets given the piping failure as the initiating event /

FR its,,., , the piping segment failure frequency (in events per year), is normally calculated using an appropriate SRRA computer code, such as PRAISE, or other applicable codes, for the appropriate ISI case. However, the SRRA codes typically provide cumulative failure probabilities over a specified time interval (40 or 60 years for this application). To obtain the failure rate, one only needs to divide the cumulative failure probability by the number of years the plant is licensed:

1 % ,,a = FP,gs,,a / EOL where His,,a = piping segment failure probability that results in the initiating event for the appropriate ISI case EOL = number of years the plant is licensed (e.g.,40 years. If remaining years of plant license are <40 years, such as 20 years, then 20 years may be used as long as it accounts for aging and degradation effects over the 40 years of plant operation)

The conditional core damage probability is determined from existing'PRA results or from solving the PRA model-if necessary to minimize truncation problems.

Miticatine System (s) Case:

For piping failures that cause degradation or loss of mitigating system (s) only, the core damage frequency for the piping segment is determined by the following equation:

CDFr = M>r, x ACDFe, + OPra xACDFm (2-2)  ;

where I

CDF,, = CDF from a piping failure (events / year)

FPp. = piping break failure probability (dimension less), for the appropriate ISI case OP. p = probability the pipe segment is under repair at the time of an initiating event ACDFm = conditional core damage frequency, if the pipe segment is under repair, minus the "The CCDP value used should ensure completeness and should not be determined by dividing CDF by the initiating event's frequency. (Note. dmdmg CDF by the initiating event's frequency is acceptable as long as the initiating event's frequency is j greater than 1.0.)

2-31 DRAFI' NUREG-1661 l

J

2 Evaluate Change in Risk core damage frequency if the pipe segment is not under repair (and not failed)

ACDFr, = CDF, in events / year, if the segment is faih d (PB=1), minus the CDF if the segment is not failed (PB=0)5 ACDFe, = CDFr ., - CDFe,.o Pipim Failures in Standby Systems When calculating the piping failure probability, FPro, the benefit of detecting piping failures through inservice testing of pumps should be addressed. An exposure time should be evaluated for a piping segment and incorporated into the analysis. Exposure time is defined as the downtime for the failed systems or trains, or the time the systems or trains would be unavailable before the plant was shut down. It is a function of the test interval, the detection time, and allowed outage time (AOT).

Tests of active components may be useful in detecting two types of piping failures. In the first type of failure, the piping fails while the system is in standby, but the failure is r>ot detected until the next test. In the second i type, the piping degrades to the point where, on the next demand, either true demand or test demand, the f piping fails. In this second case one can call the piping degradation occurring between tests a " latent" failure. l The piping does not fail until the stresses caused by the test or true demand occur. In addition, piping failures j may be detected immediately in certain cases and not require a test to reveal the failure. Examples are normally operating systems, such as the charging pump system.

(

The key attributes in determining the exposure time are the system states when the piping failure is expected to j occur (standby, test, or real demand), and the time required to detect the break (means available to detect  !

diversions of the flow)(Ref. 2.5). 'Ihe failure may be detected by different types of tests, and this should be taken into consideration. For example, some piping failures will be detected by monthly or quarterly pump surveillance tests; others will be detected only by full flow system tests during refueling. The exposure time, when multiplied by the piping failure rate, gives the probability that an accident sequence initiating event, j occurring at a random time, will occur with the piping failed or in a latent failure condition, so that it will fail i i

on demand. There is a second contribution to the increase in core damage frequency caused by a piping break. j IIere, an initiating event occurs, and then the piping break occurs during the mission time for the mitigating i system (say,24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />). The probability of the piping break here is the product of the piping failure rate for an operating system times the mission time. The failure rate for piping breaks when the system is operating may i be different than when the system is in a standby mode.

i Two cases are distinguished. In the first case the system is normally in standby, and detection occurs during a tesi of an active component. In the second case, the system is normally operating; detection is assumed to be immediate.

'Since the pipe segment does not result in an initiating event, eare should be taken to ensure that the CCDF is not attitrarily j truncated to 1.0. CCDF values greater than 1.0 are appropriate if for an initiating event with a frequency greater than 1.0, the l pipe seFnnt failure leads directly 'o care damage. j i

DRAFT NUREG-1661 2-32 {

m

e a 2 Evaluite Chinge in Risk System in standhy:

For the first case, where the system is normally in standby, CDF,, = (FPwg / EOL) x (0.5 x T ,,,,a x CCDF,, + OT x CCDFm) where FI b = the cumulative failure probability over the number of years the plant is licensed to operate for the appropriate ISI case EOL = the number of years the plant is licensed to operate (e.g.,40 years)

Note that the quantity CCDFur differs from the quantity CCDFe, because the configuration of the system may change when the pipe is under repair, so that the conditional frequency of core damage is different than in the case where the pipe fails, but the pipe segment is not under repair. In calculating CCDFm, these system configuration changes must be taken into account.

The term OT (outage time) here may refer to the allowed outage time, if for the particular piping failure, the plant would be maintained at power for the allowed outage time, but this term may also be the mean repair time for the piping segment, if the piping is repaired in less than the AOT. Or it may be only the time necessary for a controlled shutdown, if this is what would be done for the particular piping failure. The contribution of the piping failure during the system mission time, after an initiating event has occurred, is omitted here. Because the mission time is short compared with the test interval, this term will have a small contribution.

To calculate the CCDFr., one subtracts CDFr , from CDF,.. .' If the analysis makes use of surrogate events, a surrogate component (basic event or set of basic events, such as a pump or valve) that is already modeled in the plant PRA is identified in which the consequence or impact on the CDF matches the postulated 7

consequence for the piping failure. The surrogate component is then assumed to fail with a probability of 1.0, and the PRA model is solved to obtain a new total plant core damage frequency. This is the conditional plant core damage frequency, given the piping has failed, denoted by CDFrs.i. CDFes.o. the plant core damage frequency given the piping has not failed, can be obtained by simply requantifying the cut sets generated when the PRA model was solved with the surrogate event set to 1.0 now set to 0.0. [ Note: if these cut sets are not saved, then the model must be resolved with the surrogate event set to 0.0,]

'As an approximation, CCDFnmay be estimated by the expression CDFn., - CDF , where CDFw is the CDF from the original PRA analysis. It is the responsibility of the utility to ensure that this approximation is valid for all pipe segment / surrogate component combinations. It is generally valid if the piping component was not modeled in the PRA (very likely), and the failure probability of the surrogate component is relatively small.

'Since the surrogate event must represent two different failures (the original component failure and the piping segment failure), a failure probability of 1.0 is used rather than settir3 the surrogate event to a TRUE state.

2-33 DRAFT NUREG-1661

/ . .

2 Evaluate Change in Risk Alternatively, one can calculate CCDFe, by isolating the cut sets associated with the piping segment, and quantifying them (with the condition that the piping segment failure probability equals unity).

The second method, the method of isolating the cut sets, permits one to perform an uncenainty analysis directly. If,instead, one calculates CCDFra as CDFe ,, - CDFes , then, in performing an uncenainty analysis, one must take into account the correlations between CDFe ., and CDF, arising from the fact that the same basic events occur in both calculations, and although there may be uncertainty in the values of the failure probabilities for these events, the uncertainty distributions are completely correlated: for example, even though the failure probability of a high-pressure injection pump may be uncertain, it has exactly the same failure probability in both cases. The correlations can be taken into account by performing correlated Monte Carlo calculations.

Systems Continuousiv Or>eratine:

For the second case, where the system is continuously operating before an initiating event occurs and is required to respond to the initiating event, the probability the given pipe segment fails during the mission time is:

FPp = FRp, x T.

The probability the piping has failed before the initiator and is under repair when the initiator occurs is:

opp, = FRp, x M where i

FPp, = the probability of a break occurring during the mission time 1 FRp, = the failure rate (in events per unit time) i T, = the total defined mission time (e.g.,24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />)  :

OT = the outage time, is defined as for standby systems opp, = the probability that a pipe segment is broken and in repair at the time of an initiating event l

From the fracture mechanics computer calculations, the failure rate (in hours) is estimated by:

FRp, = FPux./ (EOL years x 8760 hr/ year) f then. ( ;

i DRAIT NUREG-1661 2-34

_ __ _______________J

2 Evaluate Change in Risk CDFe, = FRp, x (T,,, x CCDFe, + OT x CCDFo.7)

This equation can also be applied to piping segments that are continuously under constant static pressure and are attached to storage tanks. These failures are identified by alarms and the segment unavailability can be immediately recognized, thereby eliminating the need to consider detection time; the exposure time consists only of OT, the time between detection and repair or shutdown. [ Note: while the prior statement is generally valid, cases can exist w here an alarm failure can result in a significantly longer exposure time which more than compensates for the alarm failure probability. Such cases warrant consideration.]

The distinguishing characteristic of continuously operating systems is the immediate detection of the piping break. Also, since the system is continuously operating, it is legitimate to identify the operating failure rate as the piping failure probability at the end of the plant lifetime, divided by the plant lifetime. For standby systems, which spend most their time in standby, and not operation, it may not be possible to do this. For such systems, as was done above, the standby failure rate is the failure probability at the end of life, divided by the plant lifetime; it would be more difficult to estimate the operating failure rate. However, as mentioned above, the tenn involving the contribution of the piping failure during the system mission iime is, for a standby system, small, and the difficulty in estimating the operating failure rate for such a system does not introduce any real difficulty in estimating the contribution to the core damage frequency of a piping break in a standby system.

Initiatine Event and Miticatine System Decradation Case:

For piping failures that cause an initiating event and degradation or loss of a mitigating system, core damage sequences involving both events simultaneously must be evaluated. To evaluate this case, the event tree for the initiator that is affected by the piping segment failure is requantified with the surrogate component for the mitigating system assumed to be failed (that is, with a failure probability of unity). For piping failures that cause an initiating event and system degradation, the following equation is used:

CDF,, = FR,, x CCDPit s ,w (2-3) where CDFr. = core damage frequency from a piping failure (events per year)

FR,, = piping failure rate (events per year)

CCDPits,pw = conditional core damage probability for the initiator with mitigating system component assumed to be failed The conditional core damage probability for the initiator is determined by the following equation:

CCDP it s,,.m = CDFit,,gm/FREQs l

)

2-3$ DRAFT NUREG-1661 1

2 Evaluate Change in Risk where C D F m ,,.io = CDF from the initiating event with segment failed FREQ, = initiating ev'ent frequency Recall that the failure probability calculated with an approved fracture mechanics code is cumulative for the licensed period of the plan, and that the failure rate, for the appropriate ISI case, is therefore calculated as:

FRe,= Pr,/EOL Soccial Cases:

When applying surrogate component methodology, cases may arise when: not all of the piping b eak locations fit into the three categories described above and on Figure 2.6. Each piping segment is analyzed separately to determine the best calculational method. Some piping k> cations may fall into several of these categories, depending on the circumstances. For example, a failure ia the piping segment in the charging system is postulated to result in a reactor trip and subsequent loss of RWST. This segment has two separate cases considered that are then added together to obtain the total core damage frequency for the segment. First, the segment is modeled as a reactor trip and loss of RWST using equation 2-3; then the segment is modeled as a loss of RWST for the remaining initiating events using equation 2-2.

Total Pressure Boundary CDF

]

i Each piping segment within the scope of the program is evaluated to determine its CDF due to piping failure. l Once this is computed, the total pressure boundary CDF is calculated by summing across each segment. This  !

provides the baseline from which to determine the risk importance measures of the segments that can then be used to categorize the segments within ISI issues. The total pressure boundary CDF provides a measure of the risk associated with the ISI program. The difference between the CDF calculated using the existing licensing basis program and the RI-ISI program gives a measure of the change in risk. For consistency, the base PRA should include the realistic piping failure rates established for the RI-ISI piping segments.

2.6.2 Option 3 in References 2.5 and 2.6, a piping segment's consequence is determined based on whether the piping segment failure results in:

• an initiating event,

• loss of mitigating ability (i.e., loss of a system / train),

degradation of containment perfomiance [ Note: Reference 2.6 does not address this failure.], or j a a combination of the above, l DRAFT NUREG-1661 2-36

.. o 2 Evaluate Chnge in Risk For a piping failure that causes only an initiating event, the consequence is determined by identifying the appropr: ate initiating event category. Table 2.7 illustrates t' tis approach. When Table 2.7 is used, the analyst must ersure that the calculation of CCDP is performed correctly for the initiating event. If the frequency of the initiating event is a 1.0, then the CDF corresponding to the initiating event can be divided by the initiating e vent frequency. However, if the initiating event's frequency is < l.0, then the plant's PRA model should be l resolved with the initiating event's frequency set to 1.0 to minimize truncation problems.

l l

l For a piping failure that results in the loss of mitigating ability, the consequence is determined by identifying l the number of unaffected backup trains available to perform the same mitigating function for a given frequency of challenge (i.e., the frequency of initiating events that require the function) and exposure time (i.e.,

the downtime for the failed systems / trains, or the time the systems / trains would be unavailable before the plant l is shutdown.). Table 2.8 provides an illustrative example of this approach. When using Table 2.8 the analyst should account for all functions that are lost as a result of the piping failure. In addition, all system dependencies and interactions should be accounted for when determining the number of unaffected backup trains.

Tables 2.9 and 2.10 provide examples of how to determine a piping segment's consequence if its failure degrades containment performance or results in a combmation of an initiating event and loss of mitigating ability if used, Table 2.10 should be expanded to include all possible combinations of initiating es ent, loss of mitigating ability, and degradatisn of containment performance (e.g. combinations of initiating event and degradation of containment performance).

Table 2.7 Consequence categories for initiating events.

Initiating Event Initiating Expected Initiating Event Initiating Event ExamHs Recommended Category Evens Type Frequency fl/yr) Consequence Categorv l l Rouune >l Startup None operat on Shutdown Standby l

Refuchng i

II Anticipated a1 Reactor inp low operatmnas (events that might occur Turbine inp occunence dunng a calendar year in a Parnalloss of main particular plano feedwater less of pnmary flow 111 Infrequent IE l to IE-2 Excessive feedwater/ steam higivMedium/imw' events (events that nucht occur removal dunng the hfetime of a toss of of. site power panicular plant IV tinuting faults clE-2 Small, medium, or large loss- High/Mediurn/Lsw' or accidents (events not expected to of. coolant accident (LOCA) occur dunng a plant's Steamhne break hfetime) Interfacing system IDCA Sources: References 2.5 and 2.6

• liigh if CCDP a IE-4, Medium if IE-6 s CCDP < IE-4, low if CCDP < IE-6 2-37 DRAFT NUREG-1661

2 Evaluate Change in Risk Tabic 2.8 Consequence categories for loss of mitigating ability.

Affccted Systems Number of Unaffected ackup Trains tre(nierry of Exposure Tinw to Challenge 0 1 2 23 (1milenge Anticapated All year il 11 M L (Category !!)

Between tests (1 3 numths) 14 H M L long 3*OT t12 weck) H M L L l Short AOT(s3 days) H tA L L Infrequent All year H H M L l ~

ICategory Ill)

Beiween tests (1-3 anonths) H M L L lemg AOT(12 weck) H M L L Short AOT(s3 days) H L L L Unexpected All year H M L L (CateFory IV)

Between tests (l-3 months) H M L L Long AOT(1-2 week)_ H L L L Short AOT M days) H L l L L Table 2.9 Consequence categories for containment degradation.

Remaining Protection Against Containment Hypass Consequence Category I Active' High 1 Passive 6 Higc 2 Active Medium I Active,1 Passive Low I

2 Passive Low l

More than 2 None

• Active protecuon is presented by a valve which needs to close on demand 6

Passive prouction is presented by a valve which needs to remain closed DRAFT NUREG-1661 2-38

2 Evaluate Chage in Risk Table 2.10 Consequence categories for combinations.

Combination Event' Conseg ience Category Initiating event and mitigating ability affected High (one onaffected train available for mitigation)

Initiating event and mitigating ability affected Medium (two unaffected train available for mitigation) (or IE consequence category if higher)

Initiating event and mitigating ability affected Imw (more than two unaffected train available for mitigation) (or IE consequence category if higher)

MitiFating systems always correspond to the analyzed hmating event.

2.7 Categorize Piping Segments and Select Piping Locations for Inspection Tnis sectmn provides guidelines and describes a sound technical approach for categorizing piping segments as high safety significant or low safety significant and high failure potential (HFP) or low failure potential (ISP),

and for selecting piping locations for inspection in RI-ISI programs. The categorization of piping segments and the selection of piping locations should be based on the following considerations:

. The selected group of piping segments and locations identified in the ISI programs should continue to meet the ntent of al! existing deterministic requirements for structural integrity, as defined by 10 CP i

50.55a, Appendix A to 10 CFR Part 50, and the ASME Pressure & Vessel Code,Section XI.

. The proposed inspection program, including the set of selected piping segments and locations, should meet the probabilistic criteria described in RG 1.174.

To meet the intent of existing requirements, the program should identify a set of piping segments and locations for which:

• Failures will have the greatest potential impact on safety, and

• There is a greater likelihood of detectable degradation and thus a greater potential for identifying piping degradation prior to failure.

Any process by which pipe segments are categorized and inspection locations are selected must be consistent with sound engineering practice and licensing requirements. If, as in other risk infonned programs (i.e.,

maintenance, inservice testing, technical specifications, and graded quality assurance), an expert panel is used as part of the process, its makeup, procedures and decision-making criteria must be unambiguously delineated. j Furthermore, the final outcome of any categorization and selection process must include:

i

• Verification that the systems included in the scope of the program are correct and that no other 2-39 DRAFT NUREG-1661

2 Evaluate Change in Risk systems should be included or excluded Verification that the system boundaries are adequate Verification that the consequences assessed for each piping segment are accurate (both direct and indirect effects)

Verification that shutdown risk, containment performances, operational history, etc. have been appropriately considered in the analysis Verification that appropriate operator recovery has been considered (i.e., consideration of available indications, timing, and attemative actions)

=

Verification that the procedure for estimating failure rates has been based on appropriate databases, analytical methods, and probabilistic structural mechanics codes, if using Options I and 2 Verification that the estinuted failure rates have addressed the limiting failure types (whether the failure results in a leak, disabling leak, or break), relevant failure mechanisms and aging effects, the significant normai and design-limiting loadings, design and fabrication factors, and material properties, if using Options 1 and 2

=

Verification that the estimated failure rates are consistent with the plant operating history, as indicated by the experience of the plant staff, along with available inspection and maintenance program data, if using Options I and 2 Verification that piping rupture potential is based on identification o.' known degradation mechanisms, i i

if using Option 3 l i

Verification that plant interactions and dependencies have been accounted for when piping segment  ;

consequences have been identified for initiating events, loss of mitigating ability, containment degradation, or some combination of these three,if using Option 3

=

Verification that uncertainties have been properly considered and treated -

f Upgrading the safety significance of a piping segment based on economic or other considerations that j' are outside the regulatory program through a consensus process and documenting the basis for such an upgrade  ;

l Concurrence that the structural elements selected for examination and the type of examination method  ;

selected meet the requirements of the program I

Integration of insights from other risk-informed programs for consistency and proper coverage  !

l DRAFT NUREG-1661 2-40 i

I l

2 Evaluate Change in Risk A review group or panel cannot downgrade a high safety-signipcant piping to a low safety-significant piping if it comports with the guidelines in this report. (That is not to imply that the review group cannot challenge the analyses.)

In rendering the final decision, the licensee ensures that the program solicits experts in the areas of PRA and engineering disciplines to develop a final list of high safety-significant piping segments. As indicated above, the licensee can choo .e to inspect piping for factors other than the decision criteria identified in this chapter.

Such faceors might include economic considerations that have no safety impact, or other nonsafety considerations as deemed appropriate by the utility, inspections based on nonsafety considerations (upgrading piping not ranked high safety significant) are not considered in this document.

For consistent application of risk-informed programs, it is recommended that the licensee incorporate the insights gained from the Maintenance Rule and other risk-informed programs at the plant. Helpful information can also be gained from the solicitation of experts in the areas of:

. plant wagineering, operations, maintenance, and maintenance rule coordination;

. plant work, planning, and control;

. piping design and stress analysis;

. inservice inspection;

. NDE;

. structural design and support engineering;

. welding and materials test engineering;

. industry friture, repair, and maintenance history; e safety analysis; and

. probabilistic safety assessments.

Finally, the licensee should build upo'.. the industry's documentation format developed for the RI-ISI pilot demonstration plants. These documents help lead the ISI teams to consider the major issues for each step of the program.

2.' 1 High or Low Safety-Significance Categorization-Options 1 and 2 For ISI safety-significance categorizing, modified importance measures (based only on considering the effects of piping failures) she 71 be used to categorize components (i.e., piping segments) for potential ISI examination. The use of importance measutes generally requires the determination of the total CDF or LERF.

Ilowever, for ISI, the total CDF or LERF used in calculating the rnodified importance measures is best determined by summing the contributions of all pressure boundary failures in the plant piping systems. This ensures that the categorization of the piping segments for ISI consideration is focused, so that the ISI programs developed from this categorizat;on will ensure that important pressure boundary failures in p51 piping systems do not become major contributors to total plant risk (i.e., CDF at LER5-) as a result of unexpected or age degradation mechanisms.

)

2-41 DRAFT NUREG-1661

)

2 Evaluate Change in Risk .

f This document does not imply that licensees can only base the categorization process on calculated risk importance measures, although the use of such measures can far ilitate the selection of an optimum set of ISI locations commensurate with risk, Other methods could be preposed that address the guidance described in Regulatory Guides 1.174 and 1.178.

2.7.1.1 Use of Importance Measures Risk imponance measures from the PRA serve as important inputs to the categorization process. If components of interest to RI-ISI are not addressed in the existing PRA either directly or indirectly, then no quantified risk imponance information will exist for these components. When feasible, these components should be added to the PRA by the licensee. In cases where this is not feasible, detailed discussions should accompany the documentation that addresses how traditional engineering analyses and judgment (e.g., -

integrated decisioranaking process, and consideration of the key principles in RG 1.174) were applied to determine if a component should be categorized as LSS or HSS.

In calculating risk importance measures for the categorization process, the failure probabilities used for each piping segment should not credit Section XI ISI inspections. For piping segments in an augmented inspection program, credit for ISI inspections may be taken. Irak detection should not be credited during the categorization process. (Note that this is not the case when evaluating the change in the CDF and LERF, as addressed in RG l.174.) As applied here, risk categorization refers to the process of grouping ISI comporents into LSS and IISS categories. i j

The following items should be considered when selecting and using imponance measures to categorize the safety significance of piping segments:

- the effects of truncation limits (e.g., SSCs not included in the final quantified cut set solution),

. the appropriateness of information provided by different importance measures,

+ the completeness of the risk model,

. the consideration of all allowable plant configurations and maintenance states,

• the effects of component (i.e., pipe segment) data uncenainties, a the effects of different pipe segment common-cause failure assumptions (e.g., one degradation mechanism causing multiple pipe segment failures),

a the effects of different operator recovery .sumptions, in addition to component categorization efforts, the determination of the safety significance of components by the use of PRA-determined importance measures is critical for two other reasons:

When performed with a series of sensitivity evaluations, it can identify potential risk outliers by identifying ISI components that could dominate risk for various plant configurations and operational modes, PRA model assumptions, and data and model uncertainties.

Imponance measure evaluations can provide a useful means for identifing improvements to current ISI practices during the risk-informed application process.

DRAIT NUREG-1661 2-42

., or 2 Evaluate Change in Risk While categorization is an essential step in defining how the RI-ISI program will be implemented, it is not an essential pan of ensuring the maintenance of an acceptable level of plant risk. Nevenheless. the sensitivity of risk importance measures to changes in ISI strategy (i.e., proposed for RI-ISI) can be used as one input to the overall understanding of the effect of this strategy on plant risk.

2.7.1,2 Criteria for Determination of Safety Significance Table 2.1I summarizes example guidelines that could be used to identify high safety-significant piping segments in making the final selection of inspection locations. Piping segments that exceed the guideline ranges for suggested importance measures' in Table 2.11 are classified as high safety significant. [ Note: for this application, importance measures are calculated using the cumulative contribution of all pressure boundary failures in piping segments; they do include contributions from other system components. This ensures that the categorization of the piping segments for ISI consideratic,. is focused, so that the ISI pr'> grams developed from this categorization will ensure that important pressure boundary failures in plant piping systems do not become major contributors to total plant risk (i.e., CDF or LERF) as a result of unexpected or age degradation mechanisms.] Those segments with a value less than the example ranges given in Table 2.1I are classified as low safety significant. The risk measures are then supplemented by sensitivity studies to obtain estimates on the variabihty of these measures The final categorization into IISS and LSS is performed using additional deterministic and qualitative insights and information. Plant design and operating features and their relationship to component categorization should be explored and underraod; in some cases, this will result in changing a component's ranking or category from what it might otherwise have been if it had been based solely on the PRA results, and allow categorization of components not analyzed in a PRA.

The use of the Bimbaum importance measure can provide an indication of the sensitivity of the CDF or LERF with respect to the basic event (i.e., piping segment) of concem if the piping segment does not result in an initiating event.' It is calculated by determining the CDF (or LERF) with the basic event probability of <

l concern set to 1.0 and again with the basic event probability set to 0.0. The difference between these two values is the Birnbaum imponance. Another importance measure that can be used to identify piping segments whose failure has a high risk and safety impact is risk achievement worth (RAW). This is the conditional core j damage probability or conditional core damage frequency calculated for the piping segment, depending upon whether the piping failure causes system unavailability through degradation or an initiating event. Both Birnbaum and RAW provide insight into the importance of a piping segment as its failure probability increases, or alternatively stated, provide insight into identifying the importance of piping segments to ensure that the current level of risk does not increase. In addition, ISI categorizing should use either a Fussell-Vesely

'The criteria in Table 111 are provided as examples. The licensee is responsible for proposing specific criteria that allow for the identification of important piping segments. For the proposed criteria, the licensee must provide sufficient justification to ensure that important pressure boundary failures in plant piping systems do not become major contributors to tota' olant nsk as a result of unexpected or age degradation mechanisms.

• 1f tle piping segrnent results in an initiating event, then the Bimbaum importance measure provides an indication of the sensitivity of the core damage pmbability (CDP) or large early release probability (LERP) (i.e., it provides conditional CDP or LERP).

2-43 DRAFT NUREG 1661

2 Evoluate Change in Risk i

(FV) imponance measure (FVm) or a risk reduction wonh (RRW)importance measure (RRWm), calculated j assuming no Section XI ISIinspections for the piping segments, to identify those piping segments for which inspection would have the greatest benefit. Used in conjunction, the Bimbaum/ RAW and FV/RRW importance measures can provide robustness to any categorization of piping segments.

Table 2.11 Example approach to overall determination of risk significance for an alternative risk-Informed selection process for inservice inspection.

Risk Importance Example Criteria * )

Measure Piping Segment Modified Birnbaum 0.01* i The utility's submittal should identify a RAWm value such thatif RAWm a a utility defined value for either CDF and LERF, the piping segment could N considered as important achievement wonh (RAWm)

If RAWm < the defined value, then the piping segment could be considered as less important t

Modified risk reduction

>1.001 - 1.005 worth Modified Fussell-Vesely

> 0.001 - 0.005 (FVm)

Qualitative Measures ,1tems to be considered in establishing qualitative criteria

. Key principles in RG 1.174 /

. Level of redundancy e System trains Groupings of components into supercomponents for modeling purposes

. Truncatior limits during quantification l

. Operatior al histories

. Others Dese example enteria apply to the use of a total CDFmor LERFm, which is the total CDF or LERF attributed to pressure boundary failure in plant piping systems. A range of values is provided, ne basis for the final selection criterion used in the submittal should be justified.

Example critenon obtained by assuming that a very small (IE-6) increase in CDF is acceptable and that it is desirable to maintain the current average leak frequency (for all piping) of 1E-4 per year [ Note: see Section 2.7.3.2 for a discussion on average leak frequency.]. With these assumptions, a Birnbaum value of 0.01 is obtained when 1E-6/ year is divided by lE-4/ year.

DttAFT NUREG-1661 2-44

o .e 2 Evaluate Change in Risk As stated previously, the final safety significance categorization may consider other issues associated with piping. The process used to finalim this safety significance categorization is ultimately the licensee's i responsibility; however, if the licensee chooses to use an expert panel to produce the final categorization, any such categorization should be achieved by consensus. Although most decisions will be reached by 100%

consensus, there will be times when differing professional opinions will exist. These differences must be documented.

The plant expen panel should review all peninent information and determine the final safety classification for '

each piping segment included within the scope of the RI-ISI program. The team should use qualitative and '

quantitative information associated with PRA and failure probability calculations in combination with traditional engineering insights, design-basis information, and the five safety principles identified in RGl.174 to develop the final classification categories of high safety significant and low safety significant piping segments.

2.7.2 High or Low Failure Potential Categorization-Options I and 2 The probability for piping failure directly drives the need for an effective examination method (s). Thus, piping segments could be categorized by a minimum demarcation of high failure potential versus low failure potential. Other categorization criteria may be proposed.

Suitable definitions or liFP versus LFP are as follows:

High Failure Potential- A segment is of high failure potential if it has either an active failure mechanism that is known to exist, which may be currently monitored as part of an existing augmented inspection program, or alternatively, is analyzed as highly susceptible to a failure mechanism, which could, in the future. lead to a leak or break. The plant expert panel (if used) applies engineering insights such as material, fluid che nistry, loadings, and inservice experience from the plant and industry to make this determination. Examples of failure mechanisms that would typically result in this classification include excessive thennal fatigue, corrosion cracking, primary water stress conosion cracking, intergranular stress corrosion cracking, microbiologically influenced corrosion, erosion-cavitation, high vibratory loadings on small-diameter piping, and flow-accelerated corrosion.

Iow Failure Potential- A segment meeting this description would not meet the above criteria for a high failure-potential segment. Examples the would typically result in this classification would have no known failure mechanisms other than fatigue based upon normal and design-basis loadings.

Probabilistic insights from SRRA results and data are used by the expert panel (if used) to make the determinations. A segment should be considered to have a high failure potential if any element in that segment exceeds any one of the two following criteria:

(1) Puu > 10 -4 10 per 2 40-year operating life 2-45 DRAFT NUREG-1661

2 Evaluate Change in Risk d -l (2) P.,m > 10 '- 10 per 40 year operating life SRRA sensitivity studies have been perfonned which have shown that piping locations with failure probabilities below these values are essentially benign. The numerical criteria provided above define " leak" to be any through-wall crack or penetration of the pipe wall, and include large disabling leaks in the category of ')

" break." Piping systems that do not exhibit a leak-before-break attribute could exceed the above break l probability criteria. even if the leak probability is determined to be less than the leak probability criterion. In such cases, the break criterion would dictate that the segment be classified as highfailure potential. ,

An example of an appropriate way of combining the guidance provided in Section 2.7.1 with that provided here is to produce a two-by-two categorir.a: ion matrix as shown in Figure 2.7. This matrix structure can then be used to develop a process for selecting piping structurals as described in Section 2.7.3.

2.7.3 Structural Element Sc!cction Within Piping Segments-Options 1 and 2 The criteria for determining how many structural elements should be selected for examination is based on the safety significance of the piping segment, the failure likehhood (i.e., potential) within that segment, and the i

ilIGli FAILURE-POTENTIAL SEGMENT $

(Degradation mechanism usually yeg;o,3 g,gg ,, y Present)

(LSS and HFP) (HSS and HFP)

Pmg > 10 4- 10-8 or Psaug > 108 - 104per 40 year operatinglife LOW FAILURE-POTENTIAL SEGMENT Region 4 Region 2 (Degradation mechanism (LSS and LFP) (HSS and LFP) not usuallypresent)

LOW SAFETY. HIGII SAFETY.

SIGNIFICANT SIGNIFICANT SEGMENT SEGMENT Figure 2.7 Piping segment categorization matrix.

DRAIT NUREG-1661 2-46

2 Evaluate Change in Risk safety principles (e.g., defense-in-depth) identified in RG 1.174. In addition, as stated in RG 1.178,"the justification for any reduction in the number of inspections should address the issue that an increase in leakage frequency or a loss of defense in depth should not result from decreases in the number of inspections."

While risk imponance is one f actor used in the selection process, it is preferable that other deterministic considerations be integrated into the decisionmaking process to ensure that the results of the selection continue to meet the existing criteria, such as 10 CFR 50.55a and the ASME Section XI. These include:

• Early Detection of Degradation Mechanisms . A goal of inservice inspection is the early detection of degradation mechanisms. Early detection and the subsequent correction of degradation mechanisms reduce the risk associated with piping failures. Accordingly, the most logical approach to j selecting locations for inspection would be to include locations where active degradation mechanisms exist, since inspecting h> cations where no known degradation mechanisms exist produces little likelihood of identifying degradation and consequently no decrease in risk. These locations may or may not be the same ones that have the greatest risk contributions as identified by calculations of risk I imponance based on estimated consequences of failures and break probabilities.

• Sample of representative locations - The selection process should include a sample of representative locations within each piping system identified as contributing to risk (e.g.,11SS piping segments),

thereby enabling the detection of degradation mechanisms that may be active within the system.

These locations should, in part, correspond to locations for which the probability of degradation is considered greatest, independent of the calculated risk importance parameters.

• Failure Probabilities - The selection process should usc the appropriate failure probabilities for the piping segment consequences being examined (i.e., leak, disabling leak, and/or break).

• Operational Insights - The selection process should ensure that insights from operational and maintenance experience, using information from the plant and relevant information from other plants, is considered.

• Safety Principles - The selection proces should ensure that sufficient locations are selected to safeguard the safe? rinciples identified in RG 1.174.

i 7

itandated programs for augmented piping inspections (e.g., boiling water r- ; tor piping for stress corrosion l cracking and balance of plant piping for wall thinning by erosion-corrosion) should be integrated into the RI-ISI program. It is acceptable to coordinate or integrate otherwise inderendent inspection programs by selecting i

common locations to the extent possible.

l For some piping segments, welds in certain locations are known to be more vulnerable to developing flaws or increasing the flaw size than other welds. If some welds are h' wn to be more vulnerable than others, the welds with the higher conditional probability or frequency fu ; flaw growing to a leak should be sampled first.

2-47 DRAFT NUREG-1661 1

. . . . . . .. . . . _ . . . . . . _ ]

2 Evaluate Change in Risk

[For example, in a straight run of piping, the degradation and fluid conditions may be similar for all elements, or welds. However, structural mechanic analyses may be able to identify a subset of elements that exhibit relatively greater stresses and potentially greate ' ~ :h still minima!) likelihood for degradation than all the remaining elements in the segment.]

While this procedure is biased compared with random sampling, it is biased in a conservative direction, provided only that the average flaw probability of the welds in the sample is larger than the average flaw probability of all the welds in the segment. If there are some welds that are never sampled because they are inaccessible, the bias that i3 introduced by this constraint can still be conservative, provided that the average flaw probability condition stated above still holds.

When considering a homogeneous piping segment, where no active degradation mechanism exists and the loadinF and environmental conditions are similar throughout, the issue of performing random versus fixed (same location) inspection has been a longstanding one." In practice, however, piping conditions are not homogeneous. leading and thermal effects can differ throughout the length of the piping. The ASME has assessed the benefits of random versus fixed inspection strateFi es and states that fixed inspections, with engineering insights, would provide more information about possible degradation than random inspections.

Should an unexpected degradation be found during a fixed inspection, the rate of degradation could be monitored through fixed inspection strategies, since one has a base case from which to measure.

Using the piping segment categorization logic structure" developed in Figure 2.7 and the sebetion guidance provided above for locating piping elements for inspection, Figure 2.8 illt:strates an acceptable four-region matrix for identifying elements with safety significance that warrant periodic examination. Each of the four regions has an examination rule base as follows:

Region I All susceptible locations in the segment identified as likely to be affected by a known or poshilated failure mechanLm must be inspected. Exceptions include existing augmented programs'2 or other inspection programs approved by the NRC (e.g., the erosion-corrosion program). [ Note: see additional guidance in Section 2.7.3.1.]

"'In a recent study performed by EPRl*, a Markov rehabihty model was used to assess the risk from random versus fixed inspection techniques. Results from the study indicated second-order improvements in segment rupture frequencies for random versus fixed inspection programs over a 40-year period (e.g., the segment rupture frequency per year for 1 of 14 welds inspected was, random = 2.3E-6, fixed =2.5E-6; for 2 of 14 welds inspected, random =2.lE-6, fixed =2.4E-6). he differences become more sigmficant at steady-state conditions, well over 100 years (I of 14 welds inspected = 9.7E-6, fixed = 1.lE-4, for 2 of 14 welds inspected, random = 5.0E-6, fixed = 1.0E-4). Therefore, for the period applicable to a ruclear power plant operating life, the assumptions made in the studies indicate no significant benefits from fixed versus random inspections for welds subject to honr ms piping conditions. t

' K. Fi - .;g, ERIN Engineering and Research, Inc.,2I i1 Palomar Airpon Rd., Suite 180, Carlsbad. CA.,92009," Application of EPk Piping Rehabihty Model to Evaluate Random vs. Fixed Weld Inspection location Sampling Schemes," January 8, 1958.

"While the initial categoi ;. tion of piping segments is based on probabilistic considerations, the utility is free to increase the safety significance of any piping segment for their own reasons.

" Segments with failure modes for which there are established augmented programs (e.g., flow-assisted corrosion, intergranular stress conosion cracking) would be inspected in accoidan:e with those programs.

DRAFT NUREG-1661 2-48

2 Evaluate Change in Risk Region 2 The selection of kications to be examined in these segments is based on the guidance provided in Sections 2.7.3.1 and 2.7.3.2 In this region, a low failure potential was identified. In most cases, fatigue is anticipated to be the failure mechanism. Based on the guidance provided, ponions of the piping segment that would experience the highest loads or highest degradation potential would generally be selected for inspection. If the degradation potential is equally dispersed among the elements in a lot, then a random element (s) may be selected. At a minimum, one element will be examined to account for uncenainty and unknown degradation mechanisms in the segment or lot, and to guard against CCF. l Note: it is the responsibility of the applicant to justify the minimum number.]

IllGli FAILURE- OWNER. SUSCEPTIBLE POTENTIAL SEGMENT DEFINED ELEMENT ELEAfENT LOCATION (Degradation mechanism usually INSPECTION PROGRAM (100% inspection or present) (incorporates augmented NRC-approved owner inspection programs) inspection program)

Pm > 10- 10 or 4 4 Pma > 10 - 10 per 40-year operating life Region 3 Region 1 ONLY ELEAfENT INSPECTION LOW FAILURE SYSTEM PRESSURE LOCATION SELECTION POTENTIAL SEGMENT TEST & VISUAL ELEMENT PROCESS (Degradation mechanism EXAMINATION (or NRC-approved not usually present) owner inspection program)

Region 4 Region 2 LOW sal ETY. IllGli SAFETY.

SIGNIFICANT SIGNIFICANT SEGMENT SEGMENT Figure 2.8 Matrix for selecting structural elements.

Region 3 All susceptible k> cations in the segment that are likely to be affected by a known or postulated failure rnechanism. and that are not already in an augmented progrant will be examined in accordance with an owner-defined program. While failure of these segments would have a minimal safety impact, the impact on plant operations may be significant in terms of unplanned o gage time, repair costs, and other consequential impacts.

2-49 DRAFT NUREG-1661

2 Evaluate Change in Risk Region 4 Only system pressure tests and visual examinations are required for segments of low failure potential and low safety significance. The exception to this rule would be the primary system piping that forms the second barrier to fission product releases. If this piping is categorized as low safety s:gnificant and of low failure potential, then the licensee should recommend some level of NDE inspections in accordance with the defense-in-depth safety pnnciple identified in ."G 1.174.

System pressure tests and visual examinations are performed for piping in Regions 1,2, and 3, as well.

2.7.3.1 General Guidelines for Selection of I,ocations in Regions 1 and 2 The risk-informed selection process includes assessments and evaluations of the piping structural elements in each high safety-significant piping segment. These structural elements include the following examination items:

. Ail piping welds, including those to nozzles, vah es, and fittings such as elbows, tees, reducers, brr. ach connections, and safe ends

• Areas and volumes of base material and examination zones such as weld counterbore areas ano fitting material, as appropriate.

Welded attachments and piping supports are not included in the assessment and evaluations.

For high-safety-significant piping segments exhibiting low failure potentials, at a minimum, one location in each segment must be inspected. The number of inspection locations can be based on the statistical sampling technique outlined in Section 2.7.3.2 and in detail in Chapter 5.

Should a piping segment (categorized as high safety-significant and high failure-potential-Region 1) consist of several elements (e.g., welds), in which ihe majority of the elements exhibit low failare potential, then the licensee may consider separatmg die elements into two lots. One lot would require 100% inspection (IISS and liFP lots) and the other lot (l{SS ared LFP lo:s) would require an inspection program similar to that required for Region 2. Simplified piping and instrumentation drawings showing the segment boundaries will be reviewed, along with piping isometrics; plant and industry operating experience; the previous piping segment evaluations performed to determine the high safety-significant piping segments; and system design, fabrication, and operating conditions. Based on the postulated failure mechanism and the loading conditions for the piping segment, the areas in which this failure mechanism is snost likely to occur should be identified, taking the following factors into account:

Configuration Dependent. This f actor considers the effect of piping layout and support arrangement.

For example, piping with low flexibility for thermal expansion will experience high bending moments w hich, in turn, can drive crack growth.

DRAIT NUREG-1661 2-50

2 Evaluate Change in Risk Component Dependent. For example, socket welds have low resistance to sustained vibration.

Elbows or piping immediately downstream of valves, which add turbulence to the flow, are locations susceptible to erosion-corrosion wear.

Materials / Chemistry Dependent. Intergranular stress corrosion cracking and dissimilar metal welds are examples of conditions where materials and chemistry interact actively.

Load Dependent. An example of this is the number of cycles experienced by the piping segment.

Another example is piping in which inadvertent operation may lead to water hammer events. Seismic events are also included in this category.

Determination of the inspection location (s) within a piping segment is dependent on the above factors. In general, Component-dependent failure modes are usually localized to a single or a small number of locations.

Materials-dependent or operations-dependent mechanisms are often present throughout the segment.

In such cases, interactions with other effects must be considered in determining the location (s).

lead-dependent failure modes typically involve undetected preexisting flaws or degradation that could cause failure under high loads. The high loads could arise from dynamic (seismic, water hammer) events, large thermal expansion loads (configuration dependent), or external loading. Locations where such loads could have the greatest impact can often be determined.

Table 2.12 provides some additional insights based on postulated failure mechanisms that can assist in identifying the susceptible areas of piping.

2.7.3.2 Detailed inspection Strategy for Region 2 The previous sections focused on determining the importance of piping segments, categorizing the segments as high and low safety significant with high and low failure potential, and general criteria for selecting piping kx ations within segments. An example of a selection rnatrix guideline is illustrated in Figure 2.8. Once a piping segment is categorized via the selection matrix guidelines, different inspection programs can be applied, based on their safety significance. As illustrated in Figure 2.8, the order from most to least safety significance is Region 1,2,3, and 4. This section addresses Region 2, a segment categorized as high safety significant with low failure potential.

Any proposed inspection strategy should:

1. Define a reliability goal for piping systems;

2. Define a method that strives to meet the reliability goal;

3. Consider thu the inspection technique is not perfect; 2-51 DRAFT NUREG-1661

s 2 Evaluate Change in Risk 4 Consider that not every weld will be inspected:

5. Consider the implication for calculating confidence or assurance that the inspected sample contains none of the defective welds in the lot; and

6. Demonstrate that the final results provide reliability and assurance that the reliability goal will be achieved.

Examples of target reliability goals are provided later, i

Table 2.12 Insights for identifying inspection locations.

Failure Mechanism General Criteria Susceptible Areas hermal fatigue Areas where hot and cold fluid mix, areas of rapid Nozzles, branch piping cold or hot water injection, areas of poten'tial les connections, safe ends, welds, past valves separating hot and cold water I heat-affected zones, base metal, areas of concentrated stress Corrosion cracking Areas exposed to contamination and areas witti 3ase metal, welds, and heat-crevices; high stresses (residual, steady-state, I affected zones pressnre), sensitized ma:erial (3(M SS; and high coolant conductivity are all required; lack of stress relief or cold springing could also lead to residual )

stresses Microbiologically Areas exposed to organic material or untreated water Fittings, welds, heat-affected influenced corrosion zones, crevices Vibratory fatigue Configurations susceptible to flow-induced vibration Welds, branch niping and flow striping or vibratory resonance with connections rotating equipment (pump) frequencies Stress corrosion Areas of high oxygen and stagutnt flow Austenitic steel welds and heat-cracking affected zones Flow accelerated Areas of low chromium material content, high corrosion moisture content, and high pH, high pressure drop or turning losses Imw cycle fatigue Areas with high loads due to theimal expansion ior Equi 3nnent nozzles and other heat-up and cool-down thermal cycling. anchor points, near snubbers, dissimilar metal joints Risk Informed let Selection and Element Selection for Inspection in the previous paragraphs, six elements were identified for consideration when developing a statistical DRAIT NUREG-1661 2-52

.. ,o 2 Evaluate Change in Risk inspection sampling program. One suitable application of a weld sampling technique is identified in Chapter

5. The method integrates statistical techniques with input from fracture mechanics calculations and/or data for Daws. This sampling process is used in Region 2 of Figure 2.8, where the ISI engineers were unable to differentiate the elements (welds) within a piping segment as having significantly different probabilities for degrading How does one inspect a pipin e segment categorized as high safety significant and high failure potential where only one element kau)in the segment experiences an active degradation mechanism, and the balance of the welds have a similar low failure potential? One method is to place the outlier element in one lot, requiring 100% inspection, and subsume the balance of the elements in a separate lot for statistical sc.mpling, as described in the previous section.

The concept of a lor can be broadened into more thaa one piping segment. That is, several piping segments with similar elements (e g., same low failure potential, no known degradation mechanisms, same environmental conditions) may be subsumed within one lot for purposes of statistical inspections. An example may be all welds attaching the cold legs to the reactor vessel inlet nozzles.

10CFR$0.55a(a)(3)(i) permits alternative programs that provide comparable quality and safety. One means for meeting this criterion is to meet or improve the performance of t' . existing ASME program by developing an inspection program that strives for a 95% probability that the occarrence of a leak would not exceed a frequency based on existing experience. For example, if existing performance experience for Class I piping is one leak for every 10^ reactor year-weld, then if one can demonstrate an inspection program that meets a target leak frequency of IE-06/ year / weld with a 95% probability, the criteria of 10 CFR 50.55a(a)(3)(i) would be met. If that performance guideline is not met, then a root-cause analysis is performed and the inspection period and number of h> cations recalculated based on the new information.

Scouential Samoting This section addresses the guidance for additional examinations should an inspection identify unacceptable degradation in piping. The assurance level saupling-global method (Perdue-Abramson method), addressed in Chapter 5 identifies the number of IISS welds that should be inspected. The RI-ISI engineers select the limiting weld oc the weld most likely to degrade first as the first weld to be inspected. Presumably, this would be the weld that was used in the classification of the segment as a low failure potential. Next, the failure frequency attributed to this limiting weld is then conservatively assumed to apply to all the other welds in the f

lot, so that a conservative estimate of assurance (by use of the binomial distributian) is generated. The only time a random selection of a weld would occur is when engineering analysis could offer no guidance as to which element was most likely to degrade.

If the inspection uncovers a Daw, then the " additional examinations" requirement of Section XI (IWB-2430, page 82) would still be applied (paraphrased):

• If no flaws are found in the first sample (s), then stop [ note that this implies a "zero defect acceptance criterion" as discussed in Chapter 5].

2-53 DRAFT NUREG-1661

4. .,

2 Evaluate Change in Risk

• If one or more Caps are found, then take ar other sample equal in size to the first sample.

• If one or more new flaws are found, inspect the rest of the lot.

Historical Failure Data and Guidelint Criteria for a Tarnet Reliability Matrix Studies performed by Dr. Spencer Bush (Ref. 2.36), for the Swedish Nuclear Power Inspectorate indicate that the frequency of leaks from piping at nuclear plants has shown decreasing trer.ds over the years of plant operations. For the exiting population of plants in the United States (approximately 110), the industry experiences a total of about 100 leaks per year. These leaks are primarily from the balance of plant systems, such as corrosion-type failures caused by poor quality water in copper nickel tubing. In safety-related systems (including the RCS) the small number of failures appeared to be focused at small-diameter branch piping, such as a vent line near an RCS pump whose failure mechanism is vibration fatigue. The ratio of leaks to breaks is a function of the failure mechanism involved. among other factors, and can be as large as 1:1 for erosion-corrosion to 10(X):1 or less for intergranular stress corrosion cracking.

On the average, there are about 10,000 welds (or stmetural elements) in piping at a typical plant. From this estimate, a leak frequency of (100 leaks per year)/(110 plants)/(10.000 welds / plant) or approximately 1E-04 leaks per weld per year can be calculated. This would include piping of all sizes, all systems, and all failure mechanisms.

The RCS piping (Class 1), however, has experienced lower leak rates than the overall leak rate for all of the plant's piping. Estimates for piping failures for a PWR RCS are less than 1E-06 per weld per year. This performance standard is a conservative representation of the operating experience for Class I piping under the existing ASME requirements and is one acceptable target goal for RI-ISI application for high safety-significant piping segments.

Applying the above data, the following trends for piping leak frequencies have been observed:

All piping -

IE-04 per weld per year 1

RCS piping -

< IE-06 per weld per year Further analysis of nuclear power plant operating experience has led to categorizing detectable piping leak rates, as shown in Table 2.13.

l DRAIT NUPEG-1661 2-54

.. .o 2 Etfaluate Change ire Risk Table 2.13 Operating experienee insights on leak frequencies,1%5-1996.

Material Pipe Size No.of Failures Leak Frequency (inch) (leaks /yr-weld)

Stainless steel s1 546 18E-06 Ferric steel s1 414 13E-06 Stainless steel >1s4 290 10E-06 Ferric steel >1s4 136 4E ',o Stainless steel 4 170 SE-06 Ferric steel 4 253 8E-06 Referring back to the statistical sampling technique described in Chapter 5, Table 2.14 provides an example of a potential matrix guideline for implementing RI-ISI programs on high safety-significant piping. It is anticipated that these or other appropriate goals would be achieved with a 95% assurance level for only that part of the system categorized as high safety signiScant. For example,if a system consists of 20 segments,10 of which are categorized as high safety significant, the leak target goal would only apply to the 10 segments as a system. A licensee should identify and justify the leak target goals it intends to monitor.

Table 2.14 Target goals for detectable leak frequency.

2.:=:::.

Material Pipe Size Target Leak Frequency (inch) (leaks /yr. weld)

%mless steel sI < IE-05 Ferric steel s1 <1E-05 Stainless steel >1s4 <lE-05 Ferric steel >1s4 <IE-06 Stainless steel >4 < IE-06 Ferric steel >4 ( SE-06 As addressed in Chapter 5, an input for the binomial distribution in the assurance level sampling method is the probability of a flaw. One appropriate definition of a flaw is to apply the ASME definition I c.g., a flaw whose depth exceeds about 10% of the wall thickness (alt ~ 0.1)). This does not imply that theflaw is unstable and willlead to a through-the-wall crack. It is a flaw that requires additional analysis. For example, a typical probability for an unacceptable flaw for a large piping in a PWR RCS may be on the order of 3E-3 per year per 2-55 DRAFT NUREG-1661

~

2 Evaluate Change in Risk weld. For a weld containing such a flaw, the probability of a detectable leak is on the order of 4.3E-8 per year per weld; for a disabling leak, it is SE-10 per year per weld; tnd for a break it is 3E-13 per year per weld. The probability of a flaw is typically calculated using an approved structural mechanics model, discussed in l Chapter 4. Application of the sampling model should account for the uncertainties in the calculated probability of a flaw per weld per year, and account for that part of the system categorized as HSS, using appropriate goals for each segment to achieve the target goal for system performance.

The above matrix guideline is conservative in that a detectable leak is used as the figure of merit. Meeting these guidelines maintains, as a minimum, the current level of safety and quality provided by the existing ASME Section XI Code, and would likely result in increased safety as the RI process expands the regulatory scope of inservice inspection to other systems not currently addressed by Section XI; it could also decrease radiation exposure for plant personnel.

^2.7.4 Structural Element Selection-Option 3 This section includes the decision matrix structure from the EPRI approach used to categorize pipe segments into high, medium, or low importance "(Ref. 2.5). At this time differences exist between the percentages of piping segments or elements to N: inspected depending on whether a partial or full scope analysis is performed

[i.e., ASME Code Cases N-560 (Ref. 2.37) or N-578 (Ref. 2.6)]. Figure 2.9 presents the decision matrix structure applicable for either Code Case. Justification for the fraction of piping elements inspected should be provided.

2.8 Assess Change in CDF and LFRF ,

Any change in the ISI program has an associated risk impact. Evaluation of the change in risk may be a detailed calculation or it may be a bounding estimate supported by sensitivity studits as appropriate. The change may be a risk increase, a risk decrease or risk neutrality. The change has to be evaluated and compared with the guidelines presented in RG 1.174. In performing the evaluation, the models and assumptions used should reflect the as-built, as-operated plant conditions for two distinct states: (1) the plant state before the proposed changes are made and (2) the plant state efter the proposed changes are made. For example, the evaluation should account for the differences between the before and after piping inspection program.

" Care should be taken when using the EPRI decision matrix in that the span in CCDF for each category can be wide; thus, if a segment is changed from one category to another this could lead to an unacceptable change in CDF and LERF and a potential increase in long term leak frequency DRAFT NUREG-1661 2-56 q l1

J k

i s

R 1 _

n 6 i

e 6

1 g - _

n G _

a E h R _

C I

t e M a

l u T I

a A v _

E R 2 i D

'0 1

5 -

m H40 "

0' u 'ar G1 1

J H 1

=2 I

D

=4 I

) I G F. E r-P D H> I H Dta CC M ot

• CC C

C d

i 1 0d 4 1

0 R A<

1

" '0 x

'O UP 1

H 0

1 M -

i t

r

'G I DC G a

= 3- U E D_ C I F t I D

0 1

w6 -

m T E<4 I

I Da CC E

=

F .

5 o

t C t

a i n

o Dta t M0 1 M CC a z

C i

r 4 o g

1 0 t e

E 1 a e C ru C P N WD M I t C U 4 R P r uc 7 5

E OC I 0 1 W 7

- E s t 2

U L '< ED <5 F .

W O

6 o

L t

a Q

t C

0' M Dta CC L C a

E 1 9

s 2 N E e r

u O N_ 40 W 7 W 7 w7 i g

C 01 O t

. O L

t a

o t a

. F T

1< L a C

C t C

- 1

, n 4-g C o 0 H i

1Wr,. d n ,C ,

t a

> m1 0ikCSC u < cCWIM a

i t

v a

n om b r S P ), C ie t

hi V g, i F CG FI (C,

/ Cgo,/n W7 daarh ai n iC e7 d <

CCni 0F C.C G C Lt <1 NDM

- CSSis O0 oe egc HFA M 1 TSTEPE t o ir

>c h H 3E$Ud* Z2H$$0$

ta ,*

2 Evaluate Chtnge in Risk REFERENCES FOR CHAPTER 2 2.1 USNRC, "An Approach for Using Probabilistic Risk Assessment in Risk. Informed Decisions on Plant-Specific Changes to the Current Licensing Basis," Regulatory Guide 1.174, draft January 1998.

2.2 USNRC, "An Approach for Plant-Specific, Risk-Informed. Decisionmaking: Inservice Inspection of Piping " Regulatory Guide 1.178 (for trial use), May 1998.

2.3 Westinghouse Energy Systems," Westinghouse Owners Group Application of Risk Informed Methods to Piping Inservice inspection Topical Repon," WCAP-14572. Revision 1, October 1997.

2.4 ASME Research White Paper, " Risk-Based Alternative Selection Process For Inservice Inspection of LWR Nuclear Power Plant Components," American Society of Mechanical Engineers Center for Research and Technology Development, Suite 906,1828 L Street, NW., Washington, DC, November 9,I995.

2.5 Electric Power Research Institute, " Risk-Informed Inservice inspection Evaluation Procedure," EPRI TR-106706, June 1996.

2.6 American Society of Mechanical Engineers, " Case N-578, Risk-Info:Tned Requirements for Class 1, 2, and 3 Piping. Method B Section XI, Division 1," September 2,1997.

2.7 USNRC, " Standard Review Plan for Risk-Informed Decision Making: Technical Specifications,"

Standard Review Plan, NUREG-0800 Chapter 16.1, March J 998.

2.8 K. Jamali, " Pipe Failures in U.S. Commercial Nuclear Power Plants," EPRI TR-100380, Prepared for Northeast Utilities Service Company and the Electric Power Research Institute, Palq Alto, California, prepared by IIalliburton NUS, Gaithersburg, MD,1992.

2.9 T.V. Vo et al., " Expert Judgement Elicitation on Component Rupture Probabilities for Five PWR Systems," PVP-Vol. 251," Reliability and Risk in Pressure Vessels and Piping," pp. I15-140, American Society of Mechanical Engineers,1993.

2.10 D.O. Harris et al., " Probability of Failure of BWR Reactor Coolant Piping: Probabilistic Treatment of Stress Corrosion Cracking in 304 and 316NG BWR Stainless Steel Piping Weldments," USNRC, NUREG/CR-4792, Vol. 3 December 1986.

2.11 M.A. Khaleet et al... "The impact of Inspection on Intergranular Stress Corrosion Cracking for Stainless Steel Piping," ASME PVP Vol. 266/ SERA-Vol. 3, pp. 411-422. " Risk and Safety Assessment: Where is the Balance," 1995.

2.12 American Society of Mechanical Engineers," Risk-Based Inspection - Development of Guidelines,"

Volume 2-Pan 1. " Light Water Reactor (LWR) Nuclear Power Plant Components," CRTD-Vol. 20-2, ASME Research Task Force on Risk-Based Inspection Guidelines, Washington, DC,1992.

2.13 S. H. Bush, " Reliability of Piping in Light-Water Reactors." Nuclear Safety, Vol. 17, No. 17, Sept.

Oct.,1976.

2.14 S.II. Bush," Statistics of Pressure Vessel and Piping Failures," Joumal cf Pressure Vessel Technology, Vol. I10, pp. 225-233, August 1988.

DRAFT NUREG-1661 2-58

2 Evaluate Change in Risk 2.15 S.II. Bush," Failure Mechanisms in Nuclear Power Plant Piping Systems," Journal Pressure Vessel and Piping Technology, Vol. I 14, pp. 389-395, November 1992.

2.16 li.M. Thomas, " Pipe and Vessel Failure Probability," Joumal of Reliability Engineering, Vol. 2, pp.83-124 Elsevier Applied Science, London and New York,1981.

2.17 R.E. Wright, J.A. Steverson, ar. ' W.F. Zuroff, " Pipe Break Frequency Estimation for Nuclear Power Plants " USNRC (prepared for NRC by Idaho National Laboratory), NUREG/CR-4407, May 1987.

2.18 S.it Bush, et al," Piping Failure in United States Nuclear Power Plants: 1961-1995." SKI Report 96:20, Statens Karnkraftinspection, Swedish Nuclear Power Inspectorate, S-106 58 Stockholm, Sweden, January 1996.

2.19 USNRC," Severe Accident Risks: An Assessment for Five U.S. Nuclear Power Plants. Final Summary Repon," NUREG-1150, December 1989.

2.20 T.A. Wheeler et al., " Analysis of Core Damage Frequency from Interna! Events: Expen Judgment Elicitation," NUREG/CR-4550 Volume 2, USNRC (prepared by Sandia National Laboratories),

April 1989.

2.21 T.V. Vo et al., " Estimates of Component Rupture Probabilities: Expen Judgment Elicitation,"

Nuclear Technology, Volume 94(I), American Nuclear Society, La Grange Park, Illinois,1991.

2.22 V.N. Shah and P.E. Mcdonald," Aging and Life Extension of Major Light Water Reactor Components," Elsevier Science Publishers, New York,1993.

2.23 American Society of Mechanical Engineers," Metal Fatigue in Operating Nuclear Power Plants-a review of Design and Monitoring Requirements, Field Failure Experience, and Recommendations to ASME,Section XI Actions," New York,1990.

2.24 USNRC," Pipe Crack Experience in Light Water Reactors " NUREG-0679,1980.

2.25 USNRC, " investigation and Evaluation of Stress Corrosion Cracking in Piping in Light Water Reactor Plants," USNRC, NUREG-0531,1979.

2.26 J F. Copeland et al.," Component Life Estimation: LWR Structural Materials Degradation Mechanisms," Electric Power Research Institute, Palo Alto, California,1987.

2.27 V.K. Chexal and J.S. Horowitz," Flow-Assisted Corrosion in Carbon Steel Piping, Parameters and 4 Influences," Proceedings of the 4* Symposium on Environmental Degradation of Materials in Nuclear Power Plant Systems. D. Cubicciotti (Editor), National Association of Corrosion Engineers, llouston, Texas, pp. 9-1 to 9-12,1990.

2.28 S.A. Eide et al., " Component External leakage and Rupture Frequencies," EEG-SSRE-9639, DE92 012357, Idaho National Laboratory, Idaho Falls, Idaho, prepared for U.S. Depanment of Energy, 1991. i l

2.29 S.it Bush," Wall Thinning in Nuclear Piping Status and ASME Section XI Activities," PNL-SA- l 16973, Pacific Nonhwest National 1.aboratory, Richland, Washington, Post SMIRT Conference, Monterey, CA August 1989.

2-59 DRAFT NUREG-1661

2 Evaluate Change in Risk 2.30 T.V. Vo et al., " Estimates of Component Rupture Probabilities: Expert Judgment Elicitation,"

Fatigue, Fracture, and Risk, PVP-Vol. 215. The American Society of Mechanical Engineers,1991.

2.31 D.O. Ilarris, E.Y. Lim, and D.D. Dedhia, " Probability of Pipe Fracture in the Primary Coolant Loop of a PWR Plant, Vol. 5: Probabilistic Fracture Mechanics Analysis," USNRC, NUREG/CR-2189, Volume 5. August 1981.

2.32 D.O. Ilarris and D. Dedhia, " Theoretical and Users Manual for pc-PRAISE, A Probabilistic Fracture Mechanics Computer Code for Piping Reliability Analysis," USNRC, NUREG/CR-5864, July 1992.

2.33 0.J.V. Chapman, and G.A. Davers, " Probability Risk Ranking," Transactions of the 9* International Conference on Structural Mechanics in Reactor Technology, Lausanne, l987.

2.34 II.A. Ilishop and J.II. Phillips, "Prioritizing Aged Piping for Inspection Using a Simplified Probabilistic Structural Analysis Model," ASME PVP-Vol. 25, Reliability and Risk in Pressure Vessels and Piping, pp. 141-152, American Society of Mechanical Engineers,1993.

2.35 Vermont Yankee Nuclear Power Corp.," Implementation of ASME Code Case N560 at Vermont Yankee - Response to NRC Questions," letter dated October 23,1997.

2.36 S.li. Ilush, M.J. Do, A.L Slavich, A.D. Chockie," Piping Failure in United States Nuclear Power Plants: 1961-1995," SKI Report 96:20, Swedish Nuclear Power Inspectorate, S-106 58 Stockholm, Sweden,1996.

2.37 American Society of Mechanical Engineers," Code N-560. Alternative Examination Requirements for Class I, Category B-J Piping Welds, Sectie; XI, Divisio . 4." August 9,1996.

DRAIT NUREG-1661 2 60

3. ESTIMATION OF FAILURE PROBABILITIES USING EXPERT JUDGMENT ELICITATION The following draws heavily from Volume 2 - Part 1 of RisL-Based Inspection - Development of Guidelines (Ref. 3.1).

3.1 Introduction This chapter is provided for completeness in the decisionmaking process for RI-ISI programs. For the pilot application of RI-IS!, an expert judgment elicitation process was not needed.

Although scientific inquiry and decisionmaking have always relied on expen judgment, the formal use of expert judgment (expen elicitation) as a well-documented systematic process is a relatively new development.

Expert judgment has been extensively applied to a number of recent major studies in the nuclear probabilistic risk assessment area (Refs.3.2,3.3, and 3.4).

Formal expert elicitation methods were used extensively in assessing core damage frequency and radio nuclide transport to the environment in the NUREG-ll50 (Ref. 3.2) study of the risks of reactor operation (Refs. 3.5 and 3.6). However, because of the many potential pitfalls in using expenjudgment, it is essential that analysts be familiar with the state of the art and utilize the services of experienced practitioners in order to avoid wasting time and resources. Useful discussions of potential pitfalls and approaches to overcoming them may be found in References 3.7,3.8, and 3.9.

This chpter describes the elements of a process for conducting an expert judgment clicitation for estimating the failure probabilities of piping system components. While there are time and cost limitations that will usually preclude application of this process in its entirety at specific plants, much of the guidance provided here can be used to make the many judgmental decisions involved in estimating failure probab lities, whether by application of databases or of probabilistic structural mechanics computer codes. In other cases it may be appropriate to systematically use the expert judgment elicitation process to address generic issues related to structural reliability. The nuclear power industry is encouraged to include these generic issues in its estimates of failure probabilities for particular systems, materials, and operational conditions, and to incorporate that knowledge in the structural mechanics computer codes in order to increase the consistency and uniformity of i estimates of plant-specific failure probabilities. However,in practice it will be necessary and appropriate to modify any such generic estimates to address plant-specific conditions.

In identifying the systems and components to be studied, expert judgment can be used to

• Precisely defme what is meant by a failure

• Formulate a mathematical failure mode a identify and assess relevant data 3-1 DRAFT NUREG-1661 I

3 Estimating Failure Probabilities Using Expert Elicitation a

Combine all of these elements to obta in the desired results in a useful format For such tasks, expert judgrnent is usually applied, but in an informal and unstructured manner.

For many problems, this approach yields satisfactory results in an efficient manner.110 wever, an informal and unstructured approach may be unsatisfactory when relevant data are sparse or nonexistent, or when the issue studied is complex or likely to receive extensive review and criticism. A formal expert judgment process has a predetermined structure for the collection, processing, and documentation of expert knowledge. He advantages and drawbacks of using such a process, as opposed to an informal process, are outlined in Bonano et al. (Ref. 3.10). The advantages include:

• Improved accuracy and reliability of the expert judgments

• A reduced potential for critical mistakes leading to suspect or biased judgments

• Enhanced consistency and comparability of procedures e Imy-ved scrutability and documentation for communication and external review The drawbacks include:

+ An increase in the resources and time required to carry out the process

. A reduction in the flexibility to make changes in the ongoing process An increased vulnerability to criticism because of the relative transparency provided by a formal documentation of the procedures and findings, including differences expressed by the various experts.

Reference 2.10 cautions that while a formal process often requires more resources and time than an informal process initially requires, a faulty process that fails to withstand criticism or that must be redone because of inappropriate design or improper execution may end up failing to satisfy the project's objectives and cost more in both time and resources. The potential for further costs in an informal study should be considered when evaluating the need for a formal process.

3.2 Expert Judgment Elicitation Process Figure 3.1 is a flowchart of the expert judgment process. There are 10 steps, outlined below This process, with some modifications, was used to estimate break probabilities for selected components at Surry-1 (see '

Refs. 3.11 and 3.12). Specific techniques for the clicitation, use, and communication of expert judgment may

{

be found in References 3.4,3.7,3.12,3.13, and 3.14 j DRAIT NUREG-1661 3-2 l

3 Failure Probabilities Using Expen Elicitation mmm l

,.....g f.m..

l FirstMeeting i l SecondMeeting j l

l ,

i 8

Selection of

- - ~ ~ ~'~

Experts Elicitation l l- - >s Presentation  !

i I Training ll l ofTechnical l_

d 1 Evidence g l l  ;

Project  !. ..m m.mm.I  ! Q Staff y l

! NmWon ad Il l

i

^

__ __ _ y Selection F ._ _ g[ Review orissuesl l ;

of Issues

_ % ereparation ofIssues  : .

i I i ..

. _ m7

- _ __ ._ _ _ _ __ ___ __ __ _ . _. _ . _ . _ . _ _ _ _ l t ...mm............ -

.m -.

Third Meeting l

l /

Preparation Discussion of Elicitation I---

ofAnalyses ~~ ~- >l* Issues and Analyses l

i

- - ,i I l

Recomposition Iinal l Review by 4- - Aggresdon,and Experts Docurnentation Documentation Figure 3.1 Expert judgment process (based on Ref. 3.6).

3.2.1 Selection ofIssues The project staff should make the initial selection of issues. which will be used to guide the selection of the expens Two primary criteria for the selection of issues are as follows:

. The issue has significant impact on the risk and/or uncenainty.

. Altemative source. of information such as experimental and observational data or validated computer models are not available.

3.2.2 Selection of Experts The expens are selected on the basis of their recognized expertise in the areas of interest and are chosen to ensure a balance of viewpoints. To address the issues of concern to the nuclear power industry. expens from reactor vendors, utilities, the federal government. national laboratories consultant companies, and academia possess the appropriate knowledge. The goal is to obtain multiple and diverse inputs so that the issues can be thoroughly examined from many viewpoints.

33 DRAFT NUREG-1661

o ..

3 Estimating Failure Probabilities Using Expert Elicitation There are two ways to organize the expens - by panels or by teams. The panel approach was used in NUREG-1150 (one panel for each of su groups of related issues) and the L.awrence Livermore seismic hazard study i i

(one seismicity panel and one ground motion panel) described in Reference 3.3. The team approach was used by the Electric Power Research Institute seismic hazard study (six balanced teams, er.ch containing seismicity and ground motion expens) described in Reference 3.4.

In addition to the experts to be elicited, substantive and normative expens' are needed to facilitate discussions, make presentations, and train the experts. The substantive expen(s) must be knowledgeable about decision theory and the practice of probability clicitation.

3.2.3 Elicitation Training The purpose of elicitation training is to help the expens learn how to encode their knowledge and beliefs into probabilistic or other quantitative forms. Elicitation training can significantly improve the quality of the experts' assessments by avoiding psychological pitfalls that can lead to biased and/or overconfident assessments. Training should include information about the methods used to process and propagate subjective beliefs, an introduction to the assessment tools and practice with these tools, calibration training using almanac questions, and an introduction to the psychological aspects of probability elicitation. The training should be conducted by a normative expert with the assistance of a substantive expert.

For NUREG-1150, the elicitation training took place at the first meeting and required a half day. Depending on their familiarity with elicitation techniques, some expens may require less or more than a half day of training. It is recommended that training occur at the beginning of the process so that the experts can -

familiarize themselves with the types of assessment they will be making before they decid on the specific issues to be addressed. However, when the training session takes place, it is imponant th; t it not be abbreviated due to time pressure.

3.2.4 Presentation and Review ofIssues The initial list of issues selected by the project staff should be sent to the expens before the first meeting for review. Relevant data sources, models, and reports should also be included. The experts would be invited to propose additions, deletions, or modifications to the list. When the experts meet, substantive experts present the issues to the expert panel. The purposes of the presentation and review are:

To ensure that a common understanding of the issues is addressed

'A substantive c2 pert or subject-matter expert is an individual recognized by his or her peers as an authority in a specific subject matter or topic. These expens typically gain recognition as such because of significant and sustained research in the subject matter or topic, and their knowledge is considered by their peers to represent the current state of the art in that subject or topic.

A normarire expert is an individual with a sound theoretica' and conceptual knowledge of probability and practical experience in the clicitation ofjudgments from individuals. Normative caperts are well-versed in the psychological and cognitive processes used by substantive or subject-matter experts in their an.uyiis of information to pmduce the desired judgments.

DRAFT NUREG 1661 3-4

e 3 Failure Pmbabilities Using Expert Elicitation

. To ensure that the experts respond to the same elicitation questions l

. To permit unimportant issues to be excluded and important issues to be included l

. To allow modification or decomposition of the issues e to provide a forum for the discussion of ahemative data sources, models, and forms of analysis l

l l

l An essential aspect of issue presentation is issue decomposition, which allows the experts to make a series of simpler assessments rather than one overall assessment of a complex issue.

l l 3.2.5 Preparation of Analyses The experts should be given sufficient time and resources to analyze the issues before the elicitation session.

This step may entail support by the project staff, e.g., by perfonning computer calculations or other requested analyses. Some expens may choose to alter the proposed decompositions or create new ones. While many calculations necessarily bear on the probability assessments that the expens make in the elicitation sessions, the experts should be cautioned to avoid making any subjective probability assessments until the clicitation to avoid the psychological bias of anchoring (Ref. 3.7).

3.2.6 Discussion ofIsrues and Analyses l

l Prior to the clicitation session, the expens should presert the results of their analyses and research. The goal l of this step is to ensure a common understanding of the issues and the database. It is not to reach agreement on the issue decompositions and the elici'.ation variables. To take advantage of the diversity of apprt aches, it is essential that each expert analyze each issue according to his/her own interpretation, and use the decomposition and clicitation variables with which he/she is most comfortable.

3.2.7 Elicitation The clicitation sessions should be held immediately following the discussion of issue analyses. An elicitation team should meet separately with each expert. This avoids the pressure ta conform and redt;ces the interactive dynamics that may arise if the expert judgments are elicited in a group setting. The elicitation aam should consist of a substantive expert, a normative expert and a recorder. It is also useful to add as a fourth member the peaon who will prepare the final documentation.

The clicitation sessions serve two purposes. The first is to obtain the decompositions and quantitative assessments for each issue from each of the experts. Insofar as possible, the uncertainty associated with each quantitative assessment should also be elicited. The second purpose is to obtain the rationales for the decompositions and assessments. The experts should be questioned about their stated beliefs and asked to reflect on and explain the reasoning behind the decompositions and quantitative assessments they have 3-5 DRAPT NUREG-1661

3 Estimating F ilure Probabilities Using Expert Elicibtion provided.

Much of the dccumentation of the experts' assumptions and reasoning can be completed during the clicitations. Ilowever, some follow-up work is usually necessary to fill voids in :he logic provided by the experts or to obtain missing assessments.

2.2.8 Recomposition and Aggregation Each expert's assessments must be recomposed by the normative and substantive expens because the assessments for the clicitation variables in the decomposition for each issue must be combined into an assessment for the issue as a whole. Since each expert may have employed a unique decomposition, the end result rnust be in a common form suitable for aggregation. This will typically be a subjective probability distribution for a parameter of interest.

After the recomposition of each expert's elicitation, the results should be aggregated to yield a final assessment for each issue. It is essential that the aggregation reflect the uncenainties as expressed by the experts. There are two general classes of aggregation methods: those that tend to consensus and those that tend to preserve the variability among the experts. Genest and Zidek (Ref. 3.15) provide informative reviews on the many proposed aggregation methods.

When the variability among the expens is greater than the uncertainty for each expert, a simple aggregation method is sometimes used. Each expert's assessment is replaced by a central value (the realistic er*imate) and the central values are plotted. Converting the plot of central values to a box and-whisker plot (Ref. 3.16)is a convenient way to summarize the assessments that reflects the uncertainties. This method was used in Reference 3.11 to estimate component break probabilities.

While consensus methods are often easy to implement (e.g., averaging over the experts), they should not be automatically applied without careful consideration. Because one of the primary coals of the expertjudgment process is to reflect uncenainty as expressed by the diversity of expen judgments, an aggregation method should net be used ifit tends to mask the diversity of that judgment. For example, consider a case where half the expens judge the probability P of a phenomenon to be close to zero while the other half judge P to be close to one. Averaging over the experts is equivalent to the case where all expens judge P to be approximately %.

These two cases, however, are quite different since there is no disagreement art.ong the expens in the second case, while there is a great deal of disagreement among the experts in the first case. In the second case, a decision maker would have high confidence that P is approximately %, while in the second case, he/she does not know what value to assign to P. If he/she would make one decision when P = 0 and another decision when P = 1, premature averaging in the first case might deprive the decision maker of essential information.

In general, an aggregation method is appropriate only if a sensitivity study indicates that it does not destroy information that might significantly affect the options of a decision maker.

DRAFT NUREG-1661 3-ti

3 Failure Pmbabilities Using Expen Elicitation 3.2.9 Review by Experts Following the initial recomposition, aggregation, and documentation, written analyses of each issue should be distributed to each panel expert, substantive expen, and normative expen for review. A substantive (and nonvoting) expert might be an individual from the plant technical staff with detailed knowledge of plant design and/or operations, whereas a normative expen might be an individual with knowledge of probability and statistics who could assist the other expens in translating their engineering knowledge into nurnerical estimates of failure probabilities. The purpose of this review is to provide the expens with the opponunity to revise their earlier assessments, and ensure that potential misunderstandings are identified and resolved before final documentation. The revised assessments are then recomposed and reaggregated. To prevent an expert from arbitrarily changing his/her assessment so as to influence the aggregated assessment in a preferred direction, the expens should be required to provide a rationale for any significant reassessment.

3.2.10 Documentation Documentation has a number of important purposes. First, clear, comprehensive documentation is essential to ensure that the expert judgment process is accepted as credible. Second, documentation can be used by the experts involved to ensure that theirjudgments are correctly reflected. Third, it can be used by potentiai users of the process to enhance their understanding. Founh, it can provide peer reviewers of the process with an informed basis for their review. Finally, documentation can be extreme,1y useful in updating the analyses when future research provides additional information.

3.3 Example Application to Nudear Piping Systems Since elicitation of expert opinion was recognized as an acceptable means to quantify input to PRAs and risk-inforned studies, this method was selected for estimating pressure boundary failure probabilities in a pilot application of risk-informed ISI methods performed by Pacific Nonhwest National Laboratory (PNNL). A systematic procedure, as described in References 3.2 and 3.5, guided the elicitation process. The following paragu phs summarize the procedures as indicated by Figure 3.2 and describe sample results obtained.

Detai;ed discussions of the procedures as well as the complete results can be found in References 3.11 and 3.12.

PNNL conducted two expert judgment clicitation meetings. These meetings addressed only structural failures i that were perceived as important to plant risk, or that could significantly affect core damage freque cies. The specific objective was to develop numerical estimates for the probabilities of catastrophic or disruptive failures for the selected pressure boundary systems and components at a pressurized water reactor plant.

Expens at these meetings included specialists in the areas of materials science, structural mec7 aics, inservice inspection, databases on service experience, plant operational practices, and specific knowle Le of the plant.

The first meeting, on May 8-10,1990, at Rockville, Maryland, addressed failure probabilities for the reactor pressure vessel, reactor coolant system, low-pressure injection system, auxiliary feedwater system, and accumulators (Ref. 3.11).

3-7 DRAFT NUREG-1661

3 Estimating Failure Probabilities Using Expert Elicitation The second meeting was held on February 3-6,1992, in Washington, DC. This meeting addressed the high-pressure injection system, residual heat removal system, service water system, component cooling system, and power conversion system (Ref. 3.12).

PRA Results and IIistorical Other Relevant Infonnation Fruture echscs (systern, component r--uon, Failure Data Analyses system descriptions, etc.)

Y Expert Judgmem l AdditionalInfonnation Elicitation and (additional plant-speciSc infonnation, etc.)

Discussion l4

- U Est nated Rupture Probabilities Figure 3.2 Process for estimating failure probability using expert judgment.

The panel of expens btought to bear a large base of experience with structural integrity issues at operating plants as well as an understanding of the response of structural materials to service environments. The experts consisted of knowledgeable representatives from utilities, vendors, federal government agencies, and consultants. Prior to the workshop, reference materials were sent to the experts, including data sources, reports, and recent PRA iesults. Panel members were asked to study these materials and formulate initiaj estimates of failure probabilities.

To resolve issues thoroughly from many viewpoints, the elicitation was designed as a face-to-face meeting. A formal presentation was provided for each system of interest. The presentations included technical descriptions, historical component 1ailure mechanisms, elicitation statements, suggested approaches, questionnai re forms, and any supporting materials. The issues were presented in a manner to avoid preconditioning or biasing responses.

All experts were encouraged to get involved in subsequent discussions. Knowledge from experts regarding DRAFT NUREG-1661 3-8 i

.. o 3 Failure Probabilities Using Expert Elicitation plant design and operation. failure history, and material degradation mechanisms was brought to the

! discussions. Since the process was designed to take advantage of the diversity of the knowledge, each expen provided an independent estimate. No effort was made to seek a consensus among the expens on estimated break probabilities. Each expert completed questionnaires addressing location-specific break probabilities for the systems of interest. These data covered realistic estimates of probabilities, uncertainty estimates, and the rationale for these estimates.

Following the elicitation meeting, infonnation provided by the expen panel was recomposed and aggregated.

The written analyses of each system, including the recomposition and additional plant-specific data, were then -

returned to each expert for review. This review provided the experts with an opponunity to revise their earlier assessments, and ensured that potential misunderstandings were identified and resolved and that the documentation correctly reflected the experts' judgment. The revised analyses were then again recomposed and aggregated to provide a single composite judgment for each break probability.

Figures 3.3 and 3.4 are samples of estimated failure probabilities obtained from the expert judgment approach.

The pebabilities are expressed as failures per year. Because, as in most expen judgment applications, the data set was not symmetric about a single peak, the median was used. Unlike the mean, the median is not influenced by extreme values. The interquartile range (75th percentile minus the 25th percentile)is used to describe variability in the data set.

As shown in the figures, the realistic estimates obtained from the population of expens are summarized in a series of box-and-whisker plots. These plots of the distribution associated with the expert population display the following features:

• The *w hiskers" identify the extreme upper and lower bound values.

• The box is determined by the 25* and 75* percentiles (i.e., the lower and upper quaniles), its length is the interquartile range (IQR),

• The middle 5070 of the data points lie within the box, and

• The circles indicate the median of the distributions.

The expens provided a wide range of responses regarding failure probabilities. This range is entirely consistent with the large uncenainties associated with the performance of the components being addressed.

Since no attempt was made to seek a consensus from the expert panel, the median of the expens' estimates was suggested as a realistic probability for usc in the risk-informed studies. The evaluation should incorporate an uncenainty analysis. as illustrated in Figures 3.3 and 3.4.

For the systems selected for study, the extreme values of the failure estimates varied between 1.0E-09 and 1.0E-03 failures per year. For a given component within a panicular system, the interquanile range generally 3-9 DRAFT NUREG-1661

4 ..

3 Estimating Failure Probabilities Using Expen Elicitation l

represented variations between a factor of 10 to 100. The component medians within a given system generally varied within a factor of 10, with the notable exception of the control rod drive mechanisms and the instrument lines of the reactor pressure vessel.

In summary, the data appeared to be reasonable and generally agreed with the PWR plant operating experience. Typical areas of high-break probabilities correspond to such factors as high<ycle thermal stresses (e.g., places where mixing of fluids with large temperature differences occurs) and places where erosion or corrosion effects are active. A tremendous amount of te bnicalinformation was gathered from the exchange j between the experts and the observers, and the elicitation greatly enhanced the realism and credibility of the plant analyses.

DRAFT NUREG-1661 3-10

3 Failure Probabilities Using Expen Elicitation SG to First isolation Valve (MF Portion) H og SG to AFW First isolanon Valve  ! g ,

Mrst to Second isolation Valve o t H Containnent Penciration to f ' O I - ~~ ~ ~

Second Isolatwn Valve ltum Unit 2 AIW Pumps  ; __ _q g , y i

i Pipe Segment tietwee O i 1 l

Contamment isolation Valves Alw Pump Ducharge lleaders H O F- - H i From Umt 2 AIW System I O i l f-- I O I -i MD Pump Discharge TD Pump Discharge i i O ,

l SG to Turbme Dnve for TDP  ; , o ,

0; '

Alw Pump CST Resum Lanes O

l i Alw TDP Suction TDP to CSTI e-- - --i O J  !

I 'U I Alv MDP Sucuon O '

MDP to CSTI l 0 '

CSTI

' - O I CSTI to CST 2 CST 2 f- L D_j l EmerFency MU to AFW MD Pumps F , O M Energency MU to Alv TD Pumps l i O H 9 -t 7 -6 -5 -4 -3 log 10 (Failures / Year)

Figure 3.3 Failure Frequency estimates for the auxiliary feedwater (AFW) system components.

3-11 DRAFT NUREG-1661

s. ..

3 Estimating Failure Probabilities Using Expen Elicitation f-I Welo1 ~ ,

Weld 2 m o~~L1 t - o WeW3 WeW4  ; M WeW$ , n- m WeW 6 .

i'H Wekt 7 H~~1.__._W_l- H i O _H WeW 8 WeW 9 1

77--.g WeW 10 6 WeW ll *2 WeW 12 %E WeW 13 "E WeW 34 r@---i Weld 15 "E Nonle Forgmgs . Inlet Nnale hrging outlet E -

Dehhne Plate O Vessel SheK.outside Behhi.e ' L i Upper Head u.WM U W tower Head i ,

,3 Vessel Flange Encksure Head ilange 7T%

Vessel stud W (_) H CRDMs M c) -4 i l- O +

Instrument Lme Penetraunes 9 -s -7 -6 -5 -4 3 Log 10 (Failures / Year)

Figure 3.4 Failure frequency estimates for the reactor pressure vessel.

DRAFT NUREG-1661 3-12

o .,

3 Failure Probabilities Using Expert Elicitation REFERENCES FOR CHAPTER 3 3.1 Risk-Based Inspection - Development of Guidelines, " Volume 2 - Part 1. Light Water Reactor (LWR)

Nuclear Power Plant Components, ASME paper CRTD-Vol. 20-2 American Society of Mechanical Engineers, New York,1992.

3.2 USNRC," Severe Accident Risks: An Assessmem for Five U.S. Nuclear Power Plants, final Summary Report," NUREG-1150 Volume 1, December 1990.

3.3 D.L.J.B. Bernreuter et al. " Seismic Hazard Characterization of 69 Nuclear Plant Sites East of the Rocky Mountains," USNRC, NUREG/CR-5250 (Prepared for NRC by lawrence Livermore National Laboratory,UCID-21517), January 1989.

3.4 "Probabilistic Seismic Ilazard Evaluations at Nuclear Plant Sites in the Central and Eastern United States: Resolution of the Charleston Earthquake issue," NP-6395-D, Electric Power Research Institute, Palo Alto, California,1989.

3.5 T.A. Wheeler et al., " Analysis of Core Damage Frequency form Intemal Events: Expert Judgement Elicitation," USNRC, NUREG/CR-4550, Volume 2 (Prepared for the NRC by Sandia National Laboratories, SAND 86-2084), April 1989.

3.6 N.R. Ortir et al., "Use of Expert Judgement in NUREG-1150," Proceedings of the International Topical Meeting of Probability, Reliability and Safety Assessment, American Noclear Society, LaGrange Park, Illinois,1989.

3.7 M.A. Meyer and J.A. Booker, " Eliciting and Analyzing Expert Judgement," USNRC, NUREG/CR- <

5424 (Prepared for the NRC by les Alamos National Laboratory), January 1990.

3.8 A. Mosleh et al.," Methods for the Elicitation and Use of Expert Opinion in Risk Assessment,"

USNRC, NUREG/CR-4962 (Prepared for the NRC by Pickard, Lowe and Garick,Inc., PLG-0533),

August 1987.

3.9 O. Svenson, "On Expert Judgement in Safety Analyses in the Process Industries," Journal, F lJability Engineering and System Safety, Vol. 25, pp. 219-256 Elsevier Applied Science, London and New York,1989.

3.10 E.J. Bonano et al.," Elicitation and Use of Expert Judgement in Performance Assessment for liigh-Level Radioactive Waste Repositories," USNRC, NUREG/CR-5411 (Prepared for NRC by Sandia National Laboratories, SAND 89-1821), May 1990.

3.11 T.V. Vo et al., " Estimates of Rupture Probabilities for Nuclear Power Plant Components: Expert Judgement Elicitation," Nuclear Technology, Vol. 96, American Nuclear Society, LaGrange Park, Illinois,1991.

I 3.12 T.V. Vo et al., " Expert Judgeraent Elicitation on Component Rupture Probabilities for Five PWR Systems," Reliability and Risk in Pressure Vessels and Piping, PVP-V01. 251, pp.127-140 American Society of Mechanical Engineers,1993.

3.13 USNRC," Reactor Safety Study - An Assessment of Accident Risks in U.S. Commercial Nuclear Power Plants," WASil-1400 (NUREG-75-014), October 1975.

3-13 DRAFT NUREG-166I l

_- _a

3 Estimating Failure Probabilities Using Expert Elicitation l

3.14 J.P. Kotra et al., " Branch Technical Position on the Use of Expert Elicitation in the liigh-Level l Radioactive Waste Program." NUREG-1563, November 1996.

3.15 C. Genest and J.V. Zidek," Combining Probability Distributions: A Critique and an Annotated l Bibliography," Statistical Science, Vol.1, No.1, pp.114-148,1989.

3.16 J.W. Tukey," Exploratory Data Analysis," Addison-Wesley Reading. Massachusetts,1977. )

l DRAFT NUREG-1661 3-14

4. PROBABILISTIC STRUCTURAL MECHANICS COMPUTER CODES FOR ESTIMATING FAILURE PROBABILITIES 4.1 Introduction Structural mechanics computer codes are valuable tools for estimating the failure probabilities of piping components. Such ccxles can be used to evaluate the impacts of parameters related to component design, stresses, operating conditions, material characteristics, and fabrication practices on failure probabilities. The predictions of these models can be useful in estimating both absolute and relative values of structural failure probabilities. Structural mechanics computer codes also predict the progress of degradation (e.g., crack growth) with time, and thereby provide insights for selecting appropriate inspection intervals.

l This chapter describes the criteria considered important when judging the acceptability of computer codes used in estimating the failure probabilities of piping components. It also provides a detailed discussion of selected structural reliability code issues. The use of validated and controlled computer codes is recommended for estimating failure probabilities because it will lead to a more efDcient, timely regulatory reviews and consistency within the industry in estimating the failure probabilities of piping. [This document does not endorse particular computer codes or preclude the use ofalternative codes to those cited herefor illustration.}

In all applications the computer codes and associated structural reliability and risk assessment (SRRA) models and methodology should be documented and/or referenced. Such documents should identify the failure mechanisms modeled, describe the underlying analytical engineering models, identify the parameters that are simulated as random variables, and describe the input for these variables and the numerical methods (e.g., 1 Monte Carlo simulation) used to calculate failure probabilities. New computer codes can be validated either by comparing their results with results from other generally accepted and documented codes or with failure frequencies based on applicable service data.

4.2 Areas of Structural Reliability Code Review 1

The review of the structural mechanics computer codes used by a utility in its calculations should include the )

code's capability to do the following:

• Address the failure mechanisms under consideration.

• Address the structural materials and component geometries under consideration.

• Ense.re that the structural mechanics models are based on pertinent engineering principles and that the approximations used in the models are appropriate.

• Ensuit that the probabilistic aspects of the structural mechanics models address those parameters with 4-1 DRAFT NUREG-1661 1

j

_--_---_------___---------J

4 Failure Probability Estirnates Using SRRA Codes the greatest variability and uncenainty.

• Ensure that the model calculates failure probabilities using realistic considerations, without conservative or nonconservative assumptions that would inappropriately bias risk-informed categorizations toward particular systems, failure mechanisms, or operati ig conditions.

• Ensure appropriate application of the numerical me' nods, including Monte Carlo simulations and importance sampling techniques.

• The inputs to the codes are within the knowledge base of the experts and/or plant engineering personnel applying the code.

• Internally assigned (hard-wired) parameters and probability distributions are documented and supported by available data and a knowledge base.

• Documentation of technical bases of the model is adequate for peer review.

• The limitations of the code are identi0ed and cautions provided for cases when alternative structural mechanics models and/or other estimation methods would be more appropriate.

• Benchmarking with validated structural mechanics codes.

• The calculated failure probabilities are consistent with historical failure rate data from plant operating experience.

• The development of the computer code, documentation, and application are consistent with quality assurance requirements in Appendix B to 10 CFR Part 50.

The documentation and validation of the codes should identify limitations of the codes and establish the appropriate role (absolute or relative probabilities) for the calculated failure probabilities obtained.

4.3 Selected Structural Reliability Code Issues 4.3.1 Loads and Stresses inputs for loads and stresses to SRRA models should address both conditions anticipated during the design of the systems, and unanticipated loads (e.g., due to snubber failures) that have become known only through operating experience at the plant of concern or at similar plants. SRRA evaluations should use realistic inputs for loads and stresses and for occurrence rates of plant transients.

Best practice dictates the, loads and transients be based as much as possible on actual operating experience rather than on design or bounding conditions. This does not mean that loadings having low estimated DRAFT NUREG-1661 4-2

n. ..

4 Failure Probability Estimates Using SRRA Codes probabilities of occurrence should be neglected but rather, that they are more appropriately addressed in a probabilistic manner in the evaluations. Given the large comp'itation effort for probabilistic calculations,it is best to limit the cases considered to those that have the largest potential contributions to component failure probaoilities. Insights from engineering calculations along with bounding estimates ofloading frequencies and conditional failure probabihties can be used to eliminate from consideration those load cases and/or transients with small contributions.

I It is imponant to include " unanticipated" stresse: that occur during plant operation, but which are not usually j included in the desig, basis. Examples of such stressee are vibrational stresses and cyclic thermal stresses associated whith thermal stratification and mixing of hot and cold fluids. Experience has shown that these unanticipated stresses can produce large numbers of fatigue cycles and cause high cycle fatigue failures in '

piping systems. In contrast, experience shows that the stresses addressed during the design of the plant are limited to lower levels of stress and numbers of cycles, such that fatigue failures due to these stresses occur rarely, if ever. 4 l

It should be noted that calculated stress levels in piping stress reports are generally based on consemative )

I analysis assumptions. It is appropriate in the evaluations to treat such calculated stresses as bounds on the actual operating stresses, with expected values being lower than those cited in stress reports. The exception may be stresses due to intemal pressures, which are subject to less uncertainty in calculations than other source > of stresses, such as those from restraint of thermal expansions. (

4.3.2 Vibratigmal Stresses l

Uncertainties associated with high-cycle fatigue stresses, such as from mechanical vibration and thermal fatigue, warrant special cons.Jeration in calculating failure probabilities. If the cyclic stress levels exceed the threshold AK fer fatigue crack growth, high-cycle fatigue occurs whenever the number of stress cycles is sufficiently large that cracks grow through the pipe wall thickness within a short time period relative to the design life of the component.

He following factors govern the growth of such cracks:

Threshold AK -In applications of the pc-PRAISE code, published data have been used to estimate  ;

appropriate inputs for AK. for stainless steels (4.6 ksi/in' for an R-ratio = 0.0) whereas AK. = 0.0 has been assumed for ferretic steels in accordance with the ASME Section XI.

R-ratio - The structumi mechanics models and inputs to these models should account for the impact of mean stresses on reducing the governing values of AK..

Vibrational Stress Levels - Because vibrational stresses are random in nature, the levels of these stresses in practice are difficult to estimate. Such stresses tend to be greatest for smaller pipe sizes.

Guidelines were developed for the pilot application of risk-informed inservice inspection at the Surry l plant at a meeting of structural mechanics specialists, who were charged with recommending 4-3 DRAFT NUREG-1661

4 Failure Probability Es mates Using SRRA Codes consensus inputs based on their knowledge and engineering judgment. These guidelines provide a sound technical basis for estimating vibrational stresses, as follows, where the cyclic stresses are given in terms of a stress amplitude [i.e., % (a m ,- c ,,,)h Pipe Upper-Bound Median Diameter Cyclic Stress Cyclic Stress l

(inches) (ksi) (ksi) 1.0 6.0 3.0 5.0 2.5 1.25

> 10.0 1.0 0.5 Occurrence Rate - In most cases the prot: ability that the vibration stress will occur is relatively low, and the duration of these stresses may be limked to the time periods of intermittent operation of vibrational sources such as pumps. One can adpst calculated failure probabilities to account for these {

uncertainties.

4.3.3 Residual Stresses Residual stresses can be the raajor factor in the growth of cracks through the mechanism of stress corrosion crading, and can also enhance crack growth through fatigue by increasing the level of mean stress as characterucd by the calculated R-ratio. Guidelines developed for use on the pilot application of RI-ISI at the Surry-1 plant prusie a suitable basis for estimating irsidual stress levels. These consensus guidelines were developed during a meGg of structural mechanics specialists, based on their knowledge and engineering l

judgment. j The guidelines for the Surry-1 study quantin-d the uncertainties in welding residual stresses, and addressed the possibilities that in some cases residual suessas cac attain yield strength levels or can be essentially zero in other cases. These guidelines recommend a - mai Stribution with a median stress approaching 70 % of  ;

the materialflow stress. Statistical distribuuea. to describe unetainties in residual stresses should be truncated at the material flow strength (average of yield and ultimate engths). Ixvels as high as 90% of the flow strength should have relatively low probabilities corresponding, for exaigle, to a 90* percentile of a log- j normal distribution.

4.3.4 Preservice Inspection DRAIT NUREG-1661 4-4

4 Failure Probability Estimates Using SRRA Codes The effects of preservice inspections by such methods as ultrasonics and radiography should be inclu6ed either explicitly or impl;citly in the calculation of failure probabilities. In most cases such inspections are addressed implicitly (as descr.ibed in Section 4.3.9) through their effects on the estimated number and sizes of initial fabrication flaws. In such cases, the simulation of preservice inspection in the structural mechanics model is inappropriate since such a simulation would result in double counting of the effects of the inspections.

4.3.5 Proor Test it is recommended that the effects of proof tests performed after fabrication but before plant operation be included in the probabilistic structural mechanics calculations. Such tests subject piping systems to pressure levels substantially greater than the normal operating and design pressures for the systems. The exact test pressure is prescribed by the construction code. Failure of the pipe (leak or break) during the proof test reduces the likelihood of subsequent failures (during plant operation) due to gross design or constru: tion errors. Simulated failures that occur during proof tests can be excluded from the failure probabilities addressed by the inservice inspection program, because the gross design or construction errors have been corrected.

4.3.6 Leak Detection in calculating pipe failure (leaks to ruptures) probabilities for use in estimating changes in core damage frequency, large early release frequency, and the change in CDF and LERF, the effects of leak detection from through-wall flaws should be addressed. leaks can be detected through explicit leak monitoring measures, or by plant staff in the course of plant walkdowns or system testing. Leak rate calculations and leak detection thresholds used in the calculations oipiping failure probabilities should be documented and justified. The leak rate model in Reference 4.1 is a suitable basis for predicting leak rates from through-wall cracks. It is not appropriate to credit leak detection when calculating pipe degradation probabilities for risk categorization of piping segments as high or low safety significant.

4.3.7 Failure Modes (Leak versus Break)

Best practice dictates that failure probability calculations address the failure modes of concern in the risk-categorization process, and include small leaks (through-wall cracks), large leaks that disable a system (referred to as a disabling leak), and pipe breaks. The leak flow rate for the disabiing leak category should be based on the plant PRA and safety analysis reports.

The methodology identified in Reference 4.1 is a sound basis for predicting leakage through cracks for use in calculations of large leak probabilities and for simulating the impact of leak detection on piping failure probabilities. An example of a suitable implementation of this leak prediction methodology is currently part of the pc-PRAISE code.

4.3.8 Service Environment 4-5 DRAFT NUREG-1661 p .

I .. ..

4 Failure Probability Estimates Using SRRA Codes The service environments tha' affect both corrosion rates and crack growth rates should be addressed in the SRRA models. Such environments are often described in the models in terms of discrete categories such as air versus water or high versus low oxygen environments. The enviromnental condition used in each SRRA calculation should be documented, along with the rationale for the selection. Databases used to develop distributions of crack initiation times and crack growth rates should represent the range of operating conditions expected for the structura? component being addressed by the SRRA models. In those cases where the service environment is subject to large uncenainties and variations, the SRRA models can be structured to simulate these variations and their effects on the resulting failure probabili;ies.

4.3.9 Initial Flaw Size Distributions Stresses at most piping kcations are sufficiently low that the calculated failure probabilities are essentially zero, unless there is an initial fabrication Daw at the structural location of concern (e.g., a weld). Therefore.

SRRA models should simulate the number, size, and location of such fabrication flaws. These characteristics should be estimated and described statistically with distributions that are appropriate for the material, wall thicknesses, welding practices, and inspection procedures for the specific k> cation ofinterest.

The documentation of the SRRA calculations should describe and justify :he number and sizes of defects that were assumed. The model developed in Reference 4.2 for simulating fabrication defects is a credible method for estimating initial Daw densities and size (depth and length) distributions. Applications of this model to pipe welds and data from detailed examinations of actual welds suggest Oaw densities of one or more defects per weld, but with less than 10% of these flaws being inner-surface connected. The Daw depth distributions from this model can be approximated by a log-normal distribution, with the mean Daw depth being on the order of the thickness of the weld beads.

Flaw distribution calculations have been performed with the model in Reference 4.2 to support pilot applicati as of RI.lS!. These calculations addressed a wide range of weld and the results provide a suitable basis for estimating the numbers and sizes of flaws in most cases of piping welds. Results from these calculations were used to develop trend curves that give naw densities and flaw depth distributions as a function of pipe wall thickness, material (stainless versus ferritic steel), and postweld inspection (i.e., with or without radiographic examination). The results indicate the following trends:

- Flaw densities are best characterized in terms of Daws per unit length of a weld rather than in terms of Daws per unit volume of weld material. This measure of flaw density can be conveniently described i by curves giving flaw density as a function of pipe wall thickness.

Most fracture mechanies models conservatively assume that all Daws are surface-breaking Daws at the

?

piping inner surface. Therefore, only a small fraction of 'he total On need be included in the

• Daw density used in these fracture mechanics calculations, in order to snt fer the fact that buried defects are less likely to cause failures than surface breaking defects.

i Radiographic inspection has a significant impact on the number (density) of tiaws. but relatively little DRAIT NUREG-1661 4-6

4 Failure Probability Estimates Using SRRA Codes <

impact on their size distributions.

• The number (density) of flaws is similar for stainless and ferritic steels, but the probabilities for very deep flaws are greater for welds in ferritic steel piping.

• For the cases of manual rnetal arc and tungsten inen gas welding processes, the number of flaws and the sizes af these flaws are insensitive to the particular process used to make the weld.

• The model of Reference 4.2 addresses a generalized basis for estimating the number and sizes of flaws in piping, and is a method that covers a wide range of piping sizes and fabrication practices. Detailed documentation of the number and sizes of flaws will facilitate any necessary reviews.

The results of calculations with the model of Reference 4.2 are cited here as an appropriate starting point for estimating the number and sizes of flaws in piping welds. The estimates have been compared on a limited basis with data on actual flaws detected in welds, and reasonable agreement has been observed. However, it is best that heensees continue m assess the need to modify the curves and equations as given below based on experience and industry data.

The curves for the probabilities of flaw depths (depth of a flaw given that a flaw exists) of Figures 4.1 and 4.2 were obtained by fitting data on simulated flaw depth distributions generated by the RR-PRODIGAL flaw distribution model. These curves (and the equations shown on the figures) give the median values (A50) and shape parameters for log-normal distributions that describe flaw depths, where:

• The variable "x" for the equations is the pipe wall thickness measured in inches.

. The " shape parameter" is the standard deviation of the normal distribution that describes the variability of the natural logarithm of the flaw depth (inches).

• The data set from the RR-PRODIGAL model indicated a difference in the flaw depth distributions for ferritic steel welds compared with those for stainless steel welds. The flaw depth distributions for the ferritic piping have a " fatter tail." This difference is insignificant for pipes with smaller wall thicknesses (e.g.,0.25-inch walls). The difference becomes more significant for thicker pipes (e.g.,

2.5-inch walls). Therefore, separate curves are given for stainless and ferritic steel piping. Use of the ferritic steel curves for stainless steel would provide conservative estimates for failure probabilities.

• The effects of the welding process (a manual metal are versus tungsan inert gas) had only a secondary effect on the flaw distribution parameters.

Fracture mechanics calculations also require inputs for the number of fabrication defects. The results of calculations for defect densities are shown in Table 4.1, which provides a basis for estimating the number of defects in a weld as a function of the pipe wall thickness, and whether a radiographic inspection (RT) was performed on the completed weld. Defect densities for welds of other wall thicknesses can be estimated by interpolation in Table 4.1.

4-7 DRAFf' NUREG-1661

4 Failure Probability Estimates Using SRRA Codes The defect density is expressed as the number of defects per inch of weld, with the weld length measured along the inner surface of the pipe. The total number of defects within a weld of given girth is determined by multiplying the defect density by the inner circumference of the pipe.

DRAFT NUREG-1661 4-8

o 1

6 6

1 s

e G d 2 E o x 5 R C a * '

U 8 2 A 6 N R 2 T R

7 F S 0 h A g

n 0 ' 0 c R i

s x - 2 ni D U le n x ,

s l

et e f 5 s e

t eS 4 2 s .

a t 4 5 e )

9 Sss m 2 3 1 n W A

i t c 2 0 k E

s iti ilen 0 + i c M r

y r a h t

et + 3 M i

l i

b FS 2 0 o 3 7

' 0 T 1

l

(

s a 1 9 l d l

b o 5 0 ' a e r w 0

W

+.

P 0 e

^. 5 e

r r

a u 0 l l

i a t a

F e 4

m

- - - - 0 l a

2 0 0 u 8 6 4 n 0 0 0 0 O a m

D eg 8yM r f

o r

t e

e m

a r

a p 9-2 x '

5 e p

4 1

8 m 2 h

a s

4 d 1

h n 0 )

' 0 c a 0 2 ni h 0 in t s ,

p 0 2 e l

e 3 s d et

+ 4 s 0

t e x o 5 e w Se t *

+

1 n l e E s 9 f sS 9 2 k n ec 2 7 s '

i c a i

2 4 i lnt i 0 o- h d iar r

t ' 0 T e t

SF e 0 x 1 l

l M

2 9 ' a 1 1 4 1

1 5

0 5 W e r

0 '

0 u g _

^.mO 0 i

- ' F m .

- - 0 O _

0 5 0 1 0 0 -

0 0 0

c. .

,= S jO '

m

m h

?

5 s a '

2 d l

t e

x h w

)

8 0 c 6

2 2 i n C I

7 te e 0 s T(

let x J s s eS -

5 e a t

Ss s 1n x '

1 n g ce 2 5 k t st ln 6 2 c r mi 8 4 i e et a 2 3 0

h n FS 0

+

0 '

1 T i n

+ l e

- 5 3 l

-- 6 6

3 a t s

g 7 '

O6 5

0 9

0 '

5 W n u

0

-- 0 t r

f o

- _ - - 0 r 0 e 8 6 4 -

2 0 t e

0 0 0 0 O 0 m

gU 2 8sc.Me a r

1 a 4 p

e p

a h

s 5 d 2 n

'x a 7 ht 9 h p 7 0 c e 0

0 3, 2 i n d 0 ,

w le + m e

s s a s tel e

• x 4 2 ' 5 e H e Se 5

e. 1 n n d sS t

4 k a o s 4 ,

, c i C lec i 0

0 s

e i

h d

e intri A tare 0 T M R SF 9

6 ix 1 l

R 1 9

l a 2 S - -

1 1 4 g

n -- 0 5 0

• 5 W e is 6O- -

0 0 r u

U g

-- i s

e F t

- 0 a O 0 5 0 im t

1 0 0 s 0 0 0 E 1 6

y 6 il t

g8 - .M. 2E c5.y2 1 i

b a G b E o

r R

P U e

r N

u T l

i a

F F A R

4 D m

4 Failure Probability Estimates Using SRRA Codes Table 4.1 Flaw densities for piping welds that have been inspected by RT.

Pipe Wall Thickness, inch Flaw Density. Fisws per inch 0.25 0.0047 0.50 0.0030 0.70 0.0020 1.00 0.0035 1.50 0.0067 2.00 0.0120 2.50 0.0256 In using Table 4.1, the following should be noted:

a For the welds not inspected by RT, the densities of the table should be multiplied by a factor equal to 12.8.

• In general, the factor of 12.8 should be applied for smaller piping (e.g.,3-inch diameter) because such piping is typically not inspected by RT.

. The number of defects in a given weld is calculated by multiplying the flaw density by the inner circumference of the pipe.

• The flaw densities of Table 4.1 assume that the fracture mechanics calculations conservatively Nace all flaws at the inner surface of the pipe. As such, the indicated densities have included only those flaws at or near the inner surface of the pipe.

• The flaw densities of Table 4.1 can be used for both ferritic and stainless steel piping, and for welding performed by txnh the manual metal are and tungsten inert gas processes.

4.3.10 Flaw Initiation

)

Operating experience shows many cases in which flaws have initiated during sersice due to such mechanisms as stress corrosion cracking or fatigue associated with cyclic stresses (e.g., thermal fatigue). Unless service-induced cracks can be verified to be negligible contributors to failure probabilities, the SRRA models for components should account for the potential contributions of initiated cracks to failcre probabilities. These contributions should be added to the contributions from initial fabrication cracks. Documentation of SRRA calculations should describe and justify the explicit or implicit approaches taken to address crack initiation.

4-11 DRAFT NUREG-1661

4 Failure Probability Estimates Using SRRA Codes Various direct and indirect approaches can be used to account for crack initiation. The pc-PRAISE code provides an approach for simulating the initiation of intergranular stress corrosion cracks. SRRA models for the mechanism of fatigue, including pc-PRAISE, do not yet simulate the contributions of fatigue crack initiation, although such effects may be approximated through inputs on the number and sizes of very small inner surface defects. For example, the calculations of Reference 4.3 assumed each weld had one small inner surface flaw with the flaw depth described by a uniform distribution ranging from 0.002 to 0.010 inch.

4.3.11 Crack Growth Rates The prediction of crack growth rates from fatigue and stress corrosion cracking is a critical step in the calculation of piping failure probabilities. large efforts are required to measure crack growth rates, and to develop predictive equations based on correlations of the data from laboratory tests. It is recommended that probabilistic structural mechanics codes make use of recognized and accepted correlations.

The correlations described in the documentation for the pc-PRAISE code provide a technically credible basis for predicting crack growth rates for stainless and ferritic steels. These equations are appropriate only for the relevant materials and service conditions. Other crack growth relationships should be used to address materials and service conditions outside the scope of the equations developed for pc-PRAISE. Such equations are best justified on the basis of measured crack growth rate data, and should account for the effects of mean stresses or R-ratio (i.e., K,,,/K.), and should address threshcid AK levels.

4.3.12 Variability in Material Properties Variability and uncenainties in material propenies can be simulated by the SRRA models. Only those propenies that have significant variability and/or for which the failure probabilities are particularly sensitive need be simulated. Other propenies can be treated as deterministic inputs. Appropriate variables for simulation in the probabilistic model include material strength levels, fracture toughness, and crack growth rates due to fatigue and/or stress con'osion cracking. Documentation for SRRA calculations should state which material propeny inputs were treated as deterministic parameters, and which parameters were simulated in the probabilistic model. The bases for assigning mean values, standard deviations, and distribution functions should be documented.

4.3.13 Cornparison with Service Experience The numerical estimates of failure probabilities from SRRA models should be compared with the service experience for the stmetural components being addressed. In most cases the predictions will give very low leak and rupture probabilities. Calculations should be compared for consistency with the plant's specific experience regarding leaks and detected degradation. Since the failure probabilities for specific structural i locations are almost always too small to permit meaningful comparisons, it is recommended that the calculations for the total failure probability for all components for each system be compared with service experience. Most data on failures will be for pi,.e leaks rather than ruptures, because piping ruptures rarely occur. However, the data on leaks and detected material degradation can help to identify the component -

DRAFT NUREG-1661 4-12

., v 4 Failure Probability Estimates Using SRRA Codes k> cations to the category of high safety-significant ISI locations.

Although there may be large uncenainties in the estimated failure probabilities, the relative values (e.g., from k> cation to location in a given system) are generally calculated with a higher level of confidence. However, even relative values can become increasingly uncertain when comparisons are made from one system to another (due to different failure mechanisms, pipe sizes, materials or fabrication practices, and operating environments), and in comparisons of different failure mechanisms within a given system. Sensitivity studies can be useful in evaluating the potential impacts on risk categorizations caused by systematic biasing of estimated failure probabilities from one system to another.

4.3.18 Consideration of Failure Mechanisms The failure mechanisms of most concern for reactor piping are the initiation and growth of fatigue and/or stress corrosion cracks, and wall thidng by flow accelerated corrosion (FAC). Each of these mechanisms should be addressed by separate structural mechanics models, either within a single computer code or by separate computer codes. The mechanism of fatigue is a concern for both ferritic and stainless steel piping. Stress corrosion cracking is limited primarily to stainless steel piping but can occur in ferritic steels. Erosion-corrosion needs to be addressed only for ferritic steels having susceptible material compositions and operating under specific fluid environments and flow conditions.

Calculations of failure probabilities are contingent on the availability of a computer code that addresses the dominant failure mechanism for the piping segment of concern. The first decision, before any calculations are performed, is whether the selected code is adequate to model the identified failure mechanism (s). The model must not only address the relevant failure mechanisms, but must cover the specific material type and grade, and the relevant operational conditions (temperature, chemical environment, flow velocities, material heat treatment, etc.).

4.3.19 Materials Considerations The governing failure mechanisms and associated failure probabilities are affected by the panicular types and grades of materials used to fabricate the piping of concern. Some materials considerations, such as yield and ultimate strength levels, are addressed by user-provided inputs to the probabilistic calculations. Because most materials-related inputs are seldom known with precision, computer codes must simulate the uncertainties in these input parameters which are related to the scatter in materials properties.

Probabilistic structural mechanics codes must address materials parameters that are often beyond the knowledge base of the expected code users. For example, predictions of growth rates for fatigue and stress corrosion cracks are a challenge even to researchers working in this specialized area of fracture mechanics.

Therefore, the users of SRRA codes must rely on the validity of default or hard-wired values for crack growth parameters, or use the guidance and/or examples given in the documentation for the computer codes.

Suitable SRRA computer codes should provide technically sound and documented approaches to predicting 4-15 DRAFT NUREG-1661

n ..

4 Failure Probability Estimates Using SRRA Codes crack growth rates. Applications of crack growth relationships should not require specialized knowledge of fracture mechanics, but should have sufficient flexibility to permit more knowledgeable users to refine predictions of fracture mechanics models.

4.3.20 Consideration of Component Geometries Probabilistic structural mechanics codes are generally based on Monte Carlo simulations, which involve repeated deterministic calculations to obtain failure probabilities. The large number of calculations dictates that the models be limited to relatively simple geometries, such as straight lengths of piping with circumferential or axial cracks. Applications of these simplified models to more complex geometries involve assumptions and approximations. For example, inputs can specify stresses for the simplified models in a manner that numerically approximates the level and distribution of stress for the complex geometry as obtained from detailed calculations performed with a finite-element code outside the framework of the probabilistic model.

l' Suitable SRRA codes should address appropriate geometric considerations for the failure mechanisms of concern. For fatigue and stress corrosion mechanisms, the models should address intemal surface circumferential cracks and have the ability to approximate the axial crack case. Erosion-corrosion models should address piping failures associated with enhanced levels of hoop stress caused by wall thinning. ]

f 4.3.21 L)eterministic Structural Mechanics Models Since probabilistic models are based on the repeated application (e.g., Monte Carlo simulations) of deterministic models, the validity of predicted failure probabilities depends on the correctness of the underlying deterministic model. As indicated above, deterministic models in probabilistic structural mechanics codes are generally limited to relatively simple structural geometries; the effects of more complex geometries are addressed through suitable manipulations of the inputs that prescribe the levels and spacial distributions of the stresses.

l The entical features of deterministic fracture mechanics models are as follows:

1

• Calculation of crack tip stress intensity factors as a function of crack depth, crack length, crack orientation, applied stress level, through wall variation in stress, and residual stresses

• Models for predicting suberitical crack growth (or wall thinning) as a function of stress intensity j factors, material properties, and operating conditions (temperature and chemical environment)

I

• Models for predicting critical crack sizes and critical depths of wall thinning that correspond to piping failum by leaks or breaks 4.3.22 Selection of Probabilistic Variables DRAFT NUREG-1661 4-16

4 Failure Probability Estimates Using SRRA Codes designs and/or severe operational conditions that can enhance the probability for piping ruptures. Industry-wide experience for similar materials, designs, and operating conditions also serve as a basis for checking the credibility of SRRA calculations.

4.3.14 Effects of Inservice Inspection (CDF vs. Importance Measure Calculations)

One of the suitable approaches to RI-ISI programs has two types of evaluations. The first evaluation is the quantification of the total CDF (or ACDF) that results from the proposed change in the ISI prograra. The second evaluation consists of categorizing piping segments as high or low safety significant.

In calculating the total CDF (or ACDF) from changes to the ISI program, the calculated piping failure probabilities should be consistent with the operations and procedures of the plant. That includes efects of the inservice inspection programs. However, when calculating failure probabilities for risk importance measures to be used in a component categorization scheme, the analyses should assess both the effects of implementing inservice inspection programs tISI) and the effeets of no inservice inspection programs.

To support the development of effective ISI programs, SRRA modeling should use the simulations of inspections to evaluate alternative inspection strategies. Two critical inputs to such SRRA calculations are the inspection method (as characterized by a probability-of-detection curve), and the time interval between the inservice inspections. Inputs for Haw detection probabilities should be relevant to the materials, component geometries, and degradation mechanisms for the structural location being addressed. Inputs for detection probabilities should be documented and justified.

4.3.15 Cumulative Effects of Repeated or Periodic Inspections The failure of an inspection to detect a particular flaw is often due to physical factors such as crack tightness or crack orientation. Such factors can continue to prevent detection regardless of how many inspections are perfomied. Calculations of the benefits ofinservice inspections should assume that nondetection of a particular flaw in one trial will be correlated with the outcome (nondetection) during a subsequent inspection. '

Overly optimistic estimates of ISI effectiveness can be obtained if the alternative assumption of independent outcomes is assumed.

4.3.16 Review and Treatment of Uncertainties Uncertainties in modeling assumptions and inputs to calculations should be identified and quantified.

8 Regulatory Guide 1.174 (Ref. 4.4) provides a general discussion on uncestainty, both aleatory and epistemic Calculaticos of piping failure probabilities are affected by both types of uncertainty.

' Aleatory uncertainty is that addressed when the events or phenomena being models are characterized as occurring in a " random" or " stochastic" manner, and probabilistic models are adopted to describe their occurrences.

Epissemic uncertainty is that associated with the analyst's confidence in the predictions of the PRA model itrelf, and is a reflection of his assessment of how well the pRA model represents the actual system being modeled. "Ihis has been referred to as state-of-knowledge uncertainty.

4-13 DRAIT NUREG-166I

4 Failure Probability Estimates Using SRRA Codes Figure 4.3 shows specific parameters tha* e appropriate for review for their impact on the calculated failure probabilities. It is best to avoid conservative modeling assumptions and inputs to address uncenainties since inflated values of failure probabilities can give unwvranted inspection priority to some components at the expense of others that may actually have greater safety significance. The effects of uncertainty distributions for calculated failure probabilities are best addressed in the PRA analysis.

FLAW WALL CRACK DEPTII THICKNESS GROWTH FLAW ASPECT PIPE FLOW RATIO RADIUS STRESS ULTIMATE DEAD STRESS PRESSURE LOAD THERMAL NUMBER OF CYCLIC STRESS STRESS CYCLES LEVEL Figure 4.3 Example of major parameters that can influence calculated piping failure probability.

4.3.17 Realistic versus Conservative Calculations Best engineering practice dictates that structural reliability calculations be based on realistic considerations rather than assumptions and inputs that ensure conservative estimates. The introduction of conservatism on a selective and/or nonuniform basis for particular components or particular failure mechanisms will have the undesired effect of biasing the imponance categorizations. The result can be inappropriately low j

categorizations for some piping that is truly more risk significant. The use of conservative assumptions (to address uncenainties) are best considered in the sensitivity studies. 'Ihe results of such sensitivity studies should go through a rigorous quality assurance (QA) process or an expen panel as a potential basis for adding DRAFT NUPIG-1661 4-14 i

.. e 4 Failure Probability Estimates Using SRRA Codes Once the deterministi,atructural mechanics models have been defined, it is then necessary to select those  ;

variables that will be simulated in the probabilistic calculations as opposed to those variables that will be treated as single-valued deterministic parameters. The variables selected for simulation should be limited to those with the most significant uncertainty due to lack of knowledge and/or a limited base of data or to known l variability (as indicated by scatter in data). A typical division between deterministic and probabilistic variables in structural mechanics calculations is shown in Table 4.2. j rable 4.2 Deterministic versus probabilistic variables.

_ 1 Deterministic Parameters Probabilistic Parameters Stress level  !

Piping diameter Initial piping wall thickness Material strength {

location of fabrication flaws Fracture toughness (surface or buried) Crack growth rates Chemical environment Number of fabrication flaws (air, water, oxygen content, etc.) Sizes of fabrication flaws Operating temperature (Depth and length) in many cases it will be necessary and appropriate to address certain probabilistic variables outside the framework of the structural mechanics code. For example, the probabilities or frequencies of loading cases (e.g., pressure-temperature transients f or pressurized thermal shock accidents) may be the subject of continuing detailed evaluations. Such decomposition of the failure probability calculations into a set of conditional failure probability cases can also facilitate sensitivity calculations and the independent reviews of failure probability estimates.

A clear explanation of the probabilistic structural mechanics codes used in the analyses will facilitate a better understanding of the results. This understanding will be enhanced by a listing of those variables that are  ;

I treated as deterministic in origin and those that are probabilistic. The distribution functions of the probabilistic variables, including mean, standard deviation, and truncation criteria, will further augment ur.derstanding of the results as will an identification of user supplied distributions and those that are hard-wired into the codes.

4.3.23 Numerical Methods The accuracy and computational efficiency of computer codes are affected by the numerical approaches used to implement the probabilistic structural mechanics model. The most commonly used approach is that of a Monte Carlo simulation, since it has general applicability to complex physical phenomena involving 4-17 DRAFT NUREG-1661 i

e ..

4 Failure Probabi:;ty Estimates Usa.g SRRA Codes interactions among variables and discontinuous behaviors. A Monte Carlo approach is also relatively ,

straightforward to program and does not require advanced mathematical knowledge of probabilistic and I statistical methods. The resul.ing computer codes will be relatively robust, but may lack the numerical 1

efficiency desired for the calculations where verv low values of failure probabilities are of mterest.

There are a number of sound numerical techniques available to enhance the speed of failure probability calculations. For example, the pc-PRAISE code (Ref. 4.5) uses stra:ified sampling, and the Westinghouse structural mechanics code (Ref. 4.6) uses importance sampling. In both cases the more sophisticated sampling procedures are used as an enhancement to the underlying Monte Carlo simulation.

)

Care must be exercised in using enhanced sampling methods to ensure that the methods are correctly impleme.ned acd are not applied to situations that model cornplex probabilistic interactions. For example, stratnied samplir,g is precluded in the pc-PRAISE code for stress corrosion cracking, because pc-PRAISE models multiple crack initiation sites and treats crack interactions and coalescence. In all cases, the validity of enhanced sampling methods and their implementation should be verified by comparing numerical resuhs with those from conventional Monte Carlo simulations.

4.3.24 Assignment ofInput Partuneters I

Consistency in code inputs is at the heart of credible results. This consistency can be established by attention to a few details:.

l l

. Detailed guidance for the assignment of input parameters in the code documentation. j l

. Presentation of sample calculations, along with a narrative describing the consideraticas used to i assign input parameters and the sources of data that support the assigned numerical values.

. Proper training for new users of the code coupled with readily available consultation and workshops l to permit interactions among the code users. j i

. Prescriptive guidance for those input parameters (e.g., flaw size distributions, crack growth equations, '

and fracture toughness correlations) that are either outside the expected knowledge base of the code users or where the expected variations in judgments made by several users could result in differing or inconsistent inputs. I

. The use of a consensus process involving experts, code users and/or plant engineering personnel to develop the guidelines for the determination of suitable numerical values of the more difficult-to-define input parameters uscd in the structural reliability calculations. Such a process, properly instituted, will enhance the level of uniformity and consistency in the calculated failure probabilities that are used to support risk-informed inspections.

DRAFT NUREG-1661 4-18

i i I l 4 Failure Probsbility Estimates Using SRRA Codes

{

4.3.25 Supporting Databases Cenain inputs for probabilistic calculations are outside the knowledge base of expected users of the SRRA l codes. Examples of such inputs are flaw density and size distributions, and materials characteristics related to l crack growth retes and flow accelerated corrosion rates. An essential part of developing a code is to provide l guidance to a code user in the selection of suitable inputs, either as menus on hard-wired options within the l code or as part of the code as recommended values for consideration by the user.  !

l A major part of developing a probabilistic structural mechanics code is the compilation of databases for use in I qu mtifying parameters of the model. An equally imponant task is the development of statistical correlations ,

t of -he data into a form that is suitable for the computation models. Complete documentation of computer  !

codes describes the data and statistical correlations used to suppon the model, along with the approaches used to derive the statistical correlations 4.3.26 Documentation and Peer Review Ultimately. the credibility of any SRRA code will rest upon its documentation and peer review. The scope of the recommended code documentation is addressed throughout this chapter. Documentation is essential to permit peer reviews of the technice basis for the codes, and to permit. correct and appropriate applications of the code by the user community

• thorough peer review process will include trial calculations by independent outside usecs of the codes. Such applications will result in improved insights regarding the j strengths and limitations of the computer codes and their associated documentation. .

I 4.3.27 Identification of Code Limitations It is essential to identify the limitations of structural mechanics models to avoid inappropriate applications or false levels of confidence in the calculated failure probabilities. Guidance should identify situations for which the codes are expected to give the most accurate absolute values for failure probabilities, as well as other situations for which the calculations are appropriate only for the estimation of relative failure probabilities.

The code documentation should state the ansumptions made in the structural nahanics models, and the expected impacts of these assumptions on the calculated failure probabilities lamitations should be specifically stated regarding the failure mechanisms addressed, along with the applicable operating conditions in terms of temperatures, operating environments, and materid types.

4.3.28 Benchmarking with Other Computer Codes The bonafides of structural mechanics codes is best established through Senchmarking against results from other computer codes that have gone through peer review and validatm such as the pc-PRAISE code.

4-19 DRAFT NUREG-1661 f

e 4 Failure Probability Estirnates Usine SRRA Codes Probabilistic structural mecha;, .sdes are relatively complex and their accuracy and reliability can only be demonstrated through benchmarking against other probabilistic codes. Elements of probabilistic codes should also be checked against predictions of deterministic calculations. Key aspects of probabilistic codes should be subject to peer reviews to ensure that models are based on sound principles and appropriate input data. In the benchmarking process, it is expecm! that there will be differences in computed values. Reconciling these differences can provide a better understanding of the codes and of the interactions among input variables and code assumptions.

Advances continue to be made in the technical field of probabilistic structural mechanics. Therefore, codes will often not be available to support the benchmarking of new and improved computer codes. In these cases, other approaches can be used to accomplish the benchmarking objectives as follows:

• Generation of a matrix of demonstration calculations to cover a wide range of input parameters that result in predicted failure probabilities covering the range from very high (i.e., approaching unity) to very low (e.g., less than 10* over the design life of the component),

. Performance of sensitivity calculations covering all input parameters to demonstrate that changes to input values result in consistent changes in calculated failure probabilities, and e Performance of selected calculations that address consistency with operating experience in accordance with the discussion of Section 4.3.29. These calculations should cover both normal or design conditions and cases of actual (but unanticipated) operating conditions that have resulted in component failures or service-related degradation.

4.3.29 Consistency with Operating Experience Failure probabilities for most structural components are so low that failures are not expected to occur over the operating life of individual components. Few (if any) failures are expected to occur even if a large population of sim!!ar components is considered. This paucity of data on actual failures provides the incentive to use probabilistic structural mechanics models as a method for estimating failure probabilities. In this regard, probabilistic models predict component failure probabilities by making use of the better-known data on the individual variables (e.g., flaw occurrence rates, flaw sizes. crack growth rates, material strengths, and fracture toughness properties) that govern the component failure probabilities. However, there are large uncertainties regarding the assumptions and input data. Comparing the calculations to operational experience provides a good consistency check and improves confidence in the calcula:ed values.

The following approaches have been successfully used to establish the consistency of model predictions with the limited amount of data on f ailures that is available from operating experience:

• In many cases there will be nc reported failures coneponding to the conditions addressed by the structural reliability calculations. C%1ations using established analytic modeling techniques and relevant physics and material propecies can be validated in the sense that the predicted failure DRAIT NUREG-1661 4-20

o .

4 Failure Probability Estimates Using SRRA Codes probabilities are indeed very low and are shown not to be inconsistent when no failures have occurred for a known population of components over a defined span of operating years.

• While operating experience may show no failures by the mode of piping rupture, the data may indicate other more common occurrences of piping leaks and/or of detected cracks. Such data should be used for consistency checks of calculated probabilities for piping leaks and for crack growth to detectable depths. The occurrences of stress corrosion cracking and now accelerated corrosion at nu lear power plants has been relatively frequent, and can provide a basis for validating predictions of structural mechanics codes.

= nere are documented cases where unanticipated operating conditions (e.g., thermal fatigue and flow accelerated corrosion) have caused reactor piping to become severely degraded (cracking and wall thinning) over relatively shon periods of operation. Such reports of service experience can be used to test the ability of some probabilistic structural tr.xhanics models to predict component performance under limiting situations of severe operating conditions.

. The literature documents studies in which piping specimens have been tested under conditions of fatigue and stress corrosion cracking. Such data can be used to evaluate the capability of the structural mechanics models to predict the conditions that result in relatively high probabilities of failure.

4.4 Example Uncertainty Analysis The objective of the example evaluation desenbed here was to quantify the uncenainties associated with the inputs to probabilistic fracture mechanics calculations along with the resulting uncertainties in calculated values of piping failure probabilities. All the calculations used the pc-PRAISE computer code (Ref. 4.5) to address both leak and break probabilities. Both uncertainties with inputs to pc-PRAISE and uncertainties in the probabilistic model itself were addressed. A two step process was used. The first step was a sensitivity study, which identi5ed those uncenainties that had the greatest effects on the results from pc-PRAISE. The second step was a quantitative ancenainty analysis that addressed the most critical parameters as identified by the sensitivity calculations. The results from the uncertainty analyses (see Section 4.4.5) show a consistent trend of large uncertainties whenever the calculated failure probabilities are relatively low (e.g., P, = 1.0E-08 per weld per 40 year life), and much smaller uncenainties whenever the failure probabilities are relatively large (e.g., P, = 1.0E-02).

The calculations of this section are limited to an example of mechanical and thermal fatigue failures of stainless steel piping due to welding defects. The calculations consider a single pipe size (6-inch schedule 120) with an inner radius of 2.75-inch and a wall thickness of 0.562-inch. A wide range of cyclic stress was addressed using the Q-factor approach (Ref. 4.3). Distributions of calculated failure probabilities are presented to characterize the uncenainties in the failure probabilities predicted by pc-PRAISE.

I I

4.4.1 Sensitivity Calculations 4-21 DRAF" NUREG-1661 1 l

4 Failure Probability Estimates Using SRRA Codes Inputs to pc-PRAISE consist of both pmbabilistic and deterministic parameters. Flaw depth, flaw aspect ratio, crack growth rate, and flow and ultimate stresses are probabilistic, while the pipe radius and wall thickness, intemal pressure, dead weight load, thernal stresses, and the number and level of cyclic stresses are deterministic.

In the sensitivity analyses, baseline failure probabilities were first calculated using best estimate values for all input parameters. In a series of calculations the inputs were changed one-by-one, wittr all other values unchanged from the baseline calculation. The numerical change for each input corresponded to the estimated uncenainty associated with that input parameter.

The sensitivity analyses varied the scale parameter (i.e., the mean for a normally distributed variable, and the median for a lognormally distributed variable) while keeping the shape parameter (i.e., the standard deviation for nonnal variables) constant. Incremental changes for the deterministic inputs were established by assuming that they were normally distributed. Standard deviations for the distributions were based on the uncertainties in the deterministic input parameters.

A total of 44 cases were run which covered three Q-factor values (Q=1,100,10,000)in order to address a wide range of cyclic stresses and failure probabilities. Calculations indicated that leak probabilities are most sensitive to changes in the flaw depth, flaw aspect ratio, crack growth rate, and the level and number of cyclic stresses. The prescribed changes in some of these parameters resulted in leak probabilities which wert higher / lower than the baseline by as much as 2.5 orders of magnitude. Uncenainties in pipe inner radius, pipe wall thickness, internal pressure, dead weight load, and flow stress were detennined to have relatively small effects on calculated failure probabilities. The flow stress of the pipe material was nevertheless included as one of the more important input parameters due to large uncertainties in the simplified fracture mechani<;s model used to predict pipe breaks (Ref. 4.7].

4,4.2 Uncertainty Calculations The objective of the uncenainty calculations was to est'imate the mean, median and f.amdard deviation of the calculated leak and break probabilities. These statistical parameters were estimated by performing Monte Carlo simulations on the variables described above. Calculations were performed for different sets of inputs obtained by sampling from triangular distributions which described the estimated uncenainties in the pc-PRAISE input parameters. Each Monte Carlo trial was a pc-PRAISE run which gave values of the failure probabilities. There were 100 trials for each Q value, which provided a sample of 100 failure probabilities from which means, medians, and standard deviations for the probabilities were established. }

Triangular distributions were appropriate because the quantification of the uncertainties was based only on limited data in combination with engineering judgment. The triangular distribution assumes zero probability for values outside the bounding range of values, and is not influenced by assumptions regarding tails of DRAFT NUREG-1661 4-22

4 Failure Probability Estimates Using SRRA Codes distributions. This distribution also accounts for the best estimate values for the variables without implying )

detand knowledge of the shape of the distribution function.

4.4.3 Inputs for Calculations Table 4.3 summarizes the input data used for the baseline case. The following describes the uncertainties associated with each of the influential input parameters.

Flaw Deoth (a)

The uncertainty in the Oaw depth distribution was based on data from the RR-PRODIG AL code (Ref. 4.2).

8 These data showed that P( a > 90% of the wall thickness) can vary from 10 to 10 ", with the baseline case having P (a > 90% t) = 10 " The data showed that the median flaw depth was about the same for the three cases, whereas the shape parameter (A) of the lognormal distribution has different values. For the uncertainty in the flaw depth the calculations assumed that the shape parameter A was a randomly distributed variable with the bast line case being the mode of the triangular distribution.

Asoect Ratio B = h/a The uncertainty in the distribution for D was described by estimating a value for the probability that the flaw 2

length-to-depth ratio exceeded 10. In pc-PRAISE the Prob ( >5)is 10 . Available data indicated that about 20% of the initial cracks would have b/a > 5. Therefore, the largest percentage of initial cracks with b/a > 5 d

was estimated to be 209 and the smallest would be 10 .

Faticue CraciGmwth The fatigue crack growth ate in the pc-PRAISE code is characterized by the following empirical relation da/dN = C (K )"

Table 4.3 laputs for baseline case.

8Pe Name Symbol Distribution Type Median Basis Parameter e

Initial Flaw Depth a LN 0.09 inch 0.24 inch RRA weld simulation Initial Aspect Raiio b/a LN(p>l) 1.336 0.5382 Judgment Applications of pc-PRAISE RRA weld simulations Fatigue Coefficient C LN 9.14xl&" 1.042 data Prior applications of pc-PRAISE 4-23 DRAFT NUREG-1661

4 Failure Probability Estimates Using SRRA Codes Thernul tress o, deterministic 10 ksi - Judgment Number of Cycles An deterministic 5 cycles /yr -- Judgment {

Cyclic Stress Ao deterministic 15 ksi - Judgment Fabrication Flaws p acterministic 1x10 2 -- RRA weld simulation per + Weld The parameters C and m are empirical constants and K'is the effective crack tip stress intensity factor. Scatter in the fatigue data is accounted for by considering the coefficient C to be randomly distributed. The scatter in da/dN is relatively well characterized from the extensive base test data. For the baseline case, the probability that C > 3.5 x 10 " is 109. To describe the uncertainty in C, it was assumed that P (C > 3.5 x 10 ") equals 59,109 and 15%.

Thermal and Cyclic Stresses The thermal stress was assumed to be lognormally distributed with a median of 10 ksi and a 0.2 shape parameter. The median and shape parameter for the cyclic stress were 15 ksi and 0.2.

Number of Cycles The number of cycles for every year of the 40 year life was 5 cycles / year, and was assumed to follow Poisson s distribution.

Number of Flaws / Weld The flaws per weld was represented by a triangular distribution having a mode, minimum and maximum of 102 ,10 5and 10 '

Flow Stress l The flow stress was described by a triangular distribution. The mode, minimum and maximum were 60,45, and 75 ksi, respectively.

I DRAIT NUREG 1661 4-24 1

4 Failure Prob 1bility Estimates Using SRRA Codes 4.4.4 Computational Approach Monte Carlo simulations sampled from the unce tainty distributions to generate 100 sets of random inputs for the pc-PRAISE runs. Each run assumed one flaw per weld and provided conditional leak and break probabilities. The uncertainty associated with the best estimate flaw density (0.01 flaws per weld) was then evaluated to obtain a distribution of unconditional leak and break probabilities. The final step was to evaluate and interpret the distribution of 100 failure probabilities. Mean and median values of the distributions of 100 failure probabilities were calculated for comperison with the corresponding probabilities from best-estimate calculations.

4.4.5 Results of Uncertainty Calculations Figure 4.4 shows an example histogram (leak probability for Q = 100) with the best-estimate probability shown along with the mean and median values from the uncertainty analysis. There is enly a relatively small difference between the best-estimate and median values, whereas the mean value is about a factor of ten -

greater than the best-estimate.

Figure 4.5 summarii.es the results from all of the uncertainty analyses. The mean and median values of leak and break probabilities from the uncenainty analyses are consistently greater than the corresponding values from the best-estimate calculations.

It is noted that:

. Median values of probabilities correlate relat.xly well with the best-estimates.

4-25 DRAFT NUREG-1661

4 ..

4 Fdlure Probability Ettimates Using SRRA Codes if f a w -

,. - h:: ,, / '""

.s

. 14 e a ll l

l a .. .-

l 0 .. . -

-i

• ll l

~

V !!  !

l

• ~

n fL ll l

?

O 16 18 44 43 -12 11 -10 4 4 -7 4 4 4 4 4 -1 0 WLeek ProtistslHey)

Figure 4.4 Distribution of calculated leak probabilities (Q = 100).

is.co isa , "=saw unimewimyaneyme Rhudian at Uno.,taenty

> '8 44 - Leak Protistdlities t

5 is.es . e.m s.mn.i. c.esam.n

.P q ... . *,,,.-

l ,

i; es w. *p. Break Prot.eldleties t

{ a"8 ' ,

. e, , , /,. - -

is u .

n.n . .) ',.' ' . *,.Al s: .--a- . C.*l~ ,,,,,,,,,,,,,, _ _

is-a .

1840 0 1 10 its 1880 10000 1800A0 o+eciar Figure 4.5 Comparison of uncertainty and best-estimate calculations.

DRAFT NUREG-1661 ' 4-26 .

1 4 Failure Probability Estimates Using SRRA Codes

• Differences between best-estimate and mean values for leak probabilities are 1-3 orders of magnitude, and 4-6 orders of magnitude for break probabilities.

a The greater uncertainties for pipe break probabilities are largely due to the sensitivity of calculations to inputs for flaw depths and aspect ratios. There are little data to suppon the estimates for the low l occurrence rates for very deep and long flaws. Estimates of probabilities for these rare defects are based on extrapolations having high levels of uncenainty. l

• The uncenainties in calculated leak probabilities become relatively small for leak probabilities greater than 10t Given a 40 year operating life for a reactor piping system, this 10" cumulative probability f corresponds to a failure frequency of 2.5x10+ leaks per weld per year. The higher levels of 4

uncertainty for calculated leak probabilities less than 10 is not of great importance, because piping with such low failure rates would generally fall below levels that would contribute significantly to plant risk.

The present calculations support the following conclusions:

. The results clearly show (as expected) large uncertainties in calculated failure probabilities, with the uncenainties being particularly large for pipe break probabilities.

. The median values of leak probabilities from the uncertainty calculations generally agree within an order of magnitude with the best-estimate calculations. This correlation suppons the viability of using best-estimate calculations for risk-informed decision making.

+ Initial flaw site distributions are a major source of uncertainty in calculating failure probabilities. The inherent difficulty in establishing the very low probabilities for very large fabrication flaws has a major impact on the ability to estimate piping failure probabilities.

Figure 4.6 is proposed as an approach to relate the uncertainty in calculated failure probabilities to the corresponding best estimates (or point estimate) in the failure probabilities. These curves are derived from the results of the pc-PRAISE calculations. Both leak and break probabilities from the pc-PRAISE calculations were used in constructing the bounding curves. The upper bound curve was based on the largest of the 100 failure probabilities calculated from the 100 pc-PRAISE runs for each given cyclic stress level. In constructing Figure 4.6, it was assumed that the median failure probability was equal to the best estimate, and that there is a common ratio of the median probabilities to the conespcmding upper and lower bound.c 4-27 DRAFT NUREG-1661

c 4 F::ilure Prob:bility Estimates Using SRRA Codes i

It is noted frorn Figure 4.6 that:  !

l 1

• %e likelihood of the actual failure probability being outside the range of the indicated upper and lower bound curves is cr.iy about one chance in a hundred.

• The largest uncertainties are for those cases that have very low values of calculated failure l probabilities. The uncertainties decrease with increasing failure probabilities. )

• The categorization of piping segments as high- and low safety-significant is a function of the degradation mechanism and consequences. "Iructive" versus " active" degradation mechanisms result in significant variation in failure probabilities. This variation renders the impact of the large uncertainties for components with low failure probabilities as having have a relatively small impact on the categorir.ation. The effects of uncertainties on component categorization can be addressed through numerical evaluations, such as Monte Carlo analyses.

• The calculations for components with very low failure probabilities are particularly sensitive to the tails of the distributions assumed for input parameters such as flaw depths and crack growth rates.

The large uncertainties in the cz'culated failure probabilities are e direct results of the fact that the tails of these input distributions are based on extrapolations from actual data.

• Failure rates for components with high calculated failure probabilities can be assessed for consistency with plant operating experience and with industry data bases on reported field failures. The ability to make such comparisons helps to minimize the uncertainties in the calculated probabilities.

DRAFT NUREG-1661 4-28

9 e 4 Failure Probability Estimates Using SRRA Codes 1E+00 .

1E41 -- -- --- - - _- -_ -__ - -

1.E-02 -- --

-q -- --

j .p- --

f, --

f 1543 - - - ---

- pg p - . ,#- - --

'IS 1E4s. . . - - - -- -- ,s- -.

,s - -- -

g 1E 06 < ~ - --- -p" -- --

--F /- - -- --- --

L 1E48. - - , s **T- - - - -- - -

1.E 07 . - --

Mn -- -- --

,p I AN - --

' Failure _ Probability- - - -

$ 1E4s. . Failure ProbaAdy. -

-.p_- __ __ _,

.G 1.E40 . -- - - -- --- -/- -- -- --- --- -- -

1.E-10 < -- - - -- --

j -- -- - - - - -- -- - - - -

1.E-11. - - ---

-f

'--- rp gg gg p 1 E-12 < -. - - - -

[- ---

tWnch Sdedule 120 (2.75 inch OD x 0.562 inch won) 3 1E.13 . _ -p( ___ __

- Oumulative Fahne Probalmy over 40-Years 1.E.14 . _f- _ . _ _ _ . - _ __ -- -_ -- _ - - .

1E-16 1E 11 1E 10 1 E40 1E-08 1E 07 1 E 06 1 1-06 1E44 1E-03 1E 02 1.E-01 1.E+00 Best Estimate Failure Probability Figure 4.6 Uncertainty Bounds Related to Values of Calculated Failure Probabilites 4.5 Formal Process for Validating and Updating SRRA Codes if SRRA codes are used for estimating failure probability of piping, a formal process for validating and updating the codes is necessary to ensure that they will represent the best engineering fracture mechanics knowledge available at the time of their use. The process will also contribute to the consistency of estimated failure probabilities for identical or similar components as calculated by different codes and/or by different organizations, and thereby enhance the credibility of the ranking and selection methodology. While the specifics detailing the process for 11idating and updating an SRRA code are the responsibility of the code i owners, a credible formalized process will typically contain the following general attributes.

I a ideally, the primary means of code validation should be by direct comparison of the code's results with applicable historical and experimental data (both generic and plant-specific) for each failure mechanism modeled. Implicit in this is that such sources of historical data exist and are collected and periodically updated as new information becomes available, and that mechanism-specific failure  ;

probabilities have been determined or can be determined from the data.  !

I 4-29 DRAFT NUREG-1661 1

. e 4 Failure Probability Estimates Using SRRA Codes j i

= A secondary means of code validation is to compare a code's results with other codes that have )

already been successfully validated. l

• As new information becomes available in the form of additional failures for known failure mechanisms, failures attributable to heretofore unknown mechanisms, or new calculation techniques, this information should be incorporated into the code in a timely fashion so that results from the updated code once again reflect the best current knowledge in fracture mechanics and numerical quantification.

• The code's documentation identifying the failure mechanisms modeled, describing the underlying analytic or engineering models, identifying the parameters that are simulated as random variables, and describing the input for these variables and the numerical methods (e.g., Monte Carlo simulation) used to calculate failure probabilities should be updated as new information, models, or techniques are incorporated.

1 i

DRAFT NUREG-1661 4 30 l

4 .

4 Failure Probability Estimates Using SRR A Codes REFERENCES FOR CHAPTER 4 4.1

• Evaluation and Refinement of Leak-Rate Estimation Models " USNRC, NUREG/CR-5128, Revision I, June 1994.

4.2 0.J.V. Chapman, " Simulation of Defects in Weld Construction," PVP-Vol. 251, Reliability and Risk in Pressure Vessels and Piping, The 1993 Pressure Vessels And Piping Conference, Denver, Colorado, July 25 29,1993, American Society of Mechanical Engineers.1993.

4.3 M.A. Khaleel and F.A. Simonen, "A Parametric Approach to Predicting the Effects of Fatigue on Piping Reliabihty," Service Experience and Reliability Improvement: Nuclear, Fossiland Petrochemical Plants ASME PVP Vol. 288, pp. I17-125,1994.

4.4 USNRC,"An Approach for Using Probabilistic Risk Assessment i's Risk-Informed Decisions on Plant-Specific Changes to the Current Licensing Basis," Regulatory Guide !.174, draft January 1998.

4.5 D.O. liarris and D.D. Dedhia," Theoretical and User's Manual for pc PRAISE, A Probabilistic Fracture Mechanics Computer Code for Piping Reliability Analysis," USNRC, NUREG/CR-5864, July 1992.

4.6 B,A. Bishop and J ll. Phillips,"Prioritizing Aged Piping for Inspection Using a Simplified Probabilistic Structural Analysis Mode." in ASME PVP-Vol. 25, Reliability and Risk in Pressure Vessels and Piping, pp. 141-152, American Society of Mechanical Engineers,1993.

4.7 G. Wilkowski, G. Kramer, P. Veith, R. Francini, P. Scott, "The Effect of Dynamic and Cyclic Loading During Ducti*e Tearing on Circumferentially Cracked Pipe: Analytical Results," Fatigue, Flaw Evaluation and f.eak Before Break Assessments, ASME PVP-Vol. 280, pp 221 239,1994.

i 9

4-31 DRAFT NUREG-1661 i

l J

5. INSPECTION STRATEGWRELIABILITY AND ASSURANCE PROGRAM This chapter describes a statistical sampling method for identifying the number of welds (as well as other structural locations) to be inspected in a risk. informed inservice inspection progen. ' In this context, certain j terms typically used by statisticians should not be confused with those used elsewhere in this document. For example, the term " consumer risk," or risk, as used here, is not to be confused with the plant isk (CDF or LERF) used elsewhere. Plant risk focuses on assessing the changes to public risk resulting fnom replacing  !

existing ISI programs with the risk informed ISI programs; and assessing high and low safety significant j piping segments. Here the term risk refers to the probability of experiencing a detectable leak (versus a break) l in piping. Keeping this distinction in mind, this chaptcr describes one process for identifying the number of piping elements to be inspected in an RI-ISI program. This process incorporates reliability, confidence, and ,

the probability of detection (POD) of the inspection procedures to identify degradation prior to leak. The j method is based on a paper by Perdue (Ref. 5.1) and augmented by Dr. lee Abotmson ffrom tne NRC), j through the ASME-Research program on RI-ISI. For convenience, we will refer to this method as the Perdue. j Abramson method.

The Perdue-Abramson method was developed to address an NRC concern that licensees should pmvide 1 technical bases that reduction in the number of inspections of primary coolant piping (for the duration of the operating license) should not lead to an increase in the ticquency of leaks when compared to existing reactor operating experience. To pmvide this technical basis, the Perdue-Abramson trethod i: designed to ineet two goals. The first is to control, by inspection, the conditional leak frequency given the inspection results, and the second is to control the unconditional leak frequency. Both goals are based on a target leak frequency (as discussed in Section 2.7.3) and, in addition, the first goal is based on a prespecified confidence level. Each of the goals is supported by an analysis, anu both analyses are based on a potential inspection pbn. The first analysis calculates the probability that the conditionsi leak frequency, given an appropriate inspection sarnple, is less than the target leak frequency and compares this probability with the prespecified confidence level. The second analysis calculates the overall leak frequency and compares it with the prespecified target leak frequency, if either goal is not met, then the potential inspection plan is modified and the process is repeated until both goals are met. The requirement that both goals be met prosides a check and balance.

I The following sections:

• introduce the concept of statistical risk for quantifying the adequacy of an inspection pian.

• Describe a general method that can be used to cciculate risk for any reliability demonstration under the implicit assumption of perfect ability to detect a flaw if the flaw is in the sample drawn. q

= Inco:T, orate how to address less-than-perfect aSility to detect a flaw if the flaw is in the sample.

'The Perdue-Abramson method is valid for pipmg with low failure potetial, as defined m Section 2.7.2. It may not de valid for elements with high failure potential. For this reason, the decision matrix in Figure 2.8 consenauvdy inspects 100% of the susceptible elements or requires the use of an NRC approved owner inspection progree.

5-1 DRAFT NUREG-1t41 J

e .

5 Inspection Strtegy

• Describe the global analysis of the Perdue-Abramson method for calculating the number of inspections and monitoring adherence to leak frequency targets or goals.

5.1 The Concept of Statistical Risk Consider a hypothetical piping segment that consists of 8 potentially inspectable elements (welds) that have not be-n previously inspected. Assume funher that no risk-informed or other information is available so that, from the plant ISI team's perspective, the 8 elements are clones of each other. Assuming that we stay within the current Section XI rules, one-quarter (25%), or 2 of the 8 elements in this segment cr.n be randomly selected for inspection during an upcoming outage.

If we inspect the 2 elements, and no defects are found, what confidence do we have that the other elements within the segment also have no defects? The question is similar to asking what " risk" is attached to this panicular sampling plan. Risk is a concept from the field c,f statistical acceptance (or inspection) sampling that can be defined ns follows: Assume that one specifies that a minimum reliability level for a lot is X defects. In other words, a lot with X or fewer defects is considered " good" and a lot with more than X defects is considered " bad.' If a sample of two elements drawn from that lot is inspected and the whole lot isjudged to be " acceptable" if the sample contains no defects, then the risk is the probability that the lot will have more than the X permissible defects. Equivalently, risk is the probability that the inspection plan willlet a lot (consisting of the elements of interest) be accepted with an unacceptable number of defects. Acceptance samphng or rehabihty demonstration is concemed with developing plans that demonstrate specified levels of risk or, equivalently," confidence"(= 1 minus risk). To calculate risk, one needs to define:

• let size

. Sample see f

• Flaw or defect

• Acceptance number (i.e., maximum number of flaws found in the sample that will lead to acceptance of the lot)

+ Minimum reliability level, X, for a lot to be good a A priori probability that a lot contains an arbitrary number of defects.

The ASME Section XI provides definitions or guidance for all but the last two items. In panicular, the current code implies an accepisoce nunber of zero (more about this later). As for the minimum reliability level, it is useful as nn indication of the confidence associated with various Imtulated minimum reliability levels.

5.2 Calculation of Risk The minimum reliability level is determined by the maximum allowable failure rate, where " failure" is typically defined as a piping break. Inspection, however,is concemed with finding flaws before they tum into leaks and breaks and, hence, there is a need to translate the failure rate measure into an equivalent number of (codutiefined unacceptable) flaws. Information for a representative system may indicate, for example, that DRAFT NUREG 1661 5-2

5 Inspection Strategy only four out of every 100 repairable flaws can be expected to propagate to a leak and only 1 in 1000 of the latter to a rupture over a 40-year interval. Such information, which can be obtained from combined structural reliability and risk assessment models, and probabilistic encoding of engineering judgment, can be used to translate a target failure frequency into an equivalent number of flaws, or vice versa. In this discussion, the failure frequency will be replaced by the leak frequency, and the definition of a good pipe segment will be determined by the target leak frequency. That is, a good pipe segment is one in which the number of flaws implies a leak frequency that does not exceed the target leak frequency. For a given probability of a leak developing into a break, this criterion is equivalent to a criterion based on a target failure frequency.

For illustrative purposes only, returning to the simple hypothetical example of eight eternents in a piping segment, the following assumptions are made:

. The probability of a flaw exceeding 10% of the piping wall thickness in any one of the eight welds is 0.0065

. The conditional frequency that a flaw will grow to a leak is 3E-5/ year.

Given a probability of 0.0065 that any element will turn up Hawed, the binomialdistribution for N = 8 and p =

0.0065 can be used to calculate the probability that 0, I,2, . . Haws will exist in the lot of 8 prior to inspection.

This is illustrated in column 3 of Table 5.1 from the spreadsheet model (Ref. 5.1) where, for example, the probability of precisely zero Daws in the lot is 0.949, one Haw is 0.N97, and so on.

Column 2 of Table 5.1 contains the failure frequency for each number of flaws as calculated by fracture mechanics methods. Thus, given that each flaw has a 3E-5/yr chance of becoming a leak, then 2 such flaws have about a 6E-5/yr chance of producing a leak and so on.

Column 4 contains the cumulative counterpart of the binomial distribution in column 3. Thus, for example, the value of 0.999 in column 4 =0.949 + 0.N97 from column 3 and can be interpreted as the probability of observing one or fewer Daws - or, equivalently, the probability of a leak frecuency of 3E-05 or lower is 99.9%. This cumulative distribution is dubbed the pre-ISIconfidence curve. It indicates, for example, that there is a 99.9% chance of finding one or fewer flaws or, equivalently, that there is a 99.9% probability that the failure frequency would be no more than 3E-5/ year in the absence of inspection. This, of course, implies a 0.1% chance that the probability of a leak would be more than 3E-5/ year. This 0.1% is the risk in the absence of inspection.

Interpreted within the context of Bayes' theorem, the distribution in column 3 of Table 5.1 can be called the

" prior to inspection" distribution. Column 5 is called an " operating characteristic" or OC curve in acceptance sampling. For purposes of Bayesian reliability demonstration, however, it can be interpreted as a " likelihood" function because it shows the likelihood or probability of accepting the lot-giy.en e that the lot has the number of flaws indicated in column 1. Like any OC curve, this one is calculated by using the hypergeometric distribution, which is tabulated in (Ref. 5.2) and is also built into a number of software packages (e.g.,

EXCEL). Keep in mind that the specified acceptance number for this example is zero; that is, the lot will pass-5-3 DRAFT NUREG-1661

a, ,.

5 Inspection Strategy i only if zero flaws are found in the scmple of 2 elements. Thus, referring to the second row m column 5, for a lot size N = 8, sample size n = 2, number of defects in lot k = 1, the hypergeometric distribution can be used to calculate that the prct abi:ity of finding x = 0 flaws is 0.75. The analogous probability for k = 2 and x = 0 is 0.536 and so on. If the acceptance number had been, say, I flaw, then the calculations would use x=1 and proceed to find the probability of (1,k,2,S) for different values of k. If a different sample size. say 3, had been used, then the probability to look up (or compute) would have been (x,k,3,8).

Table 5.1 Evaluation of risk for N=8, n=2, and zero defect acceptance criterion.

1< '

'2 9 - -

~3 x

• 4- A @ .

• : 6 :: "W7 4 6 SWSh No. of a Conditional Binomial Pre-ISI OC curve Col. 3 x Post- ~ t PestISL$3 s

flaws (k) leak frequency probability of k confidence hypergeometric col. 5 inspection h~

so-m

~ m(i'--

in N leak /yr/ lot flaws in the lot (i.e., no ISI) distribution probability peakWihyM clements given a flaw (prob. of a flaw > probability of k n.p that k flaws yw.Wfouer2

>0.1 wall 0.1 thickness of k or fewer Probability that 0 a c in the lot g asws p thickness the piping wall = flaws in the lot flaws are in the given that fgN.Uint}

a:m ,.n 6.5E-3/ weld) sample of 2, none are in some esein shq a n conditional on k the sample asagie flaws in the lot (col. 6 / (kw wl (cmedesive m.,,w - w -

(0,k 2,8) sum col.6) sesmascoL7) 20MW 0 0 0.949 0.949 1_ 0.949 0.962 Me.9d2'T I 0.00003 0.0497 0.999 _ ,

0.750 0.0373 0.0377 NC&999Y 2 0.00006 0 00114 1.(XX) 0.536 0.00061 0.00062 M13llC 3 0.00(X)9 0.00001 1.(XXXX) 0.357 5.3E-06 5.4 E-06 %3A00b 4 0.00012 0.0(XXX) 1.00000 0.214 2.6E-08 2.6E-08 W1A00E 5 0.00015 OlKKXX) 1.00000 0.107 6.8E-11 6.9F-i l 6 91.000 M Col Total 1.00000 l 0 987 WN&

Key: N = Lot (population) size (8) n = Sample size (2) k = Number of defects in lot (1-8) x = Number of defects in sample (0)

Given the prior and the likelihood function, the next step in the application of Bayes' theorem is to simply multiply the two columns (i.e., column 3 times columo 5) to get column 6. The latter column is not itself a proper probability distribution because it does not sum to unity. This is corrected by summing column 6 snd then dividing each of its elements by the column sum to get the " post-inspection"' probability distribution in column 7. The cumulative counterpart of the latter distribution, called here the " post-ISI corfidence" distribution is column 8.

DRAIT NUREG-1661 5-4

5 Inspection Strategy To examine the effect of the target leak frequency goal, assume that the minimum reliability level is associated with a maximum leak frequency of 1E.5 per year for the lot (not per element but rather for all 8 elements that rnake up the lot). Thus, from column 2, the first (and only) entry that is less than or equal to IE-06 is "O," 1 which is associated with k 0 in column 1. Assume further (for the moment) that if a flaw appears in the sample, the inspectors will see it. Column 8 of Table 5.1 indicates that if the sample passes the inspection (i.e., )

ii no deiects are iound), then we have 96.2% confidence that the reliability is no worse than the maximum allowable failure /rcourney o/ /E-6/vear. Equivalently, the risk probability associated with this inspection plan is 1 - 0362 = 0.038 or 3.8 % Once a specified level of " risk" is defined, different inspection strategies )

I can be evaluated by the above method until one is found that meets the goal.

5.3 Correction for Imperfect Detection The OC curve in column 5 of Table 5.1 implicitly assumes that the nondestructive evaluation NDE techniques l used to find flaws are perfectly accurate -i.e., if a flaw ends up in the sample, then it will be detected and properly sized. The OC curve can be corrected to reflect any hypothesized or real NDE level of accuracy (usually expressed as the probability of detection).

Figure 51 illustrates the logic for an imperfect detection process where it is assumed that one flaw exists in a lot. The outcome of a sampling process could:

1. Detect the flaw if it is in the sample, and reject the lot,

2. Not detect the flaw even if it is in the sample (due to the inaccuracy of the detection process), and accept the lot, or

3. Accept the lot because the flaw was not in the sample selected for inspection.

It is rssumed that there are no false detections,i.e., NDE never calls an item defective when it is not.

Only for the case where the flaw was within the sample and detected, would the lot be rejected. The lot would be accepted if the flaw was in the sample and not detected or if the flaw was not in the inspection sample.

Thus, the probability of detection can have an important role in the analysis and needs to be addressed in the analysis.

5-5 DRAFT NUREG-1661

5 Inspection Stretegy Detect Flaw Reject Lot a-1 Fiswin Sampic N _ 2 Do Not Detect Flaw " Accept Lot -

g ggg No Fisw in Sampic Accept 14 m 4 Figure 5.1 Single-sample plan logic.

For div.trative purposes, assume the probability of detecting a flaw if it is in the sample is 0.65. Referring to Figure 5.1, the probability of accepting a lot, given that one flaw exists in the lot, is the sum of all the path probabilities that lead to an " accept lot" outcome. In this example, there are two possible paths for accepting the lot; the first involves not catching the lot flaw in the sample, and the probability of that happening is calculated from the hypergeometric distribution as HYPGEOMDIST (0,2,1,8), which signifies the probability of getting 0 flaws in a sample of 2, given that I flaw exists in a lot of 8. The second path involves catching the lot flaw in the sample but not detecting it, and the probability of this event is HYPGEOMDIST (1,2,1,8) x (1 --

0.65), where the second term is (1 - probability of detection) the probability that the flaw will not be detected by the inspection technique. The probability of accepting the lot is then the sum over these two paths, HYPGEOMDIST(0,2,1,8) + HYPGEOMDIST(1,2,1,8) x (1 - 0.65)

Note that in practice, the probability of detection depends on both the rnechanical detection technique as well as the capability of the person performing the inspection.

The existing Section XI of the ASME Code allows for a double sampling plan. An example of a double sampling plan is as follows: Take a sample of I and accept the lot if no flaw is found in that sample.

Otherwise, take another sample of I and reject the lot if a flaw is found and accept the lot if no flaw is found.

In general, if a flaw is detected in the first sample, then take another sample of equal size. If a flaw is found in the second sample, then reject the entire lot. The logic for this plan is illustrated in Figure 5.2.

DRAFT NUREG-1661 5-6

5 Inspection Strategy I Detect Fisw Flowin g RebetIst ;

2nd Sample ./. T g,s.cg yg, N Dea'tDetectFiswm, AcceptLet; Flowis -

w  % ,

\ No Flawin 2nd Saug's ,, AcceptLet;

== 1 Dee'sDetectFisw ,, AcceptIst j 1

oFisw.in1stSemple ,, AcceptIet ;

- 7 Figure 5.2 Double-sampling plan logic.

Iet us calculate the probability of accepting the lot for this example. The application of the hy distribution function takes on the following representation for 2 flaws in a lot with an initial sam

! HYPGEOMDIST(0,1,2,8) + HYPGEOMDIST(1,1,2,8) x (1 - 0.65)

+ HYPGEOMDIST(1,1,2,8) x 0.65 x HYPGEOMDIST(0,1,2 - 1,8- 1)

+ HYPGEOMDIST(1,1,2,8) x 0.65 x HYPGEOMDIST(1,1,2 - 1,8 - 1) x (1 - 0.65)

The results of the above hypothetical example are listed in Table 5.2. Either a single or a do plan can be used in the risk analysis.

5.4 The Global Analysis The following discussion presents the global analysis of the Perdue-Abramson method for c number ofinspections and for trnnitoring adherence to the leak frequency targets or goals. "

ensures that a prespecified target leak frequency is not exceeded for a given high safety- significant/ low failure-potential piping segment. In this section, the target leak frequency is specified in terms of th frequency in Figure 5.3. of leaks per year per weld. The analysis consists of the following steps, as shown in t 1.

Calculate the leak frequency for the given segment without inspection.

2.

If the calculated leak frequency does not exceed the target leak frequency, then no inspectio necessaty, except for one weld to satisfy the defense-in-depth consideration.

3.

If the calculated leak frequency exceeds the target leak frequency, then some inspec Specify an inspection plan and recalculate tne leak frequency.

5-7 DRAFTNUREG-1661

1 i

~

w Bkes LEax l

^

t i e )i s" r s N - '0 0 0 p4 n 0tyf 0' 9*

l 7 9 4 'u 3Me*Q{

t it 3 9 0 0 0 0 0 00 klie 9 9. 10. l. . .

1 eg D a r 'l' bw 1 1 l 0 0 - g-nObA *

• i S P( or rP o.N ]y L s f

o A) c fo wa 2 9 C 0 0 00n n 1 yl f y - =it 6 9 (

t 3 l

sDie r 9 9 0 0 0 O 1 1 1 i

l leOaNw 0 0 1 i ~

gF bf e b inI ror a S P e b

o i k

,3 o a n r )f ~

p 9 99 00 00 00 00 5

)

2 3

Q[l2 he=Ci{

cl ie(ea pD b i.

6 yf l cJ t

4 9 9 01 1 0l 0 01 6 b o

r e i 0 0 0 w eOh7

= o D"

sF nre p

~

D 1 O )

nyf 1 0 5 5 R 0 P(

I S itoti0l t 9 7 9 0 0 -

1 4

1 I

cN1 oc 4 9

4 1

0 E E E t 1 ts 4 3 7 6 c 1 op e 4l omu 0 0 0

R 1 f

e P sn 4s, c 0 1 r ( i , s e ~

p o. 5 5 8 i

m l o

c 9 7 9 0 0- 0 -

01 0

0 4 4 E E E 0 d o x 9 0 10 0 3 7 6 1 n t 3 O O 0 1 8 1 a l o

C l(

)

1

= t s)

D eI v

2

= 5 0 8 O

r .

ue e I 2

9 5

8 1

7 W cb lp l I 9

P

( Cum 0 0 O 0 o

t Od( as c

e f f i

r e le h eI= o. e w 9 5 0 0 O 0 e l 4 9 0 0 I 0

p R b pcl u

o ma por b fem 9 9 0 0 R I

0 I

Ds atemporn r 0 0 1 f o a

<ik f

m nymo t 7 2 I O n 0 0

e - it oh s ) 9 9 1 0 0 K m 0 r t s cN/6 4 4 1

0 0 X 0 0 o 9 r 0 O 0 Ptbs a o e 6.lo 7 0 0 0 e ol c 0 0 0 0 0 0 1 h nr o i pc T (

'se x 9 4

7 9

2 1

1 1

0 0

0 0

0 0

0 0

y 6

3

.5 9 0 4

0 0 0

0 0 0 a l lo oc 0 0 0 0 0 1 B C 0 0 g

n e vr 5 5 9 9 i

s 8 5 0 4 u 5 u c

1 1 9 9 9 R 0 0 0 0 ks C i

O r .

. fo r f e. ye o ) t s ws 9 4 9 0 0 0 0 9 99 00 00 000 0 i( I n . 4 SI oa Mf I Si ew a I .

1 1 0 n e- nb of rl 0 0 I 1 1 taio P

r mk p

l ut c a te f o 8 v e  ! 4 1 0 n 0 Ed initys a

w of 9 4 97 1 1

0 0 n 0 0 0 o 0 9 40 00 0 00 0n 0o t

r! a o 0 3

aNl B o af bk a l

n 0 0 0 O 0 0 1 r i p

2 5 dl t

o C M 3 N w

2 5 1 t e e/ M 0 n i yr K n o t

l 0

• 0 b 2 lp/ r O

t O O 0 c a mka 0 0 0 0 o T ie l f

. g

) 2 ) 4 $ ol ,

I o.

os( swL 0 1 Cu i

Nf he

t. l oW>b z:CMm9 8~

Illl t!'\Ii;ljllt/'

5 Inspection Strategy

, - an;

. . :.:- n;sy l~ NOINSPECTION iSYSTEM ?

YES NEEDED TO -

MEETTARGETc (OTREE TE4N FORDEFENCE NY 1NDEPM)

, 1 OF; i

.AIZAK.W/O FREQUENCY,&j) '~

INSPECTION? gg 1 (

,q .c;v.

'r '4 ,y ., ' ,

+  : iINSPECTION

. PLANJ' .'4 u YES IMPLEMENT A INSPECTION LEAKR1'IE M pm NO l l Figure 5.3 Gid J method analysis.

l l

1 Il

4. If the recMeulated leak frequency is less than the target leak frequency, then implement the inspection plan.

1

5. If the recalculated leak frequency exceeds the target feak frequency, then a more stringent inspection plan is necessary. Modify the inspection plan in step 3 and recalculate the leak frequency.

6. Repeat steps 4 and 5 until the inspection plan results in a leak frequency that is less than the tuget leak frequency.

Ensuring the Goal by the Global Analysis  :

The goal of the inspection strategy is to ensure a maximum acceptable leak frequency per year per weld in a

, segment consisting of N welds. For most cases of interest, this leak frequency is sufficiently small that the 5-9 . DRAFT NUREG-1661

.. ,=

5 Inspection Strategy ,

chance of more than one leak in the segment in a year is negligible. Therefore, it is assumed that at most one leak will occar, (The methodology can be extenhd if this assumption is not valid.) Accordingly, the leak frequency for the segment of N welds is numerically equal to the probability per year that one of the welds will develop a ler.k. Denote the target leak frequency per year per weld by r Then the target leak frequency for the segment is Nr. per year. Equivalently, the target frequency of a leak in the segment is Nr. per year.

The purpose of inspection is to ensure that the target leak frequency r, car Nr. is not exceeded. The inspections considered here attempt to identify flaws which, if not repaired, have the potential to develop into leaks. For any given segrnent, its leak frequency depends on the initial distribution of flaws, the number of flaws remaining after inspection, and the probability that a flaw will develop a leak.

In the discussion below, it is assumed that all welds in the segment have the same probability of (1) having a flaw, and (2) having the flaw result in a leak. We will then show how the analysis can be generalized to the case where these probabilities are not constant.

First. consider the case where no inspection is performed. In order to calculate the leak frequency for the segment without inspection. let p = Prob (a weld has a flaw) q = Prob (a flaw will develop a leak in a 12-month period)

Then the frequency per year that any given weld will develop a leak is pg. The leak frequency for the segment is the probability per year that one of the welds in the segment will leak and is equal to Npg. Comparing this with the target of Nr o, we conclude that:

If pq s r . ono inspection is necessary to meet the target goal.

If pq > r .oinspection is necessary to meet the target goal.

If inspection is necessary, then the leak frequency will depend on the initial distribution of flaws, the probability that one or more flaws will escape detection, and the probability that a flaw will develop a leak.

Let k be the number of flaws in the segment. Then 4 has a binomial distribution with parameters N and p.

Let:

Pmb(k) = Prob {k flawsin the segment)

Conditional on & and nn any inspection strategy S, let G3(k) = Prob (no flaws are detected Ik, S }

Denote the leak frequency for the segment by R. It is assumed that if a flaw is detected, the entire segment is DRAIT NUREG-1661 5-10

n ,,

5 Inspection Strategy inspected and repaired so that no leak will occur. Thtrefore, R is the probability that no flaws are detected and ihrt one of the flaws develops a leak. To calculate R, we panition on the number of flaws in the segment.

This results in the following formula:

R = Prob (one leak in the segment)

=f Prob (k) G,(k) Prob (leakik) 4o N f

-[ p ' (1 -p)"'* G,(A) kg i s.o r k, q(Np(1 -p)"~ 8G,(1)+N(N-1)p2 (j _p)u-2G3 (2)+...]

(5-1)

As an example, consider a seFment with N = 8 welds and p = 0.0065. let S = (inspect 2 out of 8 welds and accept the lot if no flaws are found in the sample of 2). Then Prob ( A) and Gs(A) are given by the hinomial and hypergeometric distributions, respective!,, .

A Prob ( A) G3 (k) 0 0.949 1.

1 0.(M97 0.750 2 0.00114 0.536 3 0.0(X)01 0.357 Substitution into Equation 1 yields:

R = 0.0385 q (5-2)

This must be compared with the maximum acceptable leak frequency oNr = Br, Accordingly, the inspection scheme S meets the target provided q s; 207.8 ro (5-3)

As an example, assume that the target leak frequency for the segment is the same IE-06 per year assumed in 5-11 DRAFT NUREG-1661

., .- 'I 5 Inspection Strategy Sec' ion 5.2. Because there are 8 welds in the segment. this corresponds to a target leak frequency per weld of 1.25E-07. From Equation 5-3, this means that q must be less than or equal to 2.6E-05 in order to nut the goal.

Generalization of the Global Analysis in many cases, the probability of a flaw and the probability that a flaw will result in a leak may differ from weld to weld, if there are N welds in a segment,let p, = Prob (weld i has an unacceptable flaw) q, = Prob (weld i will result in a leak, given that weld i has an unacceptable flaw) for i = i, 2, ... , N.

If no inspection is performed, the leak frequency for the segment is:

N R=[p,q, o

61 Comparing this with the target of Nr o, we conclude that:

If R, s Nr , noo inspection is necessary to meet the leak frequency target.

If R, > Nr , inspection o is necessary to meet the leak frequency target.

If inspection is necessary, set p = max { p,, p,, . . , py) and q' = (max q,, q2, ... qu). A conservative approach is to assume that all welds have the same probability, p , of having an unacceptable flaw and the same probability. q', that the flaw will result in a leak. Equation I can then be used to calculate an upper bound, R* , on the leak frequency by replacing p by p* and q by q' . R* can then be compared with Nr . If R*

s Nr then the inspection strategy S meets the target. Otherwise, a more stringent inspection strategy is needed to meet the target.

5.5 Discussion The Perdue-Abramson method for developing the inspection strategy presented here requires that both the risk and global analyses be performed. This is to ensure that both the conditional leak frequency and the unconditional leak frequency targets are met. It is possible that only one of these targets will be met. For example, suppose that the prespecified confidence level associated with the first target is 95%. Referring to the first row of Table 5.1, we see that we have 96.2% confidence that the conditional leak frequency is 0. It follows that any conditional target leak frequency will be met, regardless of the value of q, the probability that DRAFT NUREG-1661 5-12

~ 5 - Inspection Strategy a flaw will develop a leak in a '12-month period. Hence, if q is sufficiently large, the second goal will not be -

met, while the first goal will always be met.' This example illustrates a shortcoming of the risk analysis and demonstrates why the global analysis is also required.

The assumptions on which Table 5.1 is based provide an example to show that the first but not the second goal can be met. Column 2 assumes that q = 3E-05. However, the example in Section 5.4, which assumes the same parameter values as does Table 5.1, requires that q s 2.6E-06. Thus,if g = 3E-05, the first but not the second goal will be met.

In addition to satisfying different goals, the risk and global analyses are fundamentally different. The global analysis satisfies its goal with a confidence level of either 100% or 0%, depending on whether the unconditional target leak frequency goalis met. This pass / fail situation may or may not be desirable, dependiag upon the user's point of view.

5-13. DRAFT NUREG-1661.

5 Inspxtion Strategy REFERENCES FOR CHAPTER 5 5.1 ' R.K. Perdue, "A Spreadsheet Model for the Evaluation of Statistical Confidence in Nuclear Inservice Inspection Plans," attached to letter to Jack Guttmann, USNRC, from R.K. Perdue, Westinghouse, February 10,1998.

$.2 GJ. Lieberman and D.B. Owen, Tables of the Hypergeometric Probability Distribution, Stanford University Press, Stanford, CA,1961.

I DRAFT NUREG-1661 5-14

s ,.

6. DEVELOPMENT OF A RISK-INFORMED INSPECTION PROGRAM The development of an improved inservice inspection plan using risk-informed techniques can be viewed as a two-step process:

= Step 1: Select - Apply risk-informed methods to select the structural elements or locations that will be inspected. The goal of this process is to ensure that the piping locations selected are those with higher failure probabilities and with greater impacts on plant safety. When thoroughly applied, it will include locations or components that were not anticipated to be problems, but which have since been identified as such through operating experience. There should also be a selected sample of other locations at which failures are not anticipated, which are selected for purposes of defense-in-depth against unanticipated degradation mechanisms. Step 1 is the main focus of the present report and of Regulatory Guide 1.178.

• Step 2: Inspect - Design inspection plans for the selected locations that ensure that the nondestructive examination methods and inspection frequencies provide the desired levels of detection of degradation and reduction of failure probabilities. Step 2 is not addressed in detail by Regulatory Guide 1.178.

Inspection methods and procedures r.re covered by other regulatory documents and by industry codes and standards, which may the subject of future improvements in based on risk-informed evaluations.

Methodologies for selecting locations for inspection (Step 1) have been described in considerable detail by Chapters 2-5. The present chapter focuses on the effectiveness of the inspection process itself (Step 2). The chapter begins in Section 6.1 with a brief review of the Step i selection process, but then turns in Section 6.2 to the elements of the inspection process (Step 2). Section 6.3 through 6.6 describe how probabilistic structural mechanics calculations can be applied in Step 2 to quantify the effectiveness of a proposed ,

inspection strategy. These calculations relate the effectiveness of the ISI to the expected reductions in i component failure probabilities. Section 6.7 addresses the reliability of NDE methods as characterized by j pmbability-of-detection curves for flaws in piping components. Section 6.8 discusses the option of using j alternative strategies to reduce the component failure probabilities for those cases that ISI are known to be l ineffective in detecting the degradation mechanisms of concern.

6.I Step 1: Select The selection of structural elements for inspection (sampling strategy) is best guided by the calculations of risk l categorization outlined in Chapters 2-5. Because there can be unanticipated generic failure mechanisms that have not yet occurred or been detected, consideration of defense-in-depth for lower risk components is also appropriate. When such degradation is detected, the sample should be immediately expanded through a sequential sampling strategy based on feedback from the ISI findings.

At a minimum, an adequate sample size should include a sufficient sample of representative locations within I each piping system to permit the detection of degradation mechanisms that may be operating within the system. These locations should, in part, corr pond to locationsfor which the probability ofdegradation is considered greatest independent of the calculated risk importance measures.

6-1 DRAFI' NUREG-1661

,, e l 6 Inspection Program Developmcat The structural elements (or locations to be inspected) si.ould be defined so that the volume of metal to be inspected includes the critical locations where degradation is most likely to occur. These elements will be the ,

basis for the " examination volumes" to be inspected through NDE procedures. In many cases, the structural elements should include base metal locations well removed from welds and heat-affect-zones to ensure that the NDE inspects locations of stress concentrations, such as weld counter bores. A checklist of degradation mechanisms ca1 help in selecting locations and in designing an inspection plan. Table 6.1 lists such ,

mechanisms, susceptible materials, and causes of degradation for piping systems.

{

I Table 6.1 Check list of degradation mechanisms for inspection of piping systems.

Degradation Susceptible Materials Susceptible Locations Contributing Causes Mechanism - a low cycle fatiFue All materials Terminal ends Operating transients Dissimilar metal welds High thermal expansion stresses Near snubbers Stress concentrations Near component nozzles Snubber failures Fittings Construction defects Therral fatigue All materials Mixing of hot and cold fluids Valve leakage Hot or cold water injection "ILermal stratification Valves (downstream from icakage) Relief valve cycling Feedwater nozzles Counterbores Horizontallines Vibratory fattFue All materials Small diameter piping (9 < 2-inch) Rotating equipment Terminal ends i

Socket weld-inte granular stress Stainless steels Welds Elevated temperatures corrosion crackirq Heas :afected zones High coolant conductivity Sensitized base metal materials High carbon grades of SS BWR piping Elevated oxygen levels PWR piping (CVCS systems) Residual stresses )

Cold springing stresses Stagnant fluids Transgranular stress Stainless steels Bolting High or low cr.rbon materials icmrosion cracking Irtn-nickel-chromium High oxygen alloys High welding stresses Severe cold working Presence of chlorides or sulfates Brackish environment Insulation materials with chlorides I

Crevice corrosion Stainless steels cracking iron nickel-chromium alloys DRAFT NIiP5G 1661 62

9 ,,

6 Inspection Program Development Table 6.1 Check list of degradation mechanisnes for inspection of piping systems.

Degradation Susceptilde Materials Suxeptilde locations Contributing Causes Mechanism _

Primary water stress Iron-nickel-chromium corrosion cracking alloys intergranular attack Iron-nickel-chromium alloys Flow-accelerated Femtic steels Elbows Wet steam corrosion Reducers Single phase (water) flow (erosion-corrosion) Tee fittings low alloy content low oxygen liigh Ph High fluw velocities Slurry c' non All materials Raw water systems Sand or solids in raw water Cavitation wastage All matenals Pumps and valves Phase change liighly localized areas Droplets Microbiologically All materials Buned piping (external surfaces) Exposure to organic matenals influenced corrosia. Other piping (intemal Surfaces) Exposure to raw water (MIC) Welds Lack of coatings Fittings Lack of cathodic protection lleat-affected zones Crevices General corrosion Femtic stects Secondary systems Galvanic / electrolytic corrosion Austeniuc steels Service water systems Crevice corrosion (occasionally) Dissimilar materials (galvanic Acid attack effects) Raw water Salt water corrosion Brackish water corrosion Boric acid corrosion Femtic materials Primary systems 1xak of boric acid solutions Pvting Femtic materials PWR feedwater nozzles leakage at thermal sleeves / joints Structural damage All Materials Sm:11 diameter piping Water Hammer Compression fittings impact Crushing Over Pressure Maintenance errors i

L 6-3 DRAFT NUREG-1661 m________.

6 incpection Program Development 6.2 Step 2: Inspect Having, in Step 1, selected the piping locations to be inspected, Step 2 addresses details of how and when to perform these inspections.

6.2.1 Objective The inspection plan must ensure that the sample size, frequency of inspection, and probability of detection will be effective in reducing the probability of component failures and in providing a level of detection that allows degraded components to be repaired before structural integrity is affected. Since several potential inspection strategies could provide the desired objectives, the final selection by licensees can be based on other important considerations, such as cost effectiveness and man-rem exposures to inspection personnel.

The risk-informed inspection concept requires that the reliability of the NDE method for the selected locations be established in order tojustify a panicular inspection strates y. Probabilistic fracture mechanics calculations based on materials, environments, loads, and degradation mechanisms can be applied to establish the required probability of flaw detection, the flaw sizing accuracy, and the frequency of inspection sieeded to meet targets for component failure probabilities. (See Chapters 2 and 5.)

Tab'e 6.2 lists the basic elements of an inspection strategy for piping systems. The elements of this strategy are discussed in the following paragraphs.

6.2.2 Time ofInspection A risk-informed program will establish inspection intervals that ensure the timely detection of degradation, and will maintain component failure probabilities at appropriate levels. These intervals must be sufficiently shon so that degradation too small to be detected during one inspection does not grow to an unacceptable size before the next inspection is performed.

Some inspection techniques (e.g., acoustic emission monitoring) are performed on a continuous rather than a periodic basis. In other cases, the streegy may 6equire inspections only after the occurrence of an unanticipated or a significant loading event, such as a severe thermal shock or a water hammer. Some inspections may be performed on a o.ie-time basis, as for example, to verify that a degradation mechanism experienced at a similar plant is not occurring at the plant of concern, or to suppon continued plant operation, such as part of a license renewal process.

6.2.3 Inspection Methods The inspection methods should address the degradation mechanisms, piping sites, and materials of concem.

The inspection method includes the basic technique itself (e.g., ultrasonics) along with the panicular equiptnent and the procedures to be urd o detect and size flaws. Appropriate inspection techniques for DRAFT NUREG-1661 6-4

s ,

6 Inspection Program Development Table 6.2 Inspection strategy table.

Inspection Time of NDE locations Development of Sampung Strategy Delivery Method Methods Inspection Qualification NDE Methods VT.I 10 Year, Personnel Welds Customization 100% TV Cameras Cracking / visual Suisaces quahfict.: ion Bolts New Vanous Divers technigun options VT.3 Refuehng Performance Flexures from of 1,2. & 3 below Submannes Gross 12 - 24 months demonstration scratch damage / Surfaces / No Remove tools surfaces Contmuous thstoncal interfaces None sequential data stra*egy in situ Remote / Support ennanced Ucense systems Whatever Removed visual renewal is froen Dowel accessible vessel Ultrawnic After pins testmg signii. cant event Unspecified No inspection Hased on Known Murutoring performance degradation neutron goal none objectives I) Initial size parts 2) Sequential rule Remote rephcation 3) Choice of samphng Mechanical location /

measurements period Metallurgical examinauon I 1

l l i

piping include ultrasonic testing, surface examinations with dye penetrants (or magnetic particles), visual l examinations, and radiography. In a larger context, alternative rrethods such as leak detection and thermal (

transient and acoustic emission monitoring can supplement or replace nondestructive testing methods. j l

l Detailed aspects of equiprnent, procedures, and personnel qualifications are significant factors that govem the reliability of the inspections. Application of the risk-informed inspection concept requires that the reliability of the inspection method be established in order tojustify the selection of a particular inspectica strategy.

6.2.4 NDE Qualification A risk-informed inspection program should have a sound technical basis for estimating the reliability of the proposed NDE methods. Data from industry programs for NDE perf ormance demonstrations can provide such a basis. Generic data from studies of NDE reliability can also be useful. In this regard, there have been continuing rescuch effons on a national and intemational level to develop data to better characterize the reliability of NDE methods for detecting and sizing representative service-type defects (cracks). Such effont I' 6-5 DRAFT NUREG-1661 i

U _ - _ _ _ _ - _ _ _ _ _ _ _ _ _ _ _

o  ?

6 Inspection Program Development have included a number of round-robin studies to determine the reliability of NDE as practiced in the nuclear power industry. In many cases results of these programs have caused the industry to take actions to improve NDE reliability.

Table 6.3 lists some of the studies that have provided information on the probabilities of detection for flaws in ruclear piping . nd other components (Ref. 6.1). These studies cover a range of components, inspection methods, and damage mechanisms. Early findings showed a relatively low level of NDE reliability, even though the inspection methods were often consistent with the minimum standards of existing codes as publhhed by such organizations as the American Society of Nondestructive Testing (ASNT) and the ASME.

Subsequent efforts have produced changes in codes and standards to improve the reliability of the NDE performed at nuclea.t power plants.

The approach in NDE reliability studies has been to use specimens with representative service-type defects (i.e.,rracks) for traimng ind for demonstrations of capability. The round-robin data have shown large team-to-team variations in the detection and sizing of flaws. As shortcomings have been noted, the nuclear industy has responded with steps to strengthen mmimum requirements, such as those in the ASME Code, to improve the inspections of reactor pressure vessels and piping systems. It has been found that the reliability of any given inspection is deperdent on the specific qualifications and skill levels of the inspection personnel. As a result, the reliability of NDH cm be enhanced by using on y inspection teams that meet performance-based codes and wtandards, and who use methods and procedures with proven capabilities.

6.2.S Development of NDE Methods l One element of the inspection strategy table (as shown by Table 6.2) includes the development of new and l improved NDE methods to achieve enhanced levels of NDE reliability. In some cases, enhanced NDE may be required to achieve the goals of the risk-informed inspection program identified in Chapter 5 ard Section 2.8 (e.g.. frequency ofa leuk </E-06 per weld-year). However, in most cases special development efforts will not be needed, since existing NDE methods can be utilized. In this regard, such activities as the industry-funded Performance Demonstration Initiative (PDI) can be considered an appropriate development effort, since it serves to enhance NDE reliability.

6.2.6 Sampling Strategy In the context of this document, the sampling strategy is defined by the selection of an appropriate number of i structural elements as described in Chapters 2 and 5. Expansion of the sample sir-(i.e., through sequential sampling) is addressed in the implementation of risk-informed inspection through feedback of ISI findings and other information on structural degradation gained from operating experience. Such irformation can affect the estimates of component failure probabilities, and may necessitate changes to the ISI programs.

6.2.7 Delivery Method The effectiveness of an ISI strategy can be enhanced by methods that provide better access to the selected hications. Improved access and the use of remote systems can also provide benefits in terms of reduced radiation exposures to the personnel.

DRAFI'NUREG-1661 6-6

)j i! l

. O t  :

n . 6 e

n -

6 1

p "

o R 2 3 4 $ 6 7 $ 8 9 10 G l

e 6 6 6 6 6 6 6 6 6 6 E

v R e g sy t

u U D

h d e v N l

e e s a m r- n b.

s a f o ma a

&n e s ee m r w s vs s oe g

m d et ir e s n is r u n m

a le b u g i

n r

w s

n p y

e wt e u e a m

d. u u i s n d n e s i o T r i se m is o n

d e awl u y A l

tr s

n p g n twet o ic a vi tcd e

F g ah e d re w q a s d n e n y os r a e s. yoro A o e Mt m. o o d o d e ns o ma m iol t

w se d- m w J. n n R r a d g h s a e e r c n n u ro t J.

c i e P i t

m e

lad me o

o g

d n m t

t ro de h t.s w_ nmerd g s

e it te a d le e

of s s te e r e t re ac m D

+a n M g us y a 9 f

f ta r w s w ro R. ala d .

e s o t u

n n les in y d or D e, t

s a nlf m

la e oc f g d n

n gn o 6 n . f fe um i

u s u i t

c e, s a 0 w t s

w b

e a ts ra Os e P n o

mgoe,f s g e ty a h m so d s e T ty is ti ht u

de ta e na e hs a le p h n ( a y e d t Ne m _h w pgn ht s

a E la n p ~

v e o r --, osr ta s i s.. s s ec tp am h v n b g e s a y a rlas y y n ne ty t h dnli i hee ta n he al i

d , n mte a n an

. f re a a w lemn a m a

d w r d ei t

s

. d ed b . a y c t t s c f d I R b e ir pth e1 b e t c e a fo a e n ca e .e d g r o mc r

o ni e s o y r

. ev t

n a a s hve le e r e h d t i nNa ertec o n ro f

ime v eb 6 e a r c foC 1

s, d t

e e ey w t ss @

c ksu abp s e e c uh r b nd e h te g

y ef fe r

a taf a nw oi n n g

a de 2

s m

a m s.

n c e a an u h y t

d mn tS m e o m s a e f oe le t n e o r ta a ry s hty mh a v v de i kra de ic e o tu haP t c  : ec hh. g N i ni a tw iy t p rt s e e a y N a or s mre e

n a ta m a l t

y ru ta e wip i dn w er s te g

e e ec l m f D c4 r u s s r Ftupg te ne A se se e se f p e y ra r l

n r a e oh le f e h e D aN q =

e m

f E c a

Vb E s a

Opt m e N c e R o r M= Bt a o

c s r n a r r r o e k ka g a e

w e n ra e

a e lec a t ie e- mo e

ht -

n n i l twid d

w)T taon labRo tm c

u t u ig gr n c

o l

r N e r n N e o en mD N c te o f e ula ky l

N.

d e wf S n = n n lu c n t' , D 5 iv N. d S n $ S. S no w n 5 re Atra p _

e

-n s U ou g

n " e (

o 1 U U O hg sd _

a C, no m

o f

c ra s eh n s s

v eem s y ls e

s a U r Ig o se aR r o

r o f ta e a i k n r v te r o e lmp e _

g ar n u e ta lin R T f m au f i n

f f aue n u f n _

. c en irgrmD r m y r i p h yl i r y y ur c a D t y

n yi p anu n LE w d n eaC o sm wu eP n

s a n k.

r e

n w n

a p rg e d s

a r

o s

p a f vO na g y O na l i

C ro w a - l ia e s a d "l p y . t r r r n s a n h n fnh c mm h nn m e ev n n m e o o twn e r o r r I t o o ip o n

c o nw e I

r an o c s o a

a i r

Asas rc a

e b

a b

a s a h a - o agve r

e r

a a s i

c a u.nudna r e aD r

f o poe mh i re lu tuD t m

s e

L L s m

t t

f mmr ta e

s L s t

m i

ig o p

- ur er o g t

a t m u - u a u pe s t

s o :~.mir wl l

c R s ss R e n r

won a os md Lr et e n e e e pf e wo e h a gna . E o oR a e . o r e w- w r g E o

). o r

e u

Gt e

u s k l

R

. e ma r n v )s o w nCa

. ytwo w ht C h C tr htr C ro

.C w h C t

- ec c c Ntnen Cn o le e D. .

O e lc c o o ry o y P(

o we y r e P %w my r P N wu u d o ps rm l

u i rn R i

P( n a m s t

- s c N no N o N o 1 -

e F riec lae ec u e z

Nic ead c ,

n e t 1 gN rm ic lau e re I o i el a ela 1 l I r h s op p r -

p c e y d g f lu n fi gu re u gu C . t f k e w C C as tc c 7-c g afAl i

cg f S ur oo S u$ l si m ic g u a e o e c c a e S le a e a a o t P EC t

P o

C F.

re pU RK P RR l

F PR a e a e PR PR P C_ F t

I PR t oe

• c h 6

n '

o l

i y t b . e. .

g c s c a n n s e.

e p a n la c

s n. d g e n

f e n e e m g a

m t

a r

e s

s e u uh a

u, s s o o s es e g .n e s.

a hto s e ds c k s r e r n in a d. n d e n s a e gi mt c n r

o o d.g kc w g un l o

i h c J.

mc e f m g s c

s c

m ak m la a h r e k d e l d l

e m s s e n r c a e

r p c s n he s r

e f

o M.

J ne J, la rme c mld i d s d e

g m

e ws n

s g

m ht e n t o a t

ig ec t n

r

_ e a g. . c e

"- sp e f o wy w lc k r r k n g is r n i c a o e s a

E a

_ c ela

. u c n a o e

rn a r c

a l u lu a

a r am wk nu n te ls.

gdd nf e f s

D e i c m g.

en-. .u c n g n g o a n g se f a kn e i

me nh t e a ra ni g .r m c r g h n mne fos s N s' s s s i u rk g m w g i u k kc w gk a t hc ra i wp- o r g r rn a te c g

tsc s e H uc e t m

Nd i L. .a d s re ip Wr a a i

te m u dn r a p i

f e s a r d t a ta r t m r C an r

Si n m . n n r r o

t Ci s f ic I c F P a c Cmty C s 4 i

e

, s  ;

d .

s

. ite c

u . c mhs s e e n t

s c

a _m nw s

y g C. r g s,B e a r es i

t e n

s e

lp1 a

4 d r o o hs o

de st l

nu n n h f ts s n lAlu i

M. a e e n.

b mr tm R. .e n i

a 6 g5 e g k

T ey l _

mE es M.

E( rt e ,

eM s e y e ..

R d

• s a S rA s s e y s

ic s s c

s .mo .

. s c

s r

r

. t . .

ic e i i n

n a n ic a n t

s m w w m, o f - o o n

s ap e e or es t f e n s no m y p r s s a n a sulu a a a r

y fy s s r

h dn r r p r

h r

h L d d d a er hr C a h

C 1e L as re U lt U U L' d n E a E d

E 1

1 t' 3

6 e e n o ice te _o l

e l e

n e

c e b a s as r

r

_se b s n e ru a e l a s s e e n a e v R v s s

e c.

g - i s

e n

g. r n eg l

u c p e

T e r

u P W tp e p

ta m p i e n

n e

e a n i

ep 1 s tp%

i g g g o h s

e f

o er t n n n t n h ht n m u u i p s e

a e a g u

g u la b n 1

n w

r l o o m de de a s w li f o o o n es e w se

. e c r s o c u n e a r o w a r a u ol w c a C n n es s e. o s er le u w e y y s n e .

r f

s o

d e nw a d s

a _

g n

i p

g n

e p

rnu nga a

y r e

n r

e n

e n

e e c

c es ne t r

s n

i o

i e e J.

G e r ,

e i p

i p pfu g g s n f t

m e .

nl , u n o p a e

d ses t R R R ne m m m r _

le B

e l

B h

e _

ic Ew i e We P m l

W B

W B

Wen P c S ar a

S m

ee S

a ne nn a e V co ir c

Af a

- (il(ji l I(((Illl (j[llljlIll!!1 lll

e t 6 Inspection Program Development 6.3 Failure Probability Goals An important goal of an ISI program is to ensure low failure probabilities for the inspected structural elements, and thereby minimize their contributions to risk as indicated by core damage frequency or by other measures.

An ancillary goal is to maintain confidence in the overall structural reliability of the piping systems.

He next section describes how quantitative goals for component reliability can guide the development of RI-ISI programs. For example, it is proposed that a reduction in the calculatedfailure probability (over the probabilityfor no inspection) by afactor of10 can be used as a guideline to identifv effective inspection strategies. Such a goal also 'aps to climinate ineffective inspection strategies. In other cases, candidate strategies may be marginr%n achieving the goal, in which case the NDE methods or the inspection frequencies can be modified. Th. following is an appropriate rationale for using a factor-of-ten reduction in calculated failure probabilities as the goal of an inspection strategy.

e i i

The literature reports SRRA calculations whereby piping failure probabilities are calculated first by assuming no ISI and then calculated by assuming that 151 has an impact (Refs. 6.11,6.12,6.13,6.14,6.15, and 6.16)

Typical reductions in failure probabilities (i.e., the ratio of the failure probability without ISI over the failure probability with ISI) are by a factor of about 10. These calculations have accounted for the probability of i

detection of defects along with the repair or replacement of the degraded piping. Furthermore, the calculations have indicated that reductions of failure probabilities by a factor greater than about 10 are difficulu.o justify.

Greater reductions are not possible because of the limitations and uncertainties in NDE flaw detection capabilities and the need for relatively frequent inspections given that realistic service conditions result in cracks which can grow relatively quickly between inspections. Based on these results, a factor of 10 reduction l

in failure probability is considered to be a realistic goal for an inspection procedure, and is also a goal that provides a substantial and meaningful contribution to plant operning safety. y l

Consistent with the overall risk-informed approach for evaluating changes to inservice inspection programs, other considerations may be taken into account when imposing component failure probability goals. For example, it might be acceptable to meet the goal for desired reductions in failure probabilities in a rather broad sense. That is, the above " factor of 10" goal could be imposed on the total failure probability contribution from s. group of the structural elements rather than each of the individual structural elemenn being inspected.

This approach minimizes the impacts of uncertainties in the calculated failure probabilities and the estimated 'j inspection reliabilities for the individual structural elements. It also implies thst graded criteria are appropriate  ;

for reducing component failure probabilities, such that the most aggressive inspection strategies would focus on the top contributors to system level failure probabilities, with reductions short of the factor of 10 being suitable for the less critical structural elements.

6.4 Application of Probabilistic Structural Mechanics Calculations DRAFT NUREG-1661 6-8 1

s .

6 Inspection Program Development This section presents the rationale and guidelines for using probabilistic structural mechanics calculations to evaluate the effectiveness of proposed inspection strategies in terms of expected reductions in con'ponent failure probabilities.

6.4.1 Rationale A sound ISI strategy provides an appropriate level of effectiveness for detecting structural degradation. An effective inspection is herein defined as one that is reliable in detecting degradation befcre it grows through the thickness of the pipe wall. This effectiveness is governed by several factors, including NDE reliability (e.g., probability of detection), inspection frequency, and crack growth rates.

The limited amount of historical data on piping failures provides little information on the impacts of inservice inspections on failure probabilities. Furthermore, the inspection strategies ofinterest are usually ones that will be newly implemented, and therefore an extended future period of operating experience would be needed before the failure rate data could indicate the effectiveness of the strategy. Even then, data on structural failures will be very limited, because actual failures (with or without inspections) are expected to occur only very infrequently (unless a very active degradation mechanism is present, such as erosion and corrosion).

Given the limitations of historical operation data, it is therefore necessary to use structural mechanics models to quantify the expected benefits of proposed inspection strategies.

l Efforts to calcule ;aspection-related reductions in failure probabilities can be enhanced through the use of the knowledge regarding NDE reiiability gained in recent years from work within the nuclear power industry by specialists in NDE technology. This work has quantified the ability of NDE methods to detect and size defects in piping, and has resulted in new requirements for performance-based demonstrations of NDE methods, procedures, and personnel which are used to qualify piping inspections at nuclear power plants.

Probabilistic structural mechanics calculations, as described below, supported the current industry studies of NDE reliability. The calculations integrate NDE reliability (i.e., as measured by probabilities of flaw detection and siring errors) with considerations of degradation mechanisms and inspection intervals. The calculations model the degradation mechanisms of concern to piping reliability, and use probabilistic fracture mechanics methods to simulate the effeca of periodic inservice inspections. The results of these calculations provide a basis for screening c 'ndidate inspection strategies and for identifying the strategies that are the most effective in detecting growing Haws before such Daws become through-wall cracks and/or cause piping breaks or large leaks.

6.4.2 Guidelines 1,

Structural reliability models can be used to address the factors that govern the ability ofISI to detect f

degradation and reduce failure probabilities. In some situations, knowledge of only the probability of flaw detection for the proposed inspection method may be sufficient to estimate the effectiveness of a proposed inspection strategy, However, this is seldom the case because the following additional factors govern the 6-9 DRAFT NUPsEG-1661

O $

6 Inspection Program Development effectiveness ofISI:

• Detection probabilities are a function of flaw size. When small flaws are important to structural

, integrity, many NDE nuethods will lack the needed sensitivity to detect all flaws important to structural integrity. Th:refore the expected sizes of fabrication and service-induced flaws must be considered by structural reliability models.

• Flaws can grow in size over time when active degradation mechanisms are present. A structural reliability model must simulate the Daw gmwth rates, predict the sizes of growing flaws, and simulate j the detection probabilities for the Daw sizes that are likely to exist when the periodic inspections are performed.

1 I

• Small detected flaws are not be repaired if they are less than the acceptable sizes as defined by the l ASME codes. liowever, some of these unrepaired flaws can contribute to piping failures.

• In some cases there can be errors in measurements of flavi sizes, so that flaws that should have been repaired are not eliminated.

Structural reliability models should simulate the above factors to properly evaluate the benefits ofISis. The  ;

models should include initial distributions of fabrication flaws in terms of their numbers and sizes. Models should also simulate the possibility that degradation mechanisms can initiate new flaws during the service life of components at k> cations that were originally free of defects. For example, the initiation of new flaws should be addressed where calculations indicate that failures could occur for even the smallest sizes of preexisting fabrication flaws.

The structural reliability model should simulate the population of flaws of various sizes over the service life of the component, and predict the flaw sizes that could be present when Isis are performed. If particular flaws are detected and repaired, the model should then assume that these flaws no longer contribute to the failure l probability.

Probabilistic r als of the ISI process typically address the following:

l

• The pamary consideration is a realistic representation of a probability-of-detection curve (i.e.

detection probability versus flaw size) that corresponds to the specific NDE method / procedure / personnel, degradation mechanism, material, piping size, and component geometry of concern. Section 6.7 provides guidance on estimating the parameters for curves of POD as a furction of flaw size.

• Consistent with the approach used by the structurai rhanics codes to simulate uncertainties in other I

variables, the POD used to simulate ISI should be based on realistic (or best estimate) curves without consideration of confidence levels in the estimated POD values. Separate uncertainty analyses can DRAIT NUREG-1661 6-10

) o 6 Inspection Program Development deal with concerns regarding the confidence levels in the estimated POD curves.

• The combined effect of a sequence of periodic or repeated inspections should be appropriately simulated. The detection (or nondetection) of a given flaw by successive inspections, or by inspections using different NDE methods, are not usually independent events. Random factors (excluding flaw size) which prevent detection in one inspection will also tend to preclude detection in the next inspection. For conservative calculations, the combined effect of repeated inspections can be bounded by taking credit only for the inspection having the greatest likelihood of detecting the flaw (e.g., the periodic inspection corresponding to the maximum size of a growing flaw, or the NDE method having the maximum POD capability).

• Simulations can address the effects of preservice inspections (PSI) on failure probabilities by treating this inspection as an ISI performed at time equals zero. However, the simulation of PSI inspections should be consistent with assumptions made in estimating the distributions of initial fabrication flaws in the component, because PSI is also a consideration in estimating distributions of initial flaws.

Double counting of PSI effects can result if the inspection was already addressed in estimating the

, initial flaw distribution. It is appropriate preservice inspections in the calculations only if the inspections are in addition to those used as pan of the fabrication process, and then only if the preservice inspection method provides an enhanced level of NDE reliability over that of the post fabrication inspection.

. Simulations of ISIS should address the fact that detected flaws (more specifically small flaws) are not repairec' if the flaws are smaller than ASME Code flaw acceptance criteria.

The structural reliability calculations for effects of inspections can be perfcnned using the same computer codes that are used to estimate failure probabilities for use in the calculations of changes in core damage j frequency and for calculations of risk importance measures. In many cases the benefits of proposed inspection ]

strategies can be estimated by reference to prior generic calculations (e.g., from the literature) for the failure i mechanisms, component designs, operating conditions, and inspection strategies of concem (References 6.11, 6.12,6.13. 6.14, and 6.15).

One potential benefit from implementing risk-informed ISI p, grams is the possible reduction of radiation exposure for personnel who inspect radioactive piping. Applying the NRC's as low as reasonably achievable (ALARA) and defense-in-depth principles, the NDE method used for pipe segments where the number of inspections has been significantly reduced should be optimized in terms of its probability-of-detection capabilities. The steps to identify optimum inspection strategies include:  !

• Select a structural mechanics model that addresses the component, failure mechanisms, and inspection strategies of coacern;

+ Define the reliability of the candidate inspection methods; 6-11 DRAFT NUREG-1661

i (

6 Inspection Program Development

• Calculate the failure proba*uility of a component assuming no Isis are performed;

• Calculate the failure probability'of a component for each of the candidate inspection strategies;

• Calculate the effectiveness of candidate inservice strategies as the ratio of failure probabilities, with the baseline being either no inspection or the current inspection strategy.

12ak probabilities are the most appropriate measure c'7iping reliability for the calculations rf failure

~

probabilities described above. The impact of ISI r a' a probabilities is used as the measure of inspection -

effectiveness, and as a surrogate for estimating the effects ofISI on reducing the probabilities of piping breaks.

The calculation of leak probabilities rather than break probabilities has significantly fewer uncertainties, and is consistent with the regulatory philosophy of prevmng leaks. It avoids a large number of assumptions and uncertainties associated with calculations of piping break probabilities. The~ numerical difficulties of calculating very small values for probabilities for piping breaks can also impose significant computational demands, which are largely avoided if the focus is redirected to calculating leak probabilities.

One approach is to quantify the benefits of inspection strategies in terms of a relative failure probability, which can be expressed either as " factor of improvement" or as " inspection efficiency" as follows:

factor ofimprovement c Po/P inspection efficiency = 1 - P/Po where Po = failure probability with beseline inspection strategy (e.g., no inspection)

P = failure probability with inspection strategy of interest These calculations of relative failure probabilities, which compare alternative inspection strategies, have been found to be relatively insensitive to such factors as uncertainties in the operating stress levels, which govern the absolute values of failure probabilities.

If the baseline strategy is no inspection, the values of inspection efficiency can range between 0.0 and 1.0,'

~

with a value of 0.0 corresponding to a totally ineffective ISI strategy (i.e., the same as no ISI). A value of 1.0 corresponds to a perfect inspection. Inspection efficiency is roughly correlated to the probability of flaw I

detection, and becomes the same as the POD given that e- the POD is independent of flaw size, and DRAr 4 NUREG-1661 6-12

6 Inspection Progrun Development

• all i *ected flaws are repaired wanout regr.rd to their measured size.

The values 1or factor of improvement can range between 1.0 and infinity. A value of 1.0 corresponds to a totally indfective ISI strategy (same as no ISI), whereas a value of infinity corresponds to a perfect inspection.

6.5 Examples of Probabilistic Structural Mechanics Calculations The selection of inspection stretegies for key piping locations can be supported by detailed SRRA evaluations.

The literature provides many examples of.uch calculations, including the work by Khaleel and Simonen (Ref.

6.14). The set of example calculations in this reference was performed with the pc-PRAISE computer code, and was part of sensitivity calculations for piping affected by fatigue crack growth. In this section we present results of both the individual SRRA calculations and the trend curves derived from the calculations. We also describe how the selection of an inspection strategy (method and frequency) can be supported by the trend curves from the example calculations.

Table 6.4 provides input parameters for the baseline case (no ISI) of a 6-inch diameter piping weld subject to fatigue cycling, which results in a calculated leak probability of only 6.0E-08 (cumulative probability per weld at 40 years). He modest level of fatigue cycling corresponded to a Qfactor" of 1.0, where the Qfactor is a  ;

I composite measure of the magnitude and the number of stress cycles for the piping location. The failure i probability calculations of Reference 6.14 covered a wide range of Qfactors, and included cases with more severe conditions of stress cycling than those of the baseline case. He results were as follows:

I Loading Condition Q-Factor Leak Probability Low 1.0 -10' = 1.0x104 Medium 102-10' = 1.0x10d High 10*- 105 = 1.0x10-2 I

The low Qfactor should relate to all piping segments in Region 2 of Figures 2.7 and 2.8. The medium and high Qfactors should relate to susceptible locations in piping segments in Region 1. He remaining locations in those Region I segments should have low Qfactors, as for piping segments in Region 2.

6-13 DRAFT NUREG-1661

. t 6 Inspection Program Development Table 6.4 PRAISE model of LPI system: baseline case.

Flaw depth distribution Exponential (mean depth = 0.06 inch)

Flaw aspect ratio Log-normal (Parameter = 0.689)

Stress through-wall thickness Uniform tension Cyclic stress amplitude 15 Ksi / 5 cycles per year da/dN Curves As given in pc-PRAISE documentation Threshold aK for da/dN 0.00 Flow stress Normal (mean = 43 ksi, C.O.V. = 0.0977)*

Piping inner radius 2.75 inches Piping wall thickness 0.562 inch Pressure 2.250 ksi Dead weight stress 3 ksi Thermal expansion stress 10 ksi inspection No PSI and no ISI

• C.O V. = Coemeient of vanation = 5'andard deviation / mean The required inspection frequencies can be established by using the trend curves of Figure 6.1, which were developed from the probabilistic structural mechanics calculations of Reference 6.14. For example, let us

! assume that a licensee wants to reduce the probability of a leak by a factor of 10. The curves of Figure 6.1 are for an ultrasonic inspection method designated "very good,", which has a POD curve having a 50% probability l

! of detecting a crack with a depth that is 10% of the wall thickness and a probability of 90% of detecting flaws greater than JO% of the wall thickness. The objective is to determine the time interval between inspections that will detect 90% of the growing cracks that could reach through-wall depth before the end of the 40-year design life.

The curves of Figure 6.1 indicate that an inspection frequency of 10 years with the first inspection at 5 years (5/10) can achieve the factor of 10 reduction in failure probability. This reduction applies to a wide range of cyclic stres< conditions (Q-factor from 1.0E+0 to about 1.0E+3 corresponding to 40-year leak probabilities of 1.0E-7 to 1.0E-1). The factor of improvement decreases for higher values of failure probabilities, because the rater of crack growth are so high that the 10-year interval between inspections is inadequate. For very low s I

values of the Q-factor, the factors of improvement are also relatively low, because the few failures that do occur are predicted to occur very early in life. These failures are caused by large fabrication defects that are l

not detected in the normal post-weld inspections. Such defects are best addressed by a high-quality preservice inspection, rather than by inservice inspections.

DRAFT NUREG-1661 6-14 l l

2 ,

. 6 Inspection Program Development 4

50 nn n

.o oo J O o o , ts:1/1 40 0

$ 131 2/2

^

N 0- O O IL 30 -

0o

^ est s/s E

20 N 2

c.

E o i

~

1 0 '

i ist 5/10 O D O z 0

m, ,, .. e d 5

109 10' 19 19 10' 10 Q-factor  !

l I

Figure 6.1 Improvement factors for four inspection interval (NDE performance level for POD =

"Very GcM").

Figure 6.1 shows that improved NDE methods (i. e., methods having the ability to detect smaller defects) can permit the use of longer time intervals between periodic inspections. He application of such improved NDE methods, even with longer inspection intervals, can in some cases actually decrease failure probabilities compared to less sensitive NDE rnethods. The reduced number of inspections, also provides the benefit of reduced radiation exposures to the workers performing the inspections.

(.

The relationships and/or tradeoffs between detection capabilities and inspection frequencies can be explained in terms of the sequence of events that lead to structural failures. This sequence consists of the initiation of small cracks, an extended. time period of slow crack growth, and a final period of rapid crack growth.

An effective inspection program should detect small cracks before the growth rates increase to unacceptably high levels. He maximum allowable time interval between inspections ia dictated by consideration of the crack growth rates. His interval is governed by the difference between the smallest crack size that can be 6 DRAFT NUREG-1661

-_--____-____=_---_____:

7-_________

< t 6 Inspection Program Development detected and the larger critical crack size that can result in a structural failure. The optimum inspection interval correspemds to the time for a crack to grow from the undetectable size to the critical size.

For many lower levels of cyclic stress. the small cracks, which are smaller than the threshold for detectable size, will not grow to critical size over the plant's operating life. In such cases, one high-quality inspection early in life is the most effective strategy. In cases of higher levels of cyclic stresses, the growth rates for these small cracks will be greater. Therefore, depend;ng on the crack growth rates, several inspections during the plant life are required to ensure that cracks do not grow to critica: we. j in summary, probabilistic fracture mechanics results can give an indication of what type of program may be i 1

necessary to achieve an improvement factor that maintains the failure probability of a given piping segment at or below an acceptable level. For those elements that have estimated leak probabilities above acceptable 3 8

threshold values (e.g.,1.0E105 per weld lifetime for small leaks and/or 1.0E10 per weld lifetime for disabling leaks), inspection programs can be designed that will yield the necessary improvement factors.

In terms of defiriing an appropriate examination method (s) for various geometries and postulated failure modes Tabie 4.1-1 in Reference 6.1 provides a comprehensive place to start in selecting appropriate examination methods.

6.6 Additional Considerations in Selecting Strategies l

l

! There are additional factors that should be addressed licensees during the selection of inspection strategies beyond those related to the effectiveness of the inspection methods towards ensuring that goals for failure probabilities are achieved. Considerations related to safety and structural reliability are as follows:

. Exposure of inspection personnel to hazardous environments, including man-rem exposure from radiation Oeactor coolant system piping and fittings), hazardous materials, dangerous heights or chmbing of scaffolds and unsteady platforms, rotating equipment or machinery, and falling objects.

I Man-rem oposure has the potential to affect not only personnel health and safety, but also the overall costs of performing the inspections. ALARA guidelines should be followed to develop strategies that reduce man-rem levels. In some cases, it may be justified to reduce the number of inspections that have marginal impacts on risk but make large contributions to man-rem exposure.

. Damage to compcments can occur as a result of the inspection itself. In some cases the inspection requires that equipment be taken apart to gain adequate access to the structural locations of concern.

The degree of success in reassembling the systems and components that must be taken apart or taken off-line to do the inspection (e.g., reactor vessel closure cruds, steam generator manway covers, piping supports and attachments, pumps, valves, turbine generator casings) should be taken into account.

. Movement of large equipment er structures (e.g., reactor vessel ;ntemala, reactor closum heads, large piping supporte, and restraints) can damage adjacent equipment and structure .

DRAFT NUREG-1661 6-16

7 2 t 6 Inspection Program Development Concems with disassembly or movement of components will not be a factor for most piping inspections.

Ilowever, when such situations do occur, it is prudent to coordinate inspections with other maintenance that requires the needed disassembly or movement operations. In other cases,it may be prudent to minimize such inspections unless tiie ISI locations are in the highest categories of risk.

6.7 Quantification of NDE Reliability Evaluations of ISI strategies acquire quantitative inputs to describe the reliability of NDE methods A primary input is a POD curve for the piping locations that are to be inspected. Other considerations include the l accuracy of flaw sizing and the flaw acceptance criteria governing the sizes of flaws that must be repaired versus the flaws that are permitted to remain in service, i 6.7.1 Factors Governing NDE Reliability j f

The POD curves and flaw sizing accuracies are related to the particular NDE nethod/ procedure /persori-c :, j degradation mechanisms, materials, piping sizes, and component geometries ceing addressed. TW section l describes credible approaches for estimating POD curves and other parameters of the inspection process, l Additional information on these topics is available in the literature, and has been summarized in Section 11 of j the Probabilistic Structural Mechanics Handbook. (Ref. 6.1)

In estimating the reliability of a candidate inspection strategy, the following factors warrant consideration:

• NDE Method - Visual examination, liquid penetrant testing, magnetic particle testing, radiographic testing, eddy current testing, ultrasonic testing, acoustic emission monitoring a Flaw Dimensions - Depth, length, opening / crack tightness s Flaw Orientation - Normal or parallel to surface

• Material Type - Stainless steel, ferritic steel, cast or wroug.4 fine-grained or coarse grained

• Access to inspection Location - Inside surface or outside surface, near or far side access to welds, presence of physical obstructions, need for disassembly

• Surface Conditions - Surface roughness, contamination or deposits, weld deposits, cladding

• Extraneous Signals - Large-grained materials, geometric reflectors, weld roots, counter-bore geometries 6 17 DRAFT NUREG-1661

, t 6 Inspection Program Development ,

l

. Iluman Factors - Inspector experience and training, motivational factors, low tolerance for false calls, time restraints, hostile environments (heat, humidity, poor lighting, confined spaces, protective clothing)

• Qualification / Performance Demonstration- Equipment, procedures and personnel, ASME Appendix VIII, detection and sizing capabilitie; 6.7.2 Performance Demonstrations ASME Section XI has adopted Appendix Vill (Ref. 6.16), which follows a performance demonstration approach. With this approach, an inspection organization must qualify the performance of equipment, procedures, and personnel. Inspection teams must achieve passing scores in tests of capabilities to detect service-type flaws in a matrix of samples that simulate degraded conditions in reactor pressure vessels and piping. A passing score requires detection of a statistically significant fraction of the flaws in the sample set, while maintaining an acceptably low frequency of false calls. The performance demonstrations also require that teams attain passing scores on flaw-sizing capability. i i

j Performance demonstrations provide the basis for identifying those NDE methods that are most. reliable, and I for eliminating those methods whose reliability is unacceptable. Current performance demonstrations in the ASME Section XI Code require a specified POD level for the flaws in the sample set. The sample sets have a range of Daw sizes, beginning with the smallest sizes that are considered to be structurally significant. As now practiced, performance demonstrations are not designed to generate the types of POD curves as a function of j Haw depth, which are needed for probabilistic structural mechanics calculations. A statistically based POD  !

I curve would require additional detection data beyond the minimum demanded by current performance j demonstration tests. Lacking a sufficiently complete set of data, POD curves must be estimated based on  !

I engineering judgment, and by application of the currently available base of flaw detection data generated from i inspection round robins and performance demonstration research.

6.7.3 Modeling of NDE Uncertainties  ;

t Consistent with the practice in probabilistic structural mechanics calculations for simulating other statistical .

parameters, the POD curves used in simulations of ISI should be selected to represent mean values of POD i curves witi out consideration of confidence levels. Arbitrary conservatism is not appropriate in estimating the POD curvet Such conservatism, if it is not applied uniformly, could improperly bias the selection of inspection strategies. While it is appropriate to use realistic values of PODS as inputs to the structural reliability codes, uncertainties associated with the POD curves can be accounted for in any supplementary DRAFT NUREG 1661 6-18 i l

') e i

6 Inspection Program Development uncenainty analyses.

6.7.4 Characteristics of POD Curves Probability of detection is defined as the ratio of the number of flaws actually detected to the number of flaws that would be detected given a perfect NDE system. Examples of estimated POD curves that have been used -

in probabilistic fracture mechanics calculations with the pc-PRAISE code (Ref. 6.17) are shown in Figure 6.2. -!

This schematic form is typical of POD curves that have been described in a number of other studies, including Reference 6.18. As indicated, flaws must have some minimum size or threshold before detection becomes possible. For flaws larger than this threshold size, detection increases rapidly as the size of the flaw increases. '

The POD curves eventually attains maximum values at which nondetection is governed by other factors (e.g.,

human errors) that come to dominate the detection processes. l

.i

_ 1.0 Gl1 Outsandmg g 0.9 0.8 v.,y cood

{  !

cf 0.7 o

CW 0.s -

. u.#n.i lii 0.5 -

O g 0.4 0.3

=

.o 0.2 l

e 0.1 a 0- , , , , , . , , , , ,

g,g l 0.0 0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9 1.0 Crack depth / wall thickness (a/h)

Figure 6.2 Exampic POD curve used in pc-PRAISE.

He t.pecific functional form used in pc-PRAISE is given by Puo(a) = c + % (1-c) erfc [v in (A/A*)]

- where Puo is the probability of nondetection. A is the area of the crack, A* is the area of crack for 50% Pyo, c -

6-19 DRAFT NUREG-1661

e (

6 Inspection Program Development is the best possible Puofor very large cracks, and v is the " slope" of the Pyocurve. Based on measured performance for Pacific Northwest National Laboratory's (PNNL's) mini round-robin teams (Ref. 6.6), a range of estimates for A* (crack area for 50% POD) was provided by the NDE experts. Reference 6.17 assumed that the " slope" parameter y is 1.6. Several POD curves from PNNL studies were analyzed, and it was determined that a value of v = 1.6 is consistent with published curves. While the assigned value of the slope parameter v was held constant, the actual slope of the plotted curves became more steep for better POD curves.

Thus, the slope of the POD curve is correlated to the detection threshold parameter A*. The value of c was assigned so that a smaller value of A'* also implies a smaller value of c.

Example Parameters for POD Curve - An approach taken for evaluating candidate inspection strategies has been to consider a range of POD curves that bound the range of pertormance expected from te:ans that might inspect piping in the field (Ref. 6.14). This range of POD curves was established in consultation with NDE experts with extensive knowledge of the trends of NDE reliability studies and of the performance levels needed to meet the criteria of performance tests. The basic premise was that all teams had passed the ASME Section XI Appendix VIII performance demonstration, it should, however, be recognized that a given inspection team operating under either the testing environment of performance demonstration trials or under field conditions can still exhibit a considerable range of POD performance, even though the team may have successfully completed a performance demonstration. The performance demonstration serves to ensure a minimal level of NDE reliability.

The NDE expens were asked to define POD curves by estimating parameters for the POD function used in the pc-PRAISE code as given by the above equation. Three POD curves with increasing levels of performance were defined as indicated in Table 6.5:

• Level 1 Performance: This curve corresponds to a team that has the minimum level of performance needed to pass an Appendix Vill performance demonstration.

. Level 2 Performance: This curve corresponds to the best teams. Such teams significantly exceed the minimum level of performance needed to pass the test.

• Level 3 Performance: This curve corresponds to a team that has a level of performance significantly better than expected from any teams that have to date passed an Appendix VIII-type of performance demonstration.

Table 6.5 Parameters of POD curves for three performance levels.

Inspection Performance a ( % alt) c v level 1 40 % 0.10 1.6 1

12 vel 2 15 % 0.02 1.6 12 vel 3 5% .005 1.6 DRAFT NUREG-1661 6-20

t 9 6 Inspection Program Development 6.8 Alternative Strategies to Reduce Failure Probabilities It may be determined in some cases that none of the candidate inspection strategies can provide an adequate reduction in failure probability, or that strategies other than ISI are more cost effective in reducing failure probabilities. Some degredation mechanisms can develop suddenly and cause structural failures within time periods shorter than the proposed ISI intervals. Examples are vibrational fatigue and thermal fatigue. New sources of vibrational stresses can develop from imbalances in rotating equipment or changes in the effectiveness of piping supports. Thermal fatigue stresses from the mixing of hot and cold fluids can develop over the life of a plant from new sources of leakage at valves and thermal sleeves. The inspection intervals needed for ISIS can become unreasonably small in order to detect impending structural failures associated with such new sources of fatigue-related stresses. In these cases, a more effective strategy may be to monitor the systems for piping vibrations and/or for temperature conditions that mdicate the development of thermal fatigue stresses.

Continuous mthods involving acoustic emission monitoring or leak monitoring can supplement or replace periodic ISI .s a means for detecting the progress of degradation in piping system components. Such methods are particularly useful when concern becomes focused on a specific location where degradation is known to exist, and the objective is an early indication that the degradation is growing. Such continuous monitoring i avoids the need to perform inspections at unreasonably small time intervals, such as when calculations and/or measurements of damage (e.g., stress corrosion cracking, erosion, or corrosion) indicate potentially high rates of degradation.

l I

i i

l I

i 6-21 DRAIT NUREG-1661

s (

6 Inspection Program Development REFERENCES FOR CHAPTER 6 6.1 F.A. Simonen," Nondestructive Examination Reliability," Probabilistic Structural Mechanics Handbook, C. Sundararajan, editor, Chapman and IIall, New York, pp. 238-260,1995.

6.2 PISC, " Analysis of the PISC Trials Results for Alternative Procedures." Plate Inspection Steering Committee Report No. 6. EURATOM Report No. 6, EOR 6371 ED, Published by the Commission of the European Communities, Directorate-General XII, Information Technologies and Industries and Telecommunications Luxembourg,1980.

6.3 R.W. Nichols and S. Crutzen, eds.. Ultrasonic inspection of Heavy Section Steel Components: The PlSC-IlFinal Report Elsesict Applied Science,12)ndon and New York,1988.

6.4 B.K. Watkins et al.,"Results Obtained from the Inspection of DDT Plates I and 2," Paper presented at UKAEA DDT Symposium. Silver Beach Conference Center, Birchwood, Warrington, U.K.,

October 7-8,1982.

6.5 G.J. Dau, " Ultrasonic Sizing Capability of JGSCC and its Relation to Flaw Evaluation Procedures,"

Electric Power Research Institute (NDE Center), North Carolina,1983.

6.6 S.R. Doctor and P. G. licaster,"A Pipe Inspection Round Robin Test," Proceedings of the 6*

International Conference on NDE in the Nuclear Industry American Society for Metals, Metals Park, l Ohio,1984. j l

6.7 P.G. licaster et al., " Ultrasonic Inspection Reliability for Intergranular Stress Corrosion Cracks: A l Round Robin Study of the Effects of Personnel, Procedures, Equipment and Crack Characteristics," l NUREG/CR 4908 (Prepared for the USNRC by Pacific Northwest Laboratory), July 1990.

6.8 R.J. Kurtz et al., " Steam Generator Tube Integrity Program / Steam Generator Group Project-Final Project Summary Report," NUREG/CR-5117 (Prepared for the NRC by Pacific Northwest laboratory, PNL-6446), May 1990.

6.9 S.li. Bush," Reliability of Nondestructive Examination," USNRC, NUREG/CR-3110. Vol. 1-3, (Prepared for the USNRC by Pacific Northwest Laboratory),1983.

6.10 B.W. Boisvert et al., " Uniform Qualification of Military and Civilian Nondestructive inspection Personnel," LG81 WP7254-003, Lockheed Georgia Company,1981.

6.11 D.O. liarris and E.Y. Lim, " Applications of a Probabilistic Fracture Mechanics Model to the influence of in-Service Inspection of Structural Reliability," Probabilistic Fracture Mechanics and Fatigue Methods: Applicationsfor Structural Reliability and Maintenance AS*IM STP 789, pp. I9-41,1983.

6.12 F.A. Simonen, "An Evaluation of the impact of Inservice inspection on Stress Corrosion Cracking of BWR Piping,* In Codes and Standards and Applications for Design and Analysis of Pressure Vessel and Piping Components, pp. 187193, ASME PVP-Vol.186, American Society of Mechanical Engineers, New York,19M).

6.13 F.A. Simonen and H.H. Woo," Analysis of the Impact of Inservice Inspection Using a Piping Reliability Model," NUREG/CR 3869 (Prepared for the USNRC by Pacific Northwest laboratory),

August 1984.

DRAFT NUREG 1661 6-22

e 6 Inspection Program Development 6.14 M.A. Khaleel and F.A. Simonen, "The Effects of Initial Flaw Sizes and Inservice Inspection on Piping Reliability," PVP-Vol. 288, Service Experience and Reliability improvement

Nuclear, Fossil, and Petrochemical Plants, American Society of Mechanical Engineers,1994.

6.15 F.A. Simonen and M.A. Khaleel, "A Model for Predicting Vessel Failure Probabilities Due to Fatigue Crack Growth," ASME PVP-Vof. 304, Fatigue and Fracture Mechanics in Pressure Vessels and Piping, pp. 401-416, American Society of Mechanical Engineers,1995.

6.16 D. Cowfer," Basis / Background for ASME Code Sect on XI Proposed Appendix VIII: Ultrasonic I Examination Performance Demonstration," In Nondestructive Evaluation: NDE Planning and Application, pp.1-5, ASME NDE - Vol.5, American Society of Mechanical Engineers, New York, 1989. .

l 6.17 D.O. Ilarris and D. Dedhia, " Theoretical and Users Manual for pc-PRAISE, A Probabilistic Fracture Mechanics Computer Code for Piping Reliability Analysis " USNRC, NUREG/CR-5864, July 1992.

6.18 W.D. Rumrnel, " Considerations of Quantitative NDE and NDE Reliability Improvement," Review of Progress in Quantitative Nondestructive Evaluation - Volume 2A. ed. D.O. Thompson and D.F.

Chimenti, pp.19-35. Plenum Press, New York,1983.

f 6 DRAFT NUREG-1661

a

• APPENDIX A COMMENT RESOLUTION This appendix addresses selected public comments received in response to an October 15,1997. Federal Register Notice on draft regulatory guide DG-1063 (predecessor to RG-1.178). Public comments identified concerns over the technical viability of applying probabilistic fracture mechanics computer programs to estimate the behavior of flaws in piping. In an NRC Commission Paper, SECY-98-139, dated June i1,1998, the staff informed the Commission that responses to those comments would be provided in this NUREG. The following discussions list and respond to the concems raised by EPRI, with respect to the application of SRRA computer codes to RJ-ISI programs.

• Comment: The fact of the matter is that piping reliability estimates derived from service experience have consistently shown higher failure rates than those obtained from current generation fracture rnechanics codes.

f Response: EPRI provided no examples in its statements. The staff is aware that improper application of any computer simulation can result in either conservative or non-conservative calculated results. This is no different from applying thermal-hydraulic simulation, neutronic simulation, or accounting simulation. " Garbage in is garbage out." That is the reason for developing technical guidance on basic elements and assumptions required in developing, validating and applying structural risk and reliability computer codes. In addition, the consideration of uncenainties adds to the understanding and application of the calculated results.

. Comment: It (Appendix 2 to DG-1063) has a number of open and unresolved technical issues such as the modeling of pipe failures on demand, the validity of Fussell-Vesely and Risk Achievement Wonh imponance measures for risk ranking, etc.

Response: The use of imponance measures are analytic tools used to categorize equipment based on their contribution to risk. This is clearly articulated in the EPRI PSA Applications Guide as a viable analytic tool. These imponance measures, or other measures, are used by the industry when implementing the maintenance rule and other RI programs (see RG 1.174). The issue of defining the cutoff value has yet to be established on a generic basis. However, the use of importance measures is a -

technically viable tool, when properly applied.

With respect to modeling piping failures, the selection of input assumptions, such as flaw distribution and flaw densities have been discussed at open ASME and industry meetings. Examples of such input are presented and discussed in this document.

• Comment: Service experience is not adequately addressed when applying fracture mechanics computer codes.

Response: It appears that many comments provided by EPRI on DG-1063 were presented out of A-1 Draft, NUREG-1661

e t r

Appendix A Comment Resolution context. One example is the need to validate computer simulation of piping failures with service experience. The document repeatedly stresses the need to validate the computer code with industry data and to check the final calculated results to ensure that they are consistent with service experience.

• Comment: Too many of these details are subject to change as the rapidly evolving state of the art of assessing the risk of passive components and structures evolves and the current pilot studies are reviewed and implemented. A more appropriate strategy for this appendix wo M be to provide guidance and discuss examples in a high level manner that brings out more clearly the guiding principles of a successful application.

Analytical and technical details should be incorporated by reference when needed and only when the technical bas.is can be fully established.

Response: The Comment is not specific. The staffis not aware of the rapidly evolving state of the an in fracture mechanics computer simulation that would alter the conclusions of a valid analysis. The results from the pilot plants have been reviewed. It is unclear how guidance at a high level would be beneficial to the industry. The body of RG 1.178 provide high level guidance. The attachments to DG-1063, pt esented in this NUREG, provide the detailed guidance that have been developed through technical exchanges between the NRC and ASME-Research. These guidance are consistent with industry practices as they evaluate identified flaws following inspections. These guidance are consistent with industry practices as applied to the analysis of pressurized thermal shock and reactor vessel intemals. They are consistent with industry practices for other applications, such as aviatior , petrochemical industry, etc. Since an RI-ISI program integrates sciences in materials, systems, thermal-hydraulics, PRA, statistics, etc., the staff believed that licensees and the public would benefit from the details of an RI-ISI process. Without this level of detail, licensing reviews could be extensive, leading to frustrations on the part of the licensees.

I I

\

!

• Comment: When adding detailed models of may different pipe segments into an existing PRA model, there are many important dependencies that need to be accounted for and this is not an easy task. As noted above, all the PRA success criteria presume the integrity of all but a small number of well defined pipe failures as initiating events.

In addition, pipe failures at the segment level can only be assumed one at a time.

Some piping challenges occur in entire systems or groups of systems such es seismic, water hammer and over pressurization. IIence, pipe elemeni. JSk factors are not independent. Finally, the standard PRA assumption that component failure rates are constant in time is generally not applicable to passive con ponents such as piping whose failures are the result of degradation mechanisms.

Response: The staff agrees that many imponant dependencies need to be addressed. The technical appendices in DG-1063 identified many of those dependencies. The Draft. NUREG-1661 A -2

1 Appendix A Comment Resolution

(

application of fracture mechanics codes is one acceptable alternative to incorporating the dependencies in the analysis. For example, thermal cycles, water hammer frequencies, earthquake loadings are integrated in the probabilistic fracture mechanics calculations. In addition it is recognized that failure rates are not constant. Degradation mechanisms play a role in the time-dependent degradation rate of a piping segment. A standard PRA process is to apply average degradation rates. Since an RI-ISI program is applied over the licensed period, one can c.;timate the degradation rates, including statistical application of failure catalysts (e.g., water hammer, water chemistry, earthquake, etc.), over the life of the plant and establish an appropriate inspection program. Where active degradation mechanisms are present, a conservative assumption is to inspect 100% of those locations or an approved augmented inspection program. Where an active degradation mechanism does not exist, the average failure rate over the licensed period is acceptable. Extensive discussions on these matters were conducted over the past two years at publicly announced meetings wPh the ASME-Research and industry.

. Comment: On the realistic vs. conservative estimate issue, it should also be stated that the introduction of optimistic assumptions should also be avoided.

Response: The document consistently addresses the use of realistic assumptions. This is consistent with the EPRI PSA Applications Document and the Commission's policy l on use of PRA.

• Comment: Pipe failure rates must be generally assumed to be time dependent and predictions of future pipe failure rates over long periods of time should be avoided. Hence, PRA evaluations done today based on current experience are of current snap shot in time and do not necessarily apply say 10 years down the road.

Response: The staff does not agree that aging mechanisms should not be considered in an RI-ISI program (pipe failure rates over long periods of time should be avoided). Aging and degradation phenomena are realities of life and should be considered in accordance with existing technology and industry experience, as appropriate. That is consistent with the Commission's Policy on PRA. An RI ISI program should integrate piping behaviors well into the life of the plant. Aging mechanisms should be addressed, where identified. Should new aging mechanisms be identified that were not addressed when developmg an RI-ISI program, the corrective action program would require reassessment of the program while accounting for the new degradation mechanisms.

• Comment: As presented by Karl Fleming at the NRC workshop in November 1997, the hazard rate for a segment subject to an active degradation mechanism is generally time A-3 Draft, NUREG-1661

7.

t W Appendix A Comment Resolution l dependent and will be less than the average probability rate in the early life and much greater in the later stages of life.

Here is a fourth method for estimating failure probabilities that is being used in the EPRI Rl-ISI program to study the quantitative risk impacts of implementing the EPRI approach to RI-ISI programs. This method is a reliability model of pipe failure an inspection processes using the Markovian reliability technique. The application of this approach to quantify the risk impacts of implementing RI ISI on the ANO

! RCS was presented to the staff at the November 1997 RI-ISI workshop.

Response: The staff is aware that aging is not a constant. Analyses performed by Dr. Fleming have not been presented to the staff for review and approval. In a meeting on the EPRI methodology, the use of the Markov model was discussed. While the application of the Markov model is one approach that may be applicable for use in a RI-ISI program, the input must be scrutinized. One such analysis was reviewed by the NRC and found inadequate in the assumptions used. It was interesting to note that the assumptions used in the Markov model were the same as those used in fracture mechanics codes and criticized in the comments. In its comments on DG-1063 EPRI repeatedly referenced work not presented to the staff for review and t

approval, even though during the past three years five meetings were scheduled l

between NRC and EPRI and all meetings were canceled by EPRI. Therefore, the ,

staff does not have adequate information to render a technical finding on Dr.

Flerning's work. Review of Dr. Fleming's work will be performed when EPRI I responds to the staff's request for additional information. At this time, the staff is not in a position to judge the merits of the analyses referenced in the Comments.

+ Comment: It is highly debatable whether the subjective nature of estimating failure probabilities is decreased because the alternative approaches have not been given equal  !

consideration in the discussion.

Response: As previously addressed, the staff has not judged attemative approaches to be unacceptable. However, the staff does require technical submittals, supplemented with technical meetings that delve into the models and assumptions prior to rendering i a d6cir, ion of acceptability.

• Comment: With regard to Section A2.6 of DG-1063,just the presence of so many terms shows the confusion in treatment of the pipe failure probability.

Response: The Comment asserts that the presence of so many terms to represent piping failure probabilities and rates shows confusion in the treatment of the pipe failure probability. This does not correctly characterize the situation. Thepresence ofso Draft, NUREG-1661 A-4

o e, Appendix A Comment Resolution many terms does not show confusion: itjust shows that there are several dWerent cases that have to be treated, and the dtfferent cases lead to different expressions j for the contribution of the pipe segmentfailure to the core damagefrequency.

There are basically two cases for the formula for the core damage frequency. One of l these is the initiating event case, and the other is the pipe failure in the mitigating l system case. Note that the case " Initiating Event and Mitigating System l Degradation" encompasses the " Initiating Event" case. The " Initiating Event" case is I just the limit where the pipe failure does not affect the mitigating system.

l l

All of the " mitigating system" cases (here the pipe failure does not cause an initiating event) are subsumed in the formula given in Eq(A2-2). One has to just define appropriately FP,, for the appropriate case: it differs for the case of a standby system and for a normally operating system. l One notes that there are analogous cases in a conventional PRA. A failure may cause an initiating event, or it may be in a mitigating system and fail to start, or given successful stan, it may fail to operate. Here too a passive failure can cause an initiating event, or a passive component in a mitigating system may fail on demand (or be in a failed condition at the time of the demand), or it may fail during the mission time for the mitigating system.

I 1

On p. 20 of the EPRI comments, in the second paragraph, it is stated that the approach used is a simplified approach which brings up seural questions.

The first statement made is that a test does not detect pipe degradation or restore piping to a good as new" condition. Of course it does not do this, but the point of the calculation is to estimate the reduction in risk that comes from this testing. In estimating how imponant it is to inspect a panicular pipe segment, one must estimate the risk Without inspection. This risk depends on the test of the active components which may reveal a failure of the pipe, even though it may not reveal panial degradation. There is considerable reduction of risk by the inservice testing of active components, which can reveal failures of pipe segments.

In a letter from EPRI, dated September 29,1998, EPRI stated that its comments on DG-106.2 may have been misunderstood. The staff agrees with EPRI's letter of September 29,1998 that states "...that structural reliability approaches to piping reliability assessment represent a viable approach to RI-ISI." The staff continues to believe that structural reliability and risk assessment computer codes can be applied to estimate the failure probability of piping and that they serve a viable option to estimating changes and CDF and LERF.

As aniculated in the Commission's policy statement on PRA, "PRA and associated analyses (e.g., sensitivity studies, uncenainty analyses, and imponance measures) should be used in regulatory matters, where practical within the bounds of the state-of-the-art. ..." The application of SRRA computer c(xtes is within the bounds of the state-of-the-an and has been peered reviewed by the NRC and accepted by the ASME.

A-5 Draft, NUREG-1661

j > .

emC Foses ass U.s. NucL8iAR RaGULAfoRY ennaamarw 1. REPORT NuhmER o* eeniew nr me. m vw,sw.,aw.

EN BIBUOGRAPHIC DATA SHEET

'"''""""*"'"'"'l NUREG 1661 J t gg 41.TrrLE AND sUBTmf. ]

Technical Elements of Rak-Informed inservice DATE REPORT PUBLA'"io inspecbon Programs for Piping 1 e j YEAR January 1999

4. FIN OR GRANT NUMBER

- l

s. AUTHOR (S) s. TYPE OF REPORT Technical T.PEFNOOCOVERED thekswW

s. PERFORhANG ORGANIZATION . NAME AND ADDRESS (r mc; pave Dvam Oke a ampm u 5 Nuchw Aegekry commmam and memne edesu; scateckr pawne nome end menne eneens}

Dusion of Systems Technology I

Office of Nuclear Regulatory Research U.s. Nuclear Regulatory Commission Washington, DC 20555-0001

9. SPONSORING ORGANIZATON NAME AND ADDRESS trme, #ype ssmees enove scweecks, powweMcDveen, orme a Asam u & M.caer Assutokryc_

est me.ke edecesJ Same as 8. above

10. SUPPLEhENTARY NOTES

11. ADSTRACT am mros e assa)

Risk 4nformed inservice inspechon (RI-tSI) programs of piping integrate traditional engineering evaluations with insights gained from probatsstne rak analyses (PRAs). Two basic elements that identify the risk from piping failures are failure frequency and consequence from piping faRutes. Once the risk of piping failures is identified, the piping can be categonzed into two or more groups, such as high safety significant (HSS) and low safety significant (LSS). From a regulatory perspective, the HSS piping would receive oversight that LSS piping would not. This NUREG addresses some of the technicalissues that should be considered when developing a Rl4Si program.

11 AVA4.A8UrY S1ATEndENr

13. KEY WOqDSOEbCRIPTORS fusf ares crp! renes shot ed esamtrenewohars e bee 6ng #w M sk4n o i rvice inspection of Rpirig , ,

Paping Inspecten erw %>

uncloseded tr=,*,wo unciaeeded to. NLaRER OF PAGES is. PRICE

' mc Fcfus 336 pg Thss seem was seector.ioney reduced by One Federal Forms, he -j

lI ll!illl t ' .

e4 I .

N.

U. _

C .

P W' EL _

E A _

N SA -

L A I R.

H NR TO Y F GEU N _

- FF OC I

-T O UT GI .

RIA

-PL N LE

AD __ .

RB DTS

% NU C RAOT

, AS TI N

.EE 2YT _.

US 0 E SS 5C 5O S

. ,E 5- na

$ 0a 3

0 0 m 0 0*

1 C

4 g N

,4 s

~-

s -

9 '

)

N" s

j 4k P.

O S

P TIF E AR R GS M U ET m

TSAc I

NNt N

O RDA s

. CFs G EEM 6

7 SA I PL A

I D

l! Il i4  !