ML20207B602
| ML20207B602 | |
| Person / Time | |
|---|---|
| Issue date: | 05/24/1999 |
| From: | Joshua Wilson NRC (Affiliation Not Assigned) |
| To: | Carpenter C NRC (Affiliation Not Assigned) |
| References | |
| PROJECT-669 NUDOCS 9906020036 | |
| Download: ML20207B602 (81) | |
Text
Gdcc& fdr eW5 g
- y e.
4 UNITED STATES j
j NUCLEAR REGULATORY COMMISSION
't WASHINGTON, D.C. 30666-0001
/
/
May 24,1999
/
{
, PIA MEMORANDUM TO:
Cynthia A. Carpenter, Chief
/'
ia, 4)4' Generic issues, Environmental, and Rulemaking Branch Division of Regulatory improvement Programs, NRR FROM:
James H. Wilson, Senior Project Manag U)(hn.)
Generic issues, Environmental, Financial, and Rulemaking Branch Division of Regulatory improvement Programs, NRR j
1
SUBJECT:
SUMMARY
OF MEETING HELD ON MARCH 2 AND 3, WITH EPRI CONCERNING RISK-INFORMED IN-SERVICE INSPECTION 1
On March 2 and 3,1999, representatives of Electric Power Research Institute (EPRI) and its contractors met with the representatives of the Nuclear Regulatory Commission (NRC) at the NRC's offices in Rockville, Maryland. The purpose of the meeting was to discuss EPRI's November 13,1998 response to NRC's June 12,1997, request for additionalinformation (RAl) related to the approach described in EPRI topical report, TR-106706, Risk-Informed Inservice inspection Evaluation Procedure. Attachment 1 provides a list of meeting attendees and their affiliations. Attachment 2 provides the presentation materials used by EPRI at the meeting.
The meeting was held to provide clarification regarding EPRI's November 13,1998, RAI responses and to address any additional NRC questions so that a timely draft safety evaluation report on the proposed approach could be completed. Additional questions have been raised during the staff's review of the topical report and EPRI's RAI responses. These questions were discussed during the two-day meeting and EPRI informally proposed responses to them on March 9,1999. A copy of these questions and the associated responses are provided as Attachment 3.
Based on discussions during the meeting, EPRI plans to revise the topical report to incorporate lessons leamed from the pilot applications (Vermont Yankee and ANO-2) of the methodology; methodology enhancements which have evolved since the June 1996 report was issued; and to provide further clarification and guidance, based on NRC RAls.
Some of the key issues and actions resulting from the meeting are described below:
1.
EPRI clarified the role of augmented inspection programs that will be maintained outside the scopo of Section XI with the following understanding (s):
1 The RI-ISI program would include Category A (GL 88-01," NRC Position on V('b;L IGSCC in BWR Austenitic Stainless Steel Piping") welds that were formally a part of the IGSCC program for BWRs; all others (Categories B-G) will still be g C I M t
inspected per the plant program under GL 88-01.
ht C
q
' l The RI-ISI program would replace augmented programs for thermal fatigue j
i (NRC Bulletins 88-08, " Thermal Stresses in Piping Connected to Reactor l
Coolant Systems" and 88-11. " Pressurizer Surge Line Thermal Stratification,"
i information Notice 93-020," Thermal Fatigue Cracking of Feedwater Piping to Steam Generators"), and for IGSCC concems for PWRs (NRC Bulletin 79-17,
" Pipe Cracks in Stagnant Borsted Water Systems at PWR Plants").
The plant's existing Flow Assisted Corrosion (FAC) program in response to i
GL 89-08, " Erosion / Corrosion-Induced Pipe Wall Thinning," would not be i
j l
impacted by the RI-ISI.
l l
The topical report guidance [as presented and discussed at the meeting by l
Structural Integrity Associates (SIA)) will be revised to provide utilities with an l
altomative for localized corrosion (MIC, pittlng) examinations currently required l
by GL 89-13. " Service Water System Problems Affecting Safety-Related l
Equipment."
l l
2.
EPRI will pursue closure of NRC RAls 1-4 and I-5 with the NEl.
1 j
3.
As a result of questions raised during the meeting regarding the applicability of data to support EPRI's service history failure potential assessments, EPRI will provide a copy of the operating experience database and associated data analysis to Bob Hermann of l
NRC/NRR and the INEEL.
4.
EPRI provided handouts of proposed templates for conducting Code Case N-560, "Altemative Examination Requirements for Class 1. Category B-J Piping Welds,Section XI, Division 1," and Code Case N 578, " Risk-informed Requirements for Class 1,2, and 3 Piping, Method B,Section XI, Division 1," evaluations. General consensus is that Code Case N 560 may become a special case of Code Case N-578.
The staff discussed severalissues that were only partially addressed in some of the RAls. The discussions indicated that the approach may be acceptable but that the staff would need to see the actual discussion in the final draft Topical before it can determine if the issue is appropriately addressed. For the following issues, the staff requested no direct written response but does expect more extensive and organized discussions in the draft TR.
1.
EPRI presented a flowchart and general overview of the methodology to clarify the role l
of qualitative and quantitative assessments, and use of plant expertise in final element l
selection process. The draft revision of Chapter 6, inspection Location Selection, of the topical report will be updated to include more prescriptive guidance regarding the qualitative and quantitative evaluation of risk impact changes due to the RI-ISI program and the responsibility of plant experts to review and approve the safety-significance classification.
j 2.
In general, more guidance is needed in the TR to require licensees to document their decision processes with regard to: 1) plant-specific service / failure history feedback relative to damage mechanisms assessments and ultimate segment risk rankings, and
- 2) licensee adjustments to element selections to affect the overall impact to risk.
i
i-u 3.
The written responses to the RAls included several discussions whereby bounding analyses are used to justify the CCDP and CLERP high, medium, and low guideline by relating the selected guidelines to the 1E-6 and 1E-7 negligible change guidelines in RG 1.174. The discussion in the revised TR should combine and structure the relevant RAI responses into a well organized discussion, and should indicate how the bounding pipe failure frequency estimates were developed.
4.
The responses to the RAls included several discussions whereby bounding analyses are used to justify that the total risk contribution from all Low Safety Significant segments is negligible. The discussion in the revised TR should combine and structure the relevant RAI responses into a well organized discussion, and should
' indicate how the bounding pipe failure frequency estimates were developed.
5.
The " Conditional" Coro damage probability and large early relief probability is similar to those used in the WCAP methodology. During the review of the WCAP methodology the staff found that " conditional" was misleading and that a more appropriate label would be the " Change"in CDP and LERP. The staff also pointed out that all the relevant parameters were not included in some of the equations in the TR and the RAI responses. EPRI indicated that they would adapt this terminology and would change the equations to include all the relevant parameters and thus clarify the actual calculation performed.
6.
The staff noted that some of the bounding values in the Table C-2 in RAI responses C-4, C-11, and C14 were not consistent with the CCDP bounding guidelines. That is, some elements have a bounding CCDP as high as 2.5E-4 (above the 1E-4 guideline for High safety significant) yet are assigned a Medium consequence category. EPRI stated that these are bonding values and the results for specific plants were expected to be lower. The staff indicated that the guidelines should be consistently applied and that if a licensee does not choose to use the bounding classification, they should estimate a CCDP and compare directly to the CCDP guidelines.
Several issues were also discussed for which the staff expressed concem that the proposed methodologies had not been used in the pilot applications or that the acceptability of use of the methodology in a pilot may not be generically applicable. These issues include:
1.
The MARCOV methodology is an optional method to calculate the anticipated change in risk due to the change in inspection. The staff pointed out that this methodology was being reviewed by a contractor in the Office of Research (RES) and the contract was only recently put into place. The topic was not discussed in detail at the meeting. As soon as the contractor had reviewed the delivered material, a telephone conversation i
or visit, as needed, will be arranged.
2.
EPRI presented the methodology to determine the number and location of elements to select in Service Water (or other raw water) systems. Currently, such systems have few, if any,Section XI inspections but many inspection programs have been developed in response to issues identified in past Generic Letters (e.g., augmented programs).
EPRI proposed using the approach eventually accepted by the staff for one of the pilot applications. The staff pointed out that the staff only accepted the application of the methodology at the pilot after extensive review, and that reviews of non-pilot applications are intended to be much less extensive. The acceptance of the applicant's
4 analysis and results was based principally on the fact that, in the proposed program, more elements were being inspected than under the existing augmented program, and on the rigorous and extensive operating experience review the licensee performed.
. The revised EPRI TR willinclude a more' detailed process description / guide for licensees to conduct these" finer screening" evaluations for localized corrosion, e.g.,
service water systems. In addition, it was noted to EPRI that the element selection / volumetric examination criteria listed in the draft TR was insufficient with respect to pitting and MIC. These issues are to be addressed in the TR revision. The staff recognized the need for a different methodology to deal with augmented programs (which tend to be already inspection for cause and some of which are also characterized by non-localized degradation) but expressed concem that the development of an acceptable generic methodology addressing augmented programs within the schedule constraints will be difficult.
3.
The EPRI methodology for Class 1 piping-only, versus so-called " full plant," includes two different guidelines on the percentages of High and Medium safety significant l
welds to select for inspection. The Class 1 methodology only requires a total of 10% of all welds, preferentially distributed to the higher safety significant sites. The full plant methodology requires 25% of High, and 10% of Medium safety significant welds to be selected for inspection. EPRI presented arguments that equivalent results were obtained for the two methodologies during the pilot applications. The staff agreed that equivalent results in the pilots were obtained but will continue to consider the advisability of two different selection criteria depending on the scope of the program.
i 4.
EPRI also introduced a new variation of the previously approved methodology. EPRI l
proposed that licensees which only use the Class 1 option would be exempt from both qualitative and quantitatively evaluation of the potential change in risk. EPRI claimed that a generic evaluation had st awn that reducing Class 1 inspections from 25% to 10% of the total welds (and t&. sting the inspections to weld exposed to potentici degradation mechanisms) represented a risk reduction. When questioned if this was generically applicable to all plants, or applicable to the average of all plants, EPRI indicated that they had developed a screening methodology which can identify plants that would not be bounded by the generic evaluation and that these plants would need an explicit change in risk evaluation. The screening methodology is based on an extensive evaluation of the potential degradation mechanisms in Class 1 piping systems. The staff opined that the screening analysis may well require as much effort as the change in risk evaluation, but must await the written description to review the proposal.
The following schedule and milestones were proposed at the meeting:
i EPRI will provide a revised topical report (including those items discussed above) to the l
NRC by April 15,1999.
NRC and its contractors will continue to identify any additional questions to be resolved by phone or by meeting with EPRI prior to issuance of the draft TER.
r-5-
l The draft SER will be issued by mid-June,1999, to support ACRS meetings. Assuming
=
a final presentation to ACRS in August,1999, the final SER siiould be completed by September 30,1999.
Project No. 669 l
Meachments: As stated Distribution:
Central Files Public RGEB r/f - GBagchi SDinsmore M Rubin RBarrett DMatthews SNewberry JHWilson S. Ali RHermann WBateman BZalcman g (6lRl99 2c/9)
DOCUMENT NAME: g:\\jhw1\\mtsm.302 ne MFt##.
9EA C:SPSd)
C5EMCE g C RGEBj f
OFFICE RGEB SC:RGEB JHWh,) BZah RBarref)f/
Wddi3....DdbrpeNr NAME DATE 5/7/9[
5/ 7[99 k 5//4/99 '
SLf)/99 SM199 OFFICIAL RECORD COPY l
l l
l 4
l...
r i
l l The draft SER will be issued by mid-June,1999, to support ACRS meetings. Assuming a final presentation to ACRS in August,1999, the final SER should be completed by September 30,1999.
Project No. 669
Attachment:
- As stated Distribution:
Central Files Public RGEB r/f GBagchi SDinsmore M Rubin RBarrett DMatthews SNewberry JHWilson S. Ali RHermann W ateman BZaleman W249)
DOCUMENT NAME: g:\\jhwi\\mtsm.302 e /4Fa'#. 9 6\\Ml99 OFFICE RGEB SC:RGEB C:SPSd C:EMCE} g
,C:RGEB RBarre'[//
WENih,0 Obrpek NAME JHWh)
BZa i
t DATE
. 5/7/9[
5/ 7[99 k 5//4/99 ~
SL7)/99 SM99 OFFICIAL RECORD COPY l
l j
i I
, -. The draft SER will be issued by mid-June,1999, to support ACRS meetings. Assuming a final presentation to ACRS in August 1999, the final SER should be completed by September 30,1999.
l
)
Project No. 669 Attachments: As stated I
' Projtet Na. 669 Electric Power Research Institute-Mr. Kurt Yeager.
President and CEO Electric Power Research institute 3412 Hillview Avenue l
Palo Alto, CA 94303
.i Robin Jones Vice Presidet and Chief Nuclear Officer Electric Power Research Institute 3412 Hillview Avenue Palo Alto, CA 94303 Mr. Raymond C. Torok Project Manager, Nuclear Power Group Electric Power Rose Mr. Kurt Yeager President and CEO Electric Power Research Institute 3412 Hillview Avenue Palo Alto, CA 94303 Mr. Gary L. Vine -
Senior Washington Representative Electric Power Research Institute 2000 L Street, N.W., Suite 805 Washington, DC 20036' Mr. Bindi Chexal Electric Power Research Institute Post Office Box 10412 Palo Alto, CA 94303 i
i 1
l 1
6
LIST OF ATTENDEES AT MEETING WITH EPRI HELD IN ROCKVILLE, MARYLAND ON MARCH 2 AND 3,1999 NAME AFFILIATION G. Bagchi NRC S. Ali NRC S. Dinsmore NRC R. Prato NRC R. Hermann NRC J. H. Wilson NRC W. Bateman NRC N. Anderson INEEL J. Trainer INEEL J. Mittman EPRI F. Ammirato EPRI P. O'Regab EPRI K. Fleming ERIN M. Smith Entergy G. Smith NYPA G. Lictra StructuralIntegrity V. Dimitrijevic Duke Engineering & Services R. Fougeroutte Inservice Engineering 1
NRC/EPRI Meeting On EPRI RI-ISI Methodology Rockville Maryland March 2 & 3,1999 MAP APR 1 ENI Agenda
. Overview Damage Mechanism Assessment Consequence Assessment
. Delta CDF
. Schedule, what additional topics does NRC need addressed on EPRI RI-ISI topical?
EPEl 1
ATTACHMENT 2
General Considerations
. TR-106706 submitted
. VY & ANO2 Pilots submitted
. VY & ANO2 RAls submitted
. EPRI RAls submitted
. Cross reference of RAls
. Revised EPRI RI-ISI topical being prepared EPfiEl Revise TopicalIncorporates
. Consistent with pilots and RAI responses
. Lessons learned from pilots
. Lessons learned from RAls and NRC comments
. Improved technical basis
. New EPRI research E PIEI 2
I Templates
. Will follow NEl formatted RI-ISI templates (copies attached)
. Two versions
- Per ASME code case N-560 (examination category BJ)
- Per ASME code case N-578 (expanded scope)
. Augment programs impact - addressed
. Current licensing basis - addressed Ef=fal Augmented Programs
. IGSCC - NUREG-0313 (applicable to BWRs)
- All others will be coordinated and addressed to ensure unified approach based on industry & NRC interactions
. Service water (applicable dependent on scope)-
details in presentation today
. All others (applicable dependent on scope) will be coordinated and addressed based on interactions between industry & NRC er=ral 3
Degradation Analysis
. Service water & MIC considerations &
topical philosophy and pilot plant lesson learned
- Per EPRI topical, risk category 1,2, & 3 required 25% sampling t
- Feedback from pilots indicated this is impractical
- Optional severity screen (as review &
improved at ANO2) developed EPet Consequence Analysis
. Revised consequence sections developed
. Incorporates lessons learned from pilots
. Incorporated into ASME code cases as currently being revised (in ASME approval process)
EPIEl 4
Delta CDF
. Where necessary, topical requires qualitative or quantitative assessment
. Does not dictate quantitative method
- topical discusses 2 methods
. RI-ISI intuitively meet RG 1.174 & 1.178 delta CDF requirements es=ei Conclusions
. What additional information does NRC need addressed on EPRI RI-ISI topical?
. SCHEDULE!
er=ei 5
Table IRAls on EPRI TR.106706 VY RAls ANO-2 Provided in This RAl#
Description RAls Transmittal I. GENERAL G-la Meets Current Regulation YES YES YES G-lb Defense in Depth Maintained YES YES YES YES YES YES G-1c Safety Margins Maintained YES YES YES G-1d RiskImpact is Small G-le Performance Based YES YES YES Implementation / Monitoring YES G-2 Decision Criteria G-3 Licensing Basis & PRA Validation YES YES YES G-4 PRA Acceptance Standards YES YES YES YES YES YES G-5 Implementation, Monitoring & Corrective Actions G-6 Containment Integrity /LERF YES YES YES G-7 Reliability Criterion, NDE & POD YES YES YES G-8 PRA Uncertainties YES YES G-9 Criterion on Selections YES YFS YES YFS G-10 Reducing influence of Uncertainty G-11 Quantification of CDF/LERF YES YES YES G-12 Increased Frequency of leaks YES YES G-13 Benchmark to Quantitative RI-ISI YES YES YES G-14 CDF vs. LERF YES YES YES YES YES G-15 SatJy Margins YES G-16 Uncertainties G-17 Plant-Specific Safety Margins YES YES G-18 10CFR50.55a YES YES YES YES YES YES G-19 Scope G-20 Industry Failures-feedback YES YES YES G-21 Target Leak Rate YES G-22 Uncertainty in Results YES G-23 Leak Before Break YES G-24 DM Database G-25 Role of PRA YES YES YES YES YES YES G-26 Application on a System Basis
- 11. CONSEQUENCE EVALUATION C-1 Worst Case Break YES YES C-2 Ranges for CCDP, Shutdown YES YES YES YES YES YES C-3 Table 3.1 YES YES YES C-4 Table 3.2 C-5 Numerical Conformation YES YES YES YES YES YES C-6 Table 3.1 YES YES YES C-7 Table 3.1 C-8 CCDP # vs. Tables YES YES YES C-9 Direct / Indirect Effects YES YES YES YES YES C-10 CCDP Criterion YES YES YES C-11 Exposure Time C-12 Break Sizes YES YES YES YES C-13 Tables C-14a Plant Safety Functions YES YES YES C-14b CCDP vs. CDF YES YES YES C-15 Plant Safety Functions YES
,YES YES
RAl#
Description VY RAls ANO-2 Provided in This RAls Transmittal C-16 Truncation levels YES YES YES C-17 Common Pipe Segments YES YES YES C-18 Breaks vs. leaks YES YES YES C-19 Common Cause Failures YES YES YES C-20 Table 3.2 YES YES 111. FAILURE POTENTIAL F-1 Repairs & Overlays YES F-2 Common Cause Failures
~,
YES YES F-3 Service Data YES YES F-4 Assignment of DMs YES YES F-S Relative Potential Between DMs YES YES YES F-6 Basis for Potential YES YES F-7 All Degradation Mechanisms YES YES F-8 Benchmarking of DM Assignments YES F-9 Industry & Plant Data YES YES F-10 Low Probability DMs/ Events YES YES F-11 Consistency of DM Table YES IV. RISK RANKING R-1 Sensitivity Studies - Risk Impact YES YES R-2 Table 3.1 & 3.2 YES YES R-3 CDF/LERF YES YES YES R-4 Group - Small Contribution to CDF(piping)
YES YES YES R-S Uncertainties YES YES R-6 Compare to F-V & RAW YES R-7 Shutdown YES YES YES R-8 Criteria YES YES R-9 POD Role YES YES YES V. ELEMENT SELECTION E-1 High SS Welds YES YES YES E-2 Decision Criteria YES YES YES E-3 Examples YES YES YES VI. INSPECTION PROGRAM I-1 Large vs. Small Segment YES YES YES l-2 Augmented Programs YES YES YES 1-3 Frequency of Inspections.
YES YES YES I-4 New Techniques YES 1-5 10 Year Interval YES YES YES 1-6 CATI = 100%
YES YES 1-7 Physical Limitations YES 1-8 Basis for Sampling Percentages YES YES YES 1-9 Examples YES YES 1-10 Sampling Percentages YES YES I-11 Increases in Inspection Requirements YES YES YES 1-12 POD YES YES YES l-13
- of Inspections per Segment YES YES YES l-14 Performance Monitoring Program YES YES YES 1-15 Element Selection Process YES YES YES VII. PLANT WALKDOWN W-1 PRA vs. Actual Plant Configuration YES YES YES W-2 Indirect Effects YES YES YES
N560 Template RISK-INFORMED INSERVICE INSPECTION (RI-ISI)
PROGRAM SUBMITTAL 1
03/02/99
RISK-INFORMED INSERVICE INSPECTION PROGRAM PLAN Table of Contents 1.
Introduction / Relation To NRC Regulatory Guide RG-1.174 2.
Proposed Attemative to ASME Section XI Inservice Inspection Program i
3.
Risk Informed ISI Process 3.1 Scope of Program 3.2 Consequence Evaluation 3.3 Failure Assessment 3.4 Risk Ranking Results 3.5 Structural Element and NDE Selection 3.6 Program Relief Requests 3.7 Change in Risk 4.
Implementation and Monitoring Program 5.
Proposed ISI Program Plan Change i
6.
References / Documentation NOTE: Items shown in italics reflect plant-specific information that needs to be provided in an actual risk-informed ISI submittal.
i 03/02/99 2
1.
INTRODUCTION / RELATION TO NRC REGULATORY GUIDE RG-1.174 Introduction Inservice inspections (ISI) are currently performed on piping to the requirements of the ASME Boiler and Pressure Vessel Code Section XI,1989 Edition as required by 10CFR50.55a. The unit is currently in the thirdinspection interval as defined by the Code for Program B.
The objective of this submittal is to request a change to the ISI program plan for piping through the use of a risk-informed ISI program. The risk informed process used in this submittal is described in EPRI TR 106706, Final Report, ' Risk-Informed Inservice inspection Evaluation Procedure,"and conforms with the framework described in ASME Code Case N-560, "Altemative Examination Requirements for Class 1, Category B Jpiping WeldsSection XI, Division I."
As a risk-informed /performanced based application, this submittal meets the intent of Regulatory Guide 1.174.
PRA Ouality The current plant-specific probabilistic risk assessment (PRA) model was used to evaluate the consequences of pipe ruptures.
PRA model updates are scheduled for 18-month intervals to coincide with the refueling outages. The administrative guidance for this activity is contained in our administrative procedures.
The RI-ISI evaluation included a determination that the PRA model and supporting documentation accurately reflects the current plant configuration and operational practices consistent with its intended application. Furthermore, an evaluation based on the Appendix B of the EPRI PSA Applications Guide, was performed to confirm that the PRA conforms to the industry state-of-the-att with respect to completeness of coverage of potentialscenarios.
The PRA model has been extensively reviewed including peer reviews during the IPEprocess and internal reviews during the PRA model updates.
2.
PROPOSED ALTERNATIVE TO ASME SECTION XIISI PROGRAM ASME Section XI Categories B-F, B-J, C-F-1 and C-F-2 currently contain the requirements for examining (via NDE) piping components. The proposed attemative program is limited to ASME Section XI Category B-Jpiping components. Other non-related portions of the ASME Section XI Code (e.g. Category B-F) will not be affected. The alternative risk-informed inservice inspection (RI-lSi) program is described in EPRI TR 106706, Final Report,
- Risk-Informed Inservice Inspection Evaluation Procedure,"and ASME Code Case N 560, " Alternative Examination Requirements for Class 1, Category B-J Piping WeldsSection XI, Division I ". The RI ISI program will be substituted for the current examination program on Category B-J p/ ping components in accordance with 10 CFR 50.55a(a)(3)(i) by alternatively providing an acceptable level of quality and safety.
3
l In addition, the augmented inspection programs remain unchanged.
3.
RISK-INFORMED ISI PROCESSES The processes used to develop the RI-ISI program are consistent with the methodology described in EPRI TR 106706, Final Report, ' Risk Informed Inservice Inspection Evaluation Procedure".
The process that has been applied, involves the following steps:
Scope Definition Consequence Evaluation Failure Assessment Risk Evaluation Element /NDE Selection implement Program e
Feedback Loop 3.1 Scope of Program The systems to be included in the risk-informed ISI program are provided in Table 3.1-1. The as-operatedpiping andinstrumentation diagrams were used to detine system boundaries.
3.2 Consequence Evaluation The consequences of pressure boundary failures was identified in terms of core damage and containment performance (isolation, bypass and large, early release). The impact on these measures due to both direct and indirect effects was considered.
3.3 Failure Assessment Failure estimates were generated utilizing industry failure history, plant specific failure history and other relevant information. These failure estimates were determined using the guidance provided in EPRI TR 106706 and ASME Code Case N 560.
34 Risk Evaluation in the preceding steps, each run of piping within the scope of the program was evaluated to determine its impact on core damage and containment performance (isolation, bypass, and large, early release) as well as its potential for failure. Given the results of these steps, piping 4
L L
1 segments are then defined as continuous runs of piping potentially susceptible to the same type (s) of degradation and whose failure will result in similar consequence (s). Segments are
- then ranked based upon their risk significance as defined in EPRI TR-106706 and ASME Code Case N-560.
l
' The results of these calculations are presented in Table 3.4-1 3.5-Structural Element and NDE Selection
- ASME Code Case N560 requires that 10% of the Category B-J population be selected for inspection and appropriate non-destructive examination (NDE) methods tailored to the applicable degradation mechanism be defined. As required by ASME Code Case N560, the locations chosen for inspection were aliocated to the higher risk regions as defined in step 3.4.
The results of this effort are presented in Table 3.5-1. In addition, all Category B-J piping components, regardless of risk classification, will continue to receive Code required pressure testing, as part of the current ASME Section XI program.
AdditionalExeminations The program in all cases will determine through an engineering evaluation the root cause of any unacceptable flaw or relevant condition found during examination. The evaluation willinclude the applicable service conditions and degradation mechanisms to establish that the element (s) will stillperform their intended safety function during subsequent operation. Elements not meeting this requirement will be repaired or replaced.
The evaluation willinclude whether other elements on the segment or segments are subject to -
the same root cause and degradation mechanism. Additionalexaminations willbe performed on these elements up to a number equivalent to the number of elements required to be inspected on the segment or segments initially. If unacceptable flaws or relevant conditions are again found similar to the initialproblem, the remaining elements identified as susceptible will be examined. No additional examinations will be performed if there are no additional elements identified as being susceptible to the same service related root cause conditions or degradation mechanism.
3'.6
. Program Relief Requests Alternate methods are specified to ensure structural integrity in cases where examinatio'1 methods cannot be applied due to limitations such as inaccessibility or radiation exposure hazard.
An attempt has been made to provide a minimum of >90% coverage (per Code Case N-460) when performing the risk-informed examinations. However, some limitations will not be known until the examination is performed, since some locations may be examined for the first time by the specified techniques.
At this time, all the risk-informed examination locations that have been selected provide >90%
coverage.' In instances where a location may be found at the time of the examination that it 5
does not meet >90% coverage, the process outlined in EPRI TR 106706, Final Report will be followed..
3.7 Change in Risk The risk informed ISI program has been conducted in accordance with Regulatory Guide 1.174, and the risk from implementation of this program is expected to decrease when compared to that estimated from current requirements.
This evaluation identified the allocation of segments into High, Medium, and Low risk regions of the EPRI TR-106706 and ASME Code Case N560 risk ranking matrix, and then determined for each of these risk classes what inspection changes are proposed for each of the locations in each segment. The changes include changing the number and location of inspections within the segment and in many cases improving the effectiveness of the inspection to account for the findings of the RI-ISI degradation mechanism assessment. For example, for locations subject to thermal fatigue, inspection locations have an expanded volume and the examination is focused to enhance the probability of detection during the inspection process.
The results from the risk comparison are shown in Table 3.7-1. As seen from the table, the RI-ISI program reduces the risk associated with piping slightly more than the current Section XI program while reducing the number of examinations.
Defense-In-Death The intent of the inspections mandated by ASME Section XI for piping welds is to identify conditions such as flaws or indications that may be precursors to leaks or ruptures in a system's pressure boundary. Currently, the process for picking inspection locations is based upon structural discontinuity and stress analysis results. As depicted in ASME White Paper 92-01-01 Rev.1, " Evaluation of inservice inspection Requirements for Class 1, Category B-J Pressure Retaining Welds", this method has been ineffective in identifying leaks or failures. EPRI TR-i 106706 and Code Case N560 provides a more robust selection process founded on actual i
service experience with nuclear plant piping failure data.
This process has.two key independent ingredients, that is a determination of each location's susceptibility to degradation and secondly, an independent assessment of the consequence of the piping failure. These two ingredients not only assure defense in depth is maintained, but actually increased over the current process. First off, by evaluating a location's susceptibility to degradation, the likelihood of finding flaws or indications that may be precursors to leak or ruptures is increased. Secondly, the consequence assessment effort has a single failure criterion. As such, no matter how unlikely a failure scenario is, it is ranked High in the I
consequence assessment, and at worst Medium in the risk assessment (i.e., Risk Category 4),
if as a result of the failure there is no mitigative equipment available to respond to the event. In addition, the consequence assessment takes into account equipment reliability, so that less reliable equipment is not credited as much as more reliable equipment.
All locations within the reactor coolant pressure boundary will continue to receive a system pressure test and visual VT-2 examination as currently required by the Code regardless of its risk classification 6
l l
4.
IMPLEMENTATION AND MONITORING PROGRAM Upon approval of the RI ISIprogram, procedures that comply with the guidelines described in
\\
EPRI TR-106706 and ASME Code Case N560, will be prepared to implement and monitor the
- program. The new program willbe integratedinto the existing ASME Section XIinterval.
The applicable aspects of the Code not affected by this change would be retained, such as inspection methods, acceptance guidelines, pressure testing, corrective measures, documentation requirements, and quality control requirements. Existing ASME Section XI program implementing procedures would be retained being modified to address the RI-ISI process The proposed monitoring and corrective action program will contain the following elements:
A. Identify B. Characterize C.
(1) Evaluate, determine the cause and extent of the condition identified (2) Evaluate, develop a corrective action plan or plans D. Decide E. Implement F. Monitor G. Trend The RI ISI program is a living program requiring feedback of new relevant information to ensure the appropriate identification of high safety significant piping locations. In addition, significant changes may require more frequent adjustment as directed by NRC bulletin or Generic Letter requirements, or by plant specific feedback.
5.
PROPOSED ISI PROGRAM PLAN CHANGE A comparison between the RI-ISI program and the current ASME Section XI program requirements for Category B-J piping is given in Table 5-1. An identification of piping segments that are part of plant augmented programs is also included in Table 5-1.
The initialprogram will be started in the inspection period current at the time of program approval. For example the second inspection period of the third inspection interval for Unit 1 ends on October 14,2000. If the program is approved such that a refueling outage remains in the second period, 66% of the required remaining examinations will be performed by the end of the inspection interval per the risk-informed inspection program.
6.0 REFERENCES
/ DOCUMENTATION EPRI TR 106706, Final Report, " Risk Informed Inservice Inspection Evaluation Procedure,"
f 1
7
)
I l
American Society of Mechanical Engineers, Code Case N-560, "Altemative Examination Requirements for Class 1, Category B Jpiping WeldsSection XI, Division I."
Sucoortina Onsite Documentation i
k 8
l Table 3.1-1 System Selection and Segment Definition
System Description
Number of Segments Core Spray (CS)
High Pressure Coolantinjection (HPCI)
Main Steam (MS)
Main Steam Drains (MSD)
Reactor Core Isolation Cooling (RCIC)
Reactor Water Recirculation (RWR)
ResidualHeat Removal (RHR)
Total 9
7 yrog ke st ia RC y
roge taC ks iR6 5y ro y
g ro ke st g ia e RC taC k
4 s
i y
R r
1 o
- y g
- 4. b ke st 3s ia en RC t
be l
am Tg e
3 S
yr f
o o
g r ke st e ia b RC muN 2yrog ke st ia RC 1
y rog ke st ia RC m
U L
e y
A t
ea C W D C R R G T
I s
r r y
op P F S S C W H W O
I S
CS H M M M R R R R T
I
.p 7
sn i
I p
k "-
p.
s i :
o RC P y
ro p
g s
e n
I ta C
k s
p i
o R6 P
y r
p o
5 s
g y n I
e r
t o
a g
C ke st p
k ia o
s RC P iR y
.p b
4 sn e
y I
s r
1 o og 5it ke
.c st p
3e ia o
ep RC P
l s bn aA r
.y Ts p
o n
3 s
g n
en, o
y I
t i
r o
ai t
o ct a
g c
c ke k e o st p
sp is r
L ia o
r n RC P ai f
r o
luo icf r
t d
e p
at r
e b
2 s
pc m
y n e
I al r
e u
o n
is N
g ddss ke lee st p
l ia o
RC P
ww f foo r r ee p
bb 1
s mm y n uu I
r nn o
ee g
hh ke t t st p
nd ia o
oe RC P it tc la e up ps on m
U L
PI C W D C R R C A
e I
T t
y S P F S S C W H W O
os pp I
s S
C H M M M R R R R T
PI n i
1 7 d l
y O tog I
ke S
st I
ia I
RC R y
r o
d g
l e
O taC I
)mk S
I s
i I
ar R6 R
g or p
5 d l
d y O l
r O
o g
I sv ke S
I st I
i a I
S RC R
I I
R(
4 d l
y r
y O r
o o
1 g
gI 7-e keS
.t I
st 3a ia I
eC RC R lb ks ai T R 3 d l
y y O b
ro s
g I
n ke S
o st I -
i ia I
t RC R cepsn 2 d l
I f
y O o
ro r
g I
e ke S
b st I
ia I
m RC R uN 1
d l
y O rog I
ke S
I st i a I
RC R m
U LA e
C W D C R R C T
I t
y S P F S S C W H W O
I s
S C H M M M R R R R T
N578 Template 1
I RISK-INFORMED INSERVICE INSPECTION (RI-ISI)
PROGRAM SUBMITTAL s
03/02/99 1
F-RISK-INFORMED INSERVICE INSPECTION PROGRAM PLAN Table of Contents 1.
Introduction / Relation To NRC Regulatory Guide RG-1.174 2.
Proposed Altemative to ASME Section XI Inservice Inspection Program 3.
Risk-Informed ISI Process i
3.1
" cope of Program 3.2 vonsequence Evaluation
{
3.3 Failure Assessment j
3.4 Risk Ranking Results 3.5 Structural Element and NDE Selection 3.6 Program Relief Requests 3.7 Change in Risk 4.
Implementation and Monitoring Program 5.
Proposed ISI Program Plan Change 6.
References / Documentation NOTE: Items shown in italics reflect plant-specific information that needs to be 1
- provided in an actual risk-informed ISI submittal.
i I
03/02/99 2
l
1.
INTRODUCTION / RELATION TO NRC REGULATORY GUIDE RG-1.174 Introduction Inservice inspections (ISI) are currently performed on piping to the requirements of the ASME Boiler and Pressure Vessel Code Section XI,1989 Edition as required by 10CFR50.55a. The unit is currently in the thirdinspection interval as defined by the Code for Program B.
The objective of this submittalis to request a change to the ISI program plan for piping through the use of a risk-informed ISI program. The risk informed process used in this submittal is described in EPRI TR 106706, Final Report, " Risk-Informed Inservice Inspection Evaluation Procedure,"and conforms with the framework described in ASME Code Case N578, " Risk-Informed Requirements for Class 1, 2, and 3 Piping, Method B."
As a risk-informed application, this submittal meets the intent of Regulatory Guide 1.174.
PRA Ouality The current plant specific probabilistic risk assessment (PRA) model was used to evaluate the consequences of pipe ruptures.
PRA model updates are scheduled for 18-month intervals to coincide with the refueling outages. The administrative guidance for this activityis containedin our administrative procedures.
The RI-ISI evaluation included a determination that the PRA model and supporting documentation accurately reflects the current plant configuration and operational practices consistent with its intended application. Fut*hermore, an evaluation based on the Appendix B of the EPRI PSA Applications Guide, was performed to confirm that the PRA conforms to the industry state-of-the-att with respect to completeness of coverage of potential scenarios.
The PRA model has been extensive!y reviewed including peer reviews during the IPE process and intemal reviews during the PRA model updates.
2.
PROPOSED ALTERNATIVE TO ASME SECTION XI ISI PROGRAM ASME Section XI Categories B-F, B-J, C-F-1 and C-F-2 currently contain the requirements for examining (via NDE) piping components. This current program is limited to ASME Class 1 and Class 2 piping. The alternative risk-informed inservice inspection (RI-ISI) program for piping is described in EPRI TR 106706, and ASME Code Case N578. The RI-ISI program will be substituted for the current examination program on piping in accordance with 10 CFR 50.55a(a)(3)(i) by alternatively providing an acceptable level of quality and safety. Additionally, the attemative program will not be limited to ASME Class 1 or Class 2 piping encompassing the high safety significant piping segments regardless of ASME Class. Other non-related portions of the ASME Section XI Code will not be affected. EPRI TR 106706 and ASME Code Case N578, provide requirements defining the relationship between the risk-informed examination program and the remaining unaffected portions of ASME Section XI.
3 l
In addition, the augmentedinspection programs remain nnchanged.
3.
RISK-INFORMED ISI PROCESSES The processes used to develop the Rl-ISI program are consistent with the methodology described in EPRI TR 106706.
The process that is being applied, involves the following steps:
Scope Definition Consequence Evaluation -
Failure Assessment Risk Evaluation Element /NDE Selection Implement Program Feedback Loop 3.1 Scope of Program
- The system (s) to be included in the risk-informed ISI program are provided in Table 3.1 1. The as-operatedpiping andinstrumentation diagrams were used to detine system boundaries.
3.2 Consequence Evaluation The consequence (s) of pressure boundary failures was identified in terms of core damage and containment performance (isolation, bypass and large, early release). The impact on these measures due to both direct and indirect effects was considered-3.3 Failure Assessment Failure estimates were generated utilizing industry failure history, plant specific failure history and other relevant information. These failure estimates were determined using the guidance provided in EPRI TR 106706 and ASME Code Case N-578.
3.4 -
Risk Evaluation in the preceding steps, each run of piping within the scope of the program was evaluated to
- determine its impact on core damage and containment performance (isolation, bypass, and large, early release) as well a's its potential for failure. Given the results of these steps, piping segments are then defined as continuous runs of piping potentially susceptible to the same type (s) of degradation and whose failure will result in similar consequence (s). Segments are 4
f j
7 1
1 then ranked based upon their risk significance as defined in EPRI TR-106706 and ASME Code Case N-578.~
The results of these calculations are presented in Table 3.4-1 3.5 Structural Element and NDE Selection -
in general, ASME Code Case N578 requires that 25% of the locations in the high risk regions (i.e. risk categories 1,2 & 3) and 10% of the locations in the medium risk regions (i.e. risk categories 4 & 5) be selected for inspection and appropriate non-destructive examination (NDE) methods tailored to the applicable degradation mechanism be defined. The results of this effort are presented in Table 3.5-1. In addition, all in scope piping components, regardless of risk.
classification, will continue to receive Code required pressure testing, as part of the current '
ASME Section XI program. Non code piping within the scope of evaluation willrequire pressure testing consistent with current code requirements.
AdditionalExaminations
' Since the risk informed inspection program may require examinations on a number of elements constructed to lesser pre-service inspection requirements, the program in all cases will determine through an engineering evaluation the root cause of any unacceptable flaw or relevant condition found during examination. The evaluation willinclude the applicable service conditions and degradation mechanisms to establish that the element (s) willstillperform their intended safety function during subsequent operation. Elements not meeting this requirement willbe repaired orreplaced.
The evaluation willinclude whether other elements on the segment or segments are subject to the same root cause and degradation mechanism. Additional examinations will be performed on these elements up to a number equivalent to the number of elements required to be inspected on the segment or segments initially. If unacceptable flaws or relevant conditiono are
' again found similar to the initial problem, the remaining elements identified as susceptible will be examined. No additional examinations will be performed if there are no additional elements identified as being susceptible to the same service related root cause conditions or degradation mechanism.
- 3.6 Program Relief Requests Alternate methods are specified to ensure structural integrity in cases where examination methods cannot be applied due to limitations such as inaccessibility or radiation exposure hazard; An attempt has been made to provide a minimum of >90% coverage (per Code Case N-460) when performing the risk-informed examinations. However, some limitations willnot be known until the examination is performed, since some locations may be examined for the first time by the specified techniques.
5
o At this time, all the risk-informed examination locations that have been selectedprovide >90%
coverage. In instances where a location may be found at the time of the examination that it does not meet >90% coverage, the process outlined in EPRI TR 106706, Final Report willbe followed.
- 3.7 -
Change in Risk
' The risk-informed ISI program has been conducted in accordance with Regulatory Guide 1.174, and the risk from implementation of this program is expected to decrease when compared to that estimated from current requirements.
This evaluation kfentified the allocation of segments into High, Medium, and Low risk regions of the EPRI TR-106706 and ASME Code Case N578 risk ranking matrix, and then determined for each of these risk classes what inspection changes are proposed for each of the locations in each segment.1The changes include changing the number and location of inspections within the segment and in many cases improving the effectiveness of the inspection to account for the findings of the RI-ISI degradation mechanism assessment. For example, for locations subject to thermal fatigue, inspection locations have an expanded volume and the examination is focused to enhance the probability of detection during the inspection process.
The results from the risk comparison are shown in Table 3.7-1. As seen from the table, the RI-i ISIprogram reduces the risk associated with piping slightly more than the current Section XI program while reducing the number of examinations.
\\
Defense In-Death The intent of the inspections mandated by ASME Section XI for piping welds is to ICentify conditions such as flaws or indications that may be precursors to leaks or ruptures in a sys'em's pressure boundary. Currently, the process for picking inspection locations is based upon structural discontinuity and stress analysis results. As depicted in ASME White Paper 92-01-01 i
Rev.1, Evaluation of Inservice inspection Requirements for Class 1, Category B-J Pressure
' Retaining Welds", this method has been ineffective in identifying leaks or failures. EPRI TR-106706 and Code Case N578 provides a more robust selection process founded on actual service experience with nuclear plant piping failure data.
This process has two key independent ingredients, that is a determination of each location's susceptibility to degradation and secondly, an independent assessment of the consequence of 1
the piping failure. These two ingredients not only assure defense in depth is maintained, but i
actually increased over the current process. First off, by evaluating a location's susceptibility to degradation, the likelihood of finding flaws or indications that may be precursors to leak or
' ruptures is increased. Secondly, the consequence assessment effort has a single failure-criterion. As such, no matter how 'unlikely a failure scenario is, it is ranked High in the i
consequence assessment, and at worst Medium in the risk assessment (i.e., Risk Category 4),
if as a result of the failure there is no mitigative equipment available to respond to the event, in addition, the consequence assessment takes into account equipment reliability, so that less reliable equipment is not credited as much as more reliable equipment.
)
i 6
All locations within the_ reactor coolant pressure boundary will continue to receive a system pressure test and visual VT-2 examination as currently required by the Code regardless of its risk classification.
4.
IMPLEMENTATION AND MONITORING PROGRAM Upon approval of the RI-ISI program, procedures that comply with the guidelines described in EPRI TR-106706, Final Report will be prepared to implement and monitor the program. The new program will be integratedinto the existing ASME Section XIinterval.
The applicable aspects of the Code not affected by this change would be retained, such as inspection methods, acceptance guidelines, pressure testing, corrective measures, documentation requirements, and quality control requirements. Existing ASME Section XI program implementing procedures would be retained being modified to address the RI-ISI process. Additionally the procedures will be modified to include the high safety significant locations in the program requirements regardless of their current ASME class.
The proposed monitoring and corrective action program will contain the following elements:
A. Identify B. Characterize C.
(1) Evaluate, determine the cause and extent of the condition identified (2) Evaluate, develop a corrective action plan or plans D. Decide E. Implement F. Monitor G. Trend The RI ISI program is a living program requiring feedback of new relevant information to ensure the appropriate identification of high safety significant piping locations. In addition, significant changes may require more frequent adjustment as directed by NRC bulletin or Generic Letter requirements, or by plant specific feedback.
5.
PROPOSED ISI PROGRAM PLAN CHANGE A comparison between the RI-ISI program and the current ASME Section XI program requirements for in-scope piping is given in Table 5-1. An identification of piping segments that are part of plant augmented programs is also included in Table 5-1.
The plant will be performing examinations on elements not currently required to be examined by ASME Section XI. Some examples of these additional examinations are provided below.
)
Several elements currently classified as Non-Code Class will receive examination.
These examinations will be in addition to applicable augmented inspection programs that willbe continued. Non-Code Class systems orportions of systems that are
l identrfied as having Non-Code Class piping segments requiring examination include auxiliary steam, steam generator blowdown, and feedwater. The ASME Section XI l
Code does not address Non-Code Class systems.
Several elements currently classified as Class 3 will receive examination. Class 3 systems or portions of systems that have Class 3 piping segments requiring examination include auxiliary feedwater and component cooling water. The ASME Section XI Code does not require NDE (volumetric or surface) examinations on Class 3 systems.
The ASME Section XI Code does not require volumetric and surface examinations of e
piping less than 3/8 inch wall thickness on Class 2 piping greater than 4 inch nominal pipe size (NPS). The welds are counted forpercentage requirements, but not examined by NDE. The RI-ISIprogram willrequire examination of these welds.
Examples where the risk informed process required examination and the Code did not are the suction lines to the charging pumps (high head safety injection).
The initialprogram will be started in the inspection period current at the time of program approval. For example the second inspection period of the thirdinspection interval for Unit 1 ends on October 14,2000. If the program is approved such that a refueling outage remains in the second period, 66% of the required remaining examinations will be performed by the end of the inspection intervalper the risk-informed inspection program.
6.0 REFERENCES
/ DOCUMENTATION EPRITR 106706, Final Report, " Risk-Informed Inservice Inspection Evaluation Procedure".
American Society of Mechanical Engineers, Code Case N-578, Risk-Informed Requirements for Class 1,2, and 3 Piping, Method B,Section XI, Division 1 Supportino Onsite Documentation 1
i l
i l
l l
l 8
Table 3.1-1 System Selection and Segment Definition
System Description
Number of Segments Core Spray (CS)
High Pressure Coolantinjection (HPCI)
Main Steam (MS)
Main Steam Drains (MSD)
Reactor Core Isolation Cooling (RCIC)
Reactor Water Recirculation (RWR)
ResidualHeat Removal (RHR)
Total 9
7y rog ke st ia RC yr og e
t a
C ks iR6 5yro y
g r
o ke st g ia e RC t
aC ks 4
i y
R r
1 o
- y g
4 ke
- 3. b st s ia t
en RC lbe am Tge 3
S yr f
o o
g r k e e st ia b RC muN 2yrog ke st ia RC 1
y rog ke st ia RC m
U L
e y
I A
ea C W D C R R C T
ts r r y
op P F S S C W H W O
I S
CS H M M M R R R R T
m
.p 7
sn y
I rog ke st p
ia o
RC P y
r o
p g
s e
n I
taC k
s p
i o
R6 P
y r
p o
S s
g y n I
e r
t o
a g
C ke st p
k ia o
s RC P
iRy
.p b
4 s
s y n I
n r
1 o og 5it ke
.c st p
3e ia o
ep RC P l s bn aA y
Ts p
o r
n 3
s g.
o y n en I
i r
o tai t
o ct a
g c
c ke k e o st p
sp is r
L ia o
r n RC P o
lai f
r uo icf s r
t dm e
p at a r
e b
2 s
pc r
n eg m
y I
al o r
er u
o n
N g
i sp ssn ke ddo st p
leet l i a o c
iRC P
wwep f foos r r n eei p
bbd e 1
s mmt y n uun nne I
ro eem g
hh g ke t t u st p
nd
,a ia o
oes RC P it ie tcf la ei t
upn pse ond m
U L
PI i A
e C W D C R R C T
. p.
I t
y S P F S S C W H W O
o s u I
s p
g S
C H M M M R R R R T
PInA
7 d l
y O rog I
ke S
st I -
ia I
RC R y
ro d
g l
e O
taC I
)mk S
I s
a i
I r R6 R
g orp 5 d d
y O l
l r
O o
s g
I v ke S
st I
I i a I
S RC R I
I-R
(
4 d l
y r
y O r
o o
1 g
g 7-e ke S
I
- 3. t st I
a ia I
eC RC R lb ks ai T R 3 d l
y y O b
ro s
g I
n ke S
o st I -
i ia I
tc RC R ep s
s m
n 2 d a
i l
r f
y O g
o r
o r
o p
r g
I e ke S
no b
st it I
ia I -
m RC R ec u
p N
sin d
1 d
e l
t y O n
r e
o m
g I
g ke S
u st a
I -
ia I
s RC R ie fitne m
U L
id e
I A
C W D C R R C T
tsy S P F S S C W H W O
I gu S
C H M M M R R R R T
A
8 CONSEQUENCE EVALUATION 1
3.1 FUNDAMENTAL PRINCIPLES 1 3.3 CONSEQUENCEIMPAcT GROUPS AND CONT 1GURATioNs 5 3.3.1 Initiating Event impact Group 6 3.3.2 Loss ofMitigating Ability impact Group 7 3.3.3 Combinations impact Group 15 3.3.4 Containment Performance impact Group 16 3.3.5 Examples of Consequence Evaluations 17 3.4 OmER MODES oF OPERATION 20 3.5 EXERNAL EVENTS 21 3.6 APPLICATION oF ME PLANT-SPECIF1c PSA 22 CONSEQUENCE EVALUATION 3.1 Fundamental Principles The Consequence Evaluation focuses on the impact of a pipe section failure (loss of pressure boundary integrity) on plant operation. This impact can be direct, indirect or a combination or both:
Direct: Failure results in a diversion of flow and a loss of the train / system or an initiating event (such as a LOCA).
Indirect: Failure results in a flood, spray, or jet impingement, spatially affecting neighboring equipment or results in depletion of a tank and loss of the systems supplied by the tank.
The approach presented herein includes a comprehensive assessment of both direct and indirect effects for a spectrum of piping failures, from pipe leaks to ruptures. The f
consequences due to indirect effects and direct effects are treated explicitly.
Spatial effects are an example of indirect effects caused by pressure boundary failures.
)
These include the effects of flood, spray, and pipe whip on equipment located in the vicinity of the break. Spatial consequences of the break are determined based on the location of the analyzed break and the relative position of important equipment.
Analyzed locations of the break should be consistent with locations analyzed in other spatial analyses performed for the plant (e.g., internal flood analysis or fire analysis).
J
l The presence of important equipment in a specific location should have already been identified through those analyses and could be confirmed by a walkdown.
The possibility of isolating a break is also identified as part of the consequence analysis.
A break could be isolated by a protective check valve, a closed isolation valve, or it could be automatically isolated by an isolation valve that closes on a given signal. If not automatically isolated, a break can be isolated by an operator action, given successful diagnosis. The likelihood of isolating a break depends on the availability of isolation equipment, a means of detecting the break, the amount of time available to prevent specific consequences (e.g., flooding of the room or draining of the tank), and human performance. Operator recovery actions are further discussed in Section 3.3.2 For each run of piping under evaluation, a spectrum of break sizes is evaluated. The break size ranges from a small leak to a rupture. Larger leaks and breaks have the potential to disable system or trains and to cause initiating events, flooding, or diversions of water sources. Typically, small breaks (minor leakage) would not render a train inoperable. They may however, depending on the energy level of the system, spray onto adjacent equipment and cause equipment malfunction.
Pilot plant evaluations have shown that the large break scenarios (worst-case breaks) result in the most limiting consequences. However, the methodology was specifically developed to require that a spectrum of break sizes be evaluated so that, if smaller breaks can cause a measurable or the dominant consequence, they are identified and i
input into the risk ranking process.
i In the Consequence Evaluation, continuous runs of piping are identified whose failure results in similar consequences. These runs of piping are called consequence segments and are an input into the analysis that defines the pipe segments used in the risk evaluation.
3.2 Consequence Ranking and Categorization i
The goal of the Consequence Evaluation is to establish a process that consistently ranks consequences, caused by a pipe failure, based on its impact or safety significance. For example, is a pipe break that results in a loss of coolant accident (LOCA) more safety significant than a pipe break that leads to a loss of feedwater? Or, is a pipe break disabling one train of high pressure injection more safety significant than a pipe break disabling an auxiliary feedwater train? In order to answer these questions consistently, consequences are categorized into different importance categories.
The consequences are ranked into those categories based on a combination of plant-specific PSA insights and results, and methodology lookup tables, which are explained 2
r in the following sections. The methodology lookup tables are developed,in order to standardize and streamline the consequence ranking process.
Four consequence importance categories have been defined based upon fundamental PSA principles. They are: High, Medium, Low, and None. The "High" category represents events with a significant impact on plant safety, while the " Low" category represent events with a minor impact on plant safety. The "None" category defines those locations that are typified by " abandoned in place" piping.
The consequence ranking philosophy, used in this methodology, can be summarized as follows:
High Consequence: Pressure boundary failures resulting in events that are important contributors to plant risk and/or pressure boundary failures which significantly degrade the plant's mitigative ability.
Low Consequence: Pressure boundary failures resulting in anticipated operational events and/or pressure boundary failures which do not significantly impact the plant's mitigative ability.
Medium Consequence: This category is included to accommodate pressure boundary failures which do not obviously belong to the "High" or " Low" rank.
If these categories are to be confirmed by a numerical PSA evaluation, each consequence category would have an assigned range of Conditional Core Damage Probability (CCDP) or Conditional Large Early Release Probability (CLERP), associated with the impact of specific Pressure Boundary Failure (PBF). The ranges used to numerically define each category are shown below:
TABLE 3.1-1 Consequence Category Corresponding CCDP Corresponding CLERP Range Range High CCDP > 1E-4 CLERP > 1E-5 Medium 1E-6 < CCDP s 1E-4 1E-7 < CLERP s 1E-5 Low CCDP s 1E-6 CLERP s 1E-7 k
3 j
)
e 4
I i
CCDP/CLERP ranges are determined based on the estimates of the total risk associated with the piping failure. Risk is measured by Core Damage Frequency (CDF) or Large Early Release Frequency (LERF) as:
CDF/LERP [given PBF] = [PBF frequency] * [CCDP/LERP].
Based on the above expression, and conservative estimates of PBF frequencies (the total for the plant is on the order of IE-2/yr), CCDP/CLERP ranges are selected to guarantee that all pipe locations ranked in the " Low" consequence category do not have a potential CDF impact higher than 1E-8/yr or a potential LERF impact higher than IE-9/yr. The " Medium" category is selected to cover a gray area between "High" and
" Low" categories, and to address uncertainties in the CCDP/CLERP estimates. The risk evaluation is discussed in detail in Section 3.4.
The process of conducting a consequence evaluation is performed in four steps, as
' defined below:
- 1. Plant PSA models, systems, initiators and supporting analysis are evaluated. The initial consequence rank is established, based on the PBFs impact on CDF.
- 2. Containment performance is evaluated. The CDF consequence rank is reviewed and adjusted to reflect the PBFs impact on containment perfonnance (e.g. LERF) or by evaluating the likelihood of containment bypass.
- 3. Shutdown operation is evaluated. The consequence rank is reviewed and adjusted to reflect the PBFs impact on plant operation during shutdown.
j
- 4. External events are evaluated. The consequence rank is reviewed and adjusted to reflect the PBFs impact on the mitigation of external events.
The first two steps will be discussed in detail in Section 3.3. The last two steps are discussed in Sections 3.4 and 3.5, respectively.
4
3.3 Consequence impact Groups and Configurations In the EPRI Methodology, the consequence evaluation and ranking is organized into four basic consequence impact groups, with three corresponding operating configurations. Those consequence impact groups, configurations, and corresponding report sections are defined below.
Table 3.3-1 Report CONSEQUENCES Section Impact Group Configuration Description 3.3.1 Initiating Event Operating A PBF occurs in an operating (pressurized) system resulting in an initiating event 3.3.2 Loss of Mitigating Standby A PBF occurs in a standby Ability system and does not result in an initiating event,but degrades the mitigating capabilities of a system or train. After failure is discovered, the plant enters the Allowed Outage Time defined in the Technical Specification Demand A PBF occurs when system / train operation is required by an independent demand j
3.3.3 Combination Operating A PBF causes an initiating event with an additional loss of mitigating ability (in addition to the expected mitigating degradation due to the initiator) k 5
i
1
'l 3.3.4 Containment Any A PBF,in addition to the above impacts, also affects containment performance The evaluation and ranking of the above consequence impact groups and configurations are discussed in the following sections.
3.3.1 Initiating Event Impact Group l
The potential for pressure boundary failure to result in an initiating event or forced V
plant shutdown needs to be is evaluated. This should be accomplished using a plant-specific list of initiating events from the plant PSA/IPE and design basis l
documentation, and should also include events that might not be explicitly modeled by either process.
An initiating event could occur as a result of a loss of fluid (e.g., LOCA, steam or feedwater line break, etc.), of the loss of a system. (e.g., loss of charging, loss of service water cooling, etc.) or an indirect effect The importance of every initiating event, caused by the pipe failure, needs to be assessed in order to assign it to it's appropriate consequence category. In order to rank i
the impact of one initiating event versus another, the plant mitigating abilities need to be addressed. The plant mitigating abilities are usually much higher for events which are anticipated during the plant lifetime than for the events not expected to occur during the plant's life. Also, different plants are sensitive to different types of events, depending on their mitigating abilities.
Considering the above, it is expected that a pipe failure that results in an initiating event, which in the plant design basis documents is expected to have a low frequency of occurrence and is a significant contributor to plant risk, should be categorized as "High." An example of this would be a pipe failure causing a LOCA in a typical PWR plant. Conversely, a pipe failure that results in an initiating event, which in the plant design basis documents is expected to have a high frequency of occurrence, and is a minor contributor to plant risk, should be categorized as " Low." An example of this would be a pipe failure causing a normal transient, such as loss of charging in a typical PWR. The CCDP guidelines in Table 3.2-1 should be used to numerically define the High, Medium and Low thresholds for initiating events.
These principles are illustrated in Table 3.1. In Table 3.1-1, based on the expected frequency of occurrence, initiating events are grouped into four design basis event categories. The first category, routine operation,is not relevant to this analysis. If a postulated pipe failure results n a Category IV event, or an event not expected to occur 6
during the lifetime of a particular plant, the assigned consequence category, based on CCDP, is expected to be " Medium" to "High," depending on plant-specific design features (primarily redundancy and diversity of mitigative systems). Conversely,if a postulated pipe failure results in a Category II event, anticipated operational occurrence, the significance of this impact is not expected to be high, and the assigned consequence category should be " Low" or " Medium." Failures that result in Category III events, infrequent events, can vary between "High" and " Low" consequence categories, depending on the specific initiating event and importance of that event to plant risk. For example, Loss of Offsite Power (LOSP) is expected to be a significant risk contributor and, therefore, is expected to be assigned to a "High" consequence category, while excessive feedwater is not expected to be a significant risk contributor and, therefore, would likely be assigned to a " Low" consequence category. (Note: pipe failure can result in LOSP due to spatial considerations such as, flooding of the switchgear room.)
It should be noted that Table 3.1 is presented only to illustrate general guidelines.
Consequence categories for PBFs leading to an initiating event are explicitly determined from the plant PSA/IPE results, based on the numerical guidelines defined in Section 3.2 (Table 3.2-1). When a PBF causes an initiating event modeled in the PSA, the CCDP corresponding to that initiating event can be obtained directly from the PSA results. The containment performance is not considered specifically in this consequence impact group. The CLERP would need to be evaluated only if the plant-specific CLERP (in this case, conditional on the core damage) is higher than 0.1, which was not the case in any of the pilot plant applications.
A plant-specific Table 3-1, from one of the pilot applications, is shown in Table 3-1 A.
This example illustrates that final initiating event ranking is a function of plant-specific design features. It should be confirmed that the PSA/IPE model for initiating events is applicable for the specific initiators caused by a PBF. For example, recovery of offsite power, an important factor in PSA models, probably can not be credited if a loss of offsite power was caused by a PBF and flooding in the switchgear room.
Table 3-1 should be generated for each plant specifc application, assuring truncation issues are addressed.
3.3.2 Loss of Mitigating Ahliity impact Group The potential for pressure boundary failure to degrade plant mitigating ability needs to be evaluated. This evaluation should identify those pipe failure that can result in a loss or degradation of a system / train, or possibly, multiple systems / trains.
A system / train can be lost either due to diversion of flow or due to secondary effects caused by the PBF. Both direct and indirect effects of pipe failure need to be evaluated 7
t
i to determine the affected systems. There are times when failure of the pipe does not result in a loss of system / train, but in a partial degradation of the system / train. Those cases also need to be analyzed.
During this analysis, the system safety function, the means of detecting a failure, test and maintenance practice, and technical specifications (i.e. limiting conditions for operation; LCO) associated with the system are identified. Possible automatic or operator actions to prevent or recover a loss of systems should also be identified and 1
evaluated.
Table 3.2 provides guidance in assigning the consequence categories to pipe failures that affect the plant mitigating ability, but do not cause an initiating event. This table is
' designed to simplify determining the CCDP range (defined in Section 3.2) for the PBFs that cause a loss of system / train, without the need for time-consuming PSA quantifications. PSA quatifications are expected to result in the same range for each case abd have been confirmed in the pilot plant applications. However, the use of Table 3-2 and its validation as shown in the pilot applications requires understanding and
- consistent use of its fundamental premise (i.e. equivalent train worth).
Table 3.2 measures the "importance" of different systems, through corresponding CCDP worth. It helps to answer the following, and similar, questions: "is the loss of one train of feedwater more important than the loss of one train of high pressure injection?" The basis for Table 3.2 and corresponding evaluations are discussed in this section.
Table 3.2 is based on three factors, which in combination, define the system importance.
Those factors are:
- 1. Frequency of the challenge determines how often the mitigating function of the systems / trains is anticipated to be called upon. All other factors being equal, systems that are called upon to mitigate an anticipated event would be more important than systems called upon to mitigate an accident (e.g. unexpected event).
- 2. Frequency of the challenge corresponds to the frequency of the initiating event that requires the system / train operation. In Table 3.2, similar to Table 3.1, the frequency of the challenge is grouped into design basis event categories (II, III, and IV):
anticipated events, infrequent events, and accidents. The quantitative basis for the frequency of the challenge is defined below:
3.
4.
l i
5.
- 6. Table 3.3-2 Initiating Event Category IE Frequency Limits IE Frequency Maximum Value DB CATII(anticipated
[>0.1/yr]
(>)1/yr events)
DB CAT III(infrequent (0.01/yr,0.1/yr]
0.1/yr events)
DB CAT IV (accidents)*
[<0.01/yr]
0.01/yr
- 1. * - many of these events may have frequencies substantially below 1E-02.
Additional may be conducted to support the assignment of PBFs to lower consequence categories provided it is documented. For these situations, the defense in depth criteria of Table 3-2 (i.e. zero backup trains = high consequence) shall be maintained.
- 2. Number of backup systems / trains available determines how many unaffected systems or trains are available to perform the same mitigating function. The availability of multiple backup trains would make the effects of the loss of one system / train less significant. Backup systems should be evaluated for each plant safety function (reactivity control, secondary heat removal, RCS inventory, etc.).
- 3. The guidance provided in Table 3.2 is based on the PSA logic structure: That is, plant response and the critical failure combinations. The critical failure combinations and available success paths are analyzed for each safety function and used to determine the importance of each mitigating system.
- 4. A list of the plant critical safety functions, and their description, should be developed during this evaluation. These descriptions should include which plant systems and actions provide which safety functions. A simplified graphical illustration of the three safety functions analyzed in a PWR pilot application, for a Transient Initiating Event, is provided in Figure 3.1. Figure 3.1 illustrates the Secondary Heat Removal, Inventory Control, and Long Term Heat Removal safety functions, based on the success criteria for a transient initiating event.
- 5. As seen from Figure 3-1, AFW is needed to perform the Secondary Heat Removal function and the backup systems / trains are MFW, Motor and Turbine EFW, and the Feed and Bleed function. HPSI, on the other hand,is needed for three functions: for Secondary Heat Removal (as part of the Feed and Bleed function), for Inventory 9
E Control (as a High Pressure Injection), and for Long Term Heat Removal (as a High Pressure Recirculation). If the affected system is needed to mitigate different safety functions, than the number of available backup systems / trains should correspond to l
the most critical number from the various functions (this is also a function of the frequency of the challenge, as discussed later in this section).
i
- 6. As shown in Table 3.2, the number of backup trains is given in "one-half" increments. To standardize crediting backup trains, a train " worth" concept has been introduced. A train of Turbine Driven EFW (unavailability of approximately 1E-1) should not be credited equally as a train of Motor Driven EFW (unavailability of approximately 1E-2). Because of this, a backup train " worth"is introduced and predefined to have a mean unavailability value of approximately 1E-2. The quantitative basis for the backup train " worth" is defined below:
7.
- 8. Table 3.3-3 Backup Train " Worth" Unavailability Unavailability Mean Limits Value 0.5
[3E-2,3E-1]
1E-1 1
[3E-3,3E-2]
1E-2 2
[3E-5,3E-4]
1E-4 3
[3E-7,3E-6]
1E-6 1.'
i i
10
c 1
i
- 2. Not all of the individual backup trains have a train " worth." An example, from a BWR plant pilot application is given below:
3.
- 4. Table 3.3-4 System / Train Unavailability Corresponding Train
" Worth" FW 1.5E-2 1
HPCI 8.8E-2 0.5 RCIC 1.1E-1 0.5 1 LPCI Train 9.2E-3 1
2 LPCI Trains 2.5E-4 2
1 CS Train 1.1E-2 1
2 CS Trains 3.9E-4 1.5 1.
- 2. As seen from the above table, the backup trains can not always be simply summed.
In the CS System, two trains are only " worth" 1.5 trains. This is beause common cause dominates system unavailability.
- 3. Human Actions as Backu_p Trains: Human actions, included in the PSA success criteria, are also credited as backup trains, based on Human Error Probability (HEP).
One example is shown in Figure 3-1, where the operator action to initiate feed and bleed is credited in the Secondary Heat Removal function. In addition to human actions modeled in the PSA, the actions to recover from pipe failures, and minimize consequences by isolating breaks, are also modeled in this approach and credited as backup trains. If isolation is possible, consequences should be analyzed for both cases: successful and unsuccessfulisolation. Operator recovery actions (isolation of the break) can only be credited if:
there is an alarm and/or clear indication, to which the operator will respond, a
11
the response is directed by procedure,
=
isolation equipment (e.g. valves) is not affected by the break, a
there is enough time to perform isolation and reduce consequences.
=
- 4. If all of the above factors are satisfied, and could be documented,it is recommended to credit the recovery action, and to assume one backup train " worth" (HEP of approximately 1E-2). Additional recovery may be available on a plant specific basis and should be documented. As necessary, the performance of detailed HRA analysis can be required. Of course, it is left to the analyst to evaluate how rea::onable the simplified assumption is and,if necessary, perform a ful! IIEP analysis. While operator action may be highly reliable, the equivalent train worth of the isolation function can not be creditted as more reliable than the recovered equipment (e.g. recovered turbine driven pump unavailability of 1E-01).
- 5. Exposure time determines the downtime for the failed system / train, or the time the system / train would be unavailable before the plant is shutdown.
As known from the PSA application, when equipment that does not cause an initiating event is set to failed, the result of the ISA calculation is a conditional core damage frequency, unless the degraded situation is assumed to exist over some fixed time. In this methodology, it is assumed that the degraded situation exists during an exposure time: That is, the equipment will not be available if challenged during the exposure time.
Examples of exposure time are discussed below:
If a pipe failure is discovered immediately, the exposure time is equal to the
=
applicable Allowed Outage Time (AOT), (plus the time it took to detect the failure).
If the pipe failure goes undetected, it is assumed that the exposure time is equal to the test period, or all year if the equipment is not tested.
Four different exposure times are included in Table 3.2.
- 1. All Year, which applies to standby systems and parts of systems where pipe segments are not " tested" or exposed to the operating load during the year;
- 2. Time Between Tests, applies to the standby systems, which are regularly tested (monthly or quarterly). It is assumed that, for those systems, an actual exposure time is equal to the test interval because,if a pipe degraded condition is present, it will be discovered during the test.
12
- 3. Long AOT, applies to operating or standby systems where a pipe failure will be -
_ detected within a short time after the occurrence, and the plant will shutdown if the failure is not recovered during the AOT. The exposure time is, therefore, equal to the AOT plus detection time. A "long AOT" exposure time is one to two weeks.
- 4. Short AOT, applies to the same systems as the "long AOT," but the exposure time is less than 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />.
The quantification basis for the exposure time is given below:
I 13
]
o i
Table 3.3-5 Exposure Time ! TypicalInterval Corresponding Value All Year 1 Year 1 yr
' Between Test 3 Months 0.25 yr -
Long AOT 1 Week 1.9E-2 yr Short AOT 1 Day 2.7E-3 yr 1.
- 2. - As defined in the introduction to-Section 3.3,in the Loss of Mitigating Ability impact group, two operating configurations are analyzed.
3.
Standby: A PBF occurs in a standby system and it is detected either by i
1 instrumentation, test or visual inspection. After the failure is detected, the plant enters the AOT. Exposure time is equal to the AOT plus detection time.
4.
Demand:
A PBF occurs when system operation is required by an independent demand. Exposure time, in this case, is equal to the test interval, or to all year if the system is not tested. Test pressures or flows are credited as equivalent to demand conditions, thereby reducing exposure time in the analysis of demands for piping that experiences testing.
- 5. Numerical Basis for Table 3.2: Based on the factors previously described, the CCDP, given a loss of system train, can be expressed as:
CCDP = IEc
- BUi(SFe)
- ET 6.
Where:
IEcis the critical initiating event (frequency) for the analyzed loss'of the system (usually the most likely event to challenge system operation).
7.
BUi (SFc) is the ith backup train (for the critical safety function) for the analyzed loss of the system. The critical safety function is 14
usually the safety function with the minimum redundancy, see note below.
8.
ETis exposure time 9.
Note: It should be mentioned that, if the system is required to mitigate a number of initiators and performs multiple safety functions, the critical combination of the initiator and safety function should be evaluated. For example, HPSI operation could be required to mitigate a transient, (e.g. HPSI is credited in the Secondary Heat Removal (Feed and Bleed)). The redundancy of the Secondary Heat Removal systems is high (MFW, EFW, AFW). HPSI operation is also required to mitigate a small LOCA, a less likely event, where the Inventory Control function requires HPSI operation (low or zero redundancy). Those two combinations need I
to be analyzed, and the more critical one should be selected in the consequence
}
ranking.
- 10. Based on the above equation for CCDP and the quantitative valuess for the variables discussed above, the expected numerical values could be entered in Table 3.2, as shown in Table 3.2A. Table 3.2 illustrates the principles used to define the consequence ranks in Table 3.2. These tables also illustrate issues associated with containment performance and its impact on consequence ranking. As an example, if the CCDP is above IE-5, CLERP could be the overriding factor in determining the consequence rank. This will be discussed in more detail in Section 3.3.4.
11.
Note: It can be noticed in Table 3.2A that some values above 1E-4 (IE-6) were ranked in a " Medium" (" Low") Category. This is because the values shown in the table often represent upper,instead of mean, values.
- 12. Tables 3.2 and 3.2A illustrate the plant and equipment reliability basis for evaluating the plant mitigative function. Application of this lookup table also assures quantitative " defense in depth" of the plant response, because all PBF leading to "zero defense" are evaluated as "high," even when the corresponding CCDP is low.
3.3.3 Combinations impact Group Guidelines for determining consequence categories for the combination consequence group are given in Table 3.3. This table applies to the evaluation of pipe failures which cause both an initiating event and affect the mitigating ability,in addition to the expected and modeled effects of the initiator. For example, when a loss of an injection leg occurs with a LOCA, that is an expected LOCA effect on the mitigating ability, and typically is analyzed as a simple initiating event (Section 3.3.1). If in addition to the loss of an injection leg, the HPSI system operation is effected, that combination should be evaluated using Table 3.3. Also,if a postulated pipe segment failure results in an 15
initiating event, and a loss of the system which is not needed to mitigate this initiating event, then it is recommended that this combination be treated as a simple initiating event, where Table 3.1 applies. In all cases,if the category recommended in Table 3.3 is lower than one recommended in Table 3.1, the worst case category (Table 3-1) should be used.
As can be seen in Table 3.3, the consequence category is determined based on the numerical ranges defined in Section 3.2 and backup train " worth" defined in Section 3.3.3.
3.3.4 Containment Performance Impact Group The consequence evaluations in Sections 3.3.1,3.3.2, and 3.3.3, with the use of Tables 3-1,3-2, and 3-3, are primarily based on the calculation of CCDP (with exceptions to the notes provided with Table 3-2 and Table 3-3, which define a simplified way to evaluate a containment bypass). In addition to consequences affecting CDF, PBFs need to be evaluated for their impact on the containment performance such as their effects on LERF.
The general philosophy for addressing containment performance is to assure a 0.1 conditional probability of LERF, given core damage. If this is not satisfied, a consequence category determined by CCDP numerical criteria may be increased. This has already been defined in CCDP and LERP numerical criteria, described in Section 3.2. For example, if CCDP for a PBF was estimated at approximately 8E-5 (a " Medium" rank), and the conditional LERF given core damage is judged to be higher than 0.1, then CLERP for that PBF could be higher than IE-5, and the consequence rank could increase to "High."
In this methodology, LERF is addressed in three ways:
I
- 1. PBF Impact on Containment Isolation
- 2. PBF Impact on LOCA Outside Containment
- 3. PBF Impact on Early Core Melt and Containment Failure These LERF considerations are discussed below:
i Impact on Containment Isolation:If the impact of PBF leads to a loss of containment isolation, or containment bypass, the consequence categories in Table 3.2 and 3.3, based on the CCDP numerical criteria, would change in the cases which are defined in the tables. Changes are based on the CLERP numerical criteria. As long as there is an 16
isolation valve available, or a closed system that provides containment isolation, the consequence category, based on the CCDP criteria, should not change.
LOCA Outside Containment: Certain PBFs can significantly increase the potential for a LOCA outside containment. Table 3.4 explicitly deals with those scenarios. Input to Table 3.4 is plant specific, and depends on the location of the break, available means of isolation, and information available about passive barriers (check valve leak detection, etc.) The rank in Table 3.4 is based on estimates of isolation boundary unavailability.
i
. Plant specific evaluations should confirm that these unavailabilities are appropr ate.
Impact on Early Core Melt and Containment Structural Failure: This is a more complex analysis, often difficult to assess, and may not be available in many PSAs. Insights from the pilot applications have shown the follawing:
In the case of PWRs, the conditional probability of early containment failure is generally on the order of 0.1 or lower. The PBFs that can affect this conditional probability are usually those that affect containment cooling (for example, loss of containment spray or service water). For those PBFs,if CCDP is in the " Medium" range, and higher than IE-5, CLERP needs to be evaluated.
In the case of BWRs, the conditional probability of early containment failure is generally on the order of 0.1. In those cases, PBFs that affect specific safety functions that can present a significant containment challenge (Loss of Reactivity Control, Vapor Suppression Failure, Loss of Injection), and are border a critical CCDP range, need to be specifically evaluated in order to estimate CLERP or assure the CCDP asMgnment is still appropriate.
3.3.5 Examples of Consequence Evaluations
- 1. Operating Configuration: A pipe break occurs in an operating (pressurized) system, usually resulting in an initiating event (IE).
Start of the Event: Pipe Break Effect on Plant Operation:Imilating Event Measure of PBF Likelihood: Pipe Break Frequency, A[1/yr]
Measure of Consequences: CCDP [Unitiess]
Measure of Risk:
Core Damage Frequency (CDF) due to the PBF CDF(PBF) = (A
- CCDP)[1/yr]
The initiating events as consequences, can be evaluated for two cases:
Initiatine Event Impact Group: the pipe break causes an initiating event equivalent to the one modeled in the PSA. In this case, Table 3-1 is used for the consequence evaluation. When a pipe break causes an initiating event modeled in the PSA, CCDP 17
.I can be obtained directly from the PSA results (by dividing the CDF due to the specific
. IE by the frequency of that IE) assuring truncation is addressed and the initiating event modeled in the PRA is' appropriate for the PBF under evaluation.
Combination Impact Group: The pipe break causes an initiating event, with an additional loss of mitigating ability (not modeled in the PSA). In this case, Table 3-3 provides a simplified way to rank consequences. (The exact results can be obtained -
)
from the PSA model by running the specific initiator case, with the mitigating system
]
assumed unavailable). Since the purpose of the consequence evaluation is to provide only an appropriate rank for CCDP, and not an exact number, Table 3-3 provides a '
conservative guide.
1 i
Example: The initiator is Loss ofPCS (a plant trip with a loss of the Pouer Contersion System).
. In addition, the Motor Driten EFW pump is lost. The backup systems remainingfor Secondary Heat Removal (see Figure 3-1), are Turbine EFW, AFW and F&B. From plant-specific data, the train " worth" of those systems is: Turbine EFW - 0.5 train, AFW - 0.5 train, F&B - 1 train;for a total of 2 trains. Therefore, two backup trains are available and,from Table 3.3, the corresponding consequence rank is " Medium." The rankfor the " Loss ofPCS" initiator,from Table 3-1A, is also " Medium."
i
- 2. Standbv Configuration: A pipe break occurs in a standby system, and, after it is discovered, the plant enters the Allowed Outage Time (AOT) defined in the Technical Specification. In the consequence evaluation, AOT is referred to as " exposure time."
q
- This is because, during the AOT, the plant's mitigating ability is reduced. (During the
" exposure time," the plant may be subjected to a spectrum of initiating events, which may require the operation of the disabled system). '
Start of the Event: Pipe Break Effect on Plant Operation: Disabled Safety System / Train, Entering AOT Measure of PBF Likelihood: Pipe Break Frequency, A [1/yr)
Measure of Consequences:
J Ts is exposure time (detection time + AOT)
' Measure of Risk: CDF(PBF) = (A
- CCDP) [1/yr]
j Table 3-2 provides a simplified way to rank consequences when a pipe break results m a loss of a single or multiple train / system. It provides a conservative, simplified j
substitute for the PSA importance measures (which can not be applied in their original
- form, due to PBF specific effects, exposure time, location-specific recoveries, etc.)
Example: A pipe break results in the loss ofan AFW train. After the break is discotered, the plant enters a "long AOT." AFW is called upon to mitigate transient (anticipated events).
j More than Ihree trains are still available to satisfy the secondary heat removalfunction (see Figure 3.1): MFW, EFW, and F&B. Therefore,from Table 3-2, the consequence rank is " Low."
18 1
1 I
a i
- 3. Demand Configuration: A pipe break occurs when system operation is required by an independent demand. For example, a small LOCA event requires HPCI operation, and a HPCI start on demand is assumed to result in an additional break, thereby disabling HPCI.
Start of the Event: An Independent Initiator Effect on the Plant Operation: Safety System / Train Fails on Demand Due to PBF Measure of PBF Likelihood:
An Actual Measure of PBF Likelihood: Pipe Failure on Demand,lo
'A Substitute Measure of PBF Likelihood: Pipe Standby Failure Frequency A
[1/yr]
Note: lo = A
- Ti, where Ti is mean time between tests, or demands Measure of Consequences:
An Actual Measure of Consequences: CDF(Fo)[1/yr](for a specific IE, given PBF failure on demand).
A Substitute Measure of Conseauences: CCDP = CDF(Fo)
- T.
Measure of Risk:
CDF(PBF)
= Ao
- CDF (Fo)
= A
- Ti CDF(Fo)
= (A
- CCDP)[1/yr)
Note: In this configuration, substitute measures are introduced,'so that the measure of PBF likelihood is always the same: yearly frequency of pipe failure.
Because the measure of importance of a system lost on demand would be similar to that j
of a system lost in a standby configuration, Table 3-2 is used. The main difference between the two cases is exposure time which, in this case,is considered to be the time since the last demand (either the test interval or all year).
Example: Given a demandfor HPSI operation, a pipe break results in the loss ofa HPSI train.
}
HPSIis called upon to mitigate DB CATIV events (i.e., LOCAs). Given a small LOCA, two backup trains of HPSI are still available, to satisfy the high pressure inventory makeupfunction (Figure 3.1).' Since HPSI C actuation requires operator actions, those two HPSI trains are credited as one. Given an exposure time of"between test," unexpectedfrequency of challenge, and one backup train,from Table 3.2, the corresponding consequence rank is " Medium," given the containment was not affected.
HPSI is also called upon to mitigate transient events, if other means ofsecondary heat removal fail (i.e. requiredfor Feed and Bleed action). In this case, we have an anticipatedfrequency of challenge, and three (backup) trainsfor Secondary Heat Removal (see Figure 3.1), before the HPSI operation is called upon. From Table 3.2, the corresponding consequence rank is " Low."
Therefore, the more critical evaluation is that of the HPSI train as a mitigating train for small LOCA events.
19
-.J
3.4 Other Modes of Operation The consequence evaluation discussed in the previous sections is defined assuming at-power operation. Generally, the at-power plant configuration are considered to be more critical in evaluating the risk from PBFs. This is because generally, for at-power operation:
The likelihood of PBFs is higher, since the plant is critical and at high pressures and
=
temperatures.
The consequences of PBFs are more severe, since the plant requires immediate
=
response to control reactivity, heat removal, and inventory.
Nevertheless, the PBFs could potentially significantly affect plant safety during shutdown, or other modes of operation. Therefore, all pipe segments that are not already classified in a "High" consequence category should be evaluated for their potential impact on shutdown operation.
If the plant has performed a Shutdown PSA, the important initiators and systems are already identified, and so are their impact on CDF. If a Shutdown PSA is not available, the impact of PBFs on CDF during shutdown needs to be evaluated. The major characteristics of shutdown operation to be considered in the consequence evaluation are defined as follows:
During shutdown, system operations, safety functions, and success criteria change
=
in different stages of operation.
For the majority of piping, the exposure time associated with operation in a
=
shutdown configuration is less than 0.1 yr. The exposure time associated with being in a more risk significant configuration is even lower, depending on the function or system being evaluated.
During shutdown, the unavailability of mitigating trains could be higher due to
=
planned maintenance activities. Shutdown guidelines need to be evaluated to assure that sufficient redundancy is protected during different stages of operation.
Recovery time during shutdown is longer, and allows for multiple operator actions.
=
The system requiring special attention during evaluation of shutdown operation is the Shutdown Cooling System. Pipe breaks in this system that can cause a loss of inventory 20 m
or loss of shutdown cooling need to be evaluated in detail, and CCDPs due to these breaks need to be estimated.
3.5 External Events The consequence evaluations in the previous sections are based on the plant PSA, and internal initiators. Although all the plants have performed an Individual Plant Examination for External Events (IPEEE), not all plants have made external events an
. integral part of their PSA models. Therefore, all pipe segments, not already classified in the "High" consequence category, need to be evaluated for their potential impact due to external events.
The external events should be evaluated from two perspectives:
- 1. The externa! avents, such as seismic, which can cause PBFs, and
- 2. The external events, such as fires, which do not affect PBF likelihood, but create demands'which may cause PBF.
Seismic IPEEE analysis should include consideration of the seismic-induced PBFs. PBFs in combination with a seismic event should also be addressed in this evaluation. The information from the seismic study to be used in this evaluation include:
seismic capacity of the piping,
=
safety functions significantly affected by seismic events,
=
the most critical seismic scenarios and backup systems.
a It should be noted that the likelihood of seismic-induced PBFs is not expected to depend on the inservice inspection program, which is the subject of this methodology.
Extensive NRC and industry sponsored research has shown that well-engineered structures / components, even with significant degradation to be substantially robust q
with respect to seismic response. Thus, it is more important to design inspection programs to prevent PBFs in piping credited for mitigating functions after an important j
seismic event.
In general, the evaluation of external events should address more likely scenarios where the pipe breaks on demand in response to an external event. The evaluation needs to be performed to ensure that certain external events,in combination with postulated PBF, do not jeopardize " single failure" criteria. A good example of this is a fire in the Control Room or Cable Vault, which could require an alternative shutdown outside of 21
the Control Room. The PBFs in systems that are operated from the remote shutdown panel, should be evaluated for those scenarios.
(
3.6 Application of the Plant-Specific PSA The consequence evaluation described above is based upon PSA fundamental principles, insights and quantitative validations. CCDP values are estimated for each I
type of consequence. Lookup Tables 3-1,3-2,3-3, and M are used to determine consequence categories, and are based on CCDP numerical values. The lookup tables are specifically designed to simplify numerical evaluation and to provide an appropriate consequence rank, without calculationally intensive PSA quantifications.
Application of a plant-specific PSA in this methodology is summarized below:
1 PSA model and success criteria are used to define safety functions and backup i
=
- trains, PSA results for all initiators are applied directly in Table 3-1 (see example in Table 3-a 1A),
PSA system / train unavailabilities are used to determine the equivalent train
=
" worth" for each backup train, PSA results are used to determine conditional LERF, given core damage, and to
=
identify event sequences that provide the dominant contribution to LERF, Plant-specific failure data are used for different containment isolation valves,
=
Internal Flood results are used in the analysis of spatial effects, a
IPEEE results are used in the evaluation of external events, and
=
Shutdown PSA (if available) is used in the evaluation of other modes of operations
=
Since the consequence rank is based on the CCDP/LERP ranges, and not on a specific CCDP/LERP value, the methodology results are less sensitive to minor changes in the PSA model and assumptions.
CCDPs and LERPs are used as consequence measures,in place of other PSA importance measures: Fussel-Vesely (FV), Risk Achievement Worth (RAW) and Risk Reduction Worth (RRW), because:
22 J
p
- 1. CCDP/LERP are independent of the PBF likelihood; FV/RRW are functions of the PBF likelihood and associated uncertainties, and
- 2. CCDP/LERP are natural importance measures for initiating events; there can be problems in applying RAWS when evaluating PBFs resulting in initiating events Since CCDPs/LERPs as consequence measures are independent of pipe failure likelihood, they can be used in combination with the PBF likelihood in the risk matrix (defined in Section 3.4) to produce meaningful risk measures.
Lookup Tables 3-1,3-2, and 3-3, used in the consequence evaluation, have been validated by using PSA runs during the pilot application process:
Table 3-1 can be re-validated by follow-on plants by setting the analyzed initiating event frequency to one, and then quantifying CCDP. Since this table is derived directly from PSA results, validation results are expected to be in complete agreement with Table 3-1 guidelines. The minor differences could occur due to the cut-off value for CDF sequences. Thus truncation should be' explicitly considered.
Table 3-2 can be re-validated by setting the affected mitigating system / train to failed and then quantifying the corresponding CDF which, with exposure time, defines the CCDP which is needed to determine the consequence rank.
I Table 3-3 can be re-validated by setting the analyzed initiating event frequency to one, and the affected mitigating system / train to failed, and then quantifying the CCDP.
1 The validation results from several different pilot plant applications (full scope and partial scope, BWR and PWR), have shown very good agreement between the CCDPs (consequence ranks) determined from the lookup tables, and those determined from
)
PSA quantification. Examples from one PWR pilot plant are provided below:
{
l Table 3.6-1
]
Application Example PSA Validation:
Methodology Consequence Quantified Lookup Table Rank CCDP Estimated CCDP 4
Table 3-1 SmallLOCA 4E-4 4E-4 High Table 3-2 Loss of HPSI 2E-5 2.5E-5 Medium 23
<1E-4 Medium train, no recovery This agreement supports the lookup tables' application. The tables not only minimize the evaluation time (including excessive quantifications), but introduce a reality check in the PBF evaluation by determining what safety functions are affected, as well as the effects on plant mitigation functions. These insights are not always obvious from PSA runs, without detailed analysis of plant model development, input and resultant CDF/LERF sequences.
l 1
24
Table 3-1 Guidelines for Assigning Consequence Categories to PBFs Resultig in an Initiating Event i
f Design Basis initiating Event Expected Examples Consequence Category
]
Initiating Event Description Category q
l Routine Operation Startup, shutdown, N/A standby, refueling, etc.
RW Operation II Events that might occur Reactor trip, turbine
" Low"rMedium" during a calendar year in a trip, partial loss Anticipated particular plant of MFW Operational Occurrence (usual frequency > 0.1/yr) 111 Events that might occur Excessive
" Low"rMedium" during the lifetime of a feedwater/ steam infrequent particular plant removal (usual frequency 0.01/yr through 0.1/yr)
- Medium" Thigh" IV Events not expected to SLOCA
" Medium" Thigh" occur during the plant's MLOCA/LLOCA Limiting Faults lifetime SLB or Accidents ISLOCA (usual frequency <0.01/yr) 25
f.
l t
t l
l l
Table 31 A, A Plant-Specific Example of Assigning Consequence Categories to PBFs Resulting in an Initiating Event 1
1 j
Initiating initiating Event initiating Event CDF due to Corresponding Consequence i
Event Frequency initiating CCDP Category Category (1/Yr)
Event ll Reactor Trip 2
1 E-6 SE-7
" Low" Turbine Trip 1
1 E-6 1 E-6
" Low" Loss of PCS 3E-1 9E-7 3E-6
- Medium" l
- 3E-5
" Medium" IV SLB 1E 3 1 E-9 1 E-6
" Medium" l
Small LOCA SE-3 2E-6 4E-4 "High" Medium LOCA 1 E-3 2E-6 2E-3
- High" Large LOCA 1 E-4 1.5E-6 1.5E-2
- High" l
26 l
Tcble 3 2 Exemple of Guidelines for Assigning Consequence Categories to Pipe Failures Resulting in System / Train Loss Affected Systems Number of Unaffected Backup Trains Frsquency of Exposure Time to Challenge 0.0 0.5 1.0 1.5 2.0 2.5 3.0
> =3.5 Ch:llenge
?Qt w
~9 L'
L Anticipated All Year i
l (DB Cat II) j l
[
j{
L' L
L Between tests (13 months)
L' L
L L
Long AOT (<=1 week)
Short AOT (<=1 day)
L*
L L
L L
Infrequent All Year L*
L L
s.-
(DB Cat. lit)
{
' i L'
L L
L Between tests (1-3 months)
Long AOT (<=1 week)
L*
L L
L L
Short AOT (<=1 day)
L*
L L
L L
L
' {f L*
L L
L Unexpected All Year g.f5 j
(DB Cat. IV) e Between tests (13 months) h, L'
L L
L L
Long AOT (<=1 week) hN L*
L L
L L
L Short AOT (<=1 day)
L*
L L
L L
L L
High Consequence Category
=
Medium Consequence Category
=
l Low Consequence Category
=
l Containment Performance: If there is no containment barrier and the consequence category is marked by an *, the consequence category should be increased (" Medium" to "High" and " Low" to " Medium").
l 27
p:
I i
i I
i i
5 I
I I
i 1
J
-I I
i i
28
Tcble 3.2A Numericallilustration for Table 3.2, Guidelines for Assigning Consequence Categories to Pipe Fcilures Resulting in System / Train Loss l
Affected Systems Number of Unaffected Backup Trains Frequency of Exposure Time 0.0 0.5 1.0 1.5 2.0 2.5 3.0
> =3.5 Challenge to Challenge Anticipated All Year 1.0E-06*
1.0E-07 (DB Cat. II)
Between tests (1-3 months)
'1 2.5E-2.5E-07 2.5E-08 Long AOT (<=1 week) 2.0E-06*
2.0E-07 2.0E-08 2.0E-09 3.0E-06*
3.0E-07 3.0E-08 3.0E-09 3.0E-10 Short AOT (<=1 day)
Milkh 1.0E-OS*
1.0E-07 1.0E-08 infrequent All Year ws.+v wws~:
(DB Cat.111)
Between tests (13 months) 2.5E-06*
2.5E-07 2.5E-08 2.5E-09 Long AOT (<=1 week) 2.0E-06*
2.0E-07 2.0E-08 2.0E-09 2.0E 10 a s.vyn Short AOT(<=1 day) 10E45 3.0E-06* 3.0E-07 3.0E-08 3.0E-09 3.0E-10 3.0E-11 wnn:
Unexpected All Year 1.0E-06*
1.0E-07 1.0E-08 1.0E 09 f
(DB Cat. IV)
Between tests (13 months)
Wi 2.5E-06*
2.5E-07 2.5E-08 2.5E-09 2.5E-10
}
- 2,h_ 2.0E-06*
2.0E-07 2.0E-08 2.0E 09 2.0E.10 2.0E-11 Long AOT (<=1 week)
Short AOT (<=1 day)
--- -mm 3.0E-06* 3.0E 07 3.0E-08 3,0E-09 3.0E-10 3.0E-11 3.0E 12 High Consequence Category
=
Medium Consequence Category
=
Low Consequence Category
=
Containment Performance: If there is no containment barrier and the consequence category is marked by an *, the consequence category should be increased (* Medium" to "High" and " Low" to
- Medium").
29
Table 3 3 Example of Guidelines for Assigning Consequence Categories to Combinations of Consequence impacts Combination Event Consequence Category initiating Event and less than 2 unaffected backup W
trains available for mitigation i
Initiating Event and at least 2, but less than 3, MEDIUM unaffected backup trains available for mitigation
-(or IE category from Table 3.1, if higher) initiating Event and at least 3 unaffected backup l
LOW trains available for mitigation l (or IE category from Table 3.1, if higher)
Initiating Event and no additional mitigating ability lE consequence category affected from Table 3.1 Cmtainment Performance: If there is no containment barrier, the consequence category is ai,ected as follows:
2 Unaffected backup trains and no containment barrier: " Medium" becomes *High." If the
=
number of unaffected trains is between 2 and 3, " Medium"is retained.
3 Unaffected backup trains and no containment barrier: " Low:" becomes
- Medium." If the
=
number of unaffected trains is greater than 3. " Low"is retained 4
30
Table 3-4 Exampit of Guidelines for Assigning Consequence Categories to Pipe Failures Resulting in increased Potential for an Unisolated LOCA Outside of Containment Protection Against Consequence Category LOCA Outside Containment One Active'
.ij[ 6
~~
One Passive'
' "? : i Two Active MEDIUM One Active, One Passive MEDIUM Two Passive LOW More than Two NONE Note 1: An Active Protection is presented by a valve that needs to close on demand.
Note 2: A Passive Protection is presented by a valve that needs to remain closed.
31
l Figure 3-1: Simplified Success Criteria for Transient MFW or s
SDBCS/Cond sj Motor
'l EAN Transient -
p Success Turbine i s.
EFW g
sj AFW
'l I HPSI'A' l ECCS s l HPSI *A'
- l CSS *A'
~
s l
'{ Vents ] Recirc l
sl OPER
'l g! HPSI'B'
-j LTOP
[
'j Vents
'l Recirc
'l s l HPSl *C" 9
~
i 32
]
PRELIMINARY QUESTIONS REGARDING EPRI METHODOLOGY l
AND ASSOCIATED RAI RESPONSES During the two day meeting on March 2 and 3,1999,, the staff provided additional questions resulting from a review of the topical report and EPRI's RAI responses. These questions were i
addressed during the meeting and EPRI provided verbal responses during the meeting. A written copy of EPRI responses was informally submitted March 9,1999, by EPRI as follows:
NRC's QUESTION 1.
The responses to the RAls stilllead to some confusion regarding the integration of the RI-ISI and existing plant augmented programs, Please provide clarification for the following issues:
i a.
The following responses to various RAls have contradictory implications:
)
(1)
The response to RAI G-1(b) (2), second paragraph, implies the EPRI approach would integrate ASME and augmented inspections for FAC, IGSCC, MIC, etc., into a single risk based approach, to achieve programmatic enhancement to the inspection process.
(2)
In the response to RAls G-15,17, & 18 Principle #1, it is stated that implementation of the EPRI RI-ISI program will not adversely impact augmented inspection programs such as Generic Letter 88 01 and 89-08.
(3)
In the response to RAls 18,10, & 13, EPRI Inspection Strategy, states that all piping segments subject to IGSCC (BWRs) and FAC will continue to be inspected according to the Owner's existing programs.
(4)
Section 6.1 of the topical report, " Inspection Location Selection", indicates that for segments in Risk Category 1,3, or 5, and are included in existing plant FAC (GL 89-08) inspection program, the number of inspection locations are to be the same as the existing plant FAC inspection program. A similar statement is made in regard to the s
existing plant IGSCC inspection program.
Please clarify if allinspections that were being performed under these augmented programs will still be performed in addition to the RI-ISI program, or if only the elements that fallinto Risk Category 1,3, or 5 for FAC, for example, and are part of the existing FAC program, would be inspected? How would a segment that was determined to be susceptible to FAC but wasn't in the current plant augmented program be treated?
EPRI's RESPONSE 1a.
As a result of new information and the pilot plant studies, the philosophy of integrating inspection programs outside the scope of Section XI has changed. The current philosophy, which will be documented in the draft TR to be submitted in April is as follows:
l
IGSCC in BWRs - Category A piping welds (per NUREG-0313) are considered resistant to IGSCC and as such are assigned to the low failure potential category. The risk ranking for category A weld locations will be a function of its consequence of failure and element selection (e.g. number of inspections) will be consistent with its risk ranking (e.g. risk category 2 vs risk category 4). All other weld categories (e.g. category D) will be inspected per the plant's response to Generic Letter 88-01.
IGSCC in PWRs A number of plant inspection programs include augmented examinations performed in response to NRC Bulletin 7917. " Pipe Cracks in Stagnant Borated Water Systems at PWR Plants." The EPRI RI-ISI process defines an explicit set of attributes that must be considered in assessing the potential susceptibility of a location to IGSCC for PWRs.
The IGSCC concern identified by this document were inputs considered in the development of the EPRI degradation mechanism criteria. As such, this concern is explicitly considered in the application of the EPRI RI ISI process. Consequently, the RI-ISI program would supercede this augmented inspection.
Flow Assisted Corrosion (FAC)- These location shall be identified and inspected in accordance with the plant's response to Generic Letter 89-08, " Erosion / Corrosion-induced Pipe WallThinning" Microbiological influenced Corrosion (MIC)- The TR is being revised to provide utilities with alternatives for identifying those locations most susceptible to degradation and the appropriate number, location and frequency for inspection. Reference; Generic Letter 8913, " Service Water System Problems Affecting Safety-Related Equipment".
Thermal Fatigue - A number of plant inspection programs include augmented examinations performed in response to NRC Bulletins 88-08, " Thermal Stresses in Piping Connected to Reactor Coolant Systems," and 88-11, " Pressurizer Surge Line Thermal Stratification" and Information Notice 93 020, Thermal Fatigue Cracking of Feedwater Piping to Steam Generators". The EPRI RI-ISI process defines an explicit set of attributes that must be considered in assessing the potential susceptibility of a location to thermal fatigue. The thermal fatigue concerns identified by these documents were inputs considered in the development of the EPRI degradation mechanism criteria. As such, this concern is explicitly considered in the application of the EPRI RI ISI process. Consequently, the RI-ISI program would supercede these augmented inspection.
At this time only the aforementioned changes to inspection programs outside the scope of Section XI are considered in the EPRI RI-ISI process. However, the industry and the NRC are continuing work on piping integrity issues and it is EPRI's intent to update the topical in future revisions to keep it current with industry /NRC interactions.
Any changes to a plant's licensing basis as a result of the above will need to be identified as part of the follow-on plant process and included in a utility's RI-ISI template submittal. The revised TR will include directions to this end.
As discussed during the meeting. the susceptibility of a location to FAC is determined by the existing FAC prcgram. Therefore, there will be no instances where a location is identified as susceptible to FAC and not included in the plant's FAC program.
NRC's QUESTION 1b.
Section 6.1 of the topical report, " Inspection Location Selection",
indicates that for segments in Risk Category 1,2,3, or 5, and are included in existing plant IGSCC (GL 88-01) inspection program, the number of inspection locations are to be the same as the existing plant IGSCC inspection program. Please explain how the IGSCC degradation mechanism (Small Leak Degradation Category) could contribute to Risk Categories other than 2,5, or 6 unless water harnmer or some other severe loading transient is also postulated for that segment?
EPRI's RESPONSE ib.
Locations susceptible to IGSCC will be ranked as risk category 1 or 3 when they are also susceptible to water hammer or when the consequence ranking, based upon a limiting break, is as a result of a smallleak (also see NRC's Question 7).
NRC's QUESTION 1c. Similar to item a. above, please clarify if the number of inspection locations for segments belonging to one of the risk significant categories and included in the existing FAC and IGSCC inspections progrems will all be inspected or if only the appropriate percentage will be inspected from the various Risk categories? Please indicate if these elements count in the totals required to satisfy the 25% HIGH and 10% MEDIUM selections or are considered independently of the RI-ISI totals?
EPRI's RESPONSE 1c.
Locations identified as susceptible to FAC will be inspected in accordance with the plant's FAC program regardless of risk category. Item in the plant's lGSCC program (BWR only) will be inspected in accordance with the plant's response to Generic Letter 88-01 for NUREG 0313 category B through E welds. For example, for a N-578 application, if there were 100 locations in the medium risk category and 50 of these locations were part of the Generic Letter 88-01 program (NUREG-0313 category B through E welds), then these 50 locations would be inspected per the plant's response to Generic Letter 88-01. The remaining 50 locations would then be subjected to the element selection process and 5 locations (i.e.10% of 50 equals 5 locations) would be selected for inspection. For NUREG-0313 category A welds, the EPRI RI-ISI process treats these locations as resistant to IGSCC and as stated above they will be inspected in accordance with their risk category (e.g. risk category 2 vs 4).
NRC's QUESTION 2.
The response to RAI G-7 states,in part,"the probability of detection can be improved by implementing an inspection process that implements appropriate inspection methods by qualified inspectors, and that inspectors will be required to demonstrate proficiency in these inspection techniques according to the qualification requirements specified in ASME Section XI." SRP 3 9.8 requires that the qualification of NDE personnel, processes and equipment be in compliance with ASME,Section XI. This could be generally interpreted to mean qualifying ultrasonic procedures, personnel, and techniques in accordance with Section XI, Appendices Vll and Vlli. Is EPRI advocating that inspection methods, procedures, personnel and equipment be qualified to a level commensurate with the intent of an Appendix Vill performance demonstration program?
EPRI's RESPONSE 2.
No.
NRC's QUESTION 3.
The EPRI's Respor,se to RAI l 1 provides the definition of pipe segments as being a continuous run of pipe in which all of the following are true: 1) The consequence of a imposed pipe break are the same at any location in the pipe segment,2)
The potential degradation mechanisms present are the same at any location in the pipe segment, and 3) The pipe segment is located in the same area of the plant so that spatial impacts are the same, Please explain why it is necessary to include item 3, since spatial impacts are part of s.
the indirect effects, and both direct and indirect effects determine the postulated consequences for a break in that segment. Wouldn't item 1 for which the consectuence of pipe break is determined to be the same at any location in the pipe segment, already establish that the spatial impacts would have to be the same as well?
EPRl's RESPONSE 3a.
It is true that it appears that dividing piping segments by plant locations, given that spatial consideration are an explicit part of the consequence assessment, would be unnecessary.
However, in order to streamline the data management of the process and to ease the bookkeeping burden, we track plant location as part of the process. This has shown to be helpfulin reviewing the analysis as well as part of the element selection process. However, whether this information is tracked or not the consequence assessment and risk ranking results will be the same.
NRC's QUESTION b.
The EPRI's Response states that this definition was established so that the program results would not be dependent on segment size or the number of segments.
Would this definition apply to plant service water systems as well? Inclusion of the plant service water system in the original ANO-2 submittal required a substantial departure from the EPRI methodology to determine potential degradation sites for examination. It was determined by the licensee that localized corrosive attack can occur within substantially large portions of the piping, and is therefore, not necessarily associated with a structural discontinuity such as a weld. For these reasons, this process was not amenable to element selection guidelines using percentages of certain risk categories, and did not initially consider the risk categorization of the segments It is noted that in Table G-4, ANO-2 Current Section Xi/ Risk-informed Element Selection Comparison, as part of the EPRI's Response to RAI G-9, the service water system is missing.
To what extent does EPRI intend to document the process that resulted from the ANO-2 SWS analysis in the EPRI methodology as guidance to other licensee's on how systems such as Service Water should be analyzed?
EPRI's RESPONSE 3b.
The various service water evaluation options were discussed during the meeting and will be documented in the revised TR.
NRC's QUESTION 4.
As discussed in the EPRI's Response to RAI G-21, and provided in. Section 6.3 has been added as a proposed enhancement to EPRI TR-106706 to provide guidance to licensees on how to determine the risk impacts from the proposed RI-ISI program, and how to determine if these impacts would be acceptable. The approach requires a qualitative evaluation, and if necessary, a more detailed quantitative evaluation, e.g., using a Markov modeling technique. It would be expected, as the last bullet in Section 6.3.1 describes, that most applications of the EPRI methodology would result in significant reductions in the number of locations selected for any High or Medium risk category, but there is no guidance or reference cited for how the qualitative evaluation should be performed.
EPRI's Response to RAI G-11 & 13 states, in part, that the evaluation (to verify that the total package of changes proposed to the inspection process results in an acceptable risk impact]
can in most cases be performed qualitatively by following a simple set of rules to ensure that any changes have a positive safety impact or at least a negligible risk impact. Please describe the qualitative evaluation process more fully and list the rules to be followed.
i EPRl's RESPONSE 4.
During the meeting the detta risk process was discussed and it was agreed that the revised TR l
would be more prescriptive in this regards.
NRC's QUESTION 5.
In general, in the EPRI's Responses to the various RAls, a number of enhancements to the draft June 1996 topical report are discussed, with the next revision of the report to be issued sometime in early 1999. As noted in the cover letter to these responses, the EPRI methodology nas been codified by the ASME Boiler and Pressure Vessel Code as code cases N 560 and N 578. In the pilot studies completed to date using these code cases, the licensees departed from the code case guidance and deferred to EPRI since the guidance in the code case was either insufficient or missing entirely, e.g., with regard to degradation mechanism evaluation, containment performance impact assessment, etc.
Since the pilot plants and other licensees have o6 will be using these code cases as the bases for the alternative Rl ISI program rather than the EPRI methodology directly, can EPRI address when it is expected that the current revisions of the code cases would be updated to include the enhanced guidance to make them consistent?
EPRI's RESPONSE 5.
ASME code cases (N-560 and N-578) have been revised based upon pilot study lessons leamed and to make them consistent with the revised TR. They are currently going through l
the ASME code consensus process While EPRI can not speak for ASME, it is expected that i
the revised code cases will be issued by the end of 1999.
NRC's QUESTION 6.
Use of EPRI Table 3.3 regarding containment performance impact assessment in the EPRI methodology versus the CCDP 0.1 margin approach could lead to conflicting (though conservative) rankings, based on the following examples:
The ANO-2 submittals used Table 3.3, which requires if there is only one active valve (which needs to close on demand) or one passive valve (that needs to remain closed) to provide a barrier to reduce the potential for an unisolated LOCA outside of L
containment, then the consequence category would be ranked as High.
In the Vermont Yankee pilot plant submittal, the containment performance assessment I
is based on CCDP and the margin which exists between the current ranking and the n%t higher ranking being less than or equal to 0.1. The example that is often given as a CCDF for core damage is 1E-S (Medium consequence), but there is no containment barrier. Since there is 0.1 margin to the High consequence at 1E-4, the Medium consequence is retained.
But what if the final CCDP of 1E 5 was calculated on the basis of MOV failure
- CCDP for a{
j LOCA-OC7 Would the Medium consequence still be retained or would Table 3 3 apply indicating that a High consequence should be used since there was only one active valve to prevent an unisolated LOCA outside containment? Please describe the relationship between Table 3-3 and the quantitative margin approach for containment impact assessment.
f EPRI's RESPONSE 6.
(
As discussed during the meeting, Table 3.3 is designed to evaluate and rank LOCAs Outside j
Containment (LOCA-OC), in cases when those events are not specifically modeled in the PRA.
In Table 3.3, it is assumed that given a LOCA Outside Containment, there is still margin against a Large Early Release, on the order of 0.1 or less. The assumption can be conservative in that, given a LOCA-OC, there are still actions available to ths operator to prevent coca damage and the potential for an early or large release. This is why two active failures without crediting these additional measures (from generic failure data, this will correspond to a CCDP of 1.5E 5) are ranked in the " Medium" consequence rank. The revised TR will be updated to provide clarification on this topic.
NRC's QUESTION 7.
The last paragraph in Section 4.3 of the EPRI topical report is not clear. If a segment consequence category was assigned based on a_smallleak rather than a large break, then why would the degradation category be assumed to be "Large Break" for all degradation mechanisms? Is this paragraph a continuation of the previous paragraph regarding water hammer?
In EPRI's Response to RAI C 1, C-12 and C-18,it is not clear how a small break can be more limiting than a large break looking at consequences only. Please provide examples.
EPRI's RESPONSE 7.
The last paragraph of section 4.3 of the TR is not a continuation of the water hammer discussion contained in section 4.3. The methodology requires that a spectrum of break sizes (i.e. small to large) be addressed as part of the consequence methodology, regardless of failure potential. This requirement of the methodology is to capture any instances where the assumption of a smallleak causes the limiting consequence impact. To date this has never been shown to be the case in any of the pilot plant studies. However, if this situation were to occur, then the methodology calls for the f ailure potential assignment for medium failure potential degradation mechanism (e.g. thermal fatigue) to be raised to the high failure potential
(
category.
NRC's QUESTION 8.
The intent of the EPRI's Response to RAI F-11 is clear, i.e., if a segment was found to be susceptible to a degradation mechanism other than FAC (which would normally be considered having a Medium pipe rupture potential), and is also susceptible to water hammer, then the failure potentialis elevated to High. But inclusion of Water Hammer J
- as depicted in Table F C of Attachment 6, as a degradation mechanism which results in a High pipe rupture potential, could be misleading, since as noted, the NDE inspections would have to be geared to finding flaws from an accompanying degradation mechanism, not for flaws due to water hammer.
Please verify that a pipe segment that has no degradation mechanisms identified but is known to be susceptible to water hammer, would not be elevated to a High pipe rupture potential on the basis of water hammer alone.
EPRI's RESPONSE 8.
Pipe sections that are identified as not being susceptible to degradation mechanisms but are susceptible to waterhammer are assigned to the low failure potential category.
NRC's QUESTION 9.
In Section 5.3, what would be an example of a pipe system that was included in the scope of the RI-ISI program that would have pipe segments with some potential degradation mechanism but no consequence of failure?
EPRl's RESPONSE 9.
3 There were no examples found during the pilot studies that identified a location that fellinto the *None" consequence category and was susceptible to some degradation mechanism.
NRC's QUESTION 10. In EPRI's Response to RAI G-9, it is not clear why the criteria used to inspect Risk Category 4 welds for ANO-2 was 7.5 %, whereas the RI ISI methodology requires inspection of a minimum of 10 % welds for this risk category.
EPRI's RESPONSE 10.
The 7.5% sample criteria applies to the old Section XI program vs the RI-ISI program sampling j
percentage of 10%.
{
l NRC's QUESTION 11.
Please clarify the 3rd column in Table G-4, page 25 of RAI responses.
EPRI's RESPONSE 11.
l The third column identifies the total number of welds that belong to risk category 2.
1 NRC's QUESTION 12. The preface for "F" series responses quoted in response to RAI F-4 q
and F-8 is missing.
)
l l
EPRl's RESPONSE 12.
l l
l The beginning of the *F" series response should have been entitled
- Preface".
NRC's QUESTION 13. EPRl's Respcu to RAI F-8 states that fracture rnechanics based estimates of pipe rupture frequencies have a history of indicating much lower values of pipe rupture than indicated by service experience. However, staff review has found higher values of -
pipe rupture frequencies than those listed in the Table on page 14, Attachment 6.
In addition, another plant submittal has reported that generic review of pipe failure data revealed FAC related f ailures occurring at a frequency of approximately one per year in the industry. For an average of 100 units in service, this gives an annual rate of 1.0E-2, much higher than the frequency listed in Table on page 14, Attachment 6. Please justify the values in this Table.
EPRl's RESPONSE 13.
As explained during the meeting the units of several of the Tables in Attachment 6 are different. The EPRI data for totalindustry is consistent with a value of approximately 1.0E-2 per plant.
NRC's QUESTION 14.
The EPRl's Responses to RAls 1-4 and I-5 state that those issues should be raised with NEl. What is NEl's Response to these RAls.?
EPRI's RESPONSE 14.
As stated during the meeting, EPRI will pursue closure of these items with NEl.
NRC's QUESTION 15. The EPRI's Response to RAI l-6 does not answer the NRC's question of justifying 25 % inspection criterion.
EPRI's RESPONSE 15.
Assignment of a location to risk category 1 does not imply an active degradation mechanism is present. Typically, locations are assigned to this category if conditions are such that it has been incorporated into a plant's FAC problem.
However, if an active degradation mechanism is present at a risk category 1 location (or any location, regardless of risk classification), it is incumbent upon the licensee to determine the safety significance of this issue and implement remedial actions in a timely manner consistent with plant procedures and Technical Specification requirements. No inspection program by itself (risk-informed or other) is a substitute for licensee programs and requirements for conditions adverse to safety.
NRC's QUESTION 16.
The footnotes to Table 12 in EPRI's Response to RAI l-13 are not clear. In particular, how does Class 1,2, and 3 enter into inspection sample in RI-ISI methodology?
EPRI's RESPONSE 16.
The reference to Class 1. 2 and 3 do not have a bearing on the selection of a location for
p inspection in a risk-informed process. The reference to Class 1,2 and 3 were provided in the RAI response to show a comparison between current practices and the risk-informed approach.
NRC's QUESTION 17. The basis for data in T6ble 6-5, Attachment 4 is not clear.
EPRI's RESPONSE 17.
EPRI stated during the meeting that they would provide additional details on the basis for the data.
i h'