ML20211B893

Safety Evaluation Supporting Amend 143 to License NPF-2

ML20211B893
Person / Time
Site:	Farley
Issue date:	08/17/1999
From:	NRC (Affiliation Not Assigned)
To:
Shared Package
ML20211B881	List: ML20211B876 ML20211B893
References
NUDOCS 9908250118
Download: ML20211B893 (24)

Text

,

nico

[,,

k UNITED STATES j.) ) %

3 NUCLEAR REGULATORY COMMISSION f

WASHINGTON, D.C. 20555 4001 SAFETY EVALUATION BY THE OFFICE OF NUCLEAR REACTOR REGULATION RELATED TO AMENDMENT NO.143 iO FACILITY OPERATING LICENSE NO. NPF-2 SOUTHERN NUCLEAR OPERATING COMPANY. INC.. ET AL.

JOSEPH M. FARLEY NUCLEAR PLANT. UNIT 1 DOCKET NO. 50-348 i

1.0 INTRODUCTION

By letter dated April 23,1999, as supplemented by letters dated July 22, Juiy 30 and i

August 12,1999, the Southern Nuclear Operating Company, Inc. (SNC) et al., submitted a

(

request to change the Joseph M. Farley Nuclear Plant, Unit 1, license so that they would not have to conduct mid-cycle steam generator tube inspections during Cycle 16. The requested change would add an additional condition to the Unit 1 license which allows SNC to operate l

Unit 1 for Cycle 16 based on a risk-informed approach to evaluate steam generator tube i

structural integrity. SNC letters dated July 22, July 30 and August 12,1999, provided clarifying information that did not change the April 23,1999, application and the initial proposed no significant hazards consideration determination.

I

2.0 BACKGROUND

On August 16,1998, SNC shut down Farley Unit 1 (Farley-1) due to the detection of elevated primary-to-secondary leakage in the "B" steam generator. During the outage, the source of the leakage was identified as an axial indication in tube R25C51. Several other defects located in the vicinity of the through-wall flaw were also detected during the inspections. Upon returning to power, SNC once again identified primary-to-secondary leakage in the "B" steam generator.

The leak rate remained stable for the remainder of the operating cycle, and the plant was shut down in November for the Cycle 15 Refueling Outage (1R15). During the outage, SNC completed more extensive examinations of the three steam generators at Farley-1 than had been conducted in the unscheduled outage in August. The source of the primary-to-secondary leakage experienced after the forced outage was identified as a freespan, axial flaw in tube R43C32. Tube inspections in 1R15 also identified a number of significant, freespan tube cracking indications elsewhere in the Farley-1 steam generators.

To improve the sensitivity of the inspection methods for detection of freespan cracking, SNC revised its inspection procedures for the 1R15 outage. SNC performed a re-analysis of the bobbin ceil eddy current data from the tubes that contained the freespan flaws that leaked during operation and revised the data analysis guidelines to identify additional tubes that contained similar signal characteristics. In addition, SNC concluded that its previous tube examinations failed to inspect tube spans near the end of the sleeve repairs. Several tubes were plugged as a result of additionalinspections of these previously uninspected tube areas.

9908250118 990817 l

PDR ADOCK 05000348 p

PDR Enclosure

o 2

Preliminary deterministic operational assessments completed by the NRC and SNC indicated that the Farley-1 steam generator tubes would not maintain tube integrity margins consistent with the plant licensing bases throughout the duration of the next cycle of operation. On April 30,1999, SNC submitted a license amendment application to allow Farley-1 to operate for the entire Cycle 16 without mid-cycle tube examinations based on risk considerations. The risk I

analysis was supported by detailed operational assessments that predicted the degraded condition of the tubes at the conclusion of the operating cycle. SNC stated that its license j

amendment application followed the guidance in NRC Regulatory Guide (RG) 1.174, "An l

Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to Licensing Basis."

i SNC's deterministic operational assessment estimated that the limiting structural margin applicable to the Farley-1 steam generator tubes could be exceeded approximately 7 months after restart from 1R15. The planned operating cycle length is 13.4 months and is equal to the period of time the unit was operated in the prior cycle up through the forced outage. The leaking tube that led to the outage in August of 1998 was the most degraded of all tubes identified in either the forced outage or the refueling outage. However, this tube had sufficient structural integrity to withstand pressures associated with main steam line break accidents.

The staff reviewed SNC's operational assessments and completed independent calculations of 1

the increased risk resulting from operating Farley-1 throughout the duration of Cycle 16 without i

SNC performing mid-cycle steam generator tube examinations. SNC's operational assessments consisted of deterministic and probabilistic assessments. SNC's deterministic assessments contained both a purely deterministic assessment and a deterministic /probabilistic assessment to calculate the exp6cted times for a steam generator flaw to grow to a depth exceeding tube integrity margins. SNC's purely deterministic assessment method was similar to that for structural calculations while its deterministic /probabilistic assessment also used Monte Carlo methods to determine flaw sizes. The data used as the basis for the deterministic assessment were also used in the probabilistic assessment. SNC's objective was to estimate probability of tube burst under steam line break conditions after operating for a period of time.

The staff checked SNC's calculation inputs and performed a separate deterministic assessment that yielded results similar to SNC's. The staff also performed an independent risk assessment (using the results of SNC's probabilistic calculations) to estimate the risk increment associated with SNC not doing a mid-cycle steam generator inspection. The staff then compared these results with RG 1.174 numerical acceptance criteria. Section 3.0 summarizes the details of SNC's evaluation and the staff's assessment.

3.0 EVALUATION 3.1 Farley-1 Cycle 16 Operational Assessment SNC completed an operational assessment of the Farley-1 steam generators for Cycle 16 operation. SNC's assessment (Cycle Length Evaluation Analysis) dated April 23,1999, considered only freespan tube degradation for the purpose of limiting operation in Cycle 16.

Although other modes of degradation would likely be found in an inspection completed at the end of the operating cycle, experience from Cycle 15 operation indicates that freespan tube flaws are the limiting mode of degradation applicable to the Farley-1 steam generators.

L_

. Two types of deterministic operational assessment were completed to evaluate tube integrity margins under design basis accident conditions. SNC completed a purely deterministic approach that assumed conservative margins for each input into the calculation. SNC also completed a deterministic /probabilistic assessment that incorporated Monte Carlo methods to more realistically address uncertainties in predicting the most significant end-of-cycle flaw. The Monte Carlo approach used for this assessment was similar to that used for operational assessments of voltage-based steam generator tube repair criteria per NRC Generic Letter (GL) 95-05. The output from this calculation was then used to determine when tube integrity margins would be exceeded.

To further support the estimates of steam generator tube integrity margins at the end of Cycle 16, SNC also completed probabilistic assessments. The probabilistic calculations generally produce results with less conservatism than those of deterministic or deterministic /

(

probabilistic assessments because all parameters selected in the analysis are randomly selected from distributions rather than assumed at some limiting value. The output from these calculations is estimates of the probability of tube burst under design basis accident conditions.

The staff's review of the Farley-1 operational assessments included a detailed review of the inputs into each of the calculations. In addition, the staff completed a sensitivity study using an alternate method to predict the extent of the most limiting freespan tube flaw for Cycle 16 operation. SNC submitted results from its own sensitivity studies, but these studies employed the same methodology as the baseline assessment. The staff's evaluation did not attempt to independently assess accident-induced leak rates for the freespan degradation. More t

emphasis was placed on reviewing the predictions for tube structural integrity because licensing margins associated with tube integrity may not be satisfied at the end of the next cycle.

The objective of a deterministic analysis is to estimate the margins of safety for the most significant flaw that could reside in the steam generator at the end of the operating cycle. One i

of the difficulties in performing these analyses is obtaining the proper balance between conservative inputs into the calculation and realistic outcomes. Overly conservative inputs (e.g., deeper, longer cracks thari reasonably expected) will generally lead to a prediction of exceeding margins earlier than one would reasonably expect. The licensing basis for Farley-1 requires that all steam generator tubes have the structural capability to withstand tube loads associated with normal operation including anticipated transients with a safety factor of three j

and the limiting design basis accident with a safety factor of 1.43. Because this requirement applies to all tubes, SNC's evaluation need only evaluate the most significantly degraded tube projected for the end of the operating cycle.

3.2 Beginning of Cycle Conditions The inspections completed at the end of Cycle 15 and the destructive examinations of tubes removed from the Farley-1 steam generators with freespan cracking provided a database for describing the geometry of cracks expected at the end of the current operating cycle. Deriving insights into the initial flaw geometries from these data is a complex operation. All the identified freespan cracks are removed from service upon detection. Therefore, only undetected flaws and those that are expected to initiate during the cycle should be present at the next inspection.

The difficulty with accurately determining a representative geometry at the beginning of an operating cycle stems from a lack of data from which the licensee can effectively determine the shape (e.g., length and depth) of each crack.

. Licensees typically analyze inspection data obtained in prior outages to estimate the initial size of cracks that were not detected during an inspection and returned to service. These analyses also can provide information that can be used for estimating crack propagation rates. Freespan tube flaw lengths generally cannot be estimated from such analyses. Prior to beginning operation in Cycle 15, SNC had acquired only bobbin coil eddy current data in the areas where freespan flaws were identified at the end of cycle. These data do not provide information on the overall length of freespan cracks. For the Cycle 16 operational assessment, SNC assumed that the distribution of flaw lengths at the end of the cycle would be similar to that identified in the most recent refueling outage. The crack length assunied for the deterministic and probabilistic/ deterministic assessments was equal to that measured for the structurally limiting flaw that developed during the previous cycle of operation. This length is assumed to be constant for the entire cycle. The probabilistic assessment utilized the distribution of flaw lengths measured from the most recent inspection results to establish end-of-cycle crack lengths. These results were the input into the staff's risk calculation.

The crack lengths considered in SNC's operational assessment are " burst effective" crack lengths rather than overall flaw lengths. The total reported flaw length includes portions of the crack that are shallow and do not affect the burst pressure of the tube. The burst effective length is determined by interactively applying analytical expressions for burst pressure to different segments of the crack profile. For each segment of the crack, an average depth is calculated. The average depth and crack segment lengths are used to calculated the burst pressure. The segment of the flaw that yields the lowest burst pressure is termed the structurally significant length. The average depth over this length is called the burst effective depth.

The deepest flaw depth at the beginning of the operating cycle was assumed on the basis of probability of detection (POD) curves. These curves were established via an analysis of pulled tube data and quantify the likelihood (i.e., probability) of detecting flaws of a specified depth during the inspection. The NRC typically requires licensees to assume values derived from statistical distributions that will provide a relatively high degree of assurance (e.g.,95 percent probability) that margins of safety will be maintained. Selection of an assurance level will define the maximum flaw depth for which one might expect a flaw to exist at the assumed probability.

SNC considered several POD assurance levels (i.e., initial flaw depths) in the deterministic operational assessment. The resulting flaw depths increased as one assumes a lower probability of not detecting flaws of a certain depth. Greater initial flaw depths yielded shorter operating periods to the time when tube structural integrity margins were exceeded.

SNC considered both the average and maximum depth of flaws in its assessment. These are used to support structural integrity assessments and accident-induced leak rate calculations, respectively. Separate POD curves were established for average and maximum flaw depths.

The population of flaws detected during inspections can generally be classified as indications that were not identified in the prior inspection and those that initiated during the operating cycle.

Licensees attempt to minimize the number of unidentified flaws during inspections by using independent groups to analyze inspection data. Estimates of the number of indications not identified during an inspection are provided by POD correlations. The number of flaws that initiate during an operating cycle can be estimated using statistical methods. The combination of these two calculations represents the total population of flaws residing in the steam generator at the end of the cycle. SNC assumed that new flaws would have an initial depth that I

[

. was bounded by the minimum flaw depth detected by a bobbin coil probe for the three pulled tube specimens. Distributions of flaw depth were used only for Monte Carlo simulations to predict the end-of-cycle flaw georretries.

The probabilistic operational assessments for Farley-1 randomly establish initial flaw geometries for all flaws that are assumed to exist within the steam generators at the beginning of the operating cycle. Flaw lengths, depths, and profile (i.e., depth as a function of position along the length of the flaw) are determined by assigning values that are probabilistically selected from distributions of these parameters. The staff was unable to independently verify the most likely flaw distribution from such a calculation. However, the staff did review the distributions that formed the basis for establishing the initial population of steam generator tube cracks.

The staff has reviewed SNC's approach for assuming an initial flaw length and depth used in the deterministic operational assessment and concludud that the methodology provides an adequate estimation of the limiting freespan tube flaw expected to remain in service during Cycle 16. The inputs to the Monte Carlo simulations for the probabilistic and deterministic /

probabilistic operational assessments were established using the best available data applicable for the Farley-1 steam generators. Therefore, the simulations produced an accurate representation of the condition of the tubes at the end of Cycle 16 consistent with the sensitivity of the inspection t'echnique used in the 1R15 outage. The results from probabilistic operational assessments indicate longer operational times prior to exceeding licensing basis tube integrity margins when compared to those produced from the deterministic assessment. This observation is consistent with reviews of similar probabilistic operational assessments.

3.3 Steam Generator Tube Flaw Growth Rates Prior to the destructive examinations completed to support SNC's operational assessment, data were unavailable regarding the expected growth rates for freespan tube degradation in the Farley-1 steam generators. Data acquired from tubes removed in the 1R15 outage enabled l

SNC to construct a relationship between bobbin coil voltage and the average depth of freespan

{

cracks. Eddy current inspection data obtained in the 1R14 outage were reviewed to assign voltages to indications that were undetected during the inspections but were later detected and confirmed in the forced outage or the 1R15 outage. This enabled SNC to estimate the initial depth of all cracks in the Farley-1 steam generators when an indication was present in the 1R14 eddy current data. Indications that were not detectable were assigned a depth corresponding to the minimum threshold of detection derived from analyses of pulled tube flaws. SNC developed correlations relating voltage to maximum and average flaw depth.

The depths of most freespan cracks were calculated in the 1R15 outage via an analysis of rotating probe eddy current data. A rotating probe coil (e.g., Plus Point, pancake) interrogates a much smaller area of a tube than a bobbin coil. This enables analysts to estimate geometric characteristics that cannot be derived from bobbin probe data. SNC calculated the average i

and maximum flaw depths for cracks identified in 1R15. The depth of flaws in tubes removed

)

from the Farley-1 steam generators during the outage was determined from the results of the j

metallographic examinations. Using these data and those from the bobbin depth analyses, SNC was able to develop a distribution of flaw growth rates for the previous cycle of operation.

in order to apply the growth rates for the current operating cycle, it was necessary to normalize the total growth for each flaw by the length of the previous operating cycle and to make an

)

1 l

i

l 1 adjustment to account for a higher steam generator tube temperatures in Cycle 16. The staff reviewed the growth rate adjustments to the data and concluded that the approach used by SNC was appropriate.

Theoretically, bobbin coil voltage does not provide an accurate estimation of the depth of cracks in tube walls. However, empirical evidence from previous steam generator tube inspections indicates that bobbin voltage generally increases with increasing maximum flaw depth. In addition, voltage-based tube repair criteria implemented per NRC GL 95-05, " Voltage-Based Repair Criteria For Westinghouse Steam Generator Tubes Affected By Outside Diameter Stress Corrosion Cracking," use bobbin coil voltage as a means to estimate the probability of tube burst and leak rates from cracking at tube support plate intersections. The voltage-depth correlations developed by SNC using tubes removed from the Farley-1 steam generators yielded a relationship between flaw depth and voltage that was consistent with inspection experience. Calculated growth rates and initial flaw depths were also in agreement with estimates made by the staff using alternate approaches.

Although there may be uncertainties in calculating growth rates and initial flaw depths for indications detected in 1R15, these uncertainties will tend to cancel out during the analysis. For example, if the population of crack depths at the beginning of the previous operating cycle are underestimated then the resulting growth rates will be overestimated and vice-versa.

i Therefore, the staff concludes that the use of bobbin coil voltage to estimate the depth of indications at the beginning of Cycle 15 is an adequate approach to support SNC's operational assessment. This conclusion is based, in part, on other considerations including the use of pulled tube data from the Farley-1 steam generators, the methods used to analyze eddy current inspection data, and the degree of conservatism applied in other areas of SNC's operational assessment.

3.4 Steam Generator Tube Structural Limits Structural limits are typically established considering several factors: (1) applied loads (e.g.,

pressures), (2) material properties, (3) the configuration of the component including any assumed structural discontinuities (e.g., flaws), and (4) expressions to relate these three items to predict component failure. The limiting loads for the Farley-1 steam generator tubes occur as a result of differential pressure between the primary and secondary systems. Therefore, only pressure loads were considered in establishing the steam generator tube structural limit.

Flaw lengths were discussed in Section 3.1 of this safety evaluation. The steam generator tube configuration is fixed since all tubes have nominal dimensions of a %-inch outside diameter and a tube wall thickness of 0.050-inches. Only the flaw depth (i.e., structural limit) remains undefined. This is determined by calculating the failure pressur*e of a tube given the flaw length and material properties using an appropriate failure model. The following discusses the limiting loads considered in establishing the structural limits, the Farley-1 steam generator tube material properties, and the assumed failure model.

The Steam Generator Tube Surveillance requ:rements in the Farley-1 Technical Specifications include a requirement that SNC remove from service (or repair) tubes with degradation with depths exceeding 40 percent of the nominal tube wall thickness. This repair limit was established to maintain a factor of safety of three against tube burst during normal operation consistent with Section til of the American Society of Mechanical Engineers Boiler and Pressure Vessel Code (ASME Code) as documented in testimony provided by James Knight

7 before the Atomic Safety and Licensing Board in January of 1975 in proceedings on the subject of the minimum acceptable wall thickness for the Prairie Island Units 1 and 2 steam generator tubes. The factor of three margin also represents the limiting structural margin applicable to the Farley-1 steam generator tubes.

SNC indicated that the limiting internal pressure loads applicable to the Farley-1 steam generator tubes occur during normal operation. The differential pressure assumed by SNC for these conditions is 1436 psia. The staff notes that this does not necessarily represent the maximum differential pressure applicable to the Farley-1 steam generator tubes. The value of 1436 psia was established on the basis of the steady-state pressure on the secondary side of the steam generators at 100 percent power operation. The assumed differential pressure did not account for transient plant conditions that occur during operation that result in slightly higher differential pressures than those experienced under steady-state conditions. Such transients were not included in SNC's analysis but should be included in establishing the limiting pressures in accordance with the guidance in the ASME Code and NRC RG 1.121,

• Bases for Plugging PWR Steam Generator Tubes." However, the staff concludes that the differential pressures assumed by SNC for the Farley-1 are adequate for the licensee's operational assessment because the results of the staff's risk evaluation are insensitive to this assumption.

Applying a safety factor of 3 to the normal operating differential pressure necessitates that the Farley-1 steam generator tubes be capable of withstanding a pressure of 4308 psi.

Under steam line break conditions, SNC assumed that the primary coolant is pressurized to the setpoint of the power operated relief valves (PORVs),2350 psia, with an additional 3-percent pressure elevation due to uncertainty in the valve opening pressure. This results in a maximum steam line break pressure differential pressure of 2405 psi. This pressure should be further elevated by a safety factor of 1.43 in accordance with the margins specified in the ASME Code included by reference in the Farley-1 licensing bases. Thus, a second structural limit that may be considered in the Farley-1 operational assessment corresponds to the pressure retaining capability of a flaw tube pressurized to a pressure of 3436 psi. SNC has established the PORV setpoint as the peak steam line break pressure following the guidance provided in GL 95-05.

This GL allows licensees to assume that the PORV setpoint is the peak accident pressure in lieu of the pressurizer safety valve setpoint for voltage-based repair criteria operational assessments provided certain conditions stated in Section 2 of Attachment 1 to the GL are satisfied. SNC's submittalindicated that these conditions are satisfied for Farley-1.

SNC assumed that steam generator tube failure is governed by the flow stress of the material which is typically calculated as the average of the yield and ultimate stresses. SNC assumed material properties in establishing the structural limits based on the properties for the population of tubes identified with freespan tube cracking at Farley-1. Material certification sheets list the yield and ultimate stresses for each heat of material used in fabricating the Farley-1 steam generator tubes. The low temperature flow stress of the tubes was calculated as the mean of the flow stress from each of the heats of materialin the sample. SNC reduced the flow stress based on a one-sided, lower tolerance limit with a probability of 0.95 evaluated at a 95 percent confidence level. In addition, the resulting flow stress was further reduced to account for the decrease in temperature of the tubes during normal operation and design basis accident conditions.

Westinghouse developed a model based on empirical data to estimate burst pressures of flawed steam generator tubes. Using this model, SNC calculated a deterministic structurallimit

. for the steam generator tubes corresponding to an internal pressure of three times the normal operating differential pressure. Burst pressure estimates from this model were calculated at a lower 95 percent confidence level based on the scatter in the data supporting the empirical correlation. Flaws with depths less than 67 percent of the nominal tube wall thickness have sufficient structural capability to withstand this pressure. Tubes will not have adequate integrity to maintain the margins necessary under steam line break conditions when flaw depths exceed 76 percent throughwall. Both of these limits assume a fixed flaw length of 0.8 inches. In the probabilistic assessment, the burst pressure for each crack is computed based on its length and depth. The calculated burst pressure indicates whether the tube flaw was beyond the structural limit rather than a single parameter (e.g., depth) as is the case for the deterministic and probabilistic/ deterministic assessments.

1 The staff independently calculated the structural limits applicable to the Farley-1 steam generator tubes. These calculations utilized material properties that were conservative with respect to those used by SNC. The staff considered it appropriate to use more conservative properties because SNC's assessment assumed that cracking is limited to the heats of materials that had been identified with cracking. Other tube material heats were used in fabricating the Farley-1 steam generator tubes with lower structural capability than those assumed by SNC. Therefore, the staff concluded that it was more appropriate to use reduced material strength values given that there is a likelihood of developing cracks in lower strength tubes. The staff's estimate of the Farley-1 structurallimits also used an alternative failure model to calculate tube burst.

The NRC staff determined that the flaw depths corresponding to the tube structural limit for meeting 3 times normal operating pressure and the peak accident pressure multiplied by a factor of 1.43 are slightly lower than those included in SNC's deterministic operational assessment. The staff's estimates result in limiting crack depths that are approximately 5 percent throughwalllower than SNC's calculations. Although the staff's structurallimits are slightly more conservative and should directly translate into exceeding licensing basis tube integrity margins at an earlier time, the staff used a lower beginning of cycle flaw depth based on industry pulled tube data in its deterministic assessment that resulted in overall times to exceed these margins approximately equal to those determined by SNC.

3.5 Nondestructive Testing Uncertainties SNC quantified the eddy current data analyst's ability to detect and size tube flaws. The database used to assess these uncertainties was based on the destructive examination results of three tubes removed from the Farley-1 steam generators with freespan degradation. SNC constructed POD correlations as a function of maximum and average flaw depths and determined the errors associated with estimating the length and depth (maximum and average) of freespan cracks.

In establishing POD curves, SNC included the results from two different analyses of the eddy current inspection data. One analysis was completed during the original inspection of the tubes. The other was a re-analysis of the original eddy current data using updated data analysis guidelines that were implemented during the most recent refueling outage. For two of the tubes, the analysis guidelines used during the original field analysis did not incorporate the modifications to the analysis guidelines implemented in the 1R15 outage intended to enhance freespan crack detection. Therefore, including the results from these analyses provides

i l

l i

i 1 additional conservatism in the final POD correlations. Data from each of the three tubes were analyzed, and the indications identified by the analysts were associated with flaws in the pulled tube specimens. SNC evaluated a number of possible expressions to relate the probability of l

detection with the depth of each flaw. The logistic function provided the most conservative l

construction of a POD curve for deeper flaws of the models considered. The staff agrees with SNC in that the logistic fit provides a suitable curve to represent inspection POD for the Farley-1 operational assessment. SNC used the resulting POD curve to estimate the number of flaws l

that were undetected at the end of the last cycle and to establish the beginning of cycle flaw depth in the deterministic operational assessment.

j l

Analysts reviewed rotating probe eddy current data to size the length and depth of all the known flaws in the pulled tube samples. Estimates of flaw lengths and depths were compared to measurements from the destructive examinations of the pulled tube specimens. Destructive examination results are generally regarded as being the most accurate approach for measuring crack characteristics. Deviations between the results provided by each of the analysts and the j

destructive examination were attributed to analyst error. The distribution of sizing errors was j

assumed to be normally distributed with a mean and standard deviation established by the i

results of this comparison. Nondestructive testing uncertainties were incorporated into j

probabilistic calculations supporting SNC's operational assessment. The deterministic assessment did not include an allowance for inspection sizing errors because all flaws are removed from service after detection.

l The staff reviewed the manner in which the data were obtained to establish the nondestructive testing uncertainties and the resulting correlations and errors. These inputs to SNC's

)

operational assessment were developed using the best availeble data and were used in analyses in a manner consistent with maintaining conservative margins of safety. On these j

bases, the staff concludes that the licensee's evaluation of nondestructive testing uncertainties is acceptable to support the Farley-1 risk assessment.

3.6 Results of Farley-1 Operational Assessments I

SNC's deterministic operational assessment assumed a limiting flaw length equal to that for the most significant flawed tube observed in Cycle 15. The initial flaw depth was established based l

cn a POD curve derived on pulled tube specimens. SNC used flaw growth rates that were also based on these data. In addition, SNC calculated tube structural limits using an empirical burst pressure model assuming Farley specific steam generator tube material properties. Each l

phase of the assessment adopted some level of conservatism. The most limiting estimate of l

the time at which licensing basis tube integrity margins would be exceeded that was provided 6

by SNC is 7.1 months after restart from 1R15.

The methodology for the deterministic leakage integrity assessment was similar to that for the c

structural calculations. However, maximum crack depth rather than an average depth was considered in the analysis. These calculations predict that throughwall crack penetration is not expected until after 12 months of operation. The time to grow a crack throughwallis taken as the time to initialleakage. According to SNC, leakage should not occur until the throughwall crack length is at least 0.1 inch. Therefore, the estimate of the time to leakage appears to be j

conservative.

i 1

i 1

l

, The probabilistic/ deterministic operational assessment calculated the time to grow a flaw with a depth equal to the Farley-1 steam generator tube structurallimit. These calculations used the input that formed the basis for the deterministic assessments, but end-of-cycle flaw sizes were determined using Monte Carlo methods rather than by using a deterministic approach. SNC estimates that licensing basis tube integrity margins wili be exceeded after 8.7 months of operation. This operating interval established the time limit beyond which at least one of the Farley-1 steam generator tubes will no longer meet licensing basis tube integrity margins. At that time, the maximum depth of the deepest flaw is predicted to be approximately 80 percent throughwall.

The objective of the probabilistic operational assessment was to estimate the probability of tube burst under steam line break conditions after operation for a period of time. SNC considered the time at which a mid-cycle would be conducted (8.7 months) and at the end of the operating cycle without performing a mid-cycle inspection (13.4 months). The conditional probabilities of tube burst for the limiting steam generator are 1.2x10' and 3.8x10~, respectively. These results were calculated via a probabilistic assessment that assumed idealized flaw geometries which were similar to those of the deterministic assessments. SNC completed probabilistic assessments using two other methods that predicted higher probabilities for tube failure at the end of Cycle 16. The distribution of probabilities for the most significant flaw predicted for the end of the current cycle from one of these alternative probabilistic approaches was used as the in. nut into the staff's risk calculation. Because the method used to calculate the probability distribution for the risk assessment predicted the highest probabilities for conditional tube burst, the staff concludes that its risk calculation was determined using reasonably conservative inputs.

3.7 Staff Assessment of Inspections Completed in 1R15 Outage At the conclusion of Cycle 15, SNC identified several steam generator tubes degraded to such an extent that the structural capabilities of the tubes were lower than required by the licensing bases for the Farley-1. If the sensitivity of the inspection conducted in the 1R15 outage was comparable to that in prior refueling outage, then it is reasonable to assume that similar flaws would be evident in the steam generator at the end of Cycle 16. The results from SNC's calculations that were used as input into the staff's risk assessment indicate that degradation as extensive as that observed in the most recent refueling is not expected to be evident at the end of the current operating cycle. For example, the likelihood of finding a flaw equal in size to the most limiting crack observed in Cycle 15 is reduced to less than 5 percent. A decrease in the probability of detecting similar sized flaws can be attributed to improvements in SNC's inspection conducted in the 1R15 outage.

On July 30,1999, SNC submitteda response to a request for additional information from the staff that outlined the enhancements to the nondestructive examination practices implemented in the most recent inspections. These improvements include the following:

(1) Tube areas near the ends of tube sleeves were inspected using probes capable of inspecting areas that were previously not inspectable using bobbin coil probes.

(2) Training for eddy current data analysts emphasized the importance of detecting freespan tube indications.

. (3) Data analyst guidelines were revised to identify freespan flaw signals that were atypical of flaw signals observed elsewhere in the steam generator.

The staff believes that the improvement listed as item (1) is effective for improving the analyst's ability to detect flaws near sleeve tube ends. Prior to this modification, these tube areas were not examined during inspections. Inspecting these areas will enable SNC to detect flaws that would not have been identified in past inspections. However, the staff notes that this modification did not have a significant impact on the overall inspection results because the length of tube inspected as a result of this change is small relative to the total length of all stearn generator tubes.

Improvements in analyst training such as items (2) and (3) are difficult to assess without completing additional tests. Retrained analysts could be exposed to a different data set with known indications to evaluate their ability to detect the know indications. Alternatively, SNC could have completed random inspections using probes more sensitive than a bobbin coil probe. Results from these efforts could be used to evaluate the effectiveness of inspection improvements. However, SNC did not attempt to assess the inspection improvements through such means. A large increase in the number of flaws detected during inspections (i.e.,

inspection transient) may also indicate improvements in the sensitivity of the inspection methods. Although the number of confirmed indications increased by a factor of two from 1R14 to 1R15, increases of this magnitude are often exhibited by active degradation mechanisms and do not necessarily indicate an inspection transient. The staff notes that the percentage of indications that were confirmed as flaws with a rotating probe remained relatively constant between the two inspections. This observation indicates that data analysts were identifying bobbin flaw signals with the same degree of sensitivity in both inspections and does not support SNC's conclusion that the sensitivity of its inspection program improved.

The staff notes that the most structurally significant flaw identified during Cycle 15 should have been identified during the previous inspections but was not identified due to analyst error. The staff independently assessed eddy current test data for the tube (R25C51) that leaked and forced Farley-1 into an outage in August 1998 and concluded that the flaw should have been detected in the previous refueling outage without the use of improved data analysis guidelines.

The data clearly showed the presence of an indication that should have been identified by one of the two data analyst teams. Although the inspection process is set up to minimize the potential for such occurrences, obvious flaw indications are occasionally not detected during inspections. The staff does not expect flaws to be present similar to the one identified in Cycle 15 in tube R25C51 at the end of Cycle 16 because the likelihood of data analysts committing such errors on a similarly sized flaw is low.

Despite the absence of a strong indicator showing large inspection program improvements, other considerations and assessments completed by the NRC lead the staff to conclude that the sensitivity of the inspections increased in 1R15. On December 28,1998, the NRC issued the results from its inspection of the eddy current test data acquisition, management, and evaluation activities at Farley-1 in the 1R15 outage. The NRC's inspection concluded that the

" weaknesses in the area of previous data evaluation were identified by review of data for leaking tubes and were corrected and emphasized during site-specific training for eddy current analysts." Therefore, based on NRC inspection results, the staff concludes that SNC's inspection program has improved.

. In summary, the predictions from the probabilistic calculations indicate a low recurrence of the significant flaws that were found in the previous operating cycle for the end of Cycle 16. The inspection program modifications are likely to have imp:oved the ability to identify freespan flaw

' indications in the 1R15 outage that could develop into significant cracks at the end of Cycle 16, as documented in the December 28,1998, NRC inspection report. In addition, the staff concludes there is a low likelihood that analysts committed errors in the 1 R15 outage similar to the errors that led to the degraded tube conditions identified in the forced outage in August 1998. On these bases, the staff concludes that the inspections performed during refueling outage 1R15 were improved relative to the inspection completed prior to Cycle 15.

3.8 Staff Evaluation of Farley-1 Operational Assessments

. SNC completed an operational assessment to establish the time at which a mid-cycle shutdown would be necessary to maintain tube integrity margins consistent with the current licensing 9

basis for Farley-1. A conservative, deterministic estimate of tube structuralintegrity for the end of Cycle 16 does not predict failure under design basis accident conditions. Each of the licensee's assessments indicate that the steam generator tubes will not maintain structural integrity margins consistent with the plant licensing basis for the duration of operating cycle.

The staff reviewed the technicalinputs that formed the basis for the steam generator tube operational assessments. For the deterministic assessment, the staff concluded that in the areas of nondestructive testing uncertainty and the assumption of an initial flaw depth, SNC's methods employed an appropriate level of conservatism. However, the staff noted that the maximum allowable flaw depths established for freespan tube degradation were slightly larger than those calculated by the staff. Despite this area of concern, independent estimates of the operating time to exceeding licensing basis tube integrity margins were consistent with the results provided by SNC.

The data assembled to support the deterministic assessments formed the inputs into the deterministic /probabilistic and probabilistic assessments. The licensee's operational assessment results were similar to the conclusions from the staff's deterministic calculations.

The staff reviewed the output from some of SNC's calculations and concluded that the estimated probability of larger sized flaws existing at the end of the current operating cycle was consistent with the sensitivity of SNC's steam generator tube inspections conducted in the most recent refueling outage. On this basis, the staff conciudes that SNC has demonstrated with sufficient confidence that the condition of the Farley-1 steam generator tubes at EOC-16 will be substantially improved over the condition of the tubes observed during and at the conclusion of the previous operating cycle.

3.9 Risk Analysis The risk increase that would be caused by not inspecting the steam generator tubes in Septembor 1999 is the difference between the risk estimates for the subsequent part of the fuel cycle as calculated with and without the benefit of detecting and repairing defected tubes in September. A conceptual illustration is shown in Figure 1. This risk increment occurs during the 144 effective full power days (EFPDs) of operation between September 1999 and March 2000. The risk estimate for the inspection case assumed that the 144 EFPDs after a mid-cycle inspection would have the same probability of occurrence for various sized tube flaws as occurred during the first 144 EFPDs following the inspection at the beginning of the fuel cycle.

- This assumption is effectively the same as assuming that the flaw growth rate is not accelerating and that the inspection process would not be further improved for the mid-cycle inspection (beyond the capabilities of the inspection dcne at the beginning of the current cycle).

y

• ~

For the case where the mid-cycle inspection does not occur, the risk estimate is based on the projection of flaw probabilities at 409 EFPDs in March 2000. The risk estimation process was further simplified by assuming that the difference in the risk estimates for the two possible conditions in March 2000 was also applicable to each of the 5 preceding calendar months. So, the staff estimated the risk increment for the period as one-half of the difference in risk per reactor year (RY) for the two cases at the end of the fuel cycle in March 2000.

Figure 1 - Risk increment illustration i

arisk 4

(probability)

(frequency) 0 144 265 409 Time (EFPD)

SNC provided flaw population estimates for flaws in the B steam generator after 144 EFPDs and 409 EFPDs. The estimates were in the form of probability distributions for the most structurally significant flaw in the generator at each of the two points in time. Two distributions were provided for each time: one for burst pressure and one for the stress magnification factor (m ) of the remaining ligament of a partially through-wall crack. These distributions were p

generated using results from SNC's probabilistic operational assessment that was discussed in Section 3.5 of this safety evaluation. The computer prog am was modified to calculate an m, and to estimate the burst pressure using an alternate empirical approach (see NUREG/CR-6575,

" Failure Behavior of Internally Pressurized Flawed and Unflawed Steam Generator Tubing at High Temperatures - Experiments and Comparison with Model Predictions,"[Ref.1)). The burst pressures from these calculations are slightly higher than estimates made using the empirical expression discussed in Section 3.3. Therefore, the distribution of flaws generated in this effort indicates a less degraded condition for the "B" steam generator than that originally estimated by SNC. Although the distribution of burst pressures for input into the staff's risk calculation is less conservative than that from SNC's calculations, the staff has concluded that the burst pressure model documented in NUREG/CR-6575 (Ref.1) is the best available model

o

. to predict nominal steam generator tube failure pressures and has been previously accepted by the NRC staff.

These distributions were used by the staff to estimate the risk increment associated with not inspecting the generators in September 1999. The staff used the process described in detailin NUREG-1570," Risk Assessment of Severe Accident-Induced Steam Generator Tube Rupture" (Ref. 2). Because the Farley plant is very similar to the Surry plant used as an example in NUREG-1570, the detailed calculations performed by the staff for production of the NUREG were used, with appropriate modifications, to estimate the risk for Farley.

The study documented in NUREG-1570 found that the risk associated with steam generator tube flaws comes from the combination of core damage plus the breach of the containment boundary that is associated with tube failure, which is measured by the large early release frequency (LERF) parameter. Steam generator tube failure was found to have little effect on the core damage frequency (CDF). The study in the NUREG found that the flaw-related LERF increments came principally from the following three types of challenges:

1) Spontaneous tube ruptures that cause core damage.

2) Steam-side depressurization events that induce tube ruptures because of the increased differential pressure across the tubes, with resulting core damage.

3) Core damage accidents due to other causes, during which flawed tubes are induced to fail by increased pressure differentials at normal temperatures or at the elevated temperatures created by core heat-up.

Generally, only the first type of events is treated in the probabilistic risk assessments (PRAs) performed by licensees.

In order to estimate the risk increment for the Farley application, equations for all three types of accidents were used, based on the equations used in NUREG-1570. The staff conservatively assumed that the flaw probability distributions provided by SNC for steam generator B were 4

also applicable to steam generators A and C at Farley.

l 3.10 Spontaneous Tube Rupture The risk increment associated with spontaneous tube ruptures was estimatcd by the staff as the difference in the probabilities that a flaw would degrade a tube's burst pressure below the pressure differential that occurs during normal operation (1436 psid) in 409 EFPDs m:nus the probability at 265 EFPDs, which is reached in September. This accounts for the fact that a spontaneous rupture during the part of the fuel cycle before the scheduled inspection would not be avoided by that inspect,on. The conditional probability that a spontaneous rupture would occur in the second part of the fuel cycle, given that it did not occur in the first part and that an d

inspection was not performed, was estimated for steam generator B as 4.34 x 10 /RY for the types of degradation considered for inspection during the mid-cycle outage. The value at 265 4

EFPDs was estimated by SNC as 8 x 10. Using these values for steam generator B to represent all three generators produces an estimate of 1.28 x 10' /RY for spontaneous rupture due to free-span cracking. The probability for not avoiding core damage after the rupture occurs is taken from the NUREG/CR-4550 analysis for the Surry plant,1.8 x 10"/ rupture. The

a

. product of the rupture probability and the conditional probability of core damage,2.3 x 10, is the large early release probability (LERP) increment due to the possibility of tube degradation to the point of spontaneous rupture during the last part of the fuel cycle, if the mid-cycle inspection is not performed.

3.11 Tube Ruptures Induced by Steam-Side Depressurization The frequency of events that substantially depressurize the steam-side of a steam generator during normal operations was taken from NUREG-1570 as 7.6 x 10' /RY. The staff estimated i

the difference in the probability that the increased pressure differential would cause a tube rupture, as the difference in the probabilities for burst pressure decreasing below 2,350 psid by 144 EFPDs and 409 EFPDs. The difference in the probabilities of failure is 7.88 x 10~' The probability of not avoiding core damage after a secondary depressurization event that causes a tube rupture is taken from NUREG-1570 as 1 x 10'. The product of these three numbers, 4

5.99 x 10 /RY, is the LERF increment at the end of 409 EFPDs of operation without mid-cycle inspection. The staff assumed that this frequency difference between the two cases would be roughly constant over the six months from September 1999 through March 2000. So, the staff multiplied the LERF increment by 0.5 RY to obtain 2.99 x 10 for the LERP increase associated with steam-side depressurization events, if a mid-cycle inspection is not performed.

3.12 Tube Ruptures Induced During Core Damage Accidents

)

The studies that are documented in NUREG-1570 identified several characteristics of core damage events that are necessary to cre, ate a significant probability of inducing failure of flawed steam generator tubes that would bypass containment and lead to a large early release of l

radioactive material. These factors are that the reactor coolant system (RCS) remains at high or intermediate pressure, the steam generators are dry, and at least one steam generator is depressurized. SNC extracted their estimated frequency of core damage accidents with high RCS pressure and dry steam generators from Farley's PRA. SNC's value is 1.34 x 10 /RY.

4 The staff believes that this number is a credible estimate, based on its own PRA for the similar Surry plant and a survey of values obtained by other licensees' PRAs. The staff used the event trees for the Surry plant as documented in NUREG 1570 (pages 2-45 through 2-49) to assess j

the probability that one or more steam generators would become depressurized during the l

progression of the core damage sequences. The split fractions in these event trees were modified to remove the effects of a procedure for manually depressurizing steam generators that is not appropriate for the Farley plant. This change involved setting the probability for event D "No Steam Generators Depressurized @ Core Uncovery Due to Operator Actions" at 98.1% "true" instead of 64.3% "true" (with the complementary values for " false"). In addition, l

the values for question J "No PI-SGTR prior to TI-SGTR" and question L "No TI SGTR Prior to i

HL/SL Failure" were modified to represent the estimates of flaw populations supplied by SNC

]

for Farley.

The values for question J are derived in the same manner as the value for pressure-induced tube failures during the steam-side depressurization events discussed above. These probability values were derived for 1,2 and 3 depressurized steam generators for each of the two cases of operation in March 2000. Because data on flaw population growth were provided only for one i

of the three steam generators, the data were used to represent all three. The staff believes that j

this is conservative, because the provided data applies to the generator that had the worst flaws l

1

I 1

0 8 during the last fuel cycle. Table 1 shows the probabilities the staff used for pressure-induced SGTR.

Table 1 - Conditional Probabilities for Pressure-Induced SGTR (Question J)

1. of Steam Prob. @

Prob. @

Difference Generators 144 EFPDs 409 EFPDs 1

1.58 x 10' 9.46 x 10~8 7.88 x 10' 2

3.16 x 10'8 1.88 x 10 2 1.57 x 10'8

[

3 4.73 x 10'8 2.81 x 10 2 2.34 x 102 The values for question L are derived by evaluating the probability that the worst flaw in a depressurized steam generator will creep fail before the surge line or a hot leg creep fails and relieves stress on the tubes. The staff used results from RELAP/SCDAP simulations of the

' thermal-hydraulic behavior of the RCS during the core damage accident sequences addressed by the event trees. As discussed below, the staff used a technique that differed somewhat from the similar analyses in NUREG-1570. First, a Monte Carlo analysis was performed to determine the failure probability of a flaw as a function of its m, for the remaining tube material (ligament) under the flaw. This analysis combines the probability distributions for several parameters: tube radius, tube diameter, tube material creep failure properties, surge line or hot leg material creep failure properties, and the probability that the flaw will be exposed to the hottest tubes and the hottest parts of the tubes along their lengths. Because sensitivity analyses conducted for NUREG-1570 shawed the tube failure probabilities were very sensitive to the tube temperatures as a function of time, for purposes of this risk estimation, the staff developed means of addressing the variabil!ty and uncertainty in the estimation of tube temperatures. RELAP/SCDAP results for tube temperature represent an average value for one "out flow" and one " return-flow" tube. To better address the temperature distribution among tubes canying "out-flow" the staff reviewed the available test data (Ref. 3). Because the data are sparse and do not suggest a smooth function in space, only a rough step-wise approximation of this distribution was used in the staff's analysis. Table 2 shows the distribution of temperature the staff used.

Table 2 -Temperature Distribution Around Mean for " Outflow" Tubes Percent Temperature Difference Out-Flow Tubes From Mean 50

- 23 K 30

+18 K 18

+ 52 K 2

+ 90 K

r-

.. The staff also used the results from case 5N in NUREG-1570 to estimate that the temperature along the tube between the tube sheet and the first support plate would vary from the RELAP/SCDAP average value by + 5 K at the tube sheet to -10 K at the support plate.

In addition, the staff's Monte Carlo analysis included a normal distribution of the uncertainty in the prediction of the tube temperatures. This distribution was given a value of +50 K at 95%

confidence, based on the sensitivity studies documented in NUREG-1570 for case 6R. In the Monte Carlo analysis, the normal distribution was truncated at 5% (i.e.,

50 K) to confine the variable to the range of known results. The purpose of adding the uncertainty of the tube j

temperature predictions to the Monte Carlo analysis is to derive one risk number for use in making a regulatory decision, rather than to provide a confidence interval that spans a wide range due to sensit vity to an especially uncertain input.

Once the flaw failure probability is derived as a function of m,, this is combined with SNC's estimate of the probability that the worst flaw in the out-flow tubes in a steam generator will

{

have a particular m,. The "out-flow" tubes are estimated to include 53% of the tubes in a steam generator. To account for this factor, Westinghouse produced the flaw m, probability distributions with an additional step in its Monte Carlo analysis for flaw occurrence and growth.

For each of the 100,000 sets of 119 flaws calculated in its Monte Carlo analysis, Westinghouse selected the " weakest exposed" flaw. This was done by rank ordering the m, values for all 119 flaws and then, starting with the highest value, retaining or eliminating it based on the value of a random number, with values below 0.53 resulting in retention. The firstvetained value was the

" weakest exposed" flaw for that set in the Monte Carlo analysis. The distribution of the 100,000 m, values so selected provides the conditional probability for a flaw with a particular m, value becoming exposed to N hign temperature challenge in the event of a core damage accident.

l When developing these m, distributions, the staff agreed that the licensee should limit the calculation to crack segments at least 0.25-inch in length, to be consistent with an assumption in NUREG-1570. The staff notes that the predicted condition at Farley differs somewhat from the basis for the assumption in NUREG-1570 in that the licensee is predicting, by the end of the current cycle, a high likelihood of at least one short crack segment susceptible to failing through-wall in severe accident sequences. Cracks shorter than about 0.4-inch are not expected to burst if they fail through-wall during core damage accident sequences. However, there are still unquantified concerns about potential for the steam jets emanating from short cracks to erode those cracks to larger openings and to cut through adjacent tubes. These issues led the staff to treat through-wall failures of cracks as short as 0.25-inch as if they were total failures of the primary-to-secondary boundary in the NUREG-1570 analysis. However, the staff believes that a few shorter cracks are not likely to cause a sufficiently large failure of the primary-to-secondary boundary to alter the thermal-hydraulic progression of the sequence.

Therefore, the staff chose to maintain consistency of the Farley analysis with the NUREG-1570 analysis with respect to the minimum size flaw considered for high temperature sequence.

The frequency of occurrence of flaws with various m, values is then combined with the conditional probability of failure of those flaws when exposed to the pressure and temperature conditions predicted for each specific core damage sequence of interest in the event tree.

The results of this analysis for the thermal-hydraulic analysis case (6R) with the RCS at high pressure, the steam generators dry, and one or more steam generators depressurized, are i

app!! cable to sub-trees A1, A2 and A3. The thermally induced failure probability calculated as a result of combining the flaw distribution and conditional failure probabilities for thermal l

t L

n

. challenges was reduced by the fraction of the exposed tubes that would already have failed due to increased pressure differential at normal temperatures. The staff estimated this reduction as 53% of the pressure-induced failure probability calculated for question J, above. Table 3 shows the resulting split fractions for question L in those sub-trees.

Table 3 - Conditional Probabilities of Thermally-Induced SGTR (Question L)

1. of Steam Prob. @

Prob. @

Difference Generators 144 EFPDs 409 EFPDs 1

2.08 x 102 7.35 x 10-2 5.26 x 102 2

4.12 x 10 2 1.42 x 10

1.00 x 104 3

6.12 x 10-2 2.05 x 10 1.43 x 10 4

4 l

Similar information on the variability and uncertainty of tube temperatures currently is not j

available for sequences involving reactor coolant pump seal leakage or open safety valves on the RCS. These sequences are addressed by sub-trees B and C, respectively, in NUREG-1570. New RELAP/SCDAP analyses since the production of NUREG-1570 now indicate that these sequences are less challenging to steam generatcr tubes than previously thought. In addition, the tube failure probabilities for pump seal leakage sequences was dominated by the fraction of cases where full-loop natural circulation conditions are predicted to occur. Tube failures under full 4oop circulation are not believed to be dependent on the presence of flaws in the tubes. So, the LERP contributions from the full-loop circulation fraction of these sequences cancel when their difference is taken to obtain the risk increment between the two inspection cases for Farley. Therefore, the staff does not believe that excluding the contributions from sub-trees B and C changes the result in a manner that affects the staff's conclusion about the relationship of the risk increment at Farley to the risk acceptance criteria.

The quantification of the event tree resulted in a LERF difference of 3.3 x 10~7/RY between the two inspection cases for Farley. Assuming that this difference is approximately constant for the 6 months that would be affected by the mid-cycle inspection, the LERP increment for not doing the inspection is 1.6 x 10~7 RY from tube ruptures induced during core damage accidents.

3.13 Total Risk Increment i

The sum of the LERP increments,from all three types of challenges evaluated above is about 3

6.9 x 10. There is some degree of conservatism in this value because SNC's data for the most degraded steam generator (B) were used to represent all three generators in the staff's 4

evaluation. Total LERF would remain in the 10 /RY range. This result is in region 2 of the LERF/ALERF criteria in RG 1.174. Proposed changes to licensing bases with LERP increments in this region are acceptable, but must also be considered in conjunction with the other criteria specified in RG 1.174.

.. 3.14 Sensitivity of Risk To Flaw Population Estimates The risk estimate above is derived from the flaw population projections provHed by SNC for two points in time in the current Farley fuel cycle. Those projections give low probabilities that the steam generators will be as badly degraded at the end this cycle as they were found to be at the end of the previous cycle. For example, Table 4 shows the burst pressures estimated by the staff for the worst flaws found in the last cycle and SNC's projection of probabilities of recurrence of flaws with the same burst pressures in the current cycle.

Table 4 - Staff's Estimated Burst Pressures for Worst Flaws Steam Generator Burst AP (psid)

Probability in Cycle 15 Cycle 16 (%)

4420 23 A

3788 10 4420 23 2819 2

B 2897 3

3739 9

4109 16 C

4771 34 This demonstrates that the inspection process at the beginning of the current cycle is being credited with producing a substantially better steam generator tube condition at the end of the current cycle than was found at the end of the previous cycle. SNC's projections indicate a two order of magnitude reduction in the expectation of recurrence foi the two weakest flaws, and about one order of magnitude reduction in the probability of recurrence of the three other flaws that did not meet the structural integrity criteria. However, the staff does not have a quantitative process for assessing the degree of improvements in the inspection process nor for linking

- them to improvements in the condition of the tubes at the end of the cycle. The staff's appraisal of the degree of improvement in SNC's inspection process is addressed in section 3.8 of this safety evaluation.

In order to address the importance of the projected improvement in SNC's inspection process, the risk of a configuration similar to the one at the end of the last fuel cycle is provided below.

For the sensitivity study, the contributions to LERF from spontaneous tube rupture and from ruptures induced by steam-side depressurizations is set to zero because none of the tubes were susceptible to either of these challenges by the end of the last fuel cycle. Without improvement in the inspection process, this may underestimate LERF at the end of the current cycle, because one of the flaws at the end of the last cycle was close to being susceptible to i

l i steam-side depressurization events. A proper LERF estimate would include some probability for pressure-induced tube ruptures at the end of the current cycle.

For this sensitivity study, the LERF contribution from tube failures induced during severe accidents 'is calculated in a manner similar to that described above, with two differences. The

. probability of pressure-induced tube failures is set to zero, consistent with the probability

)

assumed for steam-side depressurization type challenges during normal operation. The probability of high-temperature-induced tube ruptures is calculated for each steam generator, assuming that the same flaws detected in each generator at the end of Cycle 15 could be randomly distributed in the first free-span of the same generator at the end of Cycle 16. This is the same as assuming that each flaw has a 53% chance of being included in the "out-flow" tubes. Table 5 shows the probabilities of failure under the high-temperature challenge for each i

generator.

Table 5 - Conditional Probabilities 'of Failure (Sensitivity Case) i Steam Steam Generator Cycle 15 Flaw Failure Generator Failure Probability Flaw m, Probability (%)

(%)

4.68 80.7 A

76.1 4.79 83.2 4.20 65.4 5.31 91.7 B

87.9 5.56 100 8.34 94.3 12.65 100 C

54.0 2.17 4.2 Combining these probabilistically for the sequences in the event trees with 1,2 and 3 depressurized steam generators gives the split fractions for question L shown in Table 6.

. Table 6 - Conditional Probabilities for Thermally-induced SGTR (Sensitivity Case)

1. of Steam Generators Failure Probability (%)

1 72.7 2

93.5 3

98.7 l

, Reevaluating the same portions of the event tree (as evaluated in the previous calculation) with these probabilities for induced tube failure gives a contribution of 3.0 x 10'8/RY for LERF at the end of the cycle. With m, values of the magnitude found during the last cycle, it is likely that some of the previously neglected parts of the event tree (with open RCS safety valves or RCP seal leaks) should also contribute to this total. So, the sensitivity study only demonstrates that LERF could exceed 3.0 x 10'*/RY by the end of next cycle if it is like the last cycle. It is not clear how much of the cycle that LERF would be high if the degradation again reaches this level. That depends largely on whether the flaws that were present at the end of the cycle grew from much smaller flaws that were present at the beginning of the cycle, or if they were already relatively large flaws that were missed by the inspection. Without a more detailed understanding of how the flaw population that was found at the end of the last cycle developed over that cycle, it is difficult to estimate an appropriate LERP for a recurrence of similar flaws in the current cycle. Thus, the staff's approval of the requested license amendment is dependent on the staff's confidence that improvement in SNC's inspection process has significantly reduced the probability for the condition of the steam generators at the end of the current cycle to be similar to the previous cycle. However, it is not necessary to achieve the degree of reduction projected by SNC in order to reduce the LERP increment to accepted levels.

3.15 Risk Informed Decision RG 1.174 "An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis" provides five principles for risk-informed decision-making. Each of these is addressed below.

Principle 1. The orocosed chance meets the current reaulations unless it is explicitiv related to a reauested exemotion or rule chanae. The staff concludes that the mid-cycle inspection is not necessary and that operation in accordance with this license amendment meets the regulations including General Design Criteria 14. SNC's analysis shows a 99% probability of withstanding l

the challenge of a design basis accident without the inspection. SNC's projected probability of completing the fuel cycle without having a steam generator tube rupture (SGTR) is 99.9%

without credit for a mid-cycle tube inspection. The staff agrees that the probability of spontaneous tube rupture would be adequately low w'thout the mid-cycle inspection, but notes j

that during the last fuel cycle, a flaw was discovered that was close to the strength limit needed to withstand a main steam line break design basis accident. With the improvements in SNC's inspection process during the last outage, the staff concludes that the probability of withstanding design basis steam line break is adequate without the mid-cycle inspection.

Principle 2. The orooosed chance is consistent with the defense in deoth chilosophy. Because the requested change involves the integrity of the steam generator tubes, it affects two of the three physical barriers provided by the regulations to prevent the release of radioactive material to the environment. The LERF criterion addressed by Principle 4 is therefore a primary consideration when considering the adequacy of these barriers for this request. From a probabilistic perspective, defense-in-depth is provided by a combination of low challenge frequency and low conditional probability of failure due to the challenge. The licensee's prediction for the condition of the tubes at the end of the current cycle indicates that the tubes will retain sufficient structural integrity to have about a 90% probability of surviving the most j

sever but the least frequent challenges (i.e., high pressure core damage accidents). They also I

are predicted to have 99% probability of surviving more frequent design-basis accidents (i.e.,

j steam line break), for which there is additional mitigation capability, as well. On this basis, the l

a

• - staff finds that the principle of defense-in-depth would be maintained without benefit of a mid-cycle inspection of the steam generators.

Principle 3. The proposed chanae maintains sufficient safety marains. Based on SNC's probabilistic projections of the effect of not performing the mid-cycle inspection, there would be at least a 49% probability instead of a 24% probability of meeting the licensing basis criterion for the strength of the steam generator tubes throughout the current cycle. This analysis indicates that the probability of maintaining sufficient safety margins will remain adequate.

However, SNC found at least five flaws that did not meet the licensing basis strength criterion during the last cycle. Therefore, the staff's finding that this principle is satisfied is based on the staff's conclusion that SNC's inspection process during the last refueling outage was adequate to suppod the risk assessment.

Princiolo 4. When orocosed chanaes result in an increase in core damaae freauency or risk.

the increases should be small and consistent with the intent of the Commission's Safety Goal Policy Statement. RG 1.174 provides a set of numerical criteria for combinations of the total and incremental CDF, and another set of numerical criteria for total and incremental LERF. As discussed in section 3.9 of this safety evaluation, the CDF is not significantly affected by SNC's request, but the LERF is affected in a manner requiring consideration. If SNC's projections of flaw sizes during the current cycle are reasonably accurate, then the change in large early release probability (ALERP) is within the numerical guidelines for acceptance. However, if the condition found at the end of the last cycle recurs for a substantial portion of the current cycle, then the ALERP would fall above the numerical acceptance guideline, which is 1 x 10 /RY.

4 The staff notes that the degree of improvement necessary to catisfy the LERF acceptance guidelines is not as great as projected by SNC, and that some conservatism remains in the risk assessment. Based on these considerations and the staff's conclusion that the Farley-1 steam generator tubes at EOC-16 will be substantially improved over the tube condition found during the previous cycle, the staff concludes that this principle is satisfied.

Principle 5. The impact of the orocosed chance should be raonitored usina oerformance measurement strateaies. Essentially, SNC's request is to not perform the monitoring activity that would permit crediting or discrediting the basis for the request, which is the adequacy of the last tube inspection. If the mid-cycle inspection is not performed, no further data on the adequacy of SNC's inspection will be produced, because the steam generators will be replaced without being reinspected at the end of the current fuel cycle. However, the purpose of this 4

principle is to prevent repetitive occurrence of undesirable conditions by detecting and correcting conditions that are not in accordance with the assumptions in the risk assessment and other analyses used to support a change. In this regard, the staff notes that recurrence after the end of the current cycle is precluded by replacement of the degrading steam generators. Therefore, the staff concludes that this principle is not a primary factor in this case.

However, if unexpected steam generator tube leakage or rupture occurs during Cycle 16, that would provide evidence that steam generator tube condition is not as good as SNC projected.

in that event, SNC's process to project tube conditions to support risk analysis would be invalidated. SNC would then have to reinspect the steam generators using methods suitable for supporting a credible tube condition projection to the end of cycle to reestablish conformance with RG 1.174 guidelines. SNC's amendment request adds a license condition indicating that if SNC plugs or repairs steam generator tubes during Cycle 16, then SNC shall reinspect the steam generators to the extent necessary to verify that they have been returned to a condition consistent with the operational assessment.

I

[

E l 3 Uncertainties RG 1.174 guidance on risk-informed decision maMnq also involves consideration of the uncertainties and their potential effeuts on the deQion. There are a large number of variables in the foregoing analysis with varying degrees of uncertainty. Sensitivity studies of a similar analysis were documented in NUREG-1570. These showed that the results were especially sensitive to two inputs: 1) the tube temperature predicted by the thermal-hydraulic model to occur at the time that RCS depressurization is predicted to occur due to pressure boundary failure, and 2) the flaw size distribution. The uncertainty in tube temperature was factored into the Monte Carlo analysis so that it is essentially integrated into tiie LERP predictions. The staff chose this method for this parameter because it integrates the available range of information about uncertainties in the basic model in a manner that facilitates a decision for this licensing action. In contrast, the uncertainty in the plant-specific input to the flaw size distribution was addressed by a sensitivity study for this analysis. This method was chosen because it most openly addresses the effect of a parameter that is another element of this safety evaluation.

The sensitivity study identified the importance of improvements in the licensee's tube inspection process with respect to achieving an acceptably smallincrease in LERP. The staff also acknowledges that its finding with respect to the LERP increment numerical acceptance guidelines is sensitive to its choice of minimum flaw length to be considered as a total failure of the primary-to-secondary boundary for severe accident sequences. Until further information becomes available on tne effects of short, through-wall cracks on the thermal-hydraulic progression of severe accident sequences, the staff has chosen to maintain consistency with the NUREG-1570 analysis for this parameter.

3.16 Staff Conclusions The staff concludes that the material provided by SNC is sufficient to provide reasonable confidence that the principles of risk-informed regulation are met by the requesteo change.

This conclusion is supported by the staff's finding that the condition of the Farley-1 steam generator tubes at EOC-16 will be substantially improved over the tube condition found during the previous cycle.

4.0 STATE CONSULTATION

in accordance with the Commission's regulations, the State of Alabama official was notified of the proposed issuance of the amendment. The State official had no comments.

5.0 ENVIRONMENTAL CONSIDERATION

The amendment changes a requirement with respect to installation or use of a facility component located within the restricted area as defined in 10 CFR Part 20. The NRC staff has determined that the amendment involves no significant increase in the amounts and no significant change in the types of any effluents that may be released offsite and that there is no significant increase in individual or cumulative occupational radiation exposure. The j

Commission has previously issued a proposed finding that the amendments involve no significant hazards consideration, and there has been no public comment on such finding (64 FR 32291, dated June 16,1999). Accordingly, the amendment meets the eligibility criteria for categorical exclusion set forth in 10 CFR 51.22(c)(9). Pursuant to 10 CFR 51.22(b) no I

1

~

L

' I envirrrunental impact statement or environmental assessment need be prepared in connection with the issuance of the amendment.

6.0 CONCLUSION

The Commission has conclud d, based on the considerations discussed above, that (1) there is l

- reasonable assurance that the health and safety of the public will not be endangered by operation in the proposed manner, (2) such activities will be conducted in compliance with the Commission's regulations, and (3) the issuance of the amendment will not be inimical to the j

common defense and security or to the health and safety of the public.

7.0 REFERENCES

' 1. " Failure Behavior of Internally Pressurized Flawed and Unflawed Steam Generator Tubing at High Temperatures - Experiments and Comparison with Model Predictions," NUREG/CR-6575, ANL-97/17, S. Majumdar et al, Argonne National Laboratory, Argonne, IL, March 1998.

2. " Risk Assessment of Severe Accident-induced Steam Generator Tube Rupture," NUREG-1570, SGTR Severe Accident Working Group, U. S. Nuclear Regulatory Commission, Washington, D.C., March 1998.

3. " Natural Circulation Experiments for PWR High Pressure Accidents," EPRI TR-102815, W.

A. Stewart, et al, Electric Power Research Institute, Palo Alto, CA, August 1993.

Principal Contributors: S.Long P. Rush Date: August 17, 1999

)

I l

i l

1 L