ML20211F428

Safety Evaluation Concluding That Licensee Provided Acceptable Alternative to Requirements of ASME Code Section XI & That Authorization of Proposed Alternative Would Provide Acceptable Level of Quality & Safety

ML20211F428
Person / Time
Site:	Arkansas Nuclear
Issue date:	08/25/1999
From:	NRC (Affiliation Not Assigned)
To:
Shared Package
ML20211F425	List: ML20211F418 ML20211F428
References
NUDOCS 9908300334
Download: ML20211F428 (18)

Text

. .

p ato

[ 8% UNITED STATN j, i*

j NUCLEAR REGULATOR'. COMMISE;ON WASHINGTON. D O. EtiSJJ01 o

v...../

SAFETY EVALUATION BY THE OFFICE OF NUCLEAR REACTOR REGULATION REQUEST TO USE ASME CODE CASE N-560 AS AN ALTERNATIVE TO ASME CODE. SECTION XI. TABLE IWB-2500-1 I ARKANSAS NUCLEAR ONE. UNIT 1 DOCKET NO. 50-313

\

l

1.0 INTRODUCTION

Inservice inspection (ISI) of the American Society of Mechanical Engineers (ASME) Code Class 1,2, and 3 components shall be performed in accordance with Section XI of the ASME Boiler and Pressure Vessel Code (Code) and applicable addenda as required by Title 10 of the Code of Federal Reaulations (10 CFR), Section 50.55a(g), except where specific written relief has been granted by the Commission pursuant to 10 CFR 50.55a(g)(6)(!). Section 50.55a(a)(3) states that alternatives to the requirements of paragraph (g) nny be used, when authorized by the NRC, if (i) the proposed alternatives would provide an acceptable level of quality and safety or (ii) compliance with the specified requiruments would result in hardship or unusual difficulty without a compensating increase in the level of quality and safety.

In a letter dated June 3,1998, Entergy Operations, Inc. (Entergy, the licensee), pursuant to the provisions of 10 CFR 50.55a(a)(3)(i), requested that the NRC staff approve a risk-informed ISI (RI-ISI) methodology, which is based on ASME Code Case N-560, " Alternative Examination Requirements for Class 1, Category B-J Piping Welds." The Code Case was proposed as an alternative to the requirements of ASME Code,Section XI, Table IWB-2500-1, and relates to examination of Class 1, Category B-J piping welds at the Arkansas Nuclear One (ANO-1) power plant. Specifically, Entergy proposes to reduce the number of weld volumetric examinations from 51 to 40. Code Case N-560 permits this reduction as long as the licensee uses a risk-informed approach in the selection of the welds. Entergy also has augmented the implementation of Code Case N-560 at the ANO-1 nuclear power station by using the RI-ISI methodology developed by the Electric Power Research Institute (EPRI) and documented in I

EPRI Report TR-106706. The staff reviewed the proposed alternative as a site-specific request applicable only to the ANO-1 power plant.

2.0

SUMMARY

OF LICENSEE'S PROPOSED APPROACH The licensee submitted a request to use the RI-ISI methodology based upon Code Case N-560 as an alternative to the requirements of ASME Code,Section XI, Table IWB-2500-1. The Code Enclosure l 9909300334 990825 PDR ADOCK 05000313 P PDR l

L I

H. .

i

. of Record for the third ISI interval at the ANO-1 is the ASME Code,Section XI,1992 Edition.

The information provided by the licensee in support of the request has been evaluated and the bases for disposition are documented below. .

l 2.1 Code Reauirement Section XI, Table IWB-2500-1, Examination Category B-J, Pressure Retaining Welds in Piping lists the examination requirements for Category B-J welds. Note 1(d) to the table states:

Examinations shallinclude the following: Additional piping welds so that the total ,

number of circumferential butt welds (or branch connections or socket welds) selected for examination equals 25% of the circumferential butt welds (or branch connections or socket welds) in the reactor coolant piping system. This total does not include welds excluded by IWB-1220. These additional welds may be located in one loop (one loop is defined for both PWR and BWR plants in the 1997 Edition).

2.2 Licensee's Code Relief Reauest Pursuant to 10 CFR 50.55a(a)(3)(i), the licensee has requested approval to use RI-ISI methodology based upon ASME Code Case N-500 as an alternative to the requirements of ASME Code Section XI, Table IWB-2500-1. Code Case N-560 states that "[t]he inspection program shall be based on a total number of examination zones consisting of not less than 10%

l of Class 1 (Category B-J) piping welds in each system, excluding socket welds, to be examined during each inspection interval. The selection process shall consist of the following:

'(1) Examination zones shall be selected based on a relative ranking process that identifies more risk-important segments in the system with regard to probability and consequences of failure. Examination zones shall be selected from those l pipe segments that fall into the highest risk group.

I The ranking process shall address relevant degradation mechanisms (2)

(e.g. corrosion, stress corrosion, thermal fatigue, thermal stratification,  ;

l flow-accelerated corrr, ' ion) and industry failure experience with systems and components.

(3) The consequences of failure at various locations in the system shall be based on the break size and operating mode that results in the highest impact on plant safety. Both direct and indirect effects shall be considered."

l 2.3 Licensee's Basis for Reauestina Relief i

Regulatory Guide (RG) 1.174,"An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis," as well as Standard Review Plan (SRP) 3.9.8, " Standard Review Plan for Trial Use for the Review of Risk-informed Inservice Inspection of Piping," identify five principles of risk-informed regulation.

They are:

l

1. Proposed change meets current regulations unless it is explicitly related to the i

I request for alternatives under 10 CFR 50.55a(a)(3) or a request for exemption or rule change.

2. Proposed change is consistent with defense-in-depth philosophy.

3. Proposed change maintains sufficient safety margins.

4. Proposed increases in core damage frequency and risk are small and are consistent with the NRC Safety Goals.

5. Use performance measurement strategies to monitor impact of the change.

By letter dated May 17,1999, the licensee provided the following information that describes how the alternative program meets the intent of NRC RG 1.174 and SRP 3.9.8:

Principle 1: Proposed change meets current regulations unless it is explicitly related to the request for alternatives under 10 CFR 50.55a(a)(3) or a request for exemption or rule change (as stated):

10CFR50.55a and Appendix A to 10CFR [Part) 50 are the primary regulations l

governing inservice inspection of piping. The intent of these regulations, as it l pertains to the Code Case N-560 scope of piping, is to assure a robust reactor coolant pressure boundary. Through 10CFR50.55a, Section XI of the American Society of Mechanical Engineers (ASME) Boiler and Pressure Vessel Code is the imp!ementing vehicle for these inspections. Code Case N-560 is an ASME approved alternative to current Section XI requirements.

Other Section XI inspection activities such as the examination of Class 1 socket welded connections and Category B-F dissimilar metal welds, pressure and leak testing requirements, and Class 2 and 3 piping examinations, are not [ adversely) affected by implementation of [ Code Case] N-560.

l In addition, certain augmented inspection programs such as those implemented in response to... Generic Letter 89-08," Erosion / Corrosion Induced Pipe Wall Thinning," are also not impacted by the implementation of N-560.. .

Other plant programs, which are not inspection related, but can have a dominant impact on assunng piping reliability, include the primary water chemistry control program, rr actor coolant leakage, containment temperature, pressure, and radiation monitoring, all of which are unaffected by implementation of Code Case N-560.

Principle 2: Proposed change is consistent with defense-in-depth philosophy (as stated):

The piping systems at ANO-1 contribute to defense-in-depth in two important ways: The piping of the reactor coolant system (RCS) and systems that directly interface with the RCS provide one of the sets of barriers in the barrier defense-in-depth arrangement. This barrier protects the release pathway from the reactor core to containment release pathways and part of it is responsible for protecting against potential containment bypass pathways. The second way piping contributes to defense in depth is its role in the protection of the core

l i

through providing critical safety functions that are dependent upon piping system integrity.

The role that inspection programs at ANO-1 plays in determining the risk significance of piping systems is rather limited and well defined. The piping inspections play a role in identifying defects and degradation in piping system elements. When defects and degradation damage are found and repaired, pipe failures are precluded and the probability of pipe rupture reduced in addition, i pipe inspections and leak tests and detection processes have the potential of correcting pipe problems and reducing the safety. function unavailability's due to pipe failures. Hence, the impact of changes in the inspection program is limited '

to potential changes in failure frequency and rupture frequency, but do not change the consequences of an assumed pipe failure.

As discussed above, the intent of the inspections mandated by ASME Section XI for Category B-J piping welds is to identify conditions such as flaws or indications that may be precursors to leaks or rupture in the reactor coolant pressure boundary. Currently, the process for picking inspection locations is based upon l

structural discontinuity and stress analy~ sis results. As depicted in ASME White

, Paper 92-01-01 Rev.1," Evaluation of Inservice inspection Requirements for Class 1, Category B-J Pressure Retaining Welds in Piping," and Electric Power Research Institute (EPRI) topical report TR-112657, " Revised Risk-Informed

l. Inspection Evaluation Procedure," this method has been ineffective in identifying

[ flaws or indications). In response to these findings, ASME issued Code Case N-560, which has a much more focused selection process founded on actual service experience with nuclear plant piping failure data.

The (Code Case] N-560 selection process has two key ingredients [: (1)] a determination of weh khtion's susceptibility to degradation, and ((2)) an assessment of tho *.ontecuence of the location's failure. These two ingredients not only assure [that] d@tnse-in-depth is maintained, but is actually increased over the current process. Initially, by evaluating a location's susceptibility to degradation, the likelihood of finding flaws or indications that may be precursors to leak [s] or ruptures in the reactor coolant pressure boundary is increased.

Secondly, the consequence assessment effort has a single failure criterion so that, no matter how unlikely a failure scenario is, it is ranked high if, as a result of

the failure, there is no mitigative equipment available to respond to the event. In

! addition, the consequence assessment takes into account equipment reliability so that poor performing equipment is not credited as much as more reliable equipment.

Principle 3: Proposed change maintains sufficient safety margins (as stated):

The safety function of interest in the ANO-1 RI-ISI evaluation is that of system pressure boundary integrity. Listed below are those attributes necessary for l fulfilling this requirement, as well as the impact of the ANO-1 RI-ISI program on

- meeting the objective:

f

(. I

5-Quality Design - No Change Quality Fabrication _ - No Change Quality Construction - No Change Quality Testing - No Change Quality inspection - Fewer inspections conducted at more appropriate locations using better techniques and as necessary expanded volumes. .

. As can be seen from the above summary, those attributes that are critical in defining and maintaining sufficient safety margins are unchanged, except for a subset of the pressure boundary volumetric examinations. In this case, the i reduced number of volumetric Section XI, [ examinations] is based upon an l explicit consideration of potential degradation and the accompanying consequence of system failure. As such, the new Section XI inspection locations are more appropriate and will have enhanced inspections conducted.

Principle 4: Proposed increases in core damage frequency (CDF) and risk are small and are consistent with the NRC Safety Goals (as stated):

...[E)ven without quantitative evaluation, the application of [ Code Case]

N-560...to ANO-1 plant is likely to result in risk improvement. This conclusion is based on the following observations:

. There is an increase of 8 inspections in the High Risk Category

. - There is a small reduction in the total number of volumetric inspections (11)

. All reductions are in risk categories where degradation mechanisms are not present...

Evaluating actual numerical changes in risk due to changes in the inspection program is a difficult task due to several factors. These factors include the inherent uncertainty in passive component reliability prediction, and the need to predict the changes in piping reliability due to changes in the inspection program.

Bounding Estimate of Removed Locations One simplified way to demonstrate that unacceptable risk impacts will not occur from implementation of the proposed RI-ISI program is to estimate the risk l I

impact only due to removing locations from the inspection program (without crediting added locations).. This was done by using the estimates of pipe rupture l frequencies for locations proposed for removal from the inspection program, and taking the product of these frequencies with the corresponding estimates of

[ conditional core damage probability) CCDP....The results of this assessment for CDF...show that the total bounding change in CDF is less than 10* per year. l The change in large early release frequency (LERF) due to removing inspection  :

locations, if a similar approach is used, is expected to be less than 10* per year. l 1

6 These estimates are indicative of negligible contributions to risk from eliminating inspections and are consistent with the criteria of RG 1.174.

Principle 5: Use performance measurement strategies to monitor impact of the change (as stated):

Implementation of the ANO-1 RI-ISI program will be consistent with. existing ASME Section XI performance monitoring requirements. These are as follows:

. pressure and Icak testing of all Class 1 piping components

. inspection results shall be compared to preservice inspections and prior ISI

. for flaws exceeding acceptance criteria (IWB-3500)

- increase the number of inspections to include those items scheduled for this and the next scheduled period

- additional flaws - all items of similar design, size and function

- flaw - removed, repaired, replaced or analytical evaluation

- flaws accepted by analytical evaluation shall be examined for the next three inspection periods in addition to the above ASME Section XI monitoring and feedback mechanisms, ANO-1 has in place the following processes to detect reactor coolant leakage as described in section 4.2.3.8 of the ANO-1 Safety Analysis Report:

- sump level

-inventory balance

- radiation monitoring 3.0 NRC STAFF EVALUATION OF THE LICENSEE'S PROPOSED ALTERNATIVE The NRC staff reviewed the licensee's request for approval to use Al-ISI methodology based upon ASME Code Case N-560 as an alternative to ASME Code,Section XI, at the ANO-1 i

power plant. The Code Case provides alternative examination requirements to those stated in Table IWB-2500-1 of the ASME Code,Section XI, and relates to examination Category B-J pressure retaining welds in piping. At the ANO-1 plant, Code Case N-560 is augmented by the '

l use of a methodology developed by EPRI. The following summarizes the results of the NRC staff review of the licensee's submittalin relation to the five key principles for risk-informed regulation.

I' l .. .

l l

l 3.1 Proposed Chance Meets Current Reaulations Unless it is Explicitiv Related to the Reauest for Alternatives Under 10 CFR 50.55afa)(3) or a Reauest for Exemotion or Rule

. Chance 1

! The primary regulation governing ISI of the reactor coolant pressure boundary piping is 10 CFR 50.55a. The intent of these regulations is to detect service-induced degradation and assure the integrity of the reactor coolant pressure boundary. Section 50.55a refers to Section XI of the l ASME Code that requires the Class 1 pressure retaining welds be periodically inspected to ensure the integrity of the piping systems. The ASME Code,Section XI, is the implementing vehicle for performing the Code-required inspections. Section 50.55a permits the staff to accept alternatives to the Code rules when the staff determines that the alternative provides an acceptable level of quality and safety. Through its review, the staff has determined that the

licensee's alternative provides this assurance. Therefore, the current regulations are met and this principle is satisfied.

3.2 Prooosed Chance is Consistent With Defense-in-Depth Philosophy The intent of the Section XI inspections for Category B-J piping welds is to identify conditions ,

such as flaws or indications that may be precursors to leaks or ruptures in the reactor coolant I pressure boundary. For plants licensed after July 1,1978, the process for choosing inspection locations is based upon structural discontinuity and stress analysis results, and for plants

licensed on or prior to July 1,1978, the process for choosing inspection locations may be randomly selected. The ASME Code evaluated the process of choosing inspection locations

! under the current Section XI rules and the results of the evaluation are documented in the ASME White Paper 9201-01, Revision 1,

• Evaluation of Inservice Inspection Requirements for Class 1 Category B-J, Pressure Retaining Welds in Piping." To provide an alternative to the current methods of choosing inspection ;ocations, the ASME Code issued Code Case N-560.

Code Case N-560 uses a risk-informed approach to select inspecticn locations for ASME Code,Section XI, Category B-J piping welds. The selection process adopted in the Code Case is a more robust selection process founded on actual service experience with nuclear plant piping j failure data.

The ASME Code Case N-560 selection process has two key ingredients: (1) determination of each location's susceptibility to degradation and (2) an assessment of the consequences of the location's failure.

The staff finds the licensee's approach acceptable because the weld selection process, as

described by the licensee in its submittal, will ensure that welds, which have a high failure

! consequence and are most susceptible to degradation, will be targeted for examination. This process should result in the detection of flaws that challenge the pressure boundary of the subject piping and, thus, the integrity of the piping systems will be maintained. Accordingly, t1 licensee's proposed alternative maintains or increases the defense-in-depth purposes of conducting inservice inspection.

3.3 Prooosed Alternative Maintains Sufficient Safety Marains As noted previously, at ANO-1, augmented inspection programs will continue, and the reduced number of volumetric Section XI examinations are based upon the exceptional performance l

l n

f l .. .

1 l

l history of Category B-J components. In addition, the new inspection locations are more appropriate, may involve larger inspection volumes, and improved examination techniques will be applied.

As of January 1,1998, at ANO-1, Entergy began using only ultrasonic examination (UT) personnel that meet the qualification requirements of the 1992 Edition of ASME Section XI, Appendix Vil, " Qualification of Nondestructive Examination Personnel for Ultrasonic Examination." Additionally, only UT personnel that have successfully completed the practical examinations of the Performance Demonstration Initiative (PDI) administered by the EPRI NDE ,

Center, for the specific application areas (e.g., carbon steel, austenitic steel, intergranular {

stress corrosion cracking, etc.), are utilized for Section XI ultrasonic examinations. This l practical performance demonstration is a comprehensive qualification for UT personnel. It is used as the practical examination required by Appendix Vil to meet contractor screening f requirements for UT at Entergy's nuclear sites. The PDI assures that UT personnel have j experienced a variety of examination problems and the associated difficulties of flaw detection i and discrimination. This test enhances the skills of the UT personnel and provides a measurable scale of the reliability of those skills.

l Accordingly, the staff has concluded that the safety margins will not be diminished and may be  ;

enhanced as a result of implementing the licensee's proposed alternative at ANO-1.

3.4 Proposed increases in Core Damaae Freauracy and Risk are Small and are Consistent 4 with the NRC Safety Goals

The NRC staff reviewed the licensee's proposal to use Code Case N-560 at ANO-1 in lieu of ,

l the requirements of ASME Code,Section XI, Table IWB-2500-1, to ascertain that the proposed increase in risk is small and that the NRC safety goals are not exceeded. The staff concluded that the implementation of the RI-ISI program as described in the application will reduce, or

negligibly increase risk, and, thus, will not cause the NRC Safety Goals to be exceeded.

Assurance that any proposed increase in risk is small is attained through the integrated analysis, evaluation, and decision making process followed by the licensee to develop the requested alternative to the ASME requirements. The results of the NRC staff review follow. i l

3.4.1 Scoce of Pioina Systems The scope of the submittal encompasses all Class 1 examination Category B-J piping we!ds excluding socket welds at ANO-1.

3.4.2 Pioina Seaments Pipe segments are defined as lengths of pipe whose failure leads to the same consequence  ;

and which are exposed to the same degradation mechanism. That is, some lengths of pipe I whose failure would lead to tae same consequences may bo split into two or more segments when two or more regions are exposed to different degradation mechanism. The staff finds this appropriate, and necessary, because the methodology combines separate consequence categories with degradation mechanism categories and, therefore, the two characteristics should not be mixed within a segment.

l

7 9

3.4.3 Pioina Failure Potential in order to. evaluate the potential for failure of the piping, the licensee identified the pctential j

degradation mechanisms for each pipe segment within the scope of this proposal. Specifically, the following six systems were included in the evaluation: Reactor Coolant, Primary Makeup and Purification, Kigh Pressure injection (HPI), Decay Heat Removal, Low Pressure injection (LPI), and Core Flood. Each pipe segment was evaluated for the following 16 degradation mechanisms: thermal fatigue, thermal stratification, cycling, and striping (TASCS), thermal transients, stress corrosion cracking, intergranular stress corrosion cracking, transgranular stress corrosion cracking, external chloride stress corrosion cracking, primary water stress corrosion cracking, localized corrosion, microbiologically influenced corrosion, pitting, crevice corrosion, water ha.nmer, and degradation (this is flow sensitive) including erosion-cavitation and flow accelerated corrosion. Each degradation mechanism was evaluated for its potential impact on the pipe segment and each pipe segment was assigned a pipe failure potential based upon the degradation mechanism.

l The NRC staff finds the licensee's evaluation of the potential for piping failure acceptable l

because the methodology provides for the evaluation of the pipe segment break potential that incorporates consideration for potential degradation mechanisms.

l 3.4.4 Conseauence of Failure The consequence of the postulated pipe failure considered includes both direct and indirect effects of each segment failure. The direct effects always include a diversion of flow large enough to either disable at least one train of a system or lead to isolation (automatic if available, manual if feaaible). Indirect effects include spacial effects caused by flooding, spray, and pipe whip as well os depletion of water sources such as draining tanks. All the Class 1 piping at ANO-1 is inr,de containment and all necessary equipment is designed for a large loss-of-coolant accident (LOCA) environment. The licensee stated that there are no spacial j j

effects identified following pipe ruptures inside the containment because of the environmental l qualification and spacial separation of the equipment.

The analysis is performed assuming a large break based on the pipe diameter unless a smaller break results in more severe consequences. No credit is given to leak-before-break. The staff finds that the use of the limiting break size and all associated effects is appropriate to characterize the risk from each segment and is, therefore, acceptable.

! In some cases, the equipment and functions lost as a result of a pipe rupture can vary greatly if an automatic (e.g., check valve closure and automatic isolation valves) or manual isolation succeeds or fails. When large variations in lost equipment and functions are identified, the consequence category (which includes a measure of the likelihood of isolation) for both successful and unsuccessful isolation is developed and the highest category selected. The staff finds this process acceptable because it includes the systematic consideration of the potential for isolation failure, and, when applicable, considers the consequence and likelihood of 1 isolation failure and isolation success.

A Failure Mode and Effects Analysis was performed for each segment rupture and the results for each segment are included in the submittal. Most Class 1 piping is exposed to primary pressure and, if ruptured, would cause an unisolable LOCA. One segment that is exposed to j

primary pressure can be isolated by the operators as part of the procedure to respond to the LOCA. If the operators isolate the segment, the sequence would become a reactor trip event.

Some Class 1 piping is normally isolated from primary pressure boundary piping. For segments l in the emergency core cooling system (ECCS) injection paths, an unrelated LOCA injection

! signal or failure of an isolation valve would be necessary to pressurize the segment and -

potentially cause a rupture. Segments not in the ECCS injection paths and ncimally isolated from primary pressure would only be pressurized if an isolation valve failed. The staff finds that all relevant consequences of Class 1 pipe failures are included in the evaluation.

j 3.4.5 Probabilistic Risk Assessment (PRA)

. The ANO-1 individual plant examination (IPE) was completed in April 1993. A limited scope l level 11 analysis considered all the accident sequences from the level I study, relevant combinations of plant damage states, containment system states, and containment failure modes. Detailed plant-specific level 11 phenomena and structural analysis were not performed.

l ANO-1 design features were considered in the IPE via limited engineering calculations or as a l basis for scaling reference plant analyses. The licensee defined LERF as early containment failure without source term mitigation. The licensee used the 1993 IPE to support the original RI-ISI submittal in June 1998. According to the licensee's May 17,1999, submittal, the licensee updated the PRA (which was the basis for the 1993 IPE) between the June 1998 submittal and the May 1999 submittal. The iPE grouped medium LOCA together with small LOCA and claimed that the results were conservative. The updated PRA evaluated medium LOCA and showed that the medium LOCA conditional core damage probability (CCDP) is, in fact, slightly smaller than the small LOCA CCDP. In general, the LOCA and transient CCDP decreased j slightly in the updated PRA as compared to the IPE estimates.

The licensee used quantitative IPE results to support the following evaluations, a) The licensee used IPE results to estimate the CCDP for segment failures, which cause LOCAs. The CCDP was obtained by dividing the LOCA CDFs by the initiating event frequency. The LOCA models in the IPE include the standard assumption that the LOCA is in one of the four injection paths, so the LOCA CCDPs can also be directly used to characterize segment ruptures that also fail, at most, one of the ECCS injection paths.

These results can be directly compared to the CCDP guidelines to place the segment in the appropriate consequence category.

b) The licensee also used the IPE to calculate the unavailability of the reactivity control functions, high and low pressure injection functions, and high and low pressure recirculation functions. These unavailabilities were used to determine the number of equivalent back-up trains at ANO-1 for each of these functions.

The licensee's methodology assigns segments into consequence categories based on the probabilities of core damage and large early release given that each segment has failed.

Although the IPE was used to develop CCDPs, it was not used to determine any large early 4

release probabilities (LERP) values. The transient with a CCDP estimated to be 1 x 10 was assigned a medium consequence and would not represent a high LERP consequence

(>1 x 104) even if the conditional containment failure probability (CCFP) was 1.0. The licensee j used the IPE to estimate the CCFP for small and large LOCA. The licensee reported that these '

I

CCFPs are less than 0.1 and, therefore, the LERP consequence category for these segment ruptures is equal to or less than the CCDP consequence category.

The staff finds that appropriate results from the IPE were used and they were used in the RI-ISI methodology in an appropriate manner.

Quality of PRA The IPE was performed by the licensee and contractor personnel, with the licensee contributing over half of the total engineering effort applied to the project, in addition to the normal engineering quality assurance carried out by the organization performing each phase of the analysis, an independent PRA review group consisting of key ANO-1 staff and outside experts l performed a detailed review. This review covered the overall PRA methodology, initiating l events and accident sequences, system models, data analysis, human reliability and recovery I analysis, model quantification, and containment analyus and release characterization. Critical comments from this review team were used to revise, refine, or clarify the IPE analysis and results.

The IPE review was completed in December 1996. The review concluded that the study met the intent of Generic Letter 88-20, but identified three concerns. Two concerns were (1) that the power recovery factor following loss of offsite power appeared optimistic and (2) that common cause failures (CCFs) were not modeled between the turbine and motor driven

)

emergency feedwater pumps. These concerns are not generally relevant to the RI-ISI analysis because Class 1 pipe ruptures are almost always LOCA scenarios. The one exception is a segment rupture, which should, by procedure, be isolated by the operators and that would then become a plant trip scenario. The plant trip scenario has a CCDP of about 1 x 10+ and was ,

categorized as medium consequence. An increase of almost two orders of magnitude to place j this segment into the high consequence category due to one CCF factor is not plausible.

The third concern, that the human errors were not analyzed in sufficient detail, is also not expected to increase the CCDP due to transients by two orders of magnitude. The LOCA CCDPs used in the submittal are in the high b mid 10 range and all direct, unisolable LOCA segments are high consequence regardless of the human error probabilities. All remaining segments, normally isolated from primary pressure and requiring an isolation valve failure or demand due to an unrelated LOCA, are categorized as medium consequence. There are no l segments categorized as low consequence. Very high human error probabilities (on the order of 0.1) could increase the CCDPs given a LOCA such that, including the probability of independent valve failures, the CCDP for some normally isolated segment ruptures would be above 1 x 104and therefore should be high instead of medium. However, considering that the plant is designed for LOCAs and operators routinely train to mitigate LOCAs, extremely high human error probabilities are not anticipated. The staff finds that assigning medium consequences to normally isolated segments is reasonable because the quantitative results l from the IPE support the observation that the consequence category of ruptures requiring other /

independent failures should be less severe than rupture directly causing a unisolable LOCA.

The staff did not review the results of the IPE to assess the accuracy of the quantitative estimates. The staff recognizes that the quantitative results of the IPE are used as order of magnitude estimates for a variety of risk and reliability parameters. These estimates are used to support the assignment of segments into three broad consequence categories. The licensee

~ -

placed all segments whose rupture causes unisolable LOCAs into the high consequence category. All remaining segments require unrelated additional failures to create conditions where a rupture could occur and are placed in the medium consequence category.

Inaccuracies in the models or assumptions large enough to invalidate the broad categorizations developed to support RI ISI should have been identified in the licensee or the staff reviews.

Minor errors or inappropriate assumptions will only affect the consequence categorization of a few segments and not invalidate the general results or conclusions. The staff finds the quality of the IPE sufficient to support the submittal.

Scope of IPE The ANO-1 IPE completed in April 1993, did not include shutdown, fircs, and seismic events.

Segments in the high consequence category are not further differentiated, so any segment categorized as high in the internal event evaluation need not be further evaluated for other types of initiating events. The licensee evaluated the shutdown modes of operation and operating conditions for each of the systems included in the evaluation. The portion of LPI that is in standby during power operation and operates in decay heat removal mode during shutdown was identified as the only piping for which operating conditions and potential consequences warranted detailed evaluation. The discussion in the submittal concluded that full power based consequence categorization of the Class 1 piping in the LPI systems appropriately reflected shutdown operation.

Fires and seismic initiating events are also evaluated and discussed in the submittal. As with 1 shutdown, only pipe segments with medium consequence need to be reviewed. Both seismic events and fires have small occurrence frequencies and, thus, the possibility of a fire or seismic event occurring independently, yet simultaneously, with a pipe rupture is negligible. Only the occurrence of these events as initiating events with subsequent demand on the mitigating systems need be further evaluated. In general, the licensee determined that the frequency of transients related to Class 1 piping and induced by external events is less than the frequency of internal LOCAs. No relationship between reduced inservice inspections and increased vulnerability to segment failure arising from the occurrence of external events was identified.

The staff finds the scope of the IPE acceptable because initiating events and operational modes outside of the scope of the IPE were systematically included in the evaluation.

3.4.6 Safetv-Sionificance Determination The IPE is used to support the categorization of pipe segments' failure consequences into one l of three broad categories: high, medium, or low. These results are coupled with degradation evaluation categories to support the more systematic and efficient selection of ASME,Section XI, Class 1 B-J pipe welds to inspect. l l

Quantitative uncertainty calculations are not included in the methodology. The placing of i segments into broad safety significant categories tends to reduce the sensitivity of the eventual decision on the specific values developed from the IPE, with the exception of values near the border between the categories. The sensitivity of the values near the borders is addressed by l defining a medium consequence category. The medium consequence category ensures that ,

segments whose failures cause consequences, which are not obviously high or low, are treated <

as medium (intermediate) severity segments, both during the final safety-significance

l- 1 determination and in the assignment of weld elements to inspect. The staff finds that the performance of quantitative uncertainty calculations would not provide information, which would j significantly change the results of the submittal.

Conseauence Cateaorization The specific decision criteria used to determine the consequence category depends on the type of impact the segment failure has on the plant. In general, however, the criteria are derived from guidelines a,o plied to the CCDP given the segment failure. That is, given a segment failure and all the associated spacial effects, the CCDP is the probability that the resulting scenario will lead to core damage. If the failure of a segment is estimated to lead to a core i 4

damage event with a probability greater the 1 x 10 , the segment is categorized as high I consequence. An estimated CCDP within the range of 1 x 104 to 1 x 104 is categorized as l medium consequence. CCDPs less than 1 x 104are categorized as low consequence. l The methodology provides guidance on assigning a consequence category to segrrwa breaks based on the number of available trains, broad categories of initiating event frequent and exposure times.. The licensee also explicitly developed order of magnitude CCDP et ates for each segment and compared the estimates to the above CCDP guidelines. The resun. from the two methods are dependent insofar as the quantitative estimates are used to determine the equivalent number of back up trains. Nevertheless, the staff finds that the parallel evaluations provide additional confidence that each segment is assigned an appropriate consequence category.

The following decision criteria are used to support the CCDP elated categorization of each type of segment failure consequence.

a) When the segment failure causes only an initiating event (i.e., no mitigating system failures caused by segment rupture), the CCDP can be estimated and directly compared to the guideline values. Most Class 1 pipe failure leads to LOCA accidents, so most segment failures in this submittal were categorized with this method, b) Segment failures which only fail mitigating functions, but do not cause a plant trip, increase the likelihood that, following an unrelated initiating event, the sequence of events will lead to a core damage event. The licensee used a matrix supplied in the submittal that specifies consequence categories based on categories of initiating events based on expected frequencies, the number of equivalent unaffected trains left to mitigate the event, and exposure time. Since Class 1 piping is not tested during operation, only the "all year" exposure time is applicable. The specified consequence category for each matrix entry was determined by developing a CCDP from the bounding values of all :hree contributors, and comparing that bounding value to the CCDP guidelines, c) Segnents which cause both an initiating event and fail mitigating systems are the last type of segment failure consequences. The licensee used a matrix supplied in the submittal whereby the number of equivalent unaffected trains available for mitigation determines the consequence.

l The matrices used in b) and c) require that each unaffected train left to mitigate an event has  !

an unavailability of 0.01. That is, in order for the CCDP of the matrix elements assigned high,

)

1- '

L

E

~ .

i 14 medium, and low to correspond to greater than 1 x 104 , between 1 x 10d and 1 x 104 , aau less than 1 x 104guidelines, each unaffected train must have an availability of at least 0.99. Due to potential interactions between system trains and between different systems, the licensee performed PRA calculations where the reliability of different combinations of trains was '

calculated and the number of equivalent backup trains determined. For example, the HPI -

system et ANO 1 has three pumps and four injection paths (one injection path assumed unavailable due to the LOCA). The licensee estimated the unavailability of this function (at least one pump through two injection paths) as about 6 x 10d or 1.5 trains (2 trains requires a maximum unavailability of 1 x 104 ).

The licensee's LERP-related guidelines are a factor of 10 lower than the CCDP guidelines (i.e., High > 1 x 104 LERP, Low < 110 3LERP, and Medium otherwise.) The segment is assigned the higher of the CCDP or LERP consequence category. All Class 1 piping is inside containment and therefore containment bypass LERP is not an issue. The licensee estimated that the conditional containment failure probability given any size LOCA is less than 0.1.

Therefore, the CCDP category would always be at least as high as the LERP category. The staff finds that the licensee systematically considered all relevant types of segment failure consequences.

The staff finds the consequence categorization process as applied by the licensee to be reasonable. The order of magnitude of the high consequence (i.e., severe consequences to receive substantial attention) guidelines are consistent with the CDF and LERF decision criteria.

I The two orders of magnitude between the high and low guidelines provide a robust medium category such that it can be reasonably concluded that segments categorized as low consequences make a negligible contribution to nsk. Therefore, the staff finds that the licensee's guidelines are consistent with acceptable risk-related guidelines and that they provide reasonable assurance that the segments are appropriately characterized.

Safety Sianificance Cateaorization of Pioe Seaments The safety significance of pipe segments is based on categorizing (a) the consequence of segment failure into high, medium, low, or none and (b) the failure potential of the piping as high, medium, or low is discussed in Section 3.4.3. Once the individual elements of risk (consequence and failure potential) are developed, they are combined in a matrix that has 12 elements, corresponding to various combinations of failure potential and consequence i rankings. I A specific grouping of these combinations define the basis for categorizing the pipe segments into risk categories 1 through 7. Risk categories 1,2, and 3 are designated as belonging to the high risk group, risk categories 4 and 5 belong to the medium risk group, and risk categories 6 and 7 belong to the low risk group. Although there are no segments categorized as low consequence, a medium consequence segment with no identified degradation mechanism is placed in the low risk group. Examination zones arc then selected by starting with the structural elements in the high risk group and working toward the low risk group, until a total number of structural elements equal to 10 percent of the Category B-J piping welds, excluding socket welds, have been selected.

The medium risk category ensures that segments, which are not clearly high or low, will receive i an intermediate level of inspection activity. The staff finds that the assignment of safety

significance to the 12 matrix elements as detailed in the submittal is internally consistent and logically compelling. The staff finds that the use of the reported categories, along with other

, evaluation and confirmation steps detailed in this safety evaluation, provides reasonable assurance that the safety significance of each segrnent is appropriately assigned.

3.4.7 Determination of the Chance in Risk The ANO-1 submittal proposes to reduce the required ASME Code,Section XI, volumetric examination of welds from 51 to 40 welds and proposes to discontinue the Section XI surface examinations that were being conducted. The licensee evaluated the impact on CDF, which might be associated with the change in the ISI program for the high and medium risk segments. '

The licensee estimated a net CDF decrease on the order of 3 x 108/yr when credit for improved inspection techniques that will be applied as part of the new inspection program is included.

When no credit for the improved inspections is included, the licensee estimates a CDF increase 3 of less than 1 x 10~8/yr.

All Class 1 piping is inside containment so containment bypass events are not an issue. The licensee estimated the CCFP for the different LOCA sizes and reported that they are allless l than 0.1. Therefore, applying the 0.1 CCFP to the CDF estimates above, the estimated decreases in LERF including credit for improved inspection is about 3 x 10*/yr. When no credit for improved inspection techniques is included, the estimated LERF increase is less than 1 x 10*/yr.

The staff finds the licensee's process to evaluate and bound the potential change in risk is acceptable because it accounts for the change in the number of elements inspected, recognizes the difference in degradation mechanism related to failure likelihood, and considers the effects of enhanced inspection. The staff finds that these factors should increase the fraction of potential weld ruptures, which would be identified by the inspection before the flaw devt.Jops into an actual rupture. The staff also finds that re-distributing the welds to be inspected with consideration of the safety significance of the segments provides assurance that segments whose failure have a significant impact on plant risk receive an acceptable level of inspection. Therefore, the staff concludes that the implementation of the RI-ISI program as described in the application will reduce, or negligibly increase risk, and, thus, will not cause the NRC Safety Goals to be exceeded.

3.4.8 Intearated Decision Makina ANO-1 performed an independent review of the safety significance analysis to support the RI-ISI program. The analysis and subsequent review was carried out in accordance with the EPRI RI-ISI methodology. The ANO-1 staff has reviewed the application results to ensure that the process has been correctly and comprehensively applied. A complete and thorough l application of the EPRI RI-ISI process results in an accurate risk categorization of piping l l

segments.

The review process employed for the ANO-1 N-560 application was very similar to that employed for the ANO-2 N-578 application, which has been reviewed and approved by the NRC staff. The review process utilized in the ANO-1 pilot application consisted of the following: l

p l

Duke Engineering & Services and Structural Integrity Associates (SIA) functioned as the i principal investigators for the ANO-1 pilot project in the application of the EPRI methodology. The consequence and degradation mechanism evaluations were performed and documented in the form of calculations. As such, after preparation of the calculations, an independent review was performed and all comments resolved before the calculations received final approval. The risk evaluation and element selection report was prepared by Entergy's personnel and documented as an SIA report.

To support the project, Entergy assembled a dedicated team of ANO-1 plant staff with diverse experience in probabilistic risk assessment, operations, and inservice inspection.

The ANO-1 staff's duties included the following: collection of required design inputs, l responding to inquiries from the project principal investigators, resolution of issues arising during the evaluations, review of plant service history relative to piping pressure boundary 4 degradation occurrences, and a comprehensive review of the calculations with primary focus on the technical accuracy and completeness of the consequence and degradation  ;

mechanism evaluations. This team, which interfaced with other plant staff personnel on an as needed basis, was an active participant in the application of the EPRI RI-Isl process and ensured that plant-specific knowledge and insights were factored into the risk evaluations.

- The ANO-1 staff is ultimately responsible for the technical content of the ANO-1 pilot application submittal. ANO-1 Procedure A4.502," Accuracy of Communications," provides a process to document that complete and accurate information is submitted to the NRC. The process requires that the originator compile the documentation necessary to substantiate that the information is true, accurate, and complete. A verification is then performed to confirm that the documentation supports the statements made. The ANO-1 staff performed this function.

i The staff finds the review of the evaluations and results used to support this RI-ISI program l acceptable since, as described by the licensee, it follows the EPRI RI-ISI methodology. The methodology provides for an independent review by personnel technically knowledgeable in the applicable engineering disciplines. The process used to select the specific welds to inspect is believed to result in a credible and supportable selection since the appropriate personnel make l the final decisions based on a discussion of the information needed to support the decision.

3.4.9 Selection of Examination Locations and Methods The licensee used guidance provided in EPRI Report TR-106706, Risk-Informed Inservice i Inspection Evaluation Procedure, for assessing potential degradation mechanisms, expected  !

locations of the degradation mechanisms, and appropriate examination methods based on a review of the operating characteristics and plant experiences for piping systems at ANO-1.

I Several types of degradation mechanisms were identified as being possible for the ANO-1 l systems included in the submittal. For each of these mechanisms, specific guidance is l provided in the EPRI procedure for choosing susceptible locations and applying volumetric examination methods to detect associated degradation. The licensee has applied the EPRI l

methodology to select examination locations and methods at ANO-1.

The staff finds that the guidance for selecting examination locations, descriptions of affected examination areas for mechanisms appropriate to ANO-1, and prescribed volumetric methods provided in EPRI Report TR 106706, if followed, will provide reasonable assurance of the L

l

=4 6 1

• structuralintegrity of Class 1 piping systems. The licensee has committed to following this guidance, therefore, the staff finds the licensee's selection of examination locations and applied volumetric methods acceptable.

3.4.10 Conclusgn The staff finds that the licensee has developed an acceptable process to determine the relative safety significance of pipe segments and to select examination locations and methods for those locations. The integrated process identifies locations where degradation mechanisms are more likely to occur and adapts examinations to those mechanisms and therefore represents an improved inspection strategy compared to the current strategy. The licensee also provides quantitative estima'es supporting the expectation that the proposed alternative represents a risk decrease or, at most, a negligible increase, which can be considered risk neutral. Since there is no proposed increase in risk, the application is consistent with Principle 4, Proposed increases in Core Damage Frequency and Risk are Small and are Consistent with the NRC Safety Goals. .

3.5 The Prooosed Alternative Uses Performance Measurement Strateaies to Monitor the Chance The Code Case N-560 methodology, as applied to ANO-1, constitutes an RI-ISI program that upon approval, would be implemented as the alternative to current Section XI requirements for Class 1 system Category B-J welds. ,

The licensee has indicated, as noted previously in Section 2.% Principle 5, that existing monitoring and feedback programs provided in Section XI will be maintained including pressure and leak tests of all Category B-J components, inspection results will be compared to l preservice inspection and prior ISI results (IWB-3130c), and use of IWB-3500 will be followed for flaws that exceed acceptance criteria.

The results of NDE inspections are evaluated upon completion and discrepancies are documented per ANO-1 procedures. Intermediate and long-term corrective actions are identified and tracked to completion. In addition to the preceding ASME Section XI monitoring mechanisms, ANO-1 has in place processes to detect reactor coolant leakage that monitor sump level, inventory balance, and radiation monitoring.

The staff, therefore, concludes that performance measurement strategies exist at ANO-1 to monitor change, and these strategies will be effective to detect any unacceptable changes in safety as a result of implementing the proposed alternative.

4.0 CONCLUSION

The NnC staff finds that the licensee has provided an acceptable alternative to the requirements of ASME C ade Section XI. The licensee has shown that implementation of the program would result in an insignificant change in risk even with fewer inspections, since the inspections will take place where degradation mechanisms are more likely to occur, and procedures and personnel will target these specific locations using improved techniques and expanded volumes. The staff has determined that the alternative method described in the licensee's submittal (based upon ASME Code Case N-560 as augmented by EPRI

r s .

Report TR-106706) results in examination criteria for Class 1 Category B-J welds that provide an acceptable level of quality and safety.

The staff, therefore, concludes that authorization of the licensee's proposed alternative would provide an acceptable level of quality and safety, is authorized by law and will not endanger life -

. or property or common defense and security, and is otherwise in the public interest. Pursuant to 10 CFR 50.55a(a)(3)(i) the alternative is authorized. This authorization does not constitute an NRC approval of Code Case N-560 for generic use. The suitability of Code Case N-560 for generic use will be determined following the staff's review of the Code Case it is expected that the results of the staff's review will be documented in a future revision of RG 1.147," Inservice Inspection Code Case Acceptability - ASME Section XI, Division 1."

Principal Contributors: G. Georgiev S. Dinsmore Date: August 25, 1999