ML20211G866

Requests Commission Approval to Publish for Comment Draft Regulatory Guide DG-1063, Approach for Plant-Specific,Risk- Informed Decisionmaking Inservice Insp of Piping, & Draft Standard Review Plan Section 3.9.8

ML20211G866
Person / Time
Issue date:	08/20/1997
From:	Callan L NRC OFFICE OF THE EXECUTIVE DIRECTOR FOR OPERATIONS (EDO)
To:
References
TASK-*****, TASK-RE SECY-97-190, SECY-97-190-01, SECY-97-190-1, SECY-97-190-R, NUDOCS 9710060009
Download: ML20211G866 (242)

Text

__

1. a g _, ,

J{ l."

e 3

eeseeeeeoeeeeeeoeeeeeees e

RELEASED TO THE PDR ,

e e g

5 fs %s'\ 'i

jdgflg date Jrz)  ;

initials seee.

j . .e e e e e e s e e s s e re e s s e e e s ,

POLICY ISSUE (Notation Vote)

Auoust 20.1997 SECY-97-190 EQB: The Commissioners FROM: L. Joseph Callan ExrGtive Director for Operations

SUBJECT:

DRAFT REGULATORY GUIDE AND STAl4DARD REVIEW PLAN ON RISK-INFORMED INSERVICE INSPECTION OF PIPING PURPOSE:

. .. p i

To request Commission approval to publish for comment draft Regu atory Guide DG-1063, "An -

i Approach for Plant-Specific, Risk-Informed Decisionmaking: Inservice Inspection of Piping," and draft Standard Review Plan Section 3.9.8, " Standard Review Plan for the Review of Risk-Informed Inservice Inspection Applications," that support implementation of risk-informed I

regulation for power reactors.

BACKGROUND.

In response to the Commission's August 16,1995, Policy Statement on the "Use of PRA O j Methods in Nuclear Regulatory Activities," and the Chairman's November 30,1995, memorandum, " Follow-up Requests in Probabilistic Risk Assessment and Digital ~

Instrumentation and Control," the staff sent a memorandum to the Chairman, dated January 3, ,

1996,. outlining the plan to develop Regulatory Guides (RG) and Standard Review Plan (SRP) 1)g7 g

~

sections to support risk-informed regulation in the following areas:

general guidance, Inservice inspection (ISI); .j-l Inservice testing (IST);

technical specification (TS); and graded quality assurance (GQA).

g 4 nvu b5 _

j k q g f)Y[oltrn -

. CONTACT: SECY NOTE: To be made publicly q Jack Guttmann, RES available when the final SRM is -

l 415-7732 made available.

?

971005 09 820~

1 PDR SECY ,* y' l

97-190 R PDR' '

t H

_a _- -

le-.

. _- . . _ _ __.__________..________,m.

e. e i

, 2

- In SECY-97-077, dated April 8,1997, the staff provided draft versions of all the RGs and SRPs, l

. - except for inservice inspection programs for piping, to the Commission for approval to publir h l for public comment. -In a staff requirements memorandum (SRM), dated June 5,1997, the l

Commission approved publication of the draft regulatory guides, standard review plans and a NUREG documents for a 90-day public comment period.

. DISCL SSION

The purpose of the draft RG'and SRP on risk-informed ISI is to provide guidance to power reactor licensetia and the NRC staff on an acceptable approach for utilizing risk information to support requests for changes in a plant's current licensing basis (CLB) for inservice in.pection

- programs for piping.' In effect, the draft RG describes a process, with examples, for an acceptable altamative means that a licenses can apply to propese plant specific CLB changes under 10 CFR 50.55a(s)(3)(i):

t

" Proposed altematives to the requirements...may be used when authorized by the Director of the Office of Nuclear Reactor Regulation. The applicant shall demonstrate thst: .. [t]he proposed attematives would provide an acceptable level of quality and safety..."

The draft RG and SRP build upon and supplement the general guidance for risk-informed regulatory programs, as outlined in the general guidance RG (DG-1061) and SRP (Chapter 19),

approved by the Commission for public comment in the SRM dated June 5,1997. As with DG-1061, use of RI-ISI programs is voluntary for licensees and is not considered a backfit. . The RG e and SRP require the risk-informed approach to be applied to piping in an integrated fashion 1

(i.e., it applies to safety as well as non-safety systems), in doing this, it allows for the use of a qualitative as well as quantitative methods to assess the risk importance of the piping, in addition, it extends and applies the use of quantitative PRA technology to piping integrity .

through the use_of fracture mechanics analytical techniques.

The draft risk-informed innervice inspection (RI-ISI) RG and SRP were developed in (Jose coordination with industry initiatives in 'his area.- Specifically, the nuclear industry submitted, through NEl, two topical reports on the subject. One topical report, WCAP-14572, sponsored by the Westinghouse Owners Group (WOG), demonstrates the application of the quantitative rimthods develooed by the ASME Research Task Force on Risk-Based Inspection and the L

ASME Code Case Committee to ISI programs across the entire nuclear plant, and has refined it for regulatory application. The second topical report (EPRI TR-106706), sponsored by EPRI, demonstra:es a more qualitative approach to RI-ISI programs developed through the ASME Code Case Committee. E;:c3 topical raport supports an ASME Code Case and has a pilot

! plant associated with its development, demonstration and implementation. The pilot plant that implements the quantitative Code Case (N-577) is Surry. The pilot plants that implement the qualitative Code Case (N-578) are ANO-2 and Fitzpatick. Proposed current licensing basis changes associated with the pilot applications are expected to be submitted to the NRC in

September 1997.

i i

we-. , ,w: -- . - - . , . ,

.s .e

3 Although ideally the RG and SRP should build upon final approved topical reports, the staff considered that the development of the RG/SRP in parallel with updating the topical reports was a reasonable approach since the knowledge gained to date from review of the topica!

reports and from interacting with the American Society of Mechanical Engineers, WOG, EPRI i

and Virginia Power was used to help define the guidance contained in the RG and SRP, Additional interactions are expected over the next several months as worlt on the topical reports

,  ! and pilots continues and the industry gets an opportunity to review the draft RG and SRP. The staff plans to hold a public workshop on the RI-ISI RG and SRP on October 30-31,1997, at the Marriott Hotel, Bethesda, Maryland. The results of these additionalinteractions with the pilot ,

plants and the public will be faciored into the final RG and SRP.

Attached to this paper are the proposed Federal Register Notice (FRN) (Attachment 1) announcing the availability of the draft regulatory guide DG-1063 (Attachment 2), the SRP i Section 3.9.8 (Attachment 3) and the workshop for risk-informed inservice inspection programs ,

for piping. The FRN contains specific questions on which feedback is sought. A 90-day i comment period is proposed.

COORDINATION The RG and SRP were reviewed by the ACRS and their views were provided in a letter dated L

July 14,1997, (Attachment 4). As referenced in the July .14,1997, ACRS letter, the staff

, revised the RG subsequent to the July 10,1997 ACRS Full Committee meeting to respond to the ACRS recommendations. CRGR reviewed the RG and SRP and has no objection to their i publication for public comment. The CRGR recommended that an independent peer review be

[ performed in parallel with the public comment process on the identification of the number of

, welds to be inspected in a pipe segment. The staff plans to complete that pear review by

! October 1997.

3- The Office of the Chief Information Officer has reviewed the draft Regulatory Guide for -

j information technology and informatbn management implications and concurs in it.

1 The Office of the Chief Financial Officer has no resource objection to this paper, 4

OGC has no legal objection.

. RECOMMENDATION

1

That the Commission:

j 1) Approve publication of the attached draft FRN and issuance of, RG (DG-1063) and SRP (Section 3.9.8) for a 90-day public comment period.

4 j 2) Note:

1 L a. Should our analysis conclude that there will be a significant burden reduction on

the licensee, OMB approval of the information collections will be obtained before j the final Regulatory Guide is published. In addition, before the final Regulatory i

[

~ _ __ -__ - ._ - _ ,

-e e 4'

Guide is published, the Paperwork Reduction Act Statement may requi.e Inodification to indicate an amendment to existing information collections and OMB's approval of the amendment.

b. A public announcement will be issued when the FRN is filed with the Office of the Federal Register,-

c. Copies of the FRN will be distributed to all power reactor licensees. The notice will be sent to other interested parties on request.

d. A Backfit Analysis is not required because the RG and SRP do not involve any provisions that would impose backfits as defined in 10 CFR 50.109(a)(1),

s

- L. Jc ph Callan Executive Director for Operations Attachments: .

DISTRIBUTION:

1. Proposed Federal Register Notice - - Commissioners

2. - Draft Regulatory Guide-DG-1063 - ISI OGC--

3. Draft Standard Review Plan -ISI OCAA-

4. ACRS Letter, dated July 14,1997 OIG OPA

- cc: OCA

-SECY ACRS OGC CIO CFO OCA

-OPA [E Y CFO-

C.lO .

i'

l. SECY NOTE: Commissioners'-comments or consent should be provided

directly to the-Office of-the Secretary by c.o.b. Tuesday, September 9, 1997. '

l Commission staff office. comment 4

- if any, should be submitted to the Commissioners NLT September 3997, with an information copy to SECY.- If the paper is of sucE a nature that it requires additional review and comment, the Commissioners and the_ Secretariat

should be apprised of when comments may be expected.

L i , . . _ _ _ . . _ _,,

1 a

4 i- .

ATTACHMENT-1 b

i FEDERAL REGISTER NOTICE J

14 i

1 h

4 1

i i'

' )

l 1

1 i l i ,

I l

l i

f.

(

1 1

4 4

4

.t l

4 s

k

e .

l l

ATTACHMENT - 1 FEDERAL REGISTER NOTICE

[7590-01-P]

FEDERAL REGISTER NOTICE NUCLEAR REGULATORY COMMISSION Draft Regulatory Guide and Standard Review Plan Section; Issuance, Availability

SUMMARY

The Nuclear Regulatory Commission has issued for public comment drafts of a regulatory guide and a Standard Review Plan Section that discuss an alternative approach for meeting inservice inspection requirements for piping. These issuances follow the Commission's 4

August 16,1995 (60 FR 42622) policy statement on the "Use of PRA Methods in Nuclear Regulatory Activities." n June 1997, the NRC published for public comment (62 FR 34321) four draft guides, 3 standard review plans and a NUREG series document on the use of PRA in nuclear power reactor licensing. The NRC is developing guidance for power reactor licensees on acceptable methods for using probabilistic risk assessment (PRA) information and insights in support of plant-specific applications to change the current licensing basis (CLB) for inservice inspection of piping, known as risk-informedinserviceinspection(RI-ISI) programs. The use of such PRA information and guidance will be voluntary. To facilitate comment, the Commission will conduct, on October 30 and 31,1997, a workshop to explain the dreft documents and answer questions.Section VI of this notice provides additional'1 formation on the scope, purpose and topics for discussion at the workshop.

l

. e CEMMENTS: Comment period cxpires (insert date 90 d;ys after d _te of publication in the Federal Register). Comments received after this date will be considered if it is practical to do so, but the Commission is able to assure consideration only for comments received on or before this date.

Mail written comments to: Rules and Directives Branch, Office of Administration, U.S. Nuclear Regulatory Commission, Washington, DC 20555-0001. Please (1) attach a diskette containing your comments,in either A">C11 text or Wordperfect format (Version 5.1 or 6.1), (2) or submit your ,

l comments electronically via the NRC Electronic Bulletin Board on FedWorld or the NRC's interactive I l

rulemaking Website. )

1 Deliver comments to 11545 Rockville Pike, Rockville, Maryland, between 7:30 a.m. and 4:15 l l

p.m. on Federal workdays.

Requests for free single copies of draft regulatory guide and standard review plan, to the extent of supply, may be made in writing to the Printing, Graphics and Distribution Branch, U.S.

Nuclear Regulatory Commission, Washington, D.C. 20555-0001, or by fax to (301)415-5272. Copies of draft regulatory guide and the standard review plan section are available for inspection and copying for a fee at the NRC Public Document Room, 2120 L street N.W. (Lower Level), Washington, D.C. 20555-0001. Electronic copies of the draft document are also accessible on the NRC's interactive rulemaking web site through the NRC home page (http://www.nrc. gov). This site includes a facility to upload comments as files (any format),if your web browser supports the function.

For more information on the NRC bulletin boards call Mr. Arthur Davis, Systems Integration and Development Branch, NRC, Washington, D.C. 20555-0001, telephone (301) 415-5780; e-mail axd3@nrc. gov. For information about the interactive rulemaking site, contact Ms. Carol Gallagher, (301) 415-5905; e-mail cag@nrc. gov.

FOR RJR11-ER NFORMATION CONTACT: Jack Guttmann, Office of Nuclear Regulatory Research, MS: T10-E50, U.S. Nuclear Regulatory Commission, Washington, DC 20555-0001, (301) 415-7732, E-mail jxg@nrc. gov.

FRN: Page 2

, .- .. -.. -- .. _ . - . - - . - - - . - - --.- - .~ . --

2 .

t 4

i SUPPLEMENTARY INFORMATIONi .

r

, l. Background On August 16,1995, the CGT.T,ieeion published in the Federal Register (60 FR 42622) a final . O policy statement on the use of probabilistic risk assessment methods in nuclear regulatory i

activities. The policy statement included the following regarding NRC's expanded use of PRA.'

4 1.-_ The use of PRA technology should be increa:,ed in all regulatory matters to the

extent supported by the state-of-the-art in PRA methods and data and in a manner that complements the NRC's deterministic approach and supports the NRC's traditional defense-in-depth philosophy. - '

!~

2. PRA and associated analyses (e.g., sensitivity studies, uncertainty analyses, and l importance measures) should be used in regulatory matters, where practical within

the bhunds of the state-of-the-art, to reduce unnecessary conservatism associated -

l with current regulatory requirements, regulatory guides, license commitments, and i

staff practices. Where appropriate, PRA should be used to support proposals for additional regulatory requirements in accordance with 10 CFR 50.109 (backfit rule). Appropriate procedures for including PRA in the process for changing 3

regulatory requirements should be developed and followed, it is, of course,

. understood that the intent of this policy is that existing rules and regulations shall be complied with unless these rules and regulations are revised.

.3.- PRA evaluations in support of regulatory decisions should be as realistic as 4

. practicable and appropriate supporting data should be publicly-available for  !

review.-

FRN: Page 3

a 6

4. The Commission's s'_fety goals for nucl:ar power plants cnd subsidiary numerical objectives are to be used with appropriate consideration of uncertainties in making regulatory judgments on the need for proposing and backfitting new generic requirements on nuclear power plant licensees, it was the Commission's intent that implementation of this policy statement would improve the regulatory process in three areas:

1. Enhancement of safety decisionmaking by the use of PRA insights,

2. More efficient use of agency resources, and

3. Reduction in unnecessary burdens on licensees.

To help implement the Commission's PRA Policy Statement, draft regulatory guides and Standard Review Plans (SRP) were developed in the areas of:

General guidance, Inservice inspection (ISI),

Inservice testing (IST),

Technical specification (TS), and Graded quality assurance (GOA).

The draft regulatory guides provide a proposed acceptable approach for power reactor licensees to prepare and submit applications for plant-specific changes to the current licensing basis that utilize risk information. The draft standard review plans provide guidance to the NRC staff on the review of such applications. On June 25,1997, all but the ISI draft regulatory guide and SRP were published for public comment (62 FR 34321).

This notice specifically seeks public comment on Draft Regulatory Guide DG-1063, "An Approach for Plant-Specific Decisionmaking: Inservice Inspection of Piping," and the accompanying draft Standard Review Plan Section 3.9.8, " Standard Review Plan for the Review of Risk-Informed Inservice inspection of Piping." These documents are discussed in more detail below.

FRN: Page 4

The draft guide and SRP are being developed to prcvide guidanc3 to power reactor licensees end NRC staff reviewers on integratin0 risk information to support requests for changes in a plant's CLB for inserviceinspection of piplng. The regulatoryguide describes a means by which licensees can propose plant-specific CLB changes under 10 CFR 50.55a(a)(3)(i). Adopting the approach in this regulatory guide would be voluntary. Licensees submitting applications for ,

changes to their CLB may use this approach or an equivalent approach. To encour6ge the use of risk information in inservice inspection programs for piping, the staff intends to give priority to applications for burden reduction that use risk information as a supplement to traditional engineering analyses, consistent with the intent of the Commission's policy. All applications that improve safety will continue to receive high priority.

DG 1061, "An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Current Licensing Basis," and the draft SRP of Chapter 19 were developed tt provide an overall framework and guidance that is applicable to any proposed CLB change when risk insights are used to support the change (62 FR 34321). The application-specific regulatory guide (RG) anri SRP for ISI would build upon and supplement the general guidance contained in DG-1061 and provide additionalguidance specific to inservice inspection programs for piping.

The guidance provided in these documents is designed to encourage licensees to use risk information by defining an acceptable framework for the ese and integration of risk information on a plant-specific basis, while promoting consistencyin PRA applications. It is expected that the long-term use of risk informationin plant-specific licensing actions will result in improved safety by focusing attention on the more risk-significant aspects of plant design and operation.

The draft guidance highlights to licensees acceptable methods and scope of analysis required to support the proposed changes to the plant's CLB.

FRN: Page 5

II. Policy issues On May 15,1996, the Commission requested the staff to recommend resolution of the following four policy issues associated with risk informed changes to a plant's CLB:

e The role of performance based regulation, o Plant specific application of safety goats, o Risk neutral vs. Increases in risk, e implementation of changes to risk informed IST and ISI requirements.

These issues are applicable to RI ISI programs. Public comments on these issues were requested in the June 25,1997 FRN (62 FR 34321) under the heading, "Use of PRA in Plant Specific Reactor Regulatory Activitics: Proposed Regulatory Guides, Standard Review Plan Sections, and Supporting NUREG." Comments provided on these issues in response to the June 25 FRN on related l guides will be used by the staff in finalizing this guide as well. Comments on these issues as they specifically apply to this guide are also requested.

Ill. Structure, Guidelines and Rationale for RG/SRP The approach described in the DG-1063 and the draft SRP has four basic steps. These are:

Define the proposed change; Perform an integrated engineering analysis (which includes both traditional engineering and risk analysis) and use an integrated decision process; Perform monitoring and feedback to verify assumptions and analysis; and Document and submit proposed change.

Five fundamental safety principles are described that should be met in each application for a change in the CLB. These principles are.

The proposed change meets the current regulation. This principle applies unless the proposed change is explicitly related to a requested exemption or rule change (i.e., a 10 CFR 50.12 " specific exemption" or a 10 CFR 2.802 " petition for rulemaking");

FRN: Page 6

Dsfense-in-d:pth is maintain:d;

. Sufficient safety margins are maintained; Proposed increases in risk, and their cumulative effect, are small and do not cause the NRC safety goals to be exceeded:

Performance-basedimplementation and monitoring strategies are prot,osed that address uncertainties in analysis models and data and provide for timely feedback and corrective action.

These principles represent fundamental safety practices that the staff believes must be retained in any change to a plant's CLB to maintain reasonable assurance that there is no undue risk to public health and safety. Each of these principlesis to be considered in the analysis and integrated decisionmaking process.

The guidelines for assessing risk proposed in the draft guide and draft SRP are derived from the Commission's safety goal quantitative health objectives (OHOs). Specifically, the subsidiary objectives of core damage frequency (CDF) and large early release frequency (LERF) are used as the measures of risk against which changes in the CLB will be assessed, in lieu of the OHOs themselves, which require level 3 PRA information (offsite health effects). These measures were chosen to simplify the scope of PRA analysis needed, to avoid the large uncertainties associated with level 3 PRA analysis, and to be consistent with previous Commission direction to decouple sithg from plant design. These values are described in the June 25,1997 Federal Register Notice (62 FR 34321) on "Use of PRA in Plant Specific Reactor Regulatory Activities: Proposed Regulatory Guides, Standard Review Plan Sections, and Supporting NUREG."

IV. Comments The staff is soliciting comments related to the guidance described in the draft regulatory guide DG-1063 and SRP Section 3.9.8. Comments submitted by the readers of this FRN will help FRN: Page 7

enoure th:t these drcft documents h:ve appropriata scope, d:pth, quality, and eff:ctiv:n:ss.

Alternative views, concerns, clarifications, and corrections expressed in public comments will i be considered in developing the final documents. l V. Workshop The Commission will conduct a workshop on October 30 and 31,1997, to discuss and explain the material contai..ed in the draft guide and SRP, and to answer questions and receive comments and feedback on the proposed documents. The purpose of the workshop is to facilitete the comment process. In the workshop,the staff will describe each document,its basis, and solicit comment and feedback on its completeness, correctness and usefulness. Since these documents cover a wide 4 l

range of technical areas, many topics will be discussed. Listed below are topics on which discussion and feedback are sought at the workshop:

A) is the level of detailin the gi ; dance contained in the proposed regulatory guide and SRP clear and sufficierit, or is more detailed guidance necessary? What level of detailis needed.

8) is it acceptable to use qualitative information (e.g., not quantifying the change in risk - ACDF and ALERF) to propose changes in ISI programs? If so, does DG-1063 provide adequate guidance in this regard? Can qualitative assessments be used to identify and categorize piping segments as high, medium and low safety significant? How? What are the limitations of such an approach?

C) Under the risk-informed approach, what is the appropriate size of the sample of welds or piping segment areas that should be inspected? What should the criteria be for selecting the sample size?

D) How should welds or piping segment areas in the inspection sample be selected for inspection: randomly, those most likely to experience degradation, or some combination of random and possible degradation? What would be the basis for the FRN: Page 8

o e r:c:mm:nd:d s:l:cti:n process?

E) Once selected, should the same welds or piping segment areas be inspected at each inspection interval or should dif ferent welds or piping segment areas be included in the sample? What would be the basis?

F) DG 1063 proposes a method for meeting the criteria for acceptabis safety and quality, as addressed in 10 CFR 50.55a(a)(3)(i). That method appliec leak frequency target goals to maintain piping performancelevels at or improved over the misting puriG mance observed when implementing ASME Section XI requirements.

Are there other acceptable risk-informed means by which to meet the criteria in 10 l

CFR 50.55a(a)(3)(i)?

G) Should the scope of DG 1063 permit licensees to propose ISI changes to selected systems,in lieu of assessing the entire piping in the plant? Fot example, would it be acceptable for a licensee to limit its analysis to Class 1 piping (reactor coolant system piping) and not consider other piping in the plant? Such an analysis would not provide information required for categorizing piping in the plant and thereby grading the inspection based on plant risk. It would also discourage the use of risk-insights (e.g., PRA) to identify risk-significant piping within the plant. How can the concept of assessing risk in an integrated fashion be maintained if the scope were limited to one or a limited number of systems, such as Class 1 piping. What is gained by analyzing all the systems versus only selected systems? What is lost by minimizing the scope?

H) The decision metrics described in Attachment 2 to DG-1063 identify a 2-by-2 matrix for identifying a graded approach to inspection based on risk and failure pntential. Piping segments categorized as Ngh safety-significant and high-failure-potential receive more inspections than segments categorized as high-FRN: Page 9

s;fety significantand low fcilurop:Onti:1. Th3 number cf insp cti:ns f:r tha high-safety significant and low lailure-potential segments is based on meeting target leak frequency goals and incorporates uncertainties in the probability of detection What other methods ere available to provide a comparable leve! of quality and safety? What are the technical bases for those other methods?

I) How should the time dependence of degradation mechanisms be accounted for in selecting inspection intervals and categorizing the safety significance of pipe segments?

J) On what basis could the requirement for ISI be eliminated? For example, if a detailed engineering analysis identifies a Class 1 or 2 piping segment as low-safety significant and low-failure-potential, is it acceptable to eliminate the ,

requirementfor ISI or should a Class 1 or a 2 pipe segment be considered part of the defense-indepth consideration and be required to have some level of inspection regardless of its categorization as low-safety-significant and low failure potential? If yes, why? If not, why not?

K) Are data bases available on degradation mechanisms and consequences of piping failures? Is data available to ideatify the secondary effects that can result from a pipe break, such as high-energy pipe whip damaging other piping and components in the vicinity of the break? What are the industry's plans for developing and maintaining an up-to-date data base on plant piping performance? Should a commitment to develop and maintain such a data base be required for a RI-ISI program? How could it be ensured that the data base is maintained?

L) Does the application of the Perdue-Abramson model (DG-1063, Attachment 4), with the use of the decision metrics and leak frequency goals (DG-1063, Attachment 2) provide an alternative acceptable level of quality and safety as required by 10 CFR FRN: Page 10

o e 50.55a(a)(3)(i)? Altern:tively,sh:uld thera be a leak frequ;ncy g:al ind:pendIrt of core damage frequency goal, as a measure of defense in depth?

M) is the guidance proposed by the staff for finding a fracture mechanics computer model acceptable for use in RI ISl_orograms clear and adequate? If not, what is missi ;.i i

N) is the guidance on risk categorization clear and sufficient, or is additional guidance needed? What additional guidance is needed?

0) Table A5.1, in DG 1063, identifies a proposed checklist that could assist in identifyir:g potentiallocations for various degradation mechanisms in a pipe. Is this checklist complete? What additionalinformation could enhance the usefulness of such a check list?

WORKSHOP. MEETING INFORMATION

l A 2-day workshop will be held to obtain public comment on the subject draft Regulatory Guide (DG 1063) and the accompanying draft standard review plan (Section 3.9.8), and to respond to questions. Persons other than NRC staff and NRC contractors interested in making a-presentation at the workshop should notify Jack Guttmann, US Nuclear Regulatory Commission, MS T10E50, phone (301) 415-7732, e-mailjxg@nrc. gov. Comments on the regulatory guidance and standard review plan documents for discussion at the workshop shouki be submitted in writing and in electronic mail (JXG@nrc. gov) in Wordperfect 5 or 6.1 compatible format.

DATE: October 30-31,1997 AGENDA: PrclinGnary agenda is as follows: (A final agenda will be available at the workshop.)

FRN: Page 11

i e 4

Wednesday. Octcber 29.1997 Time 3:00 pm to 7:00 pm Registration Ihu,rsday. Getober 30; 1997 Time -

7:00 am to 4:00 pm Registration Session 1: (Morning 10B087 - 8:00 am - 11:30 am)

Overview by NRC management of the draft regulatory guide and standard review plan, followed by NRC staff presentation on the draft documents (DG-1063 and SRP Section 3.9.8).

Lunch: 11:30 am - 1:00 pm i

Session 2: (Afternoon 10B0M7- 1:00pm - 5:00pm)

Public/ industry presentations on issues and recommendations for the general guidance documents, followed by open discussions.

Friday, October 31,1997 i

Session 3: (Morning 108187- 8:00 am -11:30g Open discussion of issues.

Session 4: (Afternoon 198187- 1:00 am -3:00 nm)

Overview of comments, issues and resolution options idantified in the FcSsions.

Concluding remarks and near term plans will be coverec by the staff.

LOCATION: Bethesda, Maryland HOTEL: Bethesda Marriott 5151 Pooks Hill Road Bethesda, Maryland (301) 897-9400 FRN: Page 12

REGISTRATION: Th:ra is no r:gistrati:n f:e for this w:rksh:p. H:wr,v:r, we r:qu:st that interested parties register in writing to Kesselman-Jones,8912 James Ave.

NE, Albuquerque, New Mexico 87111 their intent on participaths in the workshop. Hease include nJme, organization, address and phone number w!th your registration request. //ot/fication of attendance (e.g., pre-registration)ls requestedso that adequate space, etc. for the workshop can be arranged. Questions regarding meeting registration or fees should l be directed to Kesselmnn-Jones, Phone (505) 271-0003, fax (505) 271 0482, e-mail kessjones@ col.com.

VI. Paperwork Reduction Act St4ement This draft regulatory guide contains inforrnation collection requirements that are subject t-to the Paperwork Reduction Act of 1995 (44 U.S.C. 3501 at seq). This regulatoryguide will be e

submitted to the Office of Management and Budget for review and approval of the information collection requirements before the finai guide is published.

Vll Public Protection Notification The NRC may not conduct or sponsor, and a person is not required to respond to, an information collection unless it displays a currently valid OMB control number.

Vill. Regulatory Analysis

1. Statement of the neoblem During the past several years, both the Commission and the nuclear industry have recognized that probabilistic risk assessment (PRA) has evolved to the point that it can be used increet oly as a toolin regulatory decisionmaking, in August 1995 the Commission published a policy statement that articulated the view that increased use of PRA technology would 1) enhance regulatorydecisionmaking,2) allow for a more efficient use of agency resources, and 3) allow a reduction in unnecessary burdens on licensees. In order for this change in regulatory approach FRN: Page-13

~i j

t) occur, guidance must be developed describing accept:ble me:ns for incr:: sing the use cf PRA

) Information in the regulation of nuclear power reactors.- -

,1

2. Objective 4

, . To provide guidance to power reactor licensees and NRC staff reviewers on acceptable approaches for utilizing risk inform 6 tion (PRA) to support requests for changes in a plant's

- current licensing basis (CLB). It is intended that the changes in regulatory approach addressed j by this guidance should allow a focussing of both industry and NRC staff resources on the most -,,

important regulatory areas while providing for a reduction in burden on U a resources of f licensees. Specifically, guidance is to be provided in several areas that havu been identified a l-- as having potential _for this application. This application includes risk-informed inservice 4

inspection ,orograms for piping.

l-l 3. Alternatives j The increased use of PRA information' as described in the draft regulatory guide being t

. developed for this purpose is voluntary. Licensees can continue to operate their plants under the -

existing procedures defined in their CLB. It is expected that licensees will choose to make changes in their current licensing bases to use the new approaches described in the draft l

regulatory guids only if it is perceived to be to their benefit to do so.

4. Consecuences l Acceptance guidelines included in the draft. regulatory guide state that only small l' increases in overall risk are to be allowed under the risk informed program. Reducir.g the p

inspection frequency of piping identified to represent low risk and low failure potential as provided for under this prograin is an example of a potential contributor to a smsil increase in j- plant risk.- ! However, the program also requires increased emphasis on piping categorized as high-safety -significant and high-f ailure-potentielthat may not be inspected under current programs, h --

FRN: Page 14-

, , , - - _,%.m.-~.., -r, , -, ._m.,-~,wme.1 m - , ,. , , .m

~

This is en eumple cf a pat:ntial contributor to d:creas:s in plant risk. An improv:d prioritization of industry and NRC staff resources, such that the most important areas associated with plant safety receive increased attention, should result in a corresponding contributor to a reduction in risk. Some of the possible impacts on plant risk cannot be readily quantified using p;esent PRA techniques and must be evaluated qualitatively. The staff believes that the net effect of the risk changes associated with the risk informed program *, as allowed using the guidelines in the draft regulatory guide, should result in a very small increase in risk, maintain a risk neutral condition, or result in a net risk reduction in some cases. -

i - 5. Dacialon Rationale it is believed that the changes in regulatory approach provided for in the draft regulatory guide being developed will result in a significant improvementin the allocation of resources both for the NRC and for the industry At the same time, it is believed that this program can be implemented while maintaining an adequate level of safety at the plants that choose to implement risk-informed programs.

6. lmolementation it is intended that the risk-informed regulatory guide on inservice inspection of piping (DG-1063) be published by early to mid CY 1998.

Dated at Rockvlife, Maryland, this day of 1997.

For the Nuclear Regulatory Commission.

1 John C. Hoyle, Secretary of the Commission.

FRN: Page 15

6- O I

ATTACHMENT - 2 i

I DRAFT REG. GUIDE 1063 l RISK-INFORMED INSERVICE INSPECTION OF PIPING

4 9 m es

%, U.S. NUCLEAR RE!ULATORY COMMISSION August 1997

[ g OFFICE OF NUCLEAR REIULATORY RESEARCH Division 1 5

Draft DG 1063

%,a see+ / DRAFT REGULATORY GUIDE

Contact:

J. Guttmann (301)415-7732 S. All (3011415 2776 I

DRAFT REGULATORY GUIDE DG-1063 AN APPROACH FOR PLANT-SPECIFIC, RISK-INFORMED DECISIONMAKING:

l lNSERVICE INSPECTION OF PIP NG Expert Contributors to DG-1063:

Deborah Jackson Stephen Dinsmore Arthur Busiik David Jeng Lee Abramson Donnie Whitehead Fred Simonen TNs reguletory guide is being issued in draft form to involve the public in the early stages of the development of a regulatory posdion in tNs area, it has not received complete staff review and does not represent an official NRC staff posrtion.

Public comments are being solicitad on the draft guide (including any implementation schedule) and its associated regulatory analysis or valueAmpact statement. Comrnents should be accomparved by appropnate supporting data. Wntten comments may be submitted to the Rules and Directives Bra office of Administration. U.S. Nuclear Regulatory Commission, WasNngton, DC 20555-0001. Copies of comments received may be examined at th oocument Room. 2120 L Street NW,. WasNngton, DC. Comments will be most helpfulif received by December _,1997.

~

Requests for single copies of draft or active regulatory guides (wNch may be reproduced) or for placement on an automatic distnbution list for single copies of future draft guides in specific divisions should be made in wnting to the u.S. Nuclear Regulatory Commission, WasNngton. DC 205554)O Attention: Printing, Graphics and Distribution Branch, or by f ax to (301)415 5272.

. , i Table of Contents l

1. I NTRO D U CTIO N . . . . . . . . . . . . . . . . . . . . . . . . . . . , . . . . . . . . . . . . . . . . . . 1 1.1- Back gr ound . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 1.2 Purpose of the Guide . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ....... 3 l

. 1.3 Scope of the RI ISI Program ................................4 l 1.4 Organization and Content . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6 l 1.5 Relationship to Other Guidance Documents . . . . . . . . . . . . . . . . . . . . . . 6 j 1.6 Abbreviations / Definitions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7 l

i

2. PROC ES S OV ERVI EW . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9 I

3. ELEMENT 1: DEFINE THE PROPOSED CHANGES TO INSERVICE lNSPECTION l PROGRAMS ...............................................13 l 3.1 Description of Proposed Changes . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13 ,

3.2 Formal Interactions With The Nuclear Regulatory Commission . . . . . . . . 13 1

4. ELEMENT 2: ENGINEERING ANALYSIS . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15 4.1 Traditional Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15 4.1.1 Reg ul ations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16 4.1.2 Defense-in Depth Evaluation . . . . . . . . . . . . . . . . . . . . . . . . . . 16 4.1.3 Safety Margins ...................................17 4.1.4 Engineering Fracture Mechanics Evaluation . . . . . . . . . . . . . . . . 17 4.1.5 Engineoring Failure Modes & Effects Analvsis . . . . . . . . . . . . . . 18 4.2 Probabilistic Risk Assessment ..........................18 4.2.1 Scope of Piping Segments ...........................20 4.2.2 Piping Segments . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22 4.2.3 Modeling Pipe Failures in PRA . . . . . . . . . . . . . . . . . . . . . . . . . 23 4.2.4 Piping Failure Potential . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23 4.2.5 Consequences of Fr.ilure . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24 4.2.6 Risk impact of ISI Changes . . . . . . . . . . . . . . . . . . . . . . . . . . . 25 4.2.6.1 Initiating Events . . . . . . . . . . . . . . . . . . . . . . . . . 27 4.2.6.2 Dependencies and Common Cause Failures . . . . . . 27 4.2.6.3 Uncertainty and Sensitivity Analyses . . . . . . . . . . 27 4.2.6.4 Human Reliability Analyses . . . . . . . . . . . . . . . . . 27 4.2.7 Element Selection .................................27 4.3 Integrated Decisicamaking ...........................28

5. ELEMENT 3: IMPLEMENTATION, PERFORMANCE MONITORING, AND CORRECTIVE ACTION STRATEGIES ..............................32 5.1 Program implementation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3 2 5.2 Performance Monitoring . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33 5.3 Corrective Action Pr ograms . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35 5.4 Acceptance Guidelines . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37

6. ELEMENT 4: D O C U M ENTATIO N . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4 2 6.1 Risk Informed Inservice Inspection Program Plan . . . . . . . . . . . . . . . . . 42 6.2 Engineering Analysis Records and Supporting Data .... ,......... 43 i

k

1 6.2.1 Traditional Analysis Records and supporting Data . . . . . . . . . . . . '43 I 6.2.2_ Probabilistic Risk Assessment Records and Supporting Data . . . . 43 6.2.2.1 Scope................................ 43 6.2.2.2 Determination and Quantification of Accident Sequences . . . . . . . . . . . . . . . . . . . . . . 45 6.2.2.3 Contribution to Risk and Risk Importance Measures for Pipe Segments . . . . . . . . . . , . . . . 47 6.3 Integrated Decisionmaking Process Records . . . . . . . . . . . . . . . . . . . . 47 -

6.4 Development of ISI Program . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 47 6.5 Implementation Pls,ns and Schedule . . . . . . . . . . . . . . . . . . . . . . . . . . 48 6.6 Quality As surance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4 9

7. REFERENCES.............................. .................~52 Appendix 1: PROBABILISTIC STRUCTURAL MECMANICS COMPUT".R CODE!

FOR ESTIMATING FAILURE PROBABILITIES . . . . . . . . . ........A11 A1.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . A 1 - 1 A1.2 Areas of Structural Reliability Code Review . . . . . . . . . . . . . . . . . . . . A12 A1.3 Selected Structural Reliability Code issues . . . . . . . . . . . . . . . . . . . . A1 3 A1.3.1 Loads and Stresses . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . A1 3 L A1.3.2 Vibrational Stresses . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . A1 3

A1.3.3 Residual Stresses . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . A1 -4

l. - A1.3.4Preservice Inspection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . A1-4 i- A 1.3.5 Proof Test . . . . . . . . . . . . . . . . . . . . , . . . . . . . . . . . . . . . . . A 1 -5 A 1.3.6 Leak Detection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . A 1 5 A1.3.7 Failure Modes (Leak Versus Break) . . . . . . . . . . . . . . . . . . . . . A1 5 A1.3.8 Service Environment . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . A1 5 j A1.3.91nitial Flaw Size DistribuCons . . . . . . . .................A1-5 A1.3.10 Flaw initiation . . . . . . . . . . . . . . . . . . . . . . . . . A1 7

- A1.3.11 Crack Growth Rates . . . . . . . . . . . . . . . . . . . . . A1-7 A1.3.12 Material Property Variability . . . . . . . . . . . . . . . A1-7 A1.3.13 Comparison with Service Experience . . . . . . . . . A1-8 A1.3.14 Effects of inservice inspection (CDF vs importance Measure Calculations) . . . . . . . . . . . Al 8 A1.3.15 Cumulative Effects of Repeated / Periodic Inspections . . . . . . . . . . . . . . . . . . . . . . . . . . . A 1 -8 A1.3.16 Review and Treatment of Uncertainties . . . . . . . A1 9 A1.3.17 Realistic Versus Conservative Calculations . . . . . A1-9 A1.3.18 Consideration of Failure Mechanisms . . . . . . . . A1-10 A1.3.19 Materials Considerations . . . . . . . . . . . . . . , , . A1-10 A1.3.20 Consideration of Component Geometries . . . . . /.1 - 1 1 A1.3.21 Deterministic Structural Mechanics Models . . . . A1-11 A1.3.22 Selection of Probabilistic Variables . . . . . . . . . . A1-12 A1.3.23 Numerical Methods . . . . . . . . . . . . . . . . . . . . A1-12 A1.3.24 Assignment of input Parameters . . . . . . . . . . . A1-13 A1.3.25 Supporting Data Bases . . . . . . . . . . . . . . . . . .-- A1-14 A1.3.26 Documentation and Peer Review . . . . . . . . . . . A1-14

- A1.3.27 Identification of Code Limitations . . . . . . . . . . . A1-14 A1.3.28_ Benchmarking with Other Computer Codes . . . . A1-15 ii

..__ y r

A1.3.29 .

- Consistency with Operating Experience . . . . . . A1 15 A1.4L Formal Process for Validating and Updating SRRA Codes . . . . . . . . . A1-16 ,

A1.5 References for Appendix 1 - . . . . . . . . . . . _. . . . . . . . . . . . . . . . . . . A1-17 Appendix 2: USING PRA TO EVALUATE THE CHANGE IN RISK ASSOCIATED WITH CHANGES TO AN ISI PROGRAM . . . . . . . . . . . . . . . . . . . . . . A21 A2.1 ' Modeling Passive Systems in PRA . . . . . . . . . . . . . . . . . . . . . . . . . . A2 3 A2.2 Determine Consequences of Pipe Failures . . . . . . , . . . . _. . . . . , . . . A2 3 _

A2.3 Pipe Segments . . - . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . A 2 7 A2.4 incorporate Pipe Segmen'.s into PRA Model . . . . . . . . . . . . . . . . . . . A2-10 A2.5 Piping Failure Potential . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . A2-12 A2.5.10verview of Estimation Procedure . . . . . . . . . . . . . . . . . . . A2-12 A2.5.2 General Guidance on lasues ........................A214 l

A2.5.3 Methods for Estimating Failure Probabilities . . . . . . . . . . . . . A 2-18 l A2.5.4 Structural Reliability Computer Codes . . . . . . . . . . . . . . . . . . A2-21 l A2.5.5 Screening and Sensitivity Studies for the Purpose

!- of Categorizite Pipe Segments . . . . . . . . . . . . . . . . . . . . . . A2 23 A2.6 Risk Impact from Proposed Changes to the ISI Program . . . . . . . . . . A2 25

' A2.7 Selection of Locations to be inspected . . . . . . . _. . . . . . . . . . . . . . . A2-31 A2.7.1 Methods of Selecting Pipe Segments for Inspection . . . . . . . . A2-32 A2.7.2 Structural Element Selection Within Pipe Segments . . . . . . . . A2 38 A2.7.31nspection Strategy - Reliability and Assurance Program . . . . . A2-43 A2.7,3.1 Risk Informed Lot Selection and Element Selection for inspection . . . . . . . . . . . A2-44 A2.7.3.2 Sequential Sampling . . . . . . . . . . . . . . . . . . . . A2-45 A2.7.3.3 Historical Failure Data and Target Reliability Matrix Guideline Criteria . . . . . . . . . . A2-46 A2.7.3.4 Inspection Location Summary . . . . . . . . . . . . . A2-47 A2.8 References for Appendix 2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . A2 50 Appendix 3: ESTIMATION OF FAILURE PROBABILITIES USING EXPERT JUDGMENT ELICITATION , . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . A3 1 A3.1 ' Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . A3-1 i A3.2 Bac kgrou nd . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . A 3- 1 A3.3 Expert Judgment Elicitation Process . . . . . . . . . . . . . . . . . . . . . . . . . A3 2 A3.3.1 Selection c f Issues . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M-3 A3.3.2 Selection of Experts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . A3 3 A3.3.3 Elicitation Training . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . A3-4 A3.3.4 Presentation and Review of Issues . . . . . . . . . . . . . . . . . . . . . A3-4 A3.3.5 Preparation of Analyses . . . . . . . . . . . . . . . . . . . . . . . . . . . . A3 5 A3.3.6 Discussion of Issues and Analyses . . . . . . . . . . . . . . . . . . . . . A3-5 A3.3.7 Elicitation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . A3-5 A3.3.8 Recomposition and Aggregation . . . . . . . . . . . . . . . . . . . . . . . A3-5 A3.3.9 Review by Experts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . A3-6 A3.3.10 Documentation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . A3-6 A3.4 Example Application to Nuclear Piping Systems . . . . . . . . . . . . . . . . . A3 7 A3.5 References for Appendix 3 . . . . . . . . . . . . . . . . . , , . . . . . . . . . . . A3-12 iii

s s Appendix 4: INSPECTION STRATEGY-RELIABILITY AND ASSURANCE PROGRAM ................................A01 I

- A4.1 - The Concept of Statistical Risk . . . . . . . . . . . . . . . . . . . . . . . . . . . . A4-1 1 A4.2 Calculation of Risk . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . A4-2 A4.3 Correction For Imperfect Dets tion .........................A4-4 A4.4 - System Assurance - Example Calculation . . . . . . . . . . . . . . . . . . . . . A4 6 1 A4.5 The Global Analysis . . . . . . . . , . . . , , . . . . . . . . . . . . . . . . . . . . . A4 9 A4.6 References for Appendix 4 . . . . . . . . . . . , , . . . . . . . . . . . . . . . . . A4-12 l

Appendix 5: RISK. INFORMED INSPECTION PROGRAM DEVELOPMENT . . . . . . . . . A51 A5.1 Elements of Inspection Strategies ..........................A55 A5.2 Failure Probability Considerations . . . . . . . . . . . . . . . . . . . . . . . . . . . AS 8 l A5.3 Integration of Probabilistic Structural Mechanics Calculations . . . . . . . A5 9 A5.4 Example Probabilistic Structural Mechanics Calculations . . . . . . . . . . AS 13 A5.5 Additional Considerations for Selecting Strategies . . . . . . . . . . . . . . AS-16 A5.6 Quantification of NDE ReliabiSty ..........................A516 A5.7 Alternative Strategies to Reduce Failure Probabilities . . . . . . . . . . , AS 21 AS.8 Ref erences for Appendix 5 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . AS 22 Appenoix 6: EXISTING DETERMINISTIC APPROACH , , . . . . . . . . . . . . . . . . . . . . A6-1 A6.1 In troduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . A6- 1 A6.2 Daterministic Decisionmaking Criteria . . . . . . . . . . . . . . . . . . . . . . . . A61 A6.3 Documsnts with Deterministic Requlrements . . . . . . . . . . . . . . . . . . . A6 2 A6.4 Inservice Inspection Requirements . . . . . . . . . . . . . . . . . . . . . . . . . . A6-3 A6.5 Ref erences for Appendix 6 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . A6-6 Appendix 7: Regulatory Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . A7-1 iv

_ - . _ - _ ~ . _ . _ . _ _ _________ - . . _ _ _ _ _ _ _ _ _ _ . _ _ . _

< a F

Figures 2.1 Principles of' Risk informed Regulation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9 : I Principle elements of risk-informed, plant specific decisionmaking ' . . . . . . . . . . 10

~

4> 2.2

! . 4.1 - Example Attributes for Risk Informed ISI Programs' . . . . . . . . . . . . . . . . . . . .19 -

5.1 Elements of a Performance Monitoring Pros, ram . . . . . . . . . . . . . . . . . . . . . . . 34 i A1.1 Stress Corrosion Cracking PRAISE vs Field Data . . . . . .............. A1 1

. A1.2. Example Of Major Parameters That Can influence Calcuisted Pipe j' Failure Probability . . . . . . . . . . . .. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . A l 9 i A2.1 Process for probabilistic analysis for risk-informed ISI . . . . . . . . . . . . . . . . . . A2 2 1 - A2.2 Process for Modifying PRA to include Passive Components ............. A2-4 i; A2.3 System pipe segment examples . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . A2 9 i A2.4 General process for estimating failure probabilities . . . . . . . . . . . . . . . . . . . A213 A2.5 Example Code -vs- Service Experience . . . . . . . . . . . . . . . . . . . . . . . . . . . A2-16 A2.6 Core d.; mage frequency calculation process (adapted from Figure 3.6-2 of Ref erence ) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . A2 26 A2.7 ' Cumulative Risk Contribution . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . A2 37 A2.8 Structural element selection matrix . . . . . . . . . . . , . . . . . . . . . . . . . . . . . A 2-40

• A3.1 - Expert judgment process . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . A3-3 A3.2 Process for estimating failure probability using expert judgment . . . . . . . . . . A 3-8 A3.3 Failure Frsquency Estimates for the Auxiliary Feedwater (AFW)

Spstem Components . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . A3 10 A3.4 Failure frequency estim6tes for the reactor pressure vessel . . . . . . . . . . . . . A3-11 A4.1 - Single Sample Plan Logic . . . . . . . . . . . .' . . . . . . . . . . . . . . . . . . . . . . . . . A4-5 A4.2 Double Sample Plan Logic . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . A4-6 '

A5.1 Inspection strategy table . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ' A5-7 A5.2 Improvement f actors for four inspection interval (NDE performance level f or POD = "Very Good") . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . A5-15 A5.3 Example PO9 curve used in pc-PRAISE . . . . . . . . . . . . . . . . . . . . . . . . . . . A3-20 V

=

OE i.

i-i Tables-i f4.1 Example of systems identified as falling under Rl-ISI programs for a reference PWR (Adapted from Reference 7) ~. . . . . . . . . . . . . . . . . . . . . . 21 t 4.2 - Example of risk informed systems excluded from consideration

! in RI-ISI programs for_ a reference PWR . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22 ,

' 6.1 - Documentation Summary Table . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 50 i 6.2_ - Example Summary of Methods Used to Estimate Pipe Failure

. Probabilities for Risk Categorization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51 ,

! A1 1 Determination vs Probabilistic Variables . . . . . . . . . . . . . . . . . . . . . . . . . . A1 ! A2.1 Examples of direct consequences from pipe segment fsilures . . . . . . . . . . . . A2 5

A2.2 - Example FMEA (Adapted from ) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . A2-6

A2.3 Example of walkdown worksheet . . . .. . . . . . . . . . . . . . . . . . . . . . . . . . . . . A2 8

. A2.4 Example list of piping segments . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . - A2-10 l A2.5 Sources of Failure Data That Can Be Used to Guide Estimation of 1 Failuro Probabilities .........................................A2-19

, A2.6- Approach to Overall Risk Significance Determination for Alternative Risk-Informed Selection Process for Inservice Inspection . . . . . . . . . . . , , . A2-35

. A2.7 : Insights for identifying inspection Locations . . . . . . . . . . . . . . . . . . . . . . . A2-44 j A2.8 Operating Experience it' sights to Leak Frequencies . . . . . . . . . . . . . . . . . . A2-46 A2.9 Target Detectable Leak Frequency Goals ......................... A2-47 4 A4.1_ Evaluation of Risk for N = 8, n = 2, and Zero Defect Acceptance Criterion . . . . = A4 F A4.2 . Evaluation of Risk Using Bayes Theorem for Perfect (POD = 1) and j Imperfect (POD =0.65) Probability of Detection Cases . . . . . . . . . . . . . . . . . A4'-7

. A5.1

- Check List of Degradation Mechanisms for Inspection of Piping Systems . . . . A5-2

! A5.2 PRAISE model of LPI system: baseline case . . . . . . . . . . . . . . . . . . . . . . . . A514 .

l . A5.3 Reliability studies of NDE for inspection of nuclear piping and other ,

.- components .............................................A518 I

A5.4 Parameters of POD curves for three performance !avels . . . . . .-. . . . . . . . . _ A5-21 i A6.1 Example Failure Causes for LWR Nuclear Power Plant i

Components (From Ref. 2) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . - A6-2 Y

+

't I ~

c i

1 k-1 1

)

Vi 4

.., - , r

1. INTRODUCTION The NRC's Commission Policy Statement on probahilisticrisk analysis (PRA) encourages use of risk informed analysis techniques to improve safety Decisionmaking and improve regulatory efficiency. A number of 14RC staff and industry activities are presently unoer development in response to the Commission's policy statement. One activity now underway is the use of PRA insights to support modifications to a nuclear plant's current 16ensing basis (CLB). A number of specific CLB changes are now under staff review.

This regulatory guide describes acceptable approaches for incorporating insights from probabilistic tisk assessment techniques to inservice inspection (ISI) programs for pipes. Given the recent initiatives by the American Society of Mechanical Engineers, it is anticipated that licensees will request changes to their current licensing basis (CLB) f or a nuclear power f acility that incorporates risk insights in their ISI programs (known as, risk informed inservice inspection progia.

• RbtSI). As always, licensees can and should identify how the chosen approach, methcW. data, and criteria are app.opriate for the 'Jecisions they need to make

1.1 Background

Traditiona'ly, regulation of the design and operation of commercial nuclear power plan's has been based on conventional engineering criteria (meaning criteria developed using traditional engineering analysis methods without applying probabilistic methods as in probabilistic risk analysis (PRA)). These engineering criteria cantinue to successfuly assure that p! ants can be The placed in a safe cond'tlon following a number of postulated design basis accidents.

traditional engineering criteria also provided the basis for identifying what plant structures, systems, components (SSCs), and activities are important to safety. Regulation of these " safety-related" SSCs and activities is controlled through regulatory requirements.

During recent years, both the Nuclear Regulatory Commission (NRC) and the nuclear industry have recognized that PRA has evolved to the point where it can be used increas:ngly as a tool in regulatorydecisionmakinq. In August 1995, the NRC adoptsd a policy statement regarding the expanded NRC use of PRA (Ref.1), in part the policy statement states that:

• The use of PRA technology should be increased in all regulatory matters to the extent supported by the state-of the-art in PRA methods and data and in a manner that complements the NRC's deterministic approach and supports the NRC's fMtional philosophy of defense in-depth.

• PRA e.d associated analyses (e.g., sensitivity studies, uncertainty analyses, and importance measures) should be used in regulatory matters, where practical within the bounds of the state-of the-art, to reduce unnecessary conservatism associated with current re0ulatory requirements, regulatory guides, license commitments, and staff practices. Where appropriate, PRA should be used to support the proposal of additional regulatory requirements in accordance with 10 CFR 50.109 (Backfit Rule). Appropriate procedures for including PRA in the process for changing regulatory requirements should be developed and followed, it is, of course, 1

i i understood that the intent of this policy is that existing rules and regulations shall be complied with unless these rules and regulations are revised.

• PRA evaluations in support of regulatory decisions should be as realistic as practicable and appropriate supporting data should be publicly available for review.

+ The Commission's safety goals for nuclear power plants and subsidiary numerical objectives are to be used with appropriate consideration of uncertainties in making regulatory judgments on the need for proposing and backfitting new generic requirements on nuclear power plant licensees.

In its approval of the policy statement, the Commission articulated its expectation tiiat implementation of the policy statement will improve the regulatory process in three areas:

foremost, through safety decisionmaking enhanced by the use of PRA insights; through more of ficient use of agency resources; and through a reductionin unnecessary burdens on licensees.

In parallel with the publication of the policy statement, the staff developed a regulatory framework that incorporates risk insights. That framework was articulated in a November 27,1995 paper (SECY 05 280) to the Commission (Ref. 2). This regulatory guide, which addresses inservice inspection (ISI) programs of welds in pipes at nuclear power plants, implements, in part, the Commission's policy statement and the staf f's f ramework f or incorporating risk insights into the regulation of nuclear power plants.

While the conventional regulatory framework, based on traditional engineering criteria, has and continues to serve its purpose in assuring the protection of public health and safety, the current information base contains insights gained from over 2000 reactor years of plant operating experience and extensive research in the areas of material sciences, aging phenomena, and inspection techniques. This information, combiried with modern risk assessment techr:iques and associated data can be used to develop a more effective approach to ISI programs of pipes.

The current ISI requirements for piping components are found in 10 CFR 50.55a and the General Design Criteria listed in Appendix A to 10 CFR Part 50 (Ref. 3). Requirements for piping are scattered throughout the General Design Criteria, such as in Section I, OverallRequ!rements, Section ll, Protection by Multiple Fission Product Barriers, Section lil, Protection and Reactivity Control Systems,Section IV, Fluid Systems, etc.

10 CFR 50.55a references Se@n XI of the American Society of Mechanical Engineers (ASMD Boiler and Pressure Vessel Ccde (BPVC) (Ref. 4). Section 50.55a addresses th6 codem and standards for design, fabrication, erection, construction, testing, and inspection of piping systems. The objective of the ISI program is to identify conditions, such as flaw indications, that are precursors to pipe leaks and ruptures, thereby meeting, in part, the requirements set in the General Design Criteria and 10 CFR 50.55a. ISI programs are intended to address all piping locations that are subject to degradations. Many of the inspections are focused on critical locations, such as welds, if such locations have the highest likelihood for failure. However, experience over many years has shown that while the location of examination using the current Section XI criteria have been effective for Category BJ" welds - Class 1 piping, many of the

' Category B-J welds are pressure retaining welds in piping.

2

, e actual reported problems (Ref. 5) were in other locations. The majority of flaws found in Category B-J piping welds have been caused by factors outside the scope of the current selection criteria.

Some of the inspected locations that are not exposed to active degradation mechanisms have led to unnecessary radiation exposure to personnelimplementing the inspections, lacorporating risk insights into the programs can have the potential to focus on the more important locations for inspections and reduce personnel exposure while at the same time maintaining or improving public health and safety.

As a result of the above insights, more of ficient and technically sound menns for selecting and scheduling Isis of pipirg are under development by the ASME [(Ref. 6) 'and (Ref. 71).

This regulatory guidance document builds upon the knowwge base documerted in NUREG/CR-6181, Rev.1 (Ref. 8), and it reflects the experience gained from the ASME initiatives (pilot plant activities). When categorizing pipe segments in terms of their contribution to risk, it is the responsibility of a licensee to justify that the categorization of pipe segments and the resulting inspection programs provide a change in core damage frequency (CDF) that is consistent with the guidelines addressed in draf t Regulatory Guide - 1061, "An Approach for Plant Specifb Risk Informed Decisionmaking General Guidance," (Ref. 9). This Regulatory Guide provides guidance on how to incorporate risk insights in an inservice inspection program, provides guidance on developing methods that identify locations where both incre.ases and decreases in ISI inspections are needed to meet the raquirements of 10 CFR 50.55a (a) (3) (i), and addresses performance objectives.

1.2 Purpose of the Guide l

Changes to many of the activities and design characteristicsin a nuclear power plant's current I licensing basis (CLB)* require NRC review and approval. Tne current inservice inspection programs are porformed in compliance with the requirements of 10 CFR 50.55a and with Section XI of the ASME Boiler and Pressure Vessel Code, which are part cf the plant's CLB. This regulatory guide describes acceptable attemative approaches to the existing Section XI requirements for ISI programs. Its use by licenseesis voluntary. This alternative approach provides an acceptable level of quality end safety {per 10 CFR 50.55a(a)(3)(i)} by incorporating insights from probabilistic risk analysis calculations. Licensees proposing to apply risk informed inservice inspection programs will be required to amend their final sr.f ety analysis report (FSAR, Sections 5.3.4 and 6.9) accordingly.

This regulatory guide addresses acceptable approaches that apply risked-informed (RI) methods to develop, monitor, and update more ef'icient ISI programs for pipes at a nuclear power f acility.

2nis regulatory guide adopts the 10 CFR Part 54 definition of current licensing basis. nat is. " Current Licensing Basis (CLB) is the set of NRC requirements applicable tu a specific plant and a licensee's written commitments for ensuring compliance with and operation within applicable NRC requirements and the plant-specific design basis (including all modifications and additions to such commitments over the life of the licensee) that are docketed and in effect. De CLB includes the NRC rer,ulations contained in 10 CFR Parts 2,19,20,21,26, 30,40, 51, 54,55,70,72,73,100 and appendices thereto; orders; license conditions; exemptions; and technical specifications. It also includes the plant specific design-basis information defined in 10 CFR 50.2 as documented in the most recent final safety analysis repon (updated FSAR) as iequired by 10 CFR 50.71 and the licensee's commitments remaining in effect that were made in docketed licensing corTespondence such as licensee responses to NRC bulletins, generic letters, and enforcement actions, as well as licensee commitments documented in NRC safety evaluations or licensee event reports.

3

This guidance does not preclude other approaches for incorporating risk insights into the ISi programs. Licensees may propose alternate approaches for NRC consideration. It is intended that the approaches presented in this guide be regarded as examples of acceptable practices and that licensees should have some degree of flexibilityin satisfying the regulatory needs on the basis of their accumulated plant experience and knowledge. This document addresses risk in.ormaj approaches that are consistent with the basic elements identified in (Ref. 9) to inservice inspection programs. In addition, this document provides guidance on:

• acceptable methods for estimating leak, disabling leak, and rupture probabilities for pipe segments, e identifying structural elements for which inservice inspection can be modified (reduced or increased) based on risk insights, defense in depth, as low as reasonably achievable (ALARA) principles for radiation exposure to personnel, etc.,

e determining the risk impact of changes to inservice inspection programs,

+

capturing deterministic considemtions in the revised inservice inspection program, and

+ developing an inspection program that monitors the performance of the pipe elements that are consistent with the conclusions from the PRA.

The NRC staff willinitiate rulemaking as necessary to permit license to implement RIISI programs, consistent with this regulatory guide and the accompanying Standard Review Plan (SRP) chapter, without having to get NRC approvalof an alternative to the ASME Code requirements pursuant to 10 CFR 50.55ata)(3). Untilthe completion of such rulemaking,the staff anticipates the need to review and approve each licensee's RI-lSI program as an alternative to the current Code requiredlSI program, prior to implementation. As such, the licensee's RI ISI program will be enforceable under 10 CFR 50.55a.

1.3 Scope of the RI-ISI Program This regulatory guide only addresses changes to the ISI programs for inspection of pipes. In the majority of the cases, p!r : welds are the point of interest in the inspection program, although within this regulatory guide, references to " welds" are intended to address inspections in general of critical structural locations including the base metal. On the average, pipe welds are anticipated to have approximately forty times the likelihood of experiendng a leak prior to the base pipe structure. Exceptions to this rule of thumb can occur when an active degradation mechanism is present, such as flow assisted corrosion (e.g., erosion corrosion). The risk implication of each pipe segment is determined by the safety significance of a pressure boundary failure of the pipe at that location, augmented by the failure likelihood of the pipe segment.

When the risk implications or degradation mechanisms along a pipe vary, the pipe is subdivided '

into segments, as discussed in Chapter 4.

4

, e To adequately reflect risk implications, the scope of systems, structures and components (SSCs) covered by this regulatory guide

• Includes:

+ All Class 1,2, and 3'* pipes within the current ASME Section XI programs, and

• All pipes whose failure would compromise

- Saf ety related structures, systems, or components that are relied upon to remain functionalduring and following design basis events to ensure the integrity of the reactor coolant pressure boundary, the capabilty to shut down the reactor and maintain it in a safe shutdown condition, or the

- capability to prevent or mitigate the consequences of accidents that could result in potential of f site exposure comparable to 10 CFR 100 guidelines.

- Non safety related structures, systems, or components:

• That are relied upon to mitigate accidents or transients or are used in plant emergency operating procedures; or

• Whose f ailure could prevent safety related structures, systems, or components from fulfilling their safety related function; or

. Whose failure could cause a reactor scram or actuation of a safety-related system.

To ensure that the proposed RI-ISI program will provide an acceptable level of quality and safety, the licensee should use the PRA to identify the appr0priate scope of pipe segments to be included in the program, This will include all pipes within the scope of the current ISI program. In addition, licensees implementing the risk-informed process may identify pipe segments categorized as high safety slanificant (HSS), which are not currently subject to the traditional Code requirements or to a level of regulation which is commensurate with their risk significance. PRA systematically takes credit for systems with non Code piping that provide support, act as alternatives, and act as backups to those systems with piping that are within the scope of the current Section XI Code, To maintain the validity of the PRA as it is used to categorize pipe segments and to evaluate the effects of the proposed RI ISI program on p! ant risk, all high-safety significant pipe segmen s should be included in a licensee's RIISI proper it.

Specifically, the licensee's RI-ISI program scope should include those ASME Code Class 1, 2, &3 and non-Code systems that the licensee's categorized as HSS.

2 It is anticipated that this regulatory guidance document will, at tome future date, be consistent with the ASME's ongoing progrrms to incorporate risk informed insights into the ASME Section XI programs.

• Generally, ASME Code Class I includes all reactor coolant pressure boundary (RCPB) components. ASME Code Class 2 generally includes systems or portions of systems important to safety that are designed for post-accident containment and removal of beat and fission products. ASME Code Class 3 generally includes those system components or ponions of systems imponant to safety that are designed to provide cooling water and auxiliary feedwater for the front line systems.

5

A s

l The PRA should also be used to evaluate RI ISI program inspection requirements as practicable.

Consequently, the licensee should examine the inspection strategies for all welds in the final proposed ISI program, including those inspections in the current Section XI program. The inspection strategy most capable of detecting the effects of the specific degradation mechanism to which each weld is exposed should be identified and selected.

1.4 Organization and Content This regulatory guide is structured to follow the general fcur element process for *isk informai applications discussed in draft Regulatory Guido DG 1061. Chapter 2 summarizes the four-element process developed by the NRC staff (referred to as, staff) to evaluate proposed CLB changes as it applies to the development of a risk informedlSI program. Chapter 3 discusses an acceptable approach for defining the proposed changes to an ISI program. Chapter 4 addresses,in general, the traditional and probabilistic engineering evaluations performed to support risk informed ISI programs and presents the risk acceptance goals for determ:ning the acceptability of the proposed change.

Chapter 5 presents one acceptable approach for implementing, monitoring, and corrective actions for RI-ISI programs. The documer.tation the NRC will use to render its saf ety decision is discussed in Chapter 6. Detailed discussions of issues and/or acceptable approaches associated with the engineering evaluations needed to support an RI-ISI program are provided in Appendices 1 through

6. The existing ASME Section Xl traditional approach is highlighted in Append /x 6.

1.5 Relationship to Other Guidance Documents As stated in Section 1.2, this regulatory guide discusses acceptable opproaches to implement risk insights into an ISI program and directs the reader to draft Regulatory Guide DG 1061 for general guidance, where appropriate.

Draft Regulatory Guide DG 1061 describes a general approach to risk informed regulatory decisionmaking and includes discussions on specific topics common to all risk informed regulatory applications. Topics addressed include:

• PRA quality - data, assumptions, methods,

+ Scope -internal and/or external event initiators, at power and/or shutdown modes of operation, consideration of Level 1,2, and 3* analyses requirements, etc.,

a Risk metrics core damage frequency, LERF and importance measures,

• Sensitivity and uncertainty analyses, and

. Process for ensuring quality - relationship to 10 CFR Appendix B.

' Draft NUREG 1602,"Use of PRA in Risk Informed Applications," provides technical details that suppon draft Regulatory Guide DG 1061.

' Level 1 accident sequence analysis, Level 2 accident progression and source term analysis, and Level 3 -

consequence analysis 6

. 4 Regulatory guides that contain ASME Code Cases for inservice inspection programt ind that are based on traditional engineering criteria include (Ref.10), (Ref.11), and (Ref.12). For references to other risk informed applications, the reader is directed to regulatory guides pertaining to inservice testing (IST) (Ref.13), graded quality assurance (GQA) (Ref,14), and technical specifications (Tech Specs) (Ref.15). Standard Review Plan (SRP) sections associated ,

with each of the risk informed regulatory guides are addressed in (Ref.16), (Ref.17), (Ref.18),

(Ref.1P), and (Ref. 20).

Regulatory guides are issued to describe to the public methods that are acceptable to the NRC staff for implementing specific parts of the NRC's regulations, to explain techniques used by the staff in evaluating specific problems or postulated accidents, and to provide guidance to applicants.

Regulatory guides are not substitutes for regulations, and compliance with regulatory guides is not required. Regulatory guides are issued in draf t form for public comment to involve the public in developing the regulatory positions. Draf t regulatory guides have not received complete staff review; they therefore do not represent official NRC staff positions.

The information collections contained in this draft regulatory guide are covered by the requirnments of 10 CFR Part 50, which were approved by the Office of Management and Budget, approval number 31504011. The NRC may not conduct or sponsor, and a person is not required to respond to, a collection of information unless it displays a currently valid OMB control number.

I 1.6 Abbreviations / Definitions AEC Atomic Energy Commission ALARA As Low as Reasonable Achievable ASME American Socloty of Mechanical Engineers BPVC Boiler and Pressure Vessel Code BWR Boiling Water Reactor CCF Common Cause Failure CDF Core Damage Frequency CLB Current Licensing Basis ECC/AM Emergency Core Cooling and Accident Mitigation ECCS Emergency Core Cooling System (s)

FMEA Failure Modes and Effects Analysis FSAR Final Safety Analysis Report Expert Elicitation This refers to experts in a specific field, normally outside the level of expertise found at the plant. The expert clicitation is used to estimate the failure probaility and the associated uncertainties of the material in question under specified decadation mechanisms. For example, if a fracture nachanics Code is not qualified to calculate the failure probability of plastic pipes, then experts in plastic pipes and their f ailure may be used to estimate the failure probabilities.

Expert Panel Normally refer 6 to plant personnel experienced in inservice inspection programs and other related activities /disciplinesthat impact the decision under consideration.

FV Fussell-Vesely importance Measure GQA Graded Quality Assurance HSS High-Safety Significance HSSC High Safety-Significant Component 7

IGSCC Intergranular Stress Corrosion Cracking

%portance MeasuresUsed in PRA to rank systems or components in terms of risk significance IPE Individual Plant Examination ISI Inservice Inspection IST Inservice Testing.

LERF Large Early Release Frequency l .LOCAs Loss of Coolant Accident i LSSC Low Safety Significant Component l NDE Nondestructive Examination i NEl Nuclear Energy institute l NPAR Nuclear Plant Aging Research l NRC Nur. lear Regulatory Commission NUMARC Nuclear Management and Resources Council PDI Performance Demonstration Initiative POD Probability of Detection PRA Probabilistic Risk Assessment PSA Probabilistic Safety Assessment PWR Pressurized Water Reactor RAW Risk Achievement Worth RCP8 Reactor Coolant Pressure Boundary RCS Reactor Coolant System Rl ISI Risk. Informed Inservice inspection i RWST Refueling Water Storage Tank staff Refers to NRC Employees Sensitivity Studies Varying parameters to assess impact due to uncertainties SER Safety Evaluation Report SRP Standard Review Plan SRRA Structural Reliability / Risk Assessment (refers to fracture mechanics analysis)

SSCs Structures, Systems, Components Tech Specs Technical Specifications 8

F

. e l l

2. PROCESS OVERVIEW For the beensee who elects to incorporate risk insights into its inservice inspection programs, i it is anticipated that the licensee will build upon its existing probabilistic risk analysis (PRA) l activities, beginning with the individual plant examination programs (IPE). Figure 2.1 illustrates the five key principles involved in the integrated decisionmaking process which is describedin detailin draft Regulatory Guide DG 1061. In addition, draf t Regulatory Guide DG-1001 describes a four element process for evaluating proposed risk informed changes to the CLB as I!!ustrated in Figure 2.2.

Msleista Defesse-In Depth t J r 's fMaletale)

Meet Currest I Suffieleet N / '

M:,';;;s Istegreled Deenslesmaklag ha plementaties [ Proposed leeresses le risk )

And Mealtering and their esamlative effect Stratesles Which are small and do not cause Address the NRC's Safety Goals to Uncertaleties y be6*ceeded )

Pgure 2.1 Principles of Risk informed Regulation.

The key principles and the locatioain this guide where each is addressed for RI ISI programs are as follows:

1. The proposedchange meets the current regulations. lThis applies unless the proposed change is explicitly related to a requested exemption or rule change.] (Section 3.1)

2. Defense-in depth is maintained. (Section 4.1.1)

3. Suf6clent safety margins are maintained. (Section 4.1.2)

4. i>g-:::sinansses kr thsk and thek cumdelive afhect are smat and do not cause the NRC's Safety Goals to be exceeded. (Sections 4.2 and 4.4)

5. Performance-based knplementation and monitoring strategies are used that address uncertaintiesin analysis models and data andprovide for timely feedback and correct /w action. (Chapter 5) 9

s e f

The individualprinciples are discussed in detailin draf t Regulatory Guide DG 1001, and are not repeated here. However, an overview of the four-element process is provided and specific issues that arise for risk-informed ISI are discussed.

The four-element process described below begins with a set of proposed changes to Isl. The process l for developing the initial proposal for changes is left to the licensee, but can benefit from an examination of PRA information, including distinguishing the of fected pipe segments through a categorization process based on various importance measures and engineering insights.

Traditional Amelysis.

l

/

//

\

\

\/

/

4's/,s' ll

'O"'

Perforan . Subsmit Debe & '" **

Change Englooerlag 4> "h",'g*,I g + Proposed l

' Analysis . ,

Change Figure 2.2 Principle elements of risk informed, plant specific dectslonmaking.

Element 1: Define the proposed change in this element the licensee identifies the pipes and welds that are affected by the change in inspection practices. This would include components currently in the ISI program and additional pipes categorized as high safety significant (HSS). Specific revisions to the inspection programs, schedules, and techniques should be documented. Plant systems and functions that rely on the affected pipes should be identified.

The licensee should assess wha *er an adequate PRA is available for risk-informed evaluations (see (Ref. 9) and (Ref. 21)) and how the existing regulations-the plant's current licensing basis-may be impacted by the proposed change. Finally, plant specificexperience with inspection program results should be examined and characterized relative to the effectiveness of past inspections and the types of flaws that have been observed. Chapter 3 provides a more detailed description of Element 1.

Element 2: Perform engineering analysis in element 2, the proposed changes are evaluated with regard to:

• Maintaining adequate defense-in depth, 10

. 4 i

. Maintaining edequate safety margins,  ;

{

3

• The risk impact of the changes, including the treatment of uncertainties. The li principle that the proposed increase in risk and their cumulative effect are small and do not cause the NR'.' Safety Goals to be exceeded is also addressed. j i

j -. Comparison of the PRA results with the acceptance guidelines in Regulatory Guide -

1 1061, h

j

• An integrated decision making process that considers insights from both the ,

i engineering and probabilistic risk analyses. i l

l Traditional engineering and PRA methods are used in this evaluation. The results of the i complementary trad'tional and PRA methods are considered together in an integrated decisionmaking j process. During the integration of all of the available information, it is expected that many issues will need to be resolved through the use of a well reasoned judgment process often l involving a combination of different engineering skills. This activity has typically been

[ referred to in industry documents as being performed by an " expert panel." As discussed in this i document, this important process is the licensee's responsibility and may be accomplished by means

!- other than a formal panel. it is the licensee's responsibility to ensure that any submittal to j the NRC is accurate and complete, in carrying out this process, the licensee will need to make 7

a number of decisions based on the best availableinformation. Some of this information will be j derived from traditional engineering practices and some will be probabilistic in nature,

resulting from PRA studies. It may be that certain issues discussed in this guide are best evaluated through the use of traditional engineering approaches, but for other issues, PRA may 1 have advantages, it is the licensee's responsibility to ensure that its RIISI program is j developed using a welkeasoned and integrated decision process that considers both forms of input Information (treditional engineering and probabilistic) including those cases in which the choice i of direction is not obvious. Examples of this latter. situation are when there is insufficient 3 informationto make a clear decision or if the PRA results appear to disagree with the traditional l engineering data. Depending on the issues involved, technical or otherwise, this important decision-making process may at times require the participation of special combinations of licensee experts (staff) and/or outside consultants. This integrated decisionmaking process is discussed further in Section 4.3.

More details concerning Element 2 are contained in Chapter 4.

Element 3: Develop :.cC;c.;i.i ., Pwformance-Monitoring, and Corrective Action Strategier in this element, plans are formulated to. monitor factors that reflect (piping) reliability commensurate with the pipe's safety significance. For example, operating and environmental

' conditions should be monitored for consistency with the assumptions in the PRA analysis, in addition, the results of the individuallSis should be monitored to ensure that piping degradation is not beyond the assumptions of the PRA. In the event that pipe failures or unanticipated degradations occur in an RIISI program, guidance for evaluating the need for:and the implementation of corrective actions should be included in the plans. Specific guidance for Element 3 is given in Chapter 5.

11

6 e Element 4: Document evaluations and submit request for proposed change The final element involves preparing the documentation to be included in the submittal and to be maintained by the licensee for later reference (i.e., archival) as needed. The submittal will be reviewed by the NRC following the guidelines set in the standard review plans (NUREG-0800) Chapter

19 and Section 3.9.8. Documentation requirements for RI ISI programs are D i ven in Chapter 6 of j this regulatory guide.

J l

1 n

'I d

l 1

i a

e 4

4

?

12

3. ELEMENT 1: DEFINE THE PROPOSED CHANGES TO INSERVICE INSPECTION P 3.1 Description of Proposed Changes in this first element of the process, the proposed changes to the ,

ISI program are defined. This involves describing the scope of ISI components that will be incorporated in the overall assessment and Denne how their inspection would be changed. Also included in this element Change is an identification of supporting information, and a proposed

• plan for +.he licensee's interactions with the NRC throughout the _

implementation of the RI ISI. ELEMENT 1 A full description of the proposed change in the ISI program is prepared. This description would include:

~

(1) An identification of the aspects of the plant's CLB that would be affected by the proposed RI ISI program.

(2) An identification of the specific revisions to existing inspection schedules, locations, and methods that would result from implementation of the proposed program.

(3) Any piping not presently covered in the plant's ISI program, but which are determined to be categorized as high safety significant (e.g., through PRA insights) should be identified and appropriately addressed. in addition, the particular systems that are affected by the proposed changes should be identified since this informationis an aid in planning the supporting engineering analyses.

1 (4) An identification of the information that will be used to support the changes. This will l include performance data, traditional engineering analyses and PRA information.

1 (5) A brief statement describing the way the proposed changes meet the objectives of the Commission's PRA Policy Statement.

3.2 Formal Interactions With The Nuclear Regulatory Commission The licensee can make changes to its approved RI ISI program under the following conditions:

1. Changes made to the NRC-approved RI-ISI program that could affect the process and results that were reviewed and approved by the NRC staff (including the change in plant risk associated with the implementationof the RI ISI program) should be evaluated to ensure that the basis for the staff's prior approval has not been compromised. If there is a question regarding this issue, the licensee should seek NRC review and approval prior to implementation.

2. All changes should also be evaluated using the change mechanisms described in existing applicable regulations (e.g.,10 CFR 50.55a,10 CFR 50.59) to determine if NRC review and approval is required prior to implementation.

13

6 .

For example:

• Changes to component groupings, inspection intervals, and inspection methods tliat do not involve a change to the overall RI ISI approach where the overall RI ISI approach was reviewed and approved by the NRC do not require specific (i.e., additional) review and approvalprior to implementation provided that the effect of the changes on plant risk increase is insignificant.

• COrponent inspection metixxf changes involving the implementation of an NRC endorsed ASME Code, NRC-endorsed Code Case, or published NRC guidance which were approved as part of the RI ISI program do not require prior NRC approval.

• nspectkwi method changes that involve deviation from the NRC-endorsed Code requirements require NRC approval prior to implementation.

Changes to the Rl ;SI program that involve programmatic changes (e.g., changes to the plant probabilistic model assumptions, changes to the grouping criteria or figures of merit used to categorize components, and changes in the Acceptance Guidelines used for the licensee's integrated decision making process) require NRC approval prior to implementation.

Piping inspection method changes will typically involve the implementation of an applicable ASME Code or Code case (as approved by the NRC) or published NRC guidance. Changes to the piping inspection methods, which nonetheless meet applicable Code requirements and/or NRC guidance do not require NRC approval. However, inspection method changes that involve deviation from the NRC approved Code requirements do require NRC approval prior to implementation.

The licensee will include in its submittal, a proposed process for determining when formal NRC review and approval are or are not necessary. As discussed, once this process is approved by the NRC, formal NRC review and approval are only needed when the process determines that such a review is necessary, or when changes to the process are requested.

14

s

4. ELEMENT 2: ENGINEERING ANALYSIS This chapter summarizes the regulatoryissues and engineering activities that a risk informed Inservice inspection program y ,, m ,y j should consider. The discussions are divided into traditional AnaN N and PRA analyses, as illustrated in Figure 2.2. Section 4.1 s , /

addresses the traditional engineering analysis, Section 4.2 addresses the PRA related analysis, Section 4.3 describes the

\

\/

/

[f/ ' ,-

/j integrationof the traditionaland PRA analyses, and Section 4.4

([

~

outlines the acceptance guidelines.

CAme%

The key principles of the engineering evaluations are to:

- Demonstrate that adequate defense in depth is ELEMENT 2 maintained;

• Demonstrate that adequate safety margins are maintained;

• Demonstrate that the proposed ISI piogram changes do not result in unacceptable risk to the public and plant personnel, and are consistent with the decision metrics guidance identified in draf t Regulatory Guide DG 1061; and

+ Support the integrated decisionmaking process.

The scope and quality of the engineering analysesm performed to justify the proposed changes to the ISI programs should be appropriate for the nature and scope of the change. The decision criteria associated with each key principle identified above sre presented in the following subsections. Equivalent criteria can be proposed by the licensee if such criteria can be shown to meet the principles set forth in Section 2.1 of DG 1061. Germaine to the assessment of the impact of the proposed ISI change on plant risk, technicaldetails on the use of risk importance measures are highlighted in draft NUREG 1602 (Reference 21) and in AppenGix 2.

4.1 Traditional Analysis This part of the evaluation is based on traditional engineering methode. Areas to be evaluated from this viewpoint include meeting d<

"N$

the regulations, defense-in-depth attr;sutes and safety margins. d e 4 M ,4i@ % M Probabilistic risk insights may be useful in the evaluation by providing information on relative importance of various SSCs.

' Augmented inspection programs of pipes (e.g.. NRC mandated programs) are also addressed in the engineering analysis performed by licensees when electing a risk infonned inspection program. ne potential core damage contributions from failures of pipes that experience active degradation mechanisms may not be negligible.

However, appropriate inspcetion programs with compensatory measures (e.g., replacement of pipes at appropriate intervals) could result in negligible contribution to core damage frequency.

15 l

g- , 1 l

}

4.1.1 Regulations l

l The engineering evaluation should assess whether the proposed changes in the ISI programs have I compromised compliance with the regulations The evaluation should consider the appropriate general design criteria, national standards, or other regulatory guidance. Specifically, the evaluation should consider:

. 10 CFR 50.55a,

• Appendix A to 10 CFR Part 50,  !

Section 1 "Overall Requirements"

- Section ll " Protection of Multiple Fission Product Barriers" Section lil " Protection and Reactivity Control Systems" *

- Section IV " Fluid Systems", etc.

. ASME Boiler and Pressure Vessel Code,Section XI, a Reg Guide 1.147, and 4.1.2 Defense in-Depth Evaluation  !

As stated in the Draft Regulatory Guide DG 1061, the General Design Criteria and national standards are to be considered in the engineering evaluation. Defense in depth for ISI programs focuses on barriers (both preventive and mitigative) to core damage, containment failure, and population exposure, a

The licensee should assess whether the proposed changes to the ISI program adversely impacts the .

CLB's conclusions on defense in-depth. One acceptable set of guidelines for making that i assessment are summarized below. Other equivalent decision criteria will also be considered.

' Defense-in-depth is preserved when:

. a reasonable balance among prevention of cose damage, prevention of containment 1 failure, and consequence mitigation is preserved;

. over-reliance on programmatic activities to compensate for weaknesses in plant ';

design is c olded; '

i e system redundancy, independence, and deversity are preserved commensurate with the expected frequency and consequences of challenges to the system; e defenses against potential common cause f ailures (CCFs) are preserved and the introduction of new CCF mechanisms are monitored for prevention; e- independence of barriers is not degraded; and

• defenses against human errors are preserved. 4 A PRA systematically assimilates all the above attributes of defense-in-depth into a coherent package. From this package, a detailed analysis can be performed to assess the impact of proposed modifications on those attributes. For example, the degradation of balance among prevention of 16

---

r.e --u__m-- r= .- -vmnw,.. ~,ws-w,--e,--.e--m-, .+wmw,-- e oneN<n ,,,w-- w,m,w,,~ ->m-,,-w.,w,->w,-,--, s - , , , , - - , yg e m4

' d core damage, prevention of containment f ailure, and corsequence mitigation can lead to calculated CDF outliers.

4.1.3 Safety Margins in any engineering program, safety margins are applied to the design and operation of a system.

These saf ety margins and accompanying engineering assumptions are intended to account for uncertainties, but in sorne cases can lead to operational and design constraints that are excessivo, costly, and could deter from safety (e.g., result in unnecessary radiation exposure to plant personnel), insufficient safety margins may require additional attention. Prior to a request for relaxation of existing requirements, the licensee must ensure that the uncertainties are adequately addressed. The quantification of uncertainties will likely require supporting sensitivity analyses.

The engineering analyses should assess whether the impact of the proposed ISI changes are consistentwith the principle that adeqeste safety margins are maintainad. An acceptable set of guidelines for making that assessment are summarized below. Other equivalent decision criteria are acceptable.

Sufficient safety margins are maintained when:

. codes and standards (as given in Section 4.1.1) or alternatives approved for use by the NRC are met, and e safety analysis acceptance criteria in the current licensing basis (e.g., updated FSAR, supporting analyses) are met, or proposed revisions provide sufficient margin to account for analysis and data uncertainty, Performance based inspection programs that monitor for degradations that can iend to leaks and are measured to acceptable target leak frequency goals, such as those identified in Section A2.7.3.3 of Appendix 2 (or alternate goals approved by the staff), can help provide confirmation of adequate safety margins. For example, if it can be demonstrated that reduction in inspections for a specific pipe segment will not lead to more leaks than the present ASME Section XI performance, then one can argue tnat the existing safety margins (due tu inspections) are excessive ari unnecessary, in the san,e sense,if the performance of a pipe segment exceeds the target leak frequency,then the saf ety margins are not suf ficient and additional attention to tnat segment is needed.

4.1.4 Engineering Fracture Mechanics Evaluation An importantinput to inserviceinspection programsis the identificationof structuralmechanics pararneters, possible degradation mechanisms, design limit considerations, operating practices and environment, and the development of a data base or analytic methods for predicting the reliability of piping systems. Design and operational stress / strain limits are assessed. This informationis available to the licensee in its design information for its plant. The loading and resulting stresses /strainson the piping is needed as input to the fracture mechanics calculatiors that predict the failure probability of a pipe segment. Use of validated fracture mechanics computer programs, with appropriateinput,is strongly recommended,because it f acilitatesthe regulatory evaluation of a submittal. The method of applying computer simulation to calculate 17

e .

l l

piping degradation has now achieved a level of maturity and validation that it can be applied in j probabilistic risk applications. This topic is discussed in detaillater in Appendix 1.

Where validated analytic computer programs are not available to predict the consequences for the degradation mechanisms or rnaterialin question, applicable data twes and expert elicitation l programs can be applied to provido the necessary information.  !

I i

4.1.5 Engineering Failure Modes & Effects Analysis i Sound engineering practices include validation of the parameters and consequences. An acceptable process that provides the risk insights to ISI programs includes detailed walkthrough of a nuclear power facility. Assessment of internal and external events, including resulting primary and secondary effects of pipe degradations (e.g., leaks and breaks), are important parameters for the 1 risk informed program. A detailed engineering iallure modes and effects analysis (FMEAl provides an acceptable, disciplined, approach to the engineering analyses. Alternate methods should be submitted to the NRC for review and approval.

4.2 Probabilistic Risk Assessment Using PRA to Assess the Change in Risk Associated with Changes to an ISI Program The risk-informed application process is intended not only to support relaxation (number of inspections, inspection intervals and method), 7 3@gV H 0 but also to identify areas where increased resources should be llS allocated to enhance safety. An acceptable RI ISI process should, therefore, not focus exclusively on areas in which reduced inspection M

bg * " -

"4D un could be justified. This section addresses ISl specific considerationsin the PRA to support relaxation of inspections, enhancement of inspections, and validation of component operability.

The general methodology for using PRA in regulatory applications is discussed in Regulatory Guide DG 1061, with reference to draft NUREG 1602, where technical details on scope, quality, and uncertainty istues are provided to support draft Regulatory Guide DG 1061. General PRA issues specific to the development of a risk informed ISl program are discussed below. Detailed discussions on an acceptable quantitative approach are provided in Appendix 2. Other approaches can be proposed and will be t,..aptable if they adequately ad !ress allissuer discussed hcre and in Appendix 2.

For the results of the PRA to play a major and direct role in the ISI dendon-making process, there is a need to ensure that the results are derived from quality analyses. Figure 4.1 identifies attributes of a quality ISI analysis.

18

Figure 4.1 Example Attributes for Risk Informed ISI Programs

Attributes of a Quality ISI Risk-Inforened Methodology l

• Failure modes (e.g., smallleak, disabling (large) leak, break) that can have either direct consequences (e.g., disable a system) or indirect consequences (writer spray, pipe whip, etc.) are addressed.

• Full range of fallare mechanisms (e.g.,inechanical fatigue, thermal fatigue, stress corrosion cracklag, flow assisted corrosion, etc.) that can contribute to component fallsre have been addressed.

• Evaluation of failure potential snakes use of plant specific operating experience and ladustry data bases on failure occurrences.

• Categories for failure potential are related to well defined numerical ranges of failure frequeucles or probabillites such that the assigninent of the failure potentials to categories can be supported and/or benchmarked with failure experience data sad with predletions based probabilistic structural anechanics models.

• Evaluation of fallere potentialloclude degradation mechanisms which are seldom or not yet experienced. Structural mechanles anodels may indicate that these mechselsens, l although outside the scope of current operating esperience and/or ladestry data bases, l can contribute to the lower failure potential category (les). l

• Identificattom of pipe segments with particularly high failure consequences,so that )

Inspection programs for these segments can be designed to detect degradatlos mechanisms which are either usespected or more aggresolve than espected. J

• Identification of structural elements having the highest relative contributions to core damage risk, sud include 100 percent of these top elements in the list of ISIlocations.

• Identification of a population of structural elements which,as a group, contribute only a  ;

small fraction to the overall core damage risk associated with piping components. These J stuctural elements esa be subject to a reduced level orinspection.

• Evaluation of the impact or change in plant risk associated with implementatin of the j proposed RI.ISI programs. )

i l

l The licensee is expected to use its judgment, drawing from the appropriate technict.I disciplines for the CLB change being considered,of the complexity and difficulty of the implications of the 1 proposed CLB change to decide upon adequate engineering anaiyses to support the regula:Ory i decisionmaking. Thus, the licensee should consider the appropriateness of qualitative and quantitative analyses, as well as analyses using traditional engineering approaches and those techniques associated with the use of PRA findings. Application of qualitative sin plification l of risk assessment may be found acceptable if benchmarked by quantitative methods. Any approaeb should develop performance objectives and means to achieve those objectives. That includes 19

e i ter'anica!!yjustified means to impose both increases and decreases in inspection requirements, i The method needs to clearly illustrate the generality of the approach to strive for specified  !

safety objectDes.

4.2.1 Soaps of Piping Segments To edequately reflect risk implications, the scope of SSCs covered by this regulatory guide inciades

• M Class 1, 2, and 3 pipse within the current ASME Section XI programs, and

. l

• All pipes rb.ssi feilers wocid compromiu  !

- Safety related structures, systems, or components that are relied upon to remain functional during and following design basis events to encure the integrity of the reactor coolant pressure boundary, the capabilty to shut down the reactor and maintain it in a safe shutdown conCition, or the capability to prevent or mitigate the consequences of accidents that could result in potential off site exposure comparable to 10 C. R 100 guidelines.

- Non safaty related structures, systens, or components:

• That are relied upon to mitigate accidents or transients or are used in plant emergency operating procedures; or

+ Whose f ailure could prevent safety related structures, systems, or components from fulfilling their safety related function; or

• Whose failure could cause a reactor scram or actuation of a safety-related system.

The final piping systems that are to be included in the scope of the RI-ISI program must be clearly defined. Similarly, piping systems not addressed by the RI ISI programs must also be identified, doc" ment,.d and justified for exclusion. TaHe 4.1, adapted from (Ref 7), provides an example list of systems included v ' thin the scope of an exampie risk-informedlSI program. Table 4.1 simply presents an exempx of information that should accompany a regulatory application. This Regulatory Guide recognizes that each plant choosing to submit changes to its ISI programs to it;corporata risk insights will identif / it own sets of systems that will differ from those listed in Table 4.1.

The oasis for excluding a plant's piping systems from consideration for inspection should be clearly discussed in the context of the criteria outlined above. Any pipe in the plant can be selected f or inservice inspection programs based on considerationsoutside the regulatory safety arena (e.g., pipes whose failure would have an inconsequential effect on safety, but could affect the economicaloperation of the plant). An example list of systems that may be considered for exclusion from considerationin a risk-informed ISI evaluationis provided in Table 4.2. Such a table should also accompany u regulatory submrttal. All systems excluded from consideration must be justifl:d.

20

Table 4.1 Example of systems identified as falling under RI.lSI programs for a reference PWR (Adepted from Reference 7).

System Description Basis l maammmmerau BDG . Steam Generator Blowdown High Energy Line Break Contems CCE Charging Pump Cooling PRA' CCI Safety injection Pump Cooling PRA' _

CCP . Reactor Plant Component Cooling PRA & ASME Section XI CHS . Chemical & Volurne Control PRA & ASME Section XI CNM . Condensate PRA8 8

DTM Turbine Plant Miscellaneous Drains ASME Section Xl ECCS . Emergency Core Cooling PRA & ASME Section XI EGF Emergency Diesel Fuel PRA FWA . Auxiliary Feedwater & Recirculatio iPRA & ASME Section XI FWS . Feedwater PRA8 & ASME Section XI HVK . Control Bldg. Cl tiled Water PRA MSS . Main Steam PRA & ASME Section XI OSS . Quench Spray PRA & ASME Section XI RCS Reactor Coolant PRA & ASME Section XI RHS Residual Heat Removal PRA & ASME Section XI RSS Containment Recirculation ' PRA & ASME Section XI SFC Fuel Pool Cooling & Purification PRA' SlH . High Pressure S(' sty injection PRA & ASME Section XI SIL Low Pressure Safety injection PRA & ASME Section XI SWP . Service Water PRA & ASME Section XI

' included in PRA boundary, but exempt by ASME Section XI pipe size.

8 Modeled indirectly in PRA, a Drain lines from MSS listed because of ASME Section XI,

• ECCS is a w..G -i uii of piping segmare which hpact a number of systems . Charging, HPSI, LPSI, Quench Spray

' Not included in PRA intomal events model, important to shutdown risk.

21

. o Table 4.2 Example of risk informed systems excluded from consideration I in Rl ISI programs for a reference PWR. l 1

1 System ID System Description Resolution DSM Moisture Separator Driins & Vents Determined to be non-risk significant' l DSR Main Steam Separator Reheater Drains Determined to be non risk significant*

and Vents EGD Emergency Diesel Fuel Exhaust & Determined to be non-risk significant Comb. Air ESS Extraction Steam Determined to be non-risk significant' GMC Stator Cooling Water Determined to be non-risk significant GMO Generator Seal Oil Determined to be non-risk significant HDH H.P. Feedwater Hester Drains Determined to be non-risk significant*

HDL L.P. Feedwater Heater Drains Determined to be non risk significant*

IAC Containment instrument Air Determined to be non risk significant TMB Turbine Control System Determined to be non-risk significant CCS Turbine Plant Component Cooling Determined to be non-risk significant*

• In addition, based on the outcome of the Feedwater, Condensate, SG Blowdown and Main Steam System piping segments evaluation, these other systems are considered bounded by these evaluations which determined all segments to be less safety significant.

4.2.2 Piping Segments An acceptable method for modeling a run of a pipe in a PRA or to define its ISI requirements is to divide the pipe run into segments. Portions of pipes within the piping systems having the same consequences of failure should be systematically identified. Consequences of failure may be defined in terms of an initiating event, loss of a particular train, loss of a system, or combinations thereof. The location of the piping in the plant, and whether inside or outside the containment, should be taken into account in defining piping segments.

Piping sections subjected to the same degradation mechanism should be systematically identified.

Most of the degradation mechanisms present in nuclear power plant piping are dependent on a combination of design characteristics, fabrication processes and practices, operating conditions, and service experience.

A piping segment should be conned as that run of piping for which the potential degradation mechanism is the same, and a failure at any point in the segment results in the same consequence, in addition, consideration should be given to identifying dit'inct segment boundaries at branching points such as flow splits or flow joining points, locations of size changes, isolation valve, MOV and AOV locations. Distinct segment boundaries should be defined if the break probability is expecteu to be significantly different for various portions of piping.

As can be noted from the previous discussions, the process of defining pipe segments is iterative.

it generetly requires an analyst to make several modifications to the pipe segment definitions before they are finalized.

22

o e See Section A2.3 of Appendix 2 for en acceptable approach on how to segment and display pipe segment information.

1 4.2.3 Modeling Pipe Failures in PRA One acceptable approach to the incorporation of pipe f allures into a PRA is to define logic model events to represent pipe segments, f allures, and to incorporate them in the logic model in such a way that their consequence in terms of equipment fsilures (see Section 4.2.5) is captured. By estimating the probabilities of these pipe segment failures, their contribution to risk can be incorporated quantitatively in the PRA model.

An attemative acceptable approach is based on categorizing each segment's f ailure likelihood and the consequences of each segment's failures in terms of their impact on the plant. These two elements of risk, failure likelihood and consequences, are then systematically combined to determine the safety significance of each segment.

New initiators m6y need to be added to the PRA model if the greater resolution of the piping

- f ailures introduce different demands on mitigating systems than the generic pipe f ailures did in the baseline PRA, Correspondingly,when non initiating event pipe f allure consequences cannot be captured by surrogate basic event failures, new basic events may need to be added to the models.

For example, consider a system model that initially has only two basic events representing the failure of train A and train 8 of the syst6em,- Train A contains two parallel flow paths, one of which can be failed by the failure of a particuk r pipe segment. Since the model does not contain a surrogate basic event that represents the i tilure of the particular pipe segment, the model should be revised by adding basic events to re tresent the f ailure of each parallel flow path in train A. In addition, careful attention shoulo be given to pipe failures which could cause initiating events and, at the same time, fail or degrade mitigating systems (common cause initiators).

See Section A2.4 of Appendix 2 for more details on en acceptab;e quantitative approach for medeling pipe f allures in a PRA.

4.2.4 Piping Falkwe Potential The determination of f ailure likelihood of piping segments, either as a quantitative est! . ate or a categorization into groups, should be based on appropriate values reflecting degradation mechanisms, operational characteristics, potential dynamic loads, flaw size and distributions, inspection parameters, experience data uase, etc. The evaluation should include the appropriate quantitative definition of the failure potential - (e.g., the failure rate or- failure ,

unavailability associated with the pipe and the basis for the quantitative definition. The failure probability or frequency used in the PRA should be appropriate for the specific environmental conditions, degradation mechanisms, and feelure modes for each pipe location. When data analysis is~ used to develop a quantitative estimate, the data should be appropriate. When elicitation of

' expert opinion is used in conjunction with,' or in lieu of probabilistic fracture mechanics analysis, a systematic procedure should be developed for conducting such elicitation, in such -

cases, a suitable team of experts should be selected and trained.

To understand the impact of specific assumptions or models used to characterize the pipe fallure

. frequency or probability, appropriate sensitivity or uncertainty studies should be performed.

23

These uncertainties include, but are not limited to, definition of limiting f ailure modes, such as loss of function as opposed to loss or struc* ural integrity; design versus fabrication differences; variation in material properties and strength; ef ect of various degradation and aging mechanisms; variation in steady state and transient loads; availability and accuracy of {

plant operating histoly; availability of inspection and maintenance program data; and l capabilities of analytic methods and models tc predict realistic results. Qualitative arguments may also be used to address these assumptions and models, but these arguments should be self supporting and self evident.

The methodology, process, and rationale used to determine the failure likelihood of piping segments should be independently reviewed curing the final classification of the safety significanceof each segment. This review should be documented and includedin the submittal.

When new computer endes are used to develop quantitative estimates, the techniques should be verified and validated against established industry codes.

See Section A2.5 of Appendix 2 for detalls on an acceptable approach for detamining pipe f ailure likelihood for use in PRA.

4.2.5 Consequences of Failure The impact on risk due to piping pressure boundary failure should consider both direct and indirect effects. Consideration of direct effects should include failures that cause initiating events, disable single or multiple components, trains or systems, or a combination of these effects. Indirect effects of pressure boundary failures affecting other systems, components and/or piping segments, also referred to as spatial effects such as pipe whip, jet impingement, consequentialinitiation of fire protection systems, or flooding should also be considered. Part of the analysis should incorporate insights obtained from the licensee's analysis of IPE, IPEEE, fire, flooding, etc.

The direct and indirect effects of pipe failures should be characterized to incorporate appropriate failure mechanisms and dependencies into the PRA model. An acceptable method of incorporating pipe failure; is to classify pipe failures as leaks, disabling leaks, and breaks.

Each of these f ailure modes has a specific failure probability and a corresponding potential for degradin9 ystem performance ':hrough direct and/or indirect effects. Leaks can result in moisture intrusion throughjet imp" gement, flooding, and sprays. Disabimgleaks (larger break area 'han for leaks) can result in mitiating events and loss of system function in addition to indirect effects. Breaks can result in damage due to pipe whip in addition to all of the above mentioned Jamages. The corresponding f ailurt, probability or potential normally decreases as the break area increasce.

Tc understand the impact of a specific assumption or model on the results of the PRA, appropriate sensitivity studies should be performed. Use of qualitativo arguments should be self supporting and self evident.

The consequence evaluation should incorporate the contributions to risk from pipe failures as initiating events, mitigating system failures, and failures that cause both (common cause initiators). Risk assessment incorporates more than the contribution of oipe segment f ailing.

It includes operator actions, system interactions, common component (segment) interactions, etc.

A qualitative assessment needs to consider the impact of these measures.

24

e o r

[

See Section A2.4 of Appendix 2 for more details on an acceptable approach for incorporating the consequences of pipe f ailures in a PRA. ,

4 4.2.6 Risk impact of 181 Changes

]

A risk informed ISI change request should demonstrate that principle four in DG 1061, highlighted '

l in Section 4.4 of this regulatory guide, is met. Principle four states that proposed increases in risk, and their cumulative effect, are small and do not cause the NRC Safety Goals to be exceeded. Increase in risk caused by changes in the ISI program could arise from a decrease in the number of welds inspected, reduced efficiency from simplified weld inspections, or both.

Decreases in risk could arise from inspecting welds not currently being inspected in the program,  ;

! improved weld inspections, or both. The greater the potential risk increase in the proposed change in the ISI program (e.g., the larger the reduction in the number of welds to be inspected and of replacements of detailed inspections with simplified inspections)the more rigosous and detailed the risk analyses needed.

The licensee's risk assessment should be used to address the principle that proposed increases in risk, and their cumulative effect are small and do not cause the NRC Safety Goals to be exooeded. For purposes of implementation, the licensee should assess the expected change in CDF and LERF. The ne:essary sophistication of the evaluation is that needed to ensure that the potentialrisk impact of a change to the ISI program is acceptable. For changes that result in substantial impact, an in-depth and comprehensive PRA analysis of appropriate scope to derive a quantified estimate of the total impact of the proposed change will be necessary to provide adequate justification, in other applications, calculated risk importance measures or bounding estimates will be adequate, in still others, a qualitative assessment of the impact of the change t on the plant's risk may be sufficient, The fulfillment of principle four should be based on e risk importance measures or bounding estimates capable of categorizing plant specific pipe element f allure potentialcategories of high and low fsilure potential, and consequences categories af high- and low safety significant piping (see Section A.2.7),

e a systematic process to combine f ailure potential and consequence to determine pipe elernnt safety significan e, e a wold inspection selection process which provides for changes in the ISI program based on the safety significance of the pipe element, e' a discussion and evaluation of the aggregate risk impact of the set of changes requested in the ISI program, and e an assessment and accounting of the sendtivities and uncertainties associated with the evaluations.

The process noeds to demonstrate that the major part of the risk attributed to piping f ailure is covered by the Rl ISI program.

P 25

. - - - - _ - _ _ _ -.-.a._- .. , , - _ . - - . . . --

l The general appruach to risk impact evaluation for irspection of piping is illustrated in Figure 4.2. See Section A2.0 of Appendix 2 for details on an acceptable quantitative approach determining the risk irnpact of an ISI change.

4 l

l

, FIGURE 4.2 General Approach to Risk lmpact Evaluation of Piping l

i I

l l h i

l -

) '

[ .

. 2 l .

t ,

l l

~ '

r . .

l e

o l l

l

~_,<<\ y ( sr  ? .

,..,,_f...,.

. ; - g 3 { ,.. f . g,,(

- 'E ., ,

f

. .d j f. ,

. '. . . : , , ., f^ ' ' '

kl.

CI .e i ; .- ; : ~ . .

i .. 4 .. . .. . .1 . . .. . .

i i

26 l

l

.._.~ _ _ .__. _ _.... _ .__ _ ._ _ _ _ - __.._ _._._ _.. ..__..._ _ .. ._ ~ _. _ _ . _ . _ ___ .._ _ _ _ _ .

o ,

4.2.6.1 Ir.itiating Events For purposes of deterrnining RIISI requirements, all initiating events (internal and external) and all operating modes should be evaluated to see whether initiating events and predicted plant response are af fected by RI lSI proposed changes, in addition, other initiators, including those that have been screened out (eliminated) from the base PRA, have to be considered by answering the following questions.

(1) Does the ISI issue involve a change that could lead to an increase in the frequency of a particular initiator r.' ready includsd in the PRA?

(2) Does the ISI issue involve a change that could lead to an increase in the frequency of a particular initiator initially screened out of the PRA?

(3) Does the ISIissue affect the quantification of previously identified accident scenarios for specific initiators that were screened out and eliminated from the PRA because of truncation?

(4) Does the ISIissue have the potential to introduce a new initiating event?

4.2.6.2 Dependencies and Common Cause Failures The etf acts of dependencies and Common Cause Failures (CCFs) fer ISI components need to be considered carefully because of the significance they can have on core damage frequency.

Generally, data are insufficient to produce plant specific estimates based solely on the data.

For CCFs, data from generic sources may be required. (Ref. 21) and Appendix 2 to this domunent address CCFs in more detail.

4.2.6.3 Uncertainty and Sensitidy Analyses Uncertainty and sensitivity analyses ere expected to play an important (and complex) part in the support of risk informedlSI program changes. These topics are discussed further in (Ref. 21 and Section A2.5.5 of Appendix 2 of this document, it is expected that certain appiication-specific guidance will be developed from the ongoing NRC reviews of the proposed Rl ISI pilot plant programs.

4.2.6.4 Human Reliability Analyses See (Ref. 21) for further discussions on this topic. For 'SI specific analyses, the human reliability analysis methodology used in the PRA must accoun' .or the impact that tlw pipe segment break will have on the operator's ability to respond to the event, in addition, the reliability of the inspection program (both operator and equipment) that f actor into the probability of detection should also be addressed (see Attachments 4 and 5).

4.2.7 Element Selection This section discusses the establishmentof the number of elements (e.g., welds) per segment requiring inspection and provides guidance on how to meet the requirements of 10CFR50.55a(a)(3)(i). 10CFR50.55a(a) statos:

27 J

)

i i

"(3) Proposed alternatives to the requirements of paragraphs (c), (d), (e), (f) (g), and th) of this section or portions thereof may be used when authorized by the Director of the Office of Nuclear Reactor Regulation. The applicant shall demonstrate that (i) The proposed alternatives would provide an acceptable level of quality and safety..."

Section 4.2.6 addressed the determination of the risk impact of ISI changes and the categorizationof pipe segments as high and low safety significant. The segments categorized as low safcty significant will require less oversight and inspection then those categorized as high safety significant.

One option for meeting the " acceptable level of quality and safety" critorion of 10 CFR 50.55a(a), _ l is for a licensee to review existing industry experience with the ASME Section XI requirements and  !

assoas that performance on systems and piping components (e.g., developing target leak frequency goals based or, existing ASME results). Meeting this performance standard with high assurance levels for the high-safety significant piping segments could be used as one e: .nont in the staff's determination of acceptable levelof quaHty and safety.

Appendix 2 to this Regulatory Guide provides one example of determining leak target goals that  ;

conform to_the 50.55a requirement, listed above. A licensee could propose its leak target goals and develop a program that meets those goals. Such a program would define the number of welds requiring inspection.

4 For the example " leak target goals" identified in Appendix 2, the target goals are applied to the syseen under consideration. For example, if a system is comprised of 36 segments, and 20 of which .

are categorized as high-safety significant, then the target goal for those 20 segments should meet the target leak goals at the g5% confidence level. The staff will find acceptable a g5% assurance J level that the target leak goals will be met.

The target leak goals can be established on a system or element level. If established on an element level, the goals should ensure that the system's reliability is consistent v ith sxisting Section XI perform:nce. For example, the leak target goals defined in Table A2.g is based on global industry piping performance. These target goals would be applied only to the HSS segments  ;

in a system. Appendix 4 to this Regulatory Guide provides an examples of how one could calculate the numb" of welds to be inspected to meet the leak target goals.

Any analysis noods to cur. ider the inspection method and the probability of detection. Appendix 4 provides an example of such a calculation.

4.3 Integrated Decielonmaking -

This section discusses the integration of the technical considerations involved in reviewing submittels from licensees proposing to implement RI ISI programs. General guidance for risk-informed' applications .is provided in draft Regulatory Guide DG 1061. Specifically, the integrated decision process should assess whether or not:

• The comprehensive plant model, including the PRA and the integrated deterministic analysis, is technically sound and supports the rest of the findings regarding the proposed RI ISI program.

• The analysis is based on the as built and as operated and maintained plant.  ;

28

. All safety impacts of the proposed changes to the licensee's ISI program have been j evaluated in an integrated mannor as part of an overall risk management approach in which the licensee is using risk analysis to improve operational and engineering decisions broadly and not just to elirninate requirements seen as undesirable (i.e., tne approach used to identify changes in requirements for ISI were used to identify areas where requirements in ISI should be increased as well as reduced).

• The proposed changes to the ISI program have been evaluated in an integrated fashion that ensures the* all of the key safety principles are met.

+ The cumulative risk evaluation accounting for all of the proposed ISI program changes confirm.: that changes to the plant core damage frequency (CDF) and large early release frequency (LERF) are smallin conformance with the guidelines given in Section 2.4.2 of draft Regulatory Guide DG 1061 and summarized below.

The risk acceptance guidelines discussed in DG 1061 are based on the pr;..ciples and expectations for risk-informed regulations. As such, the licensee's risk assessment should:

• address the principle that increases in estimated CDF and LERF resulting from the proposed CLB changes will be limited to small increments,

• be sophisticated enough to support the determination of the expected change in the risk, i.

> be subjected to appropriate quality controls, and

> realistically reflect the actual design, construction, and operational practices of the plant requesting the proposed CLB change.

For the purpose of establishing objectives or guidelines for risk informed decisionmaking, the CDF objective of 1E-04 per reactor year has been adopted. A large 7

j early release frequency (LERF) range of 1E-6 to 1E-5 per reactor year has been adopted

- as a containment performance guideline.

l The acceptance guidelir.as have the following elements:

• For a plant with a mean core damage frequency at or above 1E-4 per reactor year (the Commission's subsidiary core damage frequency objectb/e) or with a mean LERF at or above 1E-5 per reactor year, it is expected that applications will result in a net decrease in risk or be risk neutral.

• For a plant with a mean core damage frequency of less than 1E-4 per reactor year, applications will be considered which, combined with the LERF guidelines described below:

• Result in a net decrease in CDF or are CDF neutral;

• Result in increases of calculated CDF that are very small (i.e., CDF increases of less than 15-6 per reactor year); or 29

Result in an increase in calculated CDF in the range of 1E-6 to 1E 5 per i reactor year, subject to increased NRC technical and management review and considering the follow!ng factors:

The scope, quality and robustness of the analysis (including but not limited to the PRA), including consideration and quantification of uncertainties,

• The base CDF and LERF of the plant,

• The cumulative impact of previous changes (the lict,nsee's risk management approach),

• Considerationof the NRC's Safety Goals policy screening criteri9

, in the staff's Regulatory Analysis Guidelines, which define what changes in CDF and containment performance would be needed to consider potential backfits, The impact of the proposed change on operational complexity, burden on the operating staff, and overall safety practices, and

• Plant specific performance and other factors, including, for a example, siting factors, inspection findings, penormance ~

4 indicetors, and operational events.

AND For a plant with a mean LERF of between 1E-6 and 1E 5 per reactor year:

• Result in a net decrease in LERF or are LERF-neutral;

• Result in an increase in calculated LERF of up to 1E-6 per reactor year, subject to increased NRC technical and management review, as described above; OR

• For a plant with a mean LERF of less than 1E 6 per reactor year:

Result in a net decrease in LERF or are LERF-neutral:

4-

• Result in increases in calculated LERF that are very small (i.e.,

LERF increases of less than 1E-7 per reactor year); or

• Result in an increase in calculated LERF of up to 1E-6 per reactor year, subject to increased NRC technical and management review, as

': scribed above.

The rigor of analyses needed to support these different types of applications is addressed in Section 2 of DG-1061.

• Appropriate consideration was given to the uncertainties in the analyses and interpretation of the results.

• Plant-specific data was incorporated into the analyses, as appropriate.

• Defense-in-depth evaluations have been performed, and insights from these have been duly incorporated into the classification scheme, the performance goals, and the associated 30

1

c. .

. programmatic activities. These evaluations confirm that sufficient safety rnargins exist and the CLB's defense in depth evaluation is not compromised.

• The scope and models used were apprvpriate for the proposed change and the analysis was

. subjected to quality controls.

! . . Pipe segments have been identified and appropriately categorized for use in prioritizing L and implementing the program. In partcular, important components not modeled in the PRA

! have been identified and appropnately categorized using available deterministic

. supporting information.

• . An appropriate monitoring program is proposed to assess plant performance and provide for feedback and corrective action if performance goals are not met, j

• The data, analysis methods and assessment criteria used in the development of the RI-ISI programs are scrutable and available for public review. .

in summary, acceptability of the proposed change should be determined using an integrated l decision-making process that addresses three major areas: (1) an evaluation of the proposed change in light of the plant's current licensing basis, (2) an evaluation of the proposed change i relative to the key principles and the acceptance criteria, and (3) the proposed plans for j_ implementation, performance monitoring, and corrective action. As stated in the Commission's

Policy Statement on the increased use of PRA in regulatory matters, the PRA information used to support the RI-ISI program should be as realistic as possible, with proper consideration of l

uncertainties. These f actors are very important when considering the cumulative plant risk and i accounting for possible risk increases as well as risk benefits. The licensee should carefully document all of these considerationsin the RI ISI program descriptionincluding those areas that I have been quantified through the use of PRA as well as qualitative arguments for those areas that i cannot be readily quantified.- Examples of qualitative subjects include Al. ARA for plant personnel, l operator procedures that ease the burden on plant personnel, organizationalhuman f actors, etc.

When making final programmatic decisions, choices must be made based on all of the available -

- information. There may be cases where information is incomplete or where conflicts appear to

i. . exist between the traditional engineering data and the PRA-generated information. .It is the responsibility of the licensee in such cases to resolve such issues.

i p

i i;

)

4 i

5

! 31 s

5. B.IWENT 3: WFLENENTATION, PERFORMANCE MONITORNG, AhD CORRECTIVE ACTION STRATEGIES i Using the information produced from Elements 1 and 2 of the RI-ISI process (as described in Chapters 3 and 4), the licensee develops a proposed RI ISI DeUne program. The program should include lm plementation/

implementation, performance monitoring and Monitoring corrective action strategies. The program should be self correcting as experience dictates. The Pr0 gram

! programs should contain performance measures used to confirm the safety insights from the PRA.

l Whde the actual development of the RI-ISI prograrn ELEMENT 3 is left to the licensee's discretion, Appendix 5 provides a detailed discussion on en acceptable -

approach for developing an RI-ISI program.

Upon approval of the RI-ISI program, the licensee should have in place an implementation schedule for inspecting all HSSCs and LSSCs identified in its program. The number of required inspections i

should be a product of the systematic application of the risk informed process.

l 5.1 Program implementation The implementation of a RI-ISI program for piping may begin at any point of the inspection interval

, as long as the examinations are scheduled and distributed tc be consistent with the inspection i interval requirements of the ASME Boiler and Pressure Vessel Code Section XI Edition and Addenda

! committed to by a licensee in accordance with 10CFR50.55a. The requirements for these intervals are contained in Section XI under Article IWA 2000 as they apply to inspection Program B. Initial l

R14SI programs should be submrtted for NRC staff approval in accordance with 10CFR50.55a(a)(3) and documentation of program updates should be kept and maintained by the licensee on site for audit. Updates to thee R!-ISI program should be performed at least on a periodic basis to coincide with the inspection program requirements contained in Section XI under incpection Program B.

These updates should be expedited as dictated by any plant established procedures to update their PRA which may be more restrictive than the Section XI period update. As plant design feature changes are implemente changes to the input associated with the RI-ISI program segr..ent 1

definition and elermnt selections should be reviewed and modified, as needed. Changes to equipment performance, the plant procedures that can affect system operating parameters, changes in componerit test intervals, valve lineups, operating modes of the equipment, or the ability of the plant personnelto perform actions associated with accident mitigation should be included in

! any RI-ISI program update. When scheduled RI-ISI program NDE examinations and pressure tests are completed with corresponding VT-2 visual examinations for leakage and flaws or indications of leakage are identified,ine existence of these conditions should be evaluated as part of the RI-ISI update.

Each 10-year inspection intervalis subdivided into inspection periods which end at 3,7, and 10 years of plant service within each interval. Variations in these inspection program intervals and

. periods by plus or minus 1 year are allowed under Section XI based on refueling outage situations l and may be employed by a licensee who implements an RI-ISI program. These same basic RI-ISI program interval and period requirements may also be used by a licensee who chooses to perform on-32

_ -_ ._ _ . _ _ _ . _ _ _ - ~ . . _ . - _ _ - - . _ _ _ _ _ . . _ _ _ - _ . _ _ _ . .

line Nondestructive Examination (NDE), but special considerations may have to be taken in regard to program updates during the performance of corrective actions that result from these examinations.

1-5.2 Performance Monitoring

! Rl ISI programs are living programs and should be monitored continuously. Monitoring these programs encompasses many f acets of feedback or corrective action that include periodic updates a

based on input and changes resulting from plant design features, plant procedures, equipment i performance, examination results, and individual plant and industry failure information. Since the PRA used in the development of any RI ISI program is a state of knowledge at the time of impiamentation, any significant change in parameters affecting the total plant's CDF or LERF needs to be considered upon identification. Plant administrative procedures should be in place to imp! ament these changes into the PRA and incorporate any relevant results into the Rl-ISI program f outside of any periodic update.

i The purpose of performance monitoring is to confirm:

I'

(1) the assumptionsin the PRA that could affect the probability or conseque ces of l

pipe f ailures, (2) the target objectives or goals used in the integrated decisionmaking process are l

!' being met, (3) the known degradation mechanisms are understood, and l

(4) that any unknown degradation mechanisms are identified before they have a j detrimentalimpact on risk.

(5) that the integrated decisionrnaking process remains current with plant and industry i experiences.

Performance monitoring of the risk informed ISI plan is intended to confirm that:

• Piping reliabilities used in the calculation of risk contributions from passive piping

' components remain valid and thereby justify. continuation of the ISI plan without

modifications

+

• Appropriate modificationr to the ISI plan are developed if new or unexpected degradation

- mechanisms occur.

f The inspection procedures and analyses must provide assurances that performance degradation is detected with sufficient margin that there is no adverse effect on public health and safety (i.e.,

L the f ailure rates cannot be allowed to rise to unacceptablelevels before detection and corrective i

action take place). The basic elements of an acceptable performance monitoring program are illustrated in Figure 5.1 and summarized in the following subsections.

l 5

Periodic Updates.

j' - Updates to an RI-ISI program should be performed at least on a period basis to coincide with the inspection program requirements contained in Section XI under Inspection Program B. These updates l

i would be expedited as dictated by any plant established procedures to update their PRA which may be more restrictive than a Section XI period type update.

33 i

Plant Design Feature Changes.

As plant design changes are implemented, changes to the inputs associated with RI-ISI program segment definition and element selections may occur. It is important to address these changes to the inputs used in any engineering assessment or structural reliability risk assessment (SRRA) model that may affect resultant failure probabilities in terms of pipe leakage, disabling leakage and full rupture events. Some examples of these inputs would include the following:

. Operating characteristics (e.g., changes ;n water chemistry control)

. Material and Configuration Changes;

. Welding Techniques / Procedures;

. Coastruction and Preservice Examination Results; and

. Stress Data (Operating Modes, Pressure, and Temperature Changes)

. anNect y . -

PERFORMAggg(gONITORING i

) k Moaltor Identify Precursor Conditions Periodic Update l Plant Design Change Characterize Operability, Safety Plant Procedure Change & Reporting Requirements Equipuent Performance Change Evaluate - Cause / Corrective Action Plan Examine:

Results Management Approval Individual Plant Fallare Inforanation Industry Failure Information Inspleasent Corrective Action Plan Trend 1 f

. w&hw .

RI-ISI PROGRAMiWALIDATION 99ggc;%K: ,

Figure 5.1 Elements of a Performance Monitoring Program in addition, plant design changes could result in significant changes to a plant's CDF or LERF, which in turn could result in a change in consequence of f ailure for a system piping segments.

34

e I

Plant Procedure Changes.

e

! Changes to plant procedures that effect system cperating parameters or the ability of plant operations personnel to perform actions associated with accident mitigation should be included

[ - for review in any Al ISI program update. Additionally, changes in these procedures which effect l, component inspection intervals, valve lineups, or operational modes of equipment should also be assessed for their impact on changes in postulated failure mechanism initiation or CDF/LERF

~

contribution.

i Equipment Performance Changes.

1 j Equipment performance changes should be reviewed with system engineers and mairnenance personnel

! to ensure that changes in pe:1ormance parameters such as valve leakage, increased pump testing

[ or identification of vibration problems is included in the periodic evaluation of the RIISI

! program update. Specific attention should be paid to these conditions if not previously assessed in the qualitative, inputs to the element selections of the RI ISI program.

Examination Results.

When scheduled RI-ISI program NDE examinations and pressure tests are completed with corresponding VT-2 visual examinations for leakage, and flaws or indications of leakage are identified,the existence of these conditions should be evaluated as part of the Rl ISI program update.

Individual Plant and Industry Failure Information.

Review of individual plant maintenance activities associated with repairs or replacements, including identified flaw evaluations, is an important part of any periodic update, regardless of whether the activity is the result of an RI-ISI program examination. Evaluating this information as it relates to a licensee's plu.it provides failure information and trending informationthat may have a profound effect on the element locations currently being examined under an RI-ISI program. When this review is coupled with industry f ailure, information, a thorough update results industry failure data is just as important to the overall program as the owner's information. During the periodic update, industry data bases (such as the internationaldata base being pursued by EPRI and SKI, and U.S. industry data base) should be reviewed for apr'":: ability to the owner's plant.

5.3 Corrective Action Programs Each licensee of a nuclear power plant is responsible for having a corrective action program, consistent with draft Regulatory Guide DG 1061. Measures shall be established to assure that  !

conditions adverse to quality, such as f ailures, malfunctions, deficiencies, deviations, l

- defective material and equipment, and nonconformances are promptly identified and corrected. In the case of significant conditions adverse to quality, the measures shall assure that the cause '

of the condition is determined and corrective action taken to preclude repetition. The identification of the significant condition adverse to quality, the cause of the condition, and the corrective action shall be documented arid reported to appropriate levels of management.

It is anticipated that a corrective action program will incorporate the following elements:

f 35

c -o a i

i

.' identify.

Through the inspection location selection process established under an RI ISI program, the structural element examinations performed should identify those conditions that would be adverse

[ to quality in relation to identifying precursors to potential or actual leaks, disabling leaksi )

I or pipe ruptures.. -

l Characterize.  !

1 Depending on the timing of the condition Mentification and operationalmode of the plant, (this i may be a more critical situation when on-line NDE is performed) the initial issues to be addressed i include:

l f

• the effects on operability of safety related systems, structures, or components;  ;

• if regulatory reporting is required; or i

• the condition results in an immediate plant / personnel safety or operational impact.

4 If - any of these three considerations exist, then the plant's management must be immediately

l. notified through plant established procedures.

2 i Evahate i

lI Evaluation has two parts: (1) determine the cause and exient of the condition identified, and (2) i develop a corrective action plan or plans. Additional examinations should be considered an acceptable method in providmg this cause and extent determination. Under an Rl-ISI program, both 4 quantitative and qualitative insights are used to identify postulated f ailure modes and elements

[ to be examined. Performances of examinations on selected elements have been grouped into regions

, of "High" and " Low" failure potential and safety significance.These groupings provide the basis

for additional examinations to be performed to determine the cause and extent of the condition

identified. Acceptable sampling schemes such as those identified in ASME Section XI under IWB-2430 1 - may be used with due consideration given to limit the additional examinations by piping segment,

materials, service conditions, and failure modes already established in the RIISI program.

i ' Alternatively, due to the available information used in an.RI-ISI program, an engineering

evaluatios..aay be used as a substitute for additional examinations to determine the cause and i

extent of the condition le ntified. -

!- - Once the true extent of the condition has been identified and documented by a licensee, then a i c,orrective action plan should be daveloped. The plan could include repair, replacement, or l- . monitoring of the condition identified depending on its safety significance. Several options of

i. corrective action may be available to a licensee, but in all cases, needed success criteria must

j. be defined and documented with the corrective action plan. These success criteria include the i mearurable attributes needed to evaluate the effectiveness of the corrective action in the

! prevention of a recurrence of the identified condition. The success criteria may be as simple as -

implementation of new element selections based on the new f ailure information during the next

} scheduled periodic update of the RI-ISI program and then performing the examinations to confirm i- that the issue has been corrected. Conversely, to prevent the condition from reoccurring, these criteria may require a plant design change, depending on the condition identified, and possible i routine scheduled replacements.

2

Decide.

} 36 i

e---_ - . - - p,m- w - ,y- v.--,e ,.ve-g+- mer,c-we ,t m-m m- == .i- .: , - - - ,-i-- - ,-g--w, --s---+- e

A decision should be made by appropriate levels of management on the owner's implementation of any corrective action plan. Agreement on the adequacy of the success criteria should be reached among the personnelinvolved and resources allocated to implement the plan. Cost will inevitably play

a part in the decision process, but it is more important to fix the problem correctly the first time so as to avoid mcurrence in the future.

6 Implement.

Complete the work necessary to both correct the problem and prevent its recurrence, in the case of an RI-ISI program, successive examinations may be one way to measure the effectiveness of the corrective action plan. A licensee could follow the requirements for successive examinations as

' described in Section XI, IWB-2420. These requirements could be used when flaws or conditions have been accepted by analytical evaluations and measurements of potential service related degradation. It is essential to avoid a future f ailure of a pipe element.

Monitor. .

i The first activity that must be monitored is whether or not the planned corrective action was implemented. Management should accomplish this as part of their oversight of daily work

' activities. In an RI ISI program this may be as simple as having administrative procedures in place to verify that the program has been updated as a result of the entrective action plan and review the data to verify that the examinations are being performed as scheduled.

Once it has been determined that corrective actions have been implemented, the planned actions to verify that the desired results are obtained should be conducted. This is done by measuring the success criteria at regularly scheduled intervals in accordance with the corrective action plan.

This measurement may indicate that the success criteria did not fix the problem or only partially fixed the problem. Additional corrective action plans may have to be developed and implemented if this situation occurs.

Trend.

The purpose of trending is to identify conditions that are significant based not only on individualissues, but on accumulation of similar issues. Even issues assigned low significance may be deerned of greater significance if there are an increasing number of similar issues. During the RI-ISI program, periodic updates of or:currences which required corrective actions should oe reviewed by the ISL team and appropriate oversight groups /managementto determine if these i

insights should result in additional or different locations for examination, l

i 5.4 Acceptance Guidelines The acceptance guidelines for the implementation, monitoring, and corrective action programs for the accepted RI-ISI program plan are presented below (a. through g./. In addition, acceptance guidelinesfor the initial development of the RI-ISI program plan, as described in Appendix 4, ar provided (h. through t.). The acceptance guidelines include:

a. The implementation program will be evaluated based on the attributes presented in Sectio 5.1.

4 37

i s

b. The monitoring strategy should evaluate that the Rl ISI components (i.e., pipe segments and elements) meet the guidelines addressed in Chapter 4 and are adequate to uncover components that f ail to either meet the acceptance guidelines or are otherwise determined to be in a non-conforming condition.

! c. The corrective action program should provide reasonable assurance that a nonconforming component will be brought back into conformance.

4

d. Evaluations within the corrective action program should:

i (1) assure that the cause of the condition is determined and that corrective actions are taken to preclude repetition. The identification of the significant condition adverse to quality, the cause of the condition , and the corrective action shall be documented and reported to appropriate levels of management

(2) det, ermine the impact of the failure or nonconformance on system / train operability since the previous inspection (3) determine and correct the root cause of the failure or nonconforming condition (4) assess the applicability of the failure or nonconforming condition to other

, components in the RI-ISI program (5) correct other susceptible RI ISI components as necessary (6) incorporate the lessons in the data base and SRRA computer models, if appropriate (7) assess the validity of the PRA f ailure rate and unavailability assumptions in light of the failure (s), and (8) consider the effectiveness of the component's inspection strategy in detecting the failure or nonconforming condition. Adjust the inspection interval and/cr inspection methods, as appropriate, where the component (or group of components) experiences repeated failures or nonconforming conditions.

e. The corrective action evaluation should be provided to the licensee's PRA group so that any necessary model changes and regrouping are done as might be appropriate.

/. The RI-ISI program documents should be revised to document any RI-ISI program changes

> resulting from the corrective actions taken.

p. A program is in place that monitors industry findings.

h. Pinina Subiect to Examination The examination requirements include Class 1, 2, and 3 piping evaluated by the risk-informed process. Piping in systems evaluated as part of the plant PRA, but outside the current Section XI examination, and categorized as high-safety-significant,in accordance with Chapter 4 of this Regulatory Guidance document, are included.

r 38

1. 3

/. - Insoaction Proaram

!.. ' The examinations shall be completed during each inspection interval in accordance with the

- goals established for leak probability per weld per year (or other NRC approved

- performance monitoring criterion), with the following exceptions.

4

! (1) If, during the interval, a reevaluation using the RI ISI process is conducted and scheduled items are no longer required to be examined, these items may be-eliminated.

i

. (2) . If, during the interval, a reevaluation using the RI ISI process is conducted and items are required to be added to the examination program, those items shall be i

added and the NRC informed.

, f. hemaniva inanactions

!- Locations' selected for inspections should be subjected to examinations consistent with o

Section XI requirements at appropriate intervals, such as given by items (1) through (3),

below. Those locations with detected degradation (found to be at acceptable levels) l should be subject to more frequent examinstons. An acceptable schedule for examinations is:

(1) The sequence of piping examinations established during the first inspection j

interval using the Rl-ISI process shall be repeated during each successive i inspection interval; however, the examination sequence may be revised to satisfy the requirements of Table IWB-2411-1 or Table IWB-2412-1, of Section XI.

(2) If piping structural elements are accepted for continued service by analytical

• evaluation in accordance with m (below), the areas containing the flaws or relevant i: conditions shall be reeramined during the next three inspection perici, referenced i in the schedule of the inspection program of / (above).

(3) -If the reexaminations required by /.2 reveal that the flaws or relevant conditions i remain essentially unchanged for three successive inspection periods, the piping examination schedule may revert to the original schedule of sur*essive I- inspections.

b - k. Additional Examinations

[

Examinations performed in accordance with / (below) that reveal flaws' or relevant conditions exceeding the acceptance standards shall be extended to include additional

examinations. The additional examinations shall include piping structural elements e

described in Table 5.1 with the same postulated f ailure mode and the same or higher failure

- likelihood.

[ The number of additional elements shall be the number of piping structural elements

(1)

< with the same postulated f ailure mode originally scheduled for that fuel cycle.

1 I (2) The scope of the additional examinations may bc limited to those high-safety-significant piping structural elements within systems whose materials and service 39 1

d L,- , - __- _ . _ _ _ _ - _ __ _ . . - . .

I i

conditions are determined by an evaluation to have the same postulated f ailure mode ,

as the piping structural element that contained the originsi flaw or relevant '

conditions. l if the additional examinations required above reveal flaws or relevant conditions exmeding the acceptance standards, the examination shall be further extended to include additional examinations.

(3) These examinations shallinclude all remaining piping elements within Table 5.1 whose postulated f ailure modes are the same as the piping structural elements originally examined above.

(4) An evaluation shall be performed to establish when those examinations are to be conducted. The evaluation must consider failure mode and likelihood.

For the inspection period following the period in which the examinauons of above were completed, the examinations shall be performed as originally scheduled.

/. Examination and Pressure Test Raouirements Piping structuralelements categorized as high safety-significant shall be examined as required in Table 5.1.

Pressure testing and VT-2 visual examinations shall be performed on Class 1, 2, and 3 piping systems in accordance with Section XI specified in the licensee's ISI progiam.

Examination qualification and methods and personnel qualification shall be in accordance with the edition and addenda of Section XI specified in the Ucensee's ISI program.

m. Accentance Standards for Identified Flaws For component configurations or examination methods not addressed by Table 5.1, the lic nsee shall develop acceptance criteria consistent with the requirements of IWA-3000.

The referenced pemraphs below and in Table 5.1 shall be applied in accordance with the edition sad addei Ja of Section XI specified in the licensee's ISI program.

(1) Flaws that exceed tha acceptance standards listed in Table 5.1 found during surf ace or volumetric examinations may be accepted by repair /replacemert activities or approved analytical evaluation.

(2) Flaws or relevant conditions that exwad the acceptance standards listed in Table 5.1 found during visual examinations may be accepted by supplemental examination, corrective measures, repair / replacement activities, or app oved analytical evaluation.

(3) Other unacceptable conditions not addressed above, may be accepted by repair / replacement activities, or by approved analytical evaluation.

n. Rensir/Reofacement Procedures 40

i Repair / replacement activities shall be performed in accordance with the Section XI requirements specified in the licensee's ISI program,

o. Svatem Pressure Tests

. System presare tests should be performed in ecw di. >ce with IWA 5000, IWB 5000, IWC-5000, IWD-5000 of the Section XI Edition and Addenda, as specified in the licensee's ISI program,

p. Records and Renorts Records and reports should be prepared and maintained in accordanco with IWA-6000 of the Section XI Edition and Addenda as specified in the Licensee's ISI program.

g. The licensee's RIISI program submittal should be consistent with the ecceptance guidelines contained throughout this regulatory guide, specifically with the findings listed in this section, or justify why an alternative approach is acceptable,

r. The licensee's proposed RI !SI program should address the four principle elements of risk-informeddecisionmaking (addressed in this document) by defining the proposed change, basing the new program on traditional analysis with insights from probabilistic risk assessments, and incorporating an implerhontation and morwtoring program that enables the staff to conclude that the proposed RI ISI program provides "an acceptable level of quality and safety" [(Ref. 3), CFR 50.55a (a)(3)(ill,

s. Administrative procedures should be in place to implement changes into the PRA and traditional analysis and incorporate sny relevant results into the RI ISI program during and outside any periodic update,

t. The RI-Isl program provides an acceptable level of quality and safetv when compared to the existing Section-Xi performance.

41

l Table 5.1 Examination Category R-A, Risk-informed Piping Examinations .

Ports Enemined Exernineden Exemheodon Acceptance Extent

• end frequency Extent

• and frequerrey Denw to Ered of L _ -..& niethod Stenderd Fkst hetervel Sareconelve hetervels* burerver

! /Geh Sefety Sdambicant Maine l StrucaualEinments 1

Elements Subject to Thermal Fetigue IWS-2500-8tel' Volumstric IW8-3514 Inspect once per inspection Some se 1st interval Not Pwnssibee IWS-2500- intevel'

• 9,10,11

! IWC 2500-7(et' l

Elements Subject to High Cycle IW8-2548tcf Visuet. VT-2 IW8-3142 inspect once per refuelmg some se 1st intsevel Not Pwasssbie Mechenical Fatigue IW8-25 > outsgo 9,10, t 1 IWC-2500-7(el' Elements Subject to Corroelve, Note 8 Volumatric' (for IWB-3514 Inspect once per inspection Some se tot intervel Not Pwnssible Erosive, or Cavitation Westege Internal Westegel or Note 8 interve8' Surface f./ Extemel Westager Elements Subject to Crevice Note 7 Volumetnc IWS-3514 inspect once per inspect 6cn Some se tot interval Not Pwnysseble Corrosion Cracking interve!"

Elements Subject to Primary Water Note 7 Visual, VT-2'* IW8-3142 inspect once per refueling Some es 1st interval Not Permise&o Stress Cor osion Crocking (PWSCCf outage Elements Subject to Intergranuier IWB-2500-8 Volumetric IWS-3514 Inspect once we inspection Some es 1st interval Not PermissNe Stress C .osion Cracking (fGSCC) IWB-2500- httervet' 9,10,11 inspect orce per inspecten Elements Subject to IWB-2500-8 Visuet, VT-3 Note 8 Some es 1st intervel Not Permissibee Microbiologically influenced IWB-2500- Intemet Surfaces or intervel' Corrosion (MIC) 9,10,11 Volumetric' Elements Subject to Flow Acceleratei Note 9 Note 9 Note 9 Note 9 Note 9 Note 9 Corrosion (FAC)

NOTES:

(1) The length for the emendnetson voksne ehes be heroesed to include % In. beyond each elde of the base enetsf thicknese transinon et counterboro (2) Includes et en_ locadone 4dentified in ercordance with the nak4nformed eclection process (3) includestOO%of theemorrenettonlocation. Whentherequireden 2 - r or erseconnotbo ewendneddue to lrnerferenceby enother cornpenenter perr yeometry.emnodes- i be ewaluneedby ow tSe Teamfor ecceptatdnty Areas with acceptable emited eneminatione, and their beses, ehee be ^ -_1_ _ - _ .

The eneminettonsheNinclude eny longitudiraelwelds et tholocationeelectedfor eneminetlonin Note 2. The ter ; - 1^es_ ,Jirementscheebe met ter both trenoveresend perasseftewe e __ . .. _ _ 1-- gnag (4l in Note 2.

15) Inchosy-selected en_.--- locations are to be enemined in the same soevence during succeeolve inspection intervets, to the extent practical.

(6) Applies to med annee864 Asoy 600 norrte woede and heet effected rene (MAZ) w8thout strees ressf.

(7) Theex_./ _ _ J_ eshe9includethe.A; L _  ;" ; uweld, uveld heet affectedrone, end basemetet, where appucetpe.in the creviceregion. En_ - - _ 2. u- en estectionet crocereirunenaDend repagwom the inner surface.

($1 The emamer eDonvolume sheRinclude base rnetelpeping, welds. weld HAZ, tncludingtho piping neer the svedd. in the effectedregionsof terbonendlow ellos eteel, end the wonde and ee%f MAZ ef susterducsteet. Ememensmonsshes verifythe. - wetthictnesseequired. Acceptancaceiterieforlocekredthinningistncoureeafpropereden.Thees_ ^ ^endenemenstionregionsheebe aufficientsecherectoritethee=te .tof the ' idegradescon

19) en accordance w*th the Owner's e=4ettng FAC program.

(1 01 VT-2 eneminettons eney t>e conducted durine e system pressure tes er a pressure seen specWhe to shot _ .

42

6. ELEMENT 4: DOCUMENTATION The recommended format and content for a plant specific risk-  !

i informed ISI submittal are presented in this section. Use of this format by licensees will help ensure the completeness of the Submit information provided, will assist the NRC staff in locating the Proposed information, and will aid in optimizing the time needed for the Change review process. Unless otherwise noted, all information should be contained in the main submittal report.

This format follows the staff's guidance identified in the Standard ELEMENT 4 Review Plan Chapter 3.9.8 (Ref.17). Additionalguidance on style, composition, and specifications of safety analysis reports is provided in the introduction of Revision 3 to Regulatory Guide 1.70, " Standard Format and Content of Safety Analysis Reports for Nuclear Power Plants (LWR Edition)"(Ref. 22).

Table 6.1 provides an overall summary of the documentation information needed to support a risk-informed ISI submittal.

6.1 Risk Informed Inservice Inspection Program Plan The licensee's submittal should describe the proposed RI-ISI program with enough detail to be clearly understandable to the reviewers of the program. The description should cover the five items listed in Chapter 3 including sufficient detail such that reviewers of the program can understand how the program would be implemented. These items are: (1) changes to the plant's CLB, (2) changes to inspection schedules, locations, and methods, plus a description of the process used for determining these, (3) listing of aff ected components including an explicit description of any grouping of components, (4) identification of supporting information, and (5) brief statement regarding the way in which the prrsposed changes are consistent with the Commission's PRA Policy Statement.

The licensee's submittal should describe how its proposed RI-ISl program addresses the four principle elements of risk-informed decisionmaking (addressed in this d,cument) by defining the proposed change, basing the new program on traditional analysis with insights from pre abilistic risk assessments, and incorporating an implementation and monitoring program that enables the staff to conclude that the proposed RI-ISI program provides "an acceptable level of quality and l safety" required by 10 CFR 50.55a ta)(3)(i).

l The submittal should document the administrative procedures in place to imptoment changes into the PRA and traditional analysis and incorporate any relevant results into the RI-ISI program during and outside any periodic update. The submittal should b1 consistent with the guidelines  ;

i contained throughout this regulatory guide, or provide justification for an alternative approach.

The submittal should also include a description of the orocess that was used for the categorization of components (further discussed in Section 61.2) and for the determination of when formal interacten with the NRC is or is not needed when making changes to an appioved RI-ISI program (as described in Section 3.2). Exemptions from the regulations, technical specificatim 43

= ,

e-amendments, and relief requests that are required to implement the licensee's proposed RI-Isl program should also be specified and included in the application.

6.2 Engineering Analysis Records and Supporting Data The licensee's submittal should describe how the proposed (M-ISI program ensures that plant risk is maintained at acceptablelevels. The description should cover the four items listed in Chapter 4 in sufficient detail such that reviewers can determine whether the proposed plan ensures risk is maintained at acceptable levels. Theses items are: (1) illustrate that defense-in-depth is maintained,(2) illustrate that adequate sa'ety margins are maintained, (3) demonstrate that the proposed ISI program changes do not result in unacceptable risk to the public and plant personnel and are consistent with the guidelines identified in draft Regulatory Guide DG-1061 (r.nd presented in Chapter 4), and (4) support the integrated decisionmaking process. Items 1 and 2 are discussed in Section 6.2.1, and item 3 is discussed in Section 6.2.2. Item 4 is discussed in Section 6.3.

6.2.1 Traditional Analysis Records and Supporting Data This section should describe how the proposed RI ISI program continues to ensure that defense-in-depth is maintained (Item 1) and how the ISI program ensures that adequate safety margins are maintained (Item 2). This description should include a presentation of the decision criteria used to determine whether defense-in-depth (see Section 4.1.1) and adequate safety margins (see Section 4.1.2) are maintained and a discussion of how the proposed ISI program meets these

criteria.

• tt. b 6.2.2 Probabilistic Risk Assessment Records and Supporting Data This section should descr'ibe.1he plant's probabilistic risk assessment in sufficient detail to allow a reviewer to ascertain whether the PRA accurately reflects the current plant configuration and operational practices, and whether the change in risk is acceptable by providing discussions on the topics identified below.

6.2.2.1 Scope The application should clearly articulate tha boundaries for the scope of piping systems, segments, and elements to be included in the Rl ISI program as follows.

Piping Systems The licensee should document that the piping systems incorporated in the scope of the RI-ISI program include:

• All Class 1,2, and 3 pipes within the current ASME Section XI programs, and

• All pipes whose failure would compromise Safety-related structures, systems, or components that are relied upon to remain functionalduring and following design basis events to ensure the integrity of the 44

o ,

7 ,

L reactor coolant pressure boundary, the capability to shut down the reactor and

! ' maintainit in a safe shutdown condition, and the capabilityto prevent or mitigate j theSonsequences of accidents that could result in potential offsite ' exposure comparable to 10 CFR 100 guidelines.

j - Non safety related structures, systems, or components:

• That are relied upon to mitigate accidents or transients or are used in plant emergency operating procedures; or ,

i

a Whose failure could prevent safety-related structures, systems, or components from fulfilling their safety-related function; or ,

• Whose fsilure could cause a reactor scram or actuation of a safety related system.

In addition, the details of the process used by the licensee to determine the final piping systems list for the Rl-ISI program should be included.

Any systems excluded from the scope of the RI ISI program should be justified by appropriate documentation.

Pipe Segments- ,

Criteria or procedures used to establish pipe segments within the piping systems should be provided. Documentatic.n should be sufficient to allow a reviewer to determine whether consequences of failure, degradation mechanisms, and segment boundaries are property considered for defining pipe segments in accordance with the guidance in this document. Any deviations from the guidance in this document should be fully documented and justified.

Structural Elements Piping structuralelements included in the scope of the RI-ISI program should be documented to confirm those pressure retaining welds, base metal reeas, weld counterbore areas, nozzle welds, valves and fittings are subject to ISI in accordance with the guidelines provided in this document. Deviations from the guidelines should be documented in sufficient detail to allow NRC review.

Lota-if structural elements from more then one pipe segment are subsumed within one bt for purpose of statistical inspection sampling, as described in Appendix A4, then the criteria used and the justification for sabsum6ng the welds (elements) should be documented in sufficient detail to aBow NRC review and approval. For a hypothetical example, assume that four segments in a piping system are identical, with respect to degradation mechanisms and f ailure likelihood. Each segment may contain four elements, it may be argued that a random sampling strategy be developed by which the sixteen (4

• 4) elements are subsumed in one calculation (e.g., one lot comprising of 16 elements), versus performing four separate calculations for each segment (e.g., four /ots, with four elements in eaciilot).

45

1 .- .

1 V

i .

b 6.2.2.2_ Determination and Quantification of Accident Sequences y

This section should present the methods and techniques used to identify and quantify the accident sequences.- As part of the documentation, a table should be provdsd that summarizes how the PRA r ' model used to develop the risk insights compares with the PRA technical issues identified in draft ,

4 -

NUREG 1601. In addition, specific detailed information should be provided on identifying and j . quantifying initiating events; developing or modifying event trees; developing or modifying system models (i.e.,- fault trees); identifying, modeling, and quantifying passive component failures (i.e., pipe segment failures); identifying, modeling, and quantifying human actions;.

sequence quantification; and uncertainty / sensitivity calculations as described below. -

! Initiating Events j.

. The process used to identify initiating events and the results from the process should be j- documented. For the process, describe how it will result in the identification of all, or the l complete set ofi initiating events important to the ISI analysis, including those initiating i events that may result from the f ailure of ISI affected passive component (1.3., pipe segments).

j For each initiating event identified by the processi present: (1) a description of the initiating

event, (2) the rational for including or excluding the event, (3) the event's frequency, and (4) j a discussion of how the frequency was estimated, if individualinitiating events are collapsed

. . Into a group, describe the basis for such a grouping. - All information should be provided in the

! main report. '

i F Event Trees I

! The process used to develop the event trees should be documented. Provde exampio event trees that i

illustrate pictorially the logic structure. The description should include: (1) how the structure of the event tree was developed (i.e., what top events were included and why), (2) a description of each top event, including the success criteria for each top event, (3) and a description of each

t core damage sequence modeled in the event tree.

p System Model Fault Trees and Passive' Component Failures

. The fault trees used to model the oystems (top events) in the event trees should be documentM.

L in addition, the method used to identify and incorporate passive marveneat (pipe segment) failures I i into the analysis should be discussed, including the impact of each f ailure.

F l l For each system model, provide: (1) a graphic representation of the logic ctructure (i.e., fault

{. tree), (2)- a simplified piping and instrumentation diagram or a one-line diagram with all

' pertinent (both active and passive) componi.;-+= identified including any dependencies, and (3) a

list or graphic representation of all dependencies associated with the system. The grc.phical .

[ . representation of the fault trees should be provided in an appendix.

[ For the passive component (pipe segment) f ailures, provide e description of : (1) the method used -

j ..to identify the passive failures, (2) how the passive component f ailures are incorporated into

, ' the _ analysis, (3) the direct (i.e., the system or train function lost) and indirect (e.g., pipe j whip, spray impingement, and flood propaganon) impacts associate with the loss of each csponent, l l (4) how the failure probability for the passive component was estimatad using experienes data ,

f sources, structural reliability methods, and/or expert judgment, and (5) uncertainties associated l

+ q

'I with each 1ailure probability, (NOTE: The NRC's preferred approach to estimating the failure p probabilityof a pipe is the use of accepted fracture mechanics codes andoperationaldata. Use

- of expert e6etteden shouW be hdy dooumonted and the reenfts subm itte d to the NRC for-i krformenfon. This enables the NRC to monitor new degradation mechanisir,s and to monitor consistency within the industry. The NRC recommends that the use of expert elicitation be performed by an Industry group or professional society and the resuits Incorporated into the i.

fracture mechanics codes. This process ensures consistencyin industry-wideopplication oiRI-

/Siprograms.) The following information should be provided to document the estimated f ailure r probabilitiesfor each component / pipe segment and structural element within the systems being addressed:

• Failure mechanism (s) that dominates the overall failure probability j .

j . Flaw frequencies and size distribution used in the fracture mechanics calculations

• Assumptions used in calculating failure probability for every-failure degradation 1, - mechanism, including the qualification t' the method of analysis.

4 l

t = Failure mode (s) for the component (rupture, large leak, etc.) that was identified as having safety consequences

[

1

!

• Method used to estimate each failure probability i

• Estimated numerical mean value of failure probabilities for the identified failure l mode (s) and mechanism (s) (FIOTE: Table 6.2 provides an example summary ofpossbfe methods for obtaining failurepmbabilities based on specifieddegradation mechanisms.

' The staff recommends that hcensees provide such a table with supporahg ciiscussions.)

~

• Estwnsted numencal mean value of each segment's CDF used in the categorization and in the ACDF and ALERF calculations y

i . Overall f ailure probabilities for each system and for each pipe segment corresponding 4

to the total enntribution from all sub elemeats making up the systm or pipe segment i being addressed f a Detailed discussion (for each system) of the major contributors to the structural failure probabilities.

I 4

i. Human Actions l

The technique (s)used to identify and quantify human actions should be described. For each action, describe:-(1) how the action was identified (e.g., explicit identification of the;

- immediate response action for a specific initiating event), (2) what method was used to estimate i the f silure probability associated with the action (e.g., THERP), (3) which performance-shapirg (or performance-influencing)f actors were or were not considered,(4) how the f actors identified

[ in (3) were estimated, and (5) how the effects of the f actors identified in (3) were incorporated 4 into the estimate of the action's f ailure probability.

l 3

4 47 d

e

o . .

Sequence Quantification The method used to quantify the accident sequences should be described. This description should:

(1) identify what scftware package was used to quantify the accident sequences, (2) identify the truncation limit used to eliminate sequences from the analysis, and show that the truncation limit l conforms to the criteria as described in- DG 1061, (3) list the failure probability or unavailability value used for 6ach basic event in the analysis, incitiding any uncertainty associated with the event, (4) list the core damage frequency for each sequence a -alyzed, and (5) present the results and discuss the implications of the uncertainty and sensitiJity stuales.

Uncertainty /Ser sitivity Calculations The data used in any uncertainty calculations (i.e., unce.-tainty distributions for basic events or input parameters) and any sensitivity calculations (e.g., giving additional or less credit for operator actions than that considered in the base case) shou!d be provided consistent with the guidance provided in draft Regulatory Guide DG-1061. How uncertainty was accounted for in the segment categorization, and what sensitivity studies were performed to ensure the robustness of the categorization should be described.

l 6.2.2.3 Contribution to Risk and Risk Importance Measures for Pipe Segments Total CDF and LERF, prior to and following implementation of a RI-ISI program, should be documented and compared against the acceptance guidelines in draft Reg Guide DG- l061 and Chapter 4 to provide assurances that pressure boundary failures associated with plant piping systems do not impose an undue increase in risk., Apgrppdate assumptions (i.e., no credit for ISI when categorizing, credit for ISI for total CDE/L-ERP considerations) used to obtain risk-categorization values for ISI shou!d be documented.

importance measures sfiould.be documented and shown to be in accordance with the threshold values specifled in Appendix A2; of this document. The role of the QA program and thepmcedure usadby an appropriate panel to further review pipe segments andpiping stmctural elements that may be inappropriately categorized as low-safety-significant should be documented to provide assurances that the PRA stre .gths and l imitations, deterministic insights, op3rationalinsights, industry pipe failure data, and Maintenance Rule insights are taken into consideration.

6.3 Integrated Decisionmaking Process Records in addition to the general documentation requirements identified in draft Regulatory Guide DG-1061, provide a description of 6ach issue considered in the integrated decision-making process

- and a discussion of how the resolution of each issue impacts the original probabilistic categorization. Information should be provided in the main report.

6.4 Development of ISI Program Describe the ISI program. The licensee's program for monitoring the performance of both HSS and LSS segments should be described. The description if the RI-ISI program should include: (1) the inspection frequency or frequencies associated with each category, (2) the method or methods of 48

• a inspection associated with each element within a passive component, and (3) comparisons between existing ASME Section XI inspections and RI ISI inspections.

The applicant should provide adequate documentation that verifies that the degradation mechanisms, postulated fr.ilute modes, and configuration of piping structural elements are incorporated in the definition of the inspection scope and inspection locations. Selected inspection locations are reviewed to confirm that stress concentration, geometric discontinuities, and terminal ends are included in the inspection program, in addition, the documentation should verify that plant specificpipe erackina experience has been considered in selecting inspection locations. Sampling methods (e.g., the Assurance Level Sampling Method recommerxled by the Perdue-Abramson method are identified in Chapter 4 and Appendoc 4) used to identify elements to be inspected should be documentea, justifed and compNed to existing Section XI licensing basis requirements. The licensee needs to document if alternate methods are -

specified to ensure structural integrity in cases where examination methods cannot be applied due to limitations, such as inaccessibility or radiation exposure hazard. The licensee should document that its-RI-ISI program continues to perform pressure tests and visual examinations of piping structural elements on all Class 1, 2, and 3 systems in accordance with ASME BVPC Section l XI programs regardless of whether the segments contain locations that have been classified as high- or low safety-significant and high- and low-failure-potential.

The licensee should document that its proposed RI-ISI inspectx>n program argi examination methods and acceptance guidelines currently included in the ASME BVPC Section XI progr.4m are used as guidance. Examinationmethods and acceptance guidelines should be documented to ensure compliance with the acceptance guidelines.

- The procedure to evaluate pipes containing flaws that exceed the acceptable flaw standard should be documented to ensure that the techniques employed are in accordance with the acceptance guidelines.

As requred by the ASME Code, a record of each inspection should be maintained in which cuirvonent degradation and f ailures occurred and corrective action was required. Procedures should be in place which are initiated by piping f ailures that are detected by the RI-ISI program as well as by other mechanisms (e.g., normal plant operations, inspections, industry exps7ience, etc.).

Precedures should also exist to determine their impact on the plant PRA. Piping specific performance data should be used to support periodic PRA and RI-ISI program updates.

The submittal should also incle"4e a proposed schedule for initiating the RI-ISI program pending NRC approval.

6.5 Implementation Plans and Schedule The licensee's implementation plans should be provided including a proposed schedule for initiating the program pending NRC approval. Describe the process for determining when formal NRC review and approval are or are not necessary (Section 3.2). As discussed, once this process is approved by the NRC, formal NRC rewtow and approval are only needed when the procoes determines that such a review is necessary, or when changes to the process are requested.

49 n _

O

• 1 In addition, document the types of informationthat will be submitted to the NRC for information only, to enable the NRC to monitor operational experience by the industry, including new degradation mechanisms.

6.6 Quality Assurance The NRC expects that the quality of the engineering analyses conducted to justify proposed CLB )

changes will be appropriate for the nature of the change. In this regard, it is expected that for i traditional engineering analyses (e.g., deterministic engineering calculations) existing provisions for quality assurance (e.g.,10 CFR 50, Appendix B for safety related SSCs) will apply and provide the appropriate quality needed. Similarly, when a risk assessment of the plant is used to provide insights into the decisionmaking process, the NRC expects that the PRA will have been subject to quality control.

To the extent that a licensee elects to use PRA information to enhance or modify activities of' ctingthe safety relatedfunctionsof SSCs,the following,in conjunctionwith otherguidance contained in this guide, describe an acceptable way to ensure that the pertinent quality assurance requirements of 10 CFR 50, Appendix B are met and that the PRA is of sufficient quality to be used

. for regulatory decisions:

• utilize personnel qualified for the analysis

= utilize procedures that ensure control of documentation, including revisions, and provide for independent review, validation or checking of calculations and information used in the an#yses (an independent peer review can be used as an important element in this process) l + provide documentation and maintain records in accordance with the guidelines in draft Regulatory Guide DG-1061.

. provide for an independent audit function to verify quality (an independent peer review I

can be used for this purpose) a utilize procedures that ensure appropriate attention and corrective actions are taken if analyses or information used in previous decision making is determined to be in error.

Where performance monitoring programs are used in the implementation of proposed change to the CLB, it is expected that those programs wil! he implemented utilizing quality provisions commensurate with the safetv significance of affected SSCs. An existing PRA or analyses can be utilized to support a proposed CLB change, provided it can be shown that the appropriait, yuality provisions have been met.

l i

50  !

e e Table 6,1 Documentation Summary Table Pf% Certification Address the adequacy of the PRA model used in the cotulations.

Address the acceptance guidehnes in Chapter 4 of tNs document and in draft Reg. Gude 1061.

Failure Probabehty Calculations Address the method (s) used to calculate the feelure .)

probabikty/ frequency of a pipe element. Any use of expert shcitation should be fully documented.

Changes in CDF and LE'tF Address the change in total CDF and LERF resultang from the CLB program versus the RblSI program.

131 Systems identfy en the systems inspected beeed on the CLB programs and compere the systems for the RblSi programs. For the Class 1 and 2 pipes, provide e sc.iernetic degram identifying the CLB and RLISI

inspection locations and frequency of inspections.

Segmentation identify methods used to segment pipeng systems.

Categorustion ,

Idenefy methods used to categurue pipe segments and elements es

- HSS, LSS, HFP, and LFP.

Identrfy all the HSS and HFP elements Document additional piping elements that will undergo ISI. but are outside the scope of tNo document TNs wel ehminate future regulatory trusmterpretetson.

Somphng Method idenOfy the method used to calculate the riumber of welds to be inspected. Document the metwd used to estabhsh elements withen a lot to g., use of the Assurance Level or 06obel statistical semphng method es desenbod in Appenda 4, or alternative method 1.

Locations of Inspections Provide e system /peonng degram that overleys the emeting CLB locatons of inspection and overley the RklSI location of inspection.

Discuse the efferences.

Fedure Probebihees identify the methods used to emvo et the failure probabehties for pipe segments.

Performance Monitonng Discuss the performance goals and corrective accon programs.

Penodic Reviews identify the frequency of performance monr anng and activettes in support of the RblSI program. Address consistency with other RI programs (e.g., Maintenance Rule. IST. Tech Specs, etc.).

QA Prograrn Desenbe the OA program used to esaure proper imp 6ementation of RblSi process and categornation end consistency with ott - Rt programs.

Expert Ehcitation Identify any use of expert elicitation used to estmete e failure probabihty. Address the reasons why en expert ehcitation was required, provide en suoporting information used to by the experts, document the conclusaons, and address how the results will be incorporated in en industry date beso or computer code.

Each weld to be inspected Identfy: 1. the NDE method to be used

2. the apphcable degradacon mechervsm to be inspected.

and

3. the frequency of inspection Comphance wrth Regulanons Venty comphance with applicable regulations.

Def. nee in Depth Address any impact on defense in depth Safety Marpna Contwm edequate safety marpns omst.

Implementation and Monrtonng Program Address the Acceptance Guidehnee outhned in Cherter 5 of tNs Reg

) Guide.

51

.1 Table 6.2 Example Summary of Methods Used to Estimate Pipe FaRure ProbabEties for Risk C1;-:-kation ..

Failure Mechanism P.1ethods for Estimating Probability 1, '

Name of Contributing Failure Stainless Carbon Other Mechanism Factors , Mode Steel Steels Materials High Cycle Thermal Striping ( Crack Code Name Code Name Fatigue Flow induced Vibration i Initiation Failure Mechanical Vibration Database -

Crack Code Name Code Name Growth  ;

Low Cycle Thermal Stratification CrsM Code Name Code Name i Fatigue Heat-up and Cool-down Ini.tiation Failure  :

Thermal Cycling Database Cr$,ck Code Name Ccde Name Grbwth ,

Corrosion Coolant Chemistry Crack Code Name Not Cracking Crevice Corrosion initiation App!icable Failure Susceptible Material Database High Stresses Crack Code Name Not .

(Residual, Springing) Growth Applicable Wastage Flow Accelerated. Corrosion W all Name of Code Name of Code Failure ,

Microbiologically Ind. Corr. Thinning Database .

Pitting and/or Wear  !

Other Creep Damage Miscellaneous Failure Failure Failure '

Mechanisms Thermal Aging Modes Database Database Database ,

Irrad Embrittlement ,

52

O c

7. REFERENCES *

, 1. USNRC, "Use of Probabilistic Risk Assessment Methods in Nuclear Activities: Final j- Policy Statement," Federal Register. Volume 60, p. 42622, August 16,1995.

2. USNRC, " Framework for Applying Probabilistic Rick Analysis in Reactor Regulation,"

SECY 95-280, November 27,1995.

. 3. . Code of Federal Regulations, " Energy," Section 10 CFR 50.

a

4. American Society of Mechanical Engineers,Section XI, Rules for Inservice Inspection of

- Nuclear Power Plant Components, ASME Boiler and Pressure Vessel Code,1989 Edition, New York.~

S. American, Society of Mechanical Engineers, " Evaluation of Inservice Inspection l^

Rct.sements For Class 1, Category B J Pressure Retaining Welds in Piping," ASME Section XI Task Group on ISI Optimization, Report No. 92 01-01, Revision 0, December 1994.

I 6. S. R. Gosselin et al., " Risk-Informed InseNice Inspection Evaluation Procedure,"

' Electric Power Research Institute (EPRI), TR 106706, June 1996.

7. WCAP-14572, " Westinghouse Owners Gf oup Application of Risk-Based Methods to Piping inservice inspection," March,1996.

8. USNRC, T.V. Vo, H.K. Phan, B.F. Gore, F.A. Simonen, S.R. Doctor,"A Pilot Application of Risk-Informed Methods To Establish Inservice inspection Priorities for Nuclear

- components at Surry Unit 1 Nuclear Power Station," NUREG/CR-6181, Rev 1, February 4

1997.

' USNRC, "An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions 9.

on Plant-Specific Changes to the Current Licensing Basis," Draft Rcgulatory Guide DG-l 1061, June 1997.

10. USNRC, " Inservice inspection Code Case Acceptability, ASME Section XI, Division I,"

Regulatory Guide 1.147, Revision 11, October 1994.

+

8 Copees of Commission policy statements. EPRI and WCAP reports referenced herein are available for inspection or copying

. for a fee from the NRC Pubiic Socument Room at 2120 L Street NW.. WasNngton, DC; the PDR's mailing address is Mail Stop LL-6, Washengton, DC 20555; telopMne (202)634 3273; fax (202)634-3343.

Copies of NuREGs are available at current rates from the u.S. Govemment Printing office P.o. Box 370d2, Washington DC 20402-9328 (telephone (202)512-2249); or from the National Technical Information Service by writing NTIS at 5285 Port Royal Road.

- Springfield, VA 22161. Copies are available for inspection or copying for a fee from the NRC Public Document Room at 2120 L Street NW., Washington, DC; the POR's anailing address is Mail Stop LL-6, Washington. DC 20555; telephone (2021634 3273; fax (202)634 4

3343.

Requests for smeio copies of draft of active regulatory guides (which may be reproduced) or for placement i

on an automatic distribution list for single copies of future draft guides in specific divisions should be made in writ ng to the U.S.

Nuclear Regulatory Commesseon, Washington, DC 20555-0001, Attention: Printing. Graphics and Distribution Branch, or by fax to (3011415 5272, i 53 w

. 4 .-

'j.

! 11. USNRC, " Design and Fabrication Code Case Acceptability, ASME Section 111, Division 1,"-

Revision 30, October 1994.

12. ~ USNRC, " Materials Code Case Acceptability, ASME Section Ill, Division I," Regulatory Guide 1.85; Revision 30, October 1994.

13. USNRC, "An Approach for Plant-Specific Risk Informed Decisionmaking: Inservice i Testing," Draft Regulatory Guide DG-1062, June 1997.

I

14. USNRC, "An Approach for Plant Specific, Risk-informed Decisionmaking: Graded Quality

Assurance," Ltaft Regulatory Guide DG-1064, June 1997.

l 15. USNRC, "An Approach for Plant-Specific, Risk-informed Decisionmaking: Technical Specifications" Draft Regulatory Guide DG-1065, June 1997.

16, USNRC, "Use of Probabilistic Risk Assessment in Plant Specific, Hisk informed 4.

j- Decisionmaking, General Guidance" Standard Review Plan, NUREG-0800, Draft Chapter 19, March 1997, t=

17. U. S. Nuclear Regulatory Commission, " Standard Review P!an for Risk-informed

Decisionmaking

Inservice inspection of Piping," Standard Review Plan, NUREG 0800, j' Draft Section 3.9.8, September 1997, p

18. USNRC, " Risk Informed Decisionmaking: Inservice Testing," Standard Review Plani NUREG-0800, Draft Section 3.9.7, June 1997.

4

19. . USNRC,1* Risk Informed Decisionmaking: Graded Quality Assurance," Standard Review Plan, NUREG Draft Section 16.1, March 1997.

)  ; 20.' USNRC, " Risk Informed Decisionmaking: Technical Specifications," Standard Review l Plan, NUREG-0800, Draft Chapter 16.1, June 1997.

i

_ 21. - USNRC, "The Use of PRA in Risk Inforrr. d Applications," Draft . NUREG-1602, e

i' 22. USNRC," Standard Format and Content of Safety Analysis Reports for Nuclear Power Plants l (LWR Edition), Regulatory Guide 1.70," Revision 3, November 1980.

e i

i.

i l

r i

?

54 4

m ,, , a- - . -. + e - -, n

Appendix 1:PROBABILISTIC STRUCTURAL MECHANICS COMPUTliR CODES FOR ESTIMATING FAILURE PROBABILITIES A1.1 Introduction This regulatoryguide does not require or endorseparticularcomputer rodes orpreclude the use of attemative codes to those citedhere as examples. Nevertheless, the use of validated computer codes is recommended for estimating failure probabilities, it is anticipated that use of validated and controlled computer codes willlead to a more, efficient and timely regulatory review.

In all applications the computer codes and associated :,tructural reliability and risk assessment (SRRA) models and methodology should be documented and/or referenced. Such documents should identify the f ailure mechanisms modeled, describe. the underlying analyticiengineeiing models, identify the parameters that are simulated as rondom variables, describe the input for these variables, and describe the numerical methods (e.g., Monte Carlo simulation) used to calculate f ailure probabilities. New compute. codes should be validated by comparison with results from 4 other generally accepted and documented codes, including applicable data.

Structural mechanics computer coder, are valuable tools for estimating f ailure probabilities of phing components. Such codes can evaluate the impsets of parameters relatea to component design, stresses, operating conditions, material characteristics, and fabrication practices on failure probabilities. Predictions of these models can be usefulin estimating both absolute and relative values of structural 8'"ure probabilities. Structuralmechanics ccmputer codes also predict the progress of degradation (e.g., crack growth) with time, and thereby provide a basis for selecting i appropriate inspection intervals. Figure A1.1 illustrates the capability of a structural mechanics computer Code. This Appendix provides the present criteria by which the NRC will judge acceptability of codes for use in estimating f ailure probabilities of piping components and a 1 detailed discussion of selected structural reliability Code issues.

10*

-t

~ N '

[. i3 4

',. .- . m i s'

, , ,,e.- % .._._._.

f t o

~

f.

'.. s,nse me a m 3i . . -

10 20 24 28 32 36 do 0 4 a 12 16 Plard Age.Yeaf5 Figure A1.1 Stress Corrosion Cracking PRAISE vs Field Data A1-1

i A1.2 Areas of Structural Reliability Code Review The areas of review of the structural mechanics computer codes include the following:

• Addressing the failure mechanisms under consideration.

Addressing the structural materials and component geometries under consideration.

l

.- Assuring that the structural mechanics models are based on pertinent engineering principais and approximations used in the models are appropriate. -

• - Assuring that the pmbabilistic aspects of the structural mechanics models address those parameters with the greatest variability and uncertainty.

Assuring that the model calculates failure probabilities using realistic considerations, without conservative or non-conservative assumptions that would inappropriately bias risk based categorizations towards particular systems, f ailure mechanisms or operating conditions.

The numerical methods, including Monte Carlo (or appropriate) simulations and importance 3

samplire techniques.

The inputs to the codes are within the imowledge base of the experts applying the Code.

Internally assigned (hardwired) parameters and probability distributions are documented and supported by available data and knowledge base.-

- Documentation 6 hnical bases of the model is available for peer review.

Limitations of the Code are identified and cautions provided for cases when alternative structural mechanics models and/or other estimation methods shouid be used.

Benchmarking with structural mechancs codes considered acceptable by the NRC such as pc-PRAISE.

Calculated failure probabilities are consistent with historical failure rate data from plant operating experience.

The development of the computer Code, documentation, and application are consistent with -

10 CFR 50, Appendix B quality assurance requirements. '

The evaluation should identifylimitations of the codes, and should establish the appropriate role (absolute or relative probabilities) for the calculated failure probabilities obtained from the-codes.

._ l A1-2

. o A1.3 Selected Structural Reliability Code issues A1.3.1 Loads and Stresses inputs f or loads and stresses to SRRA models should address both conditions anticipated during the design of the systems, and unanticipated loads that have become known only through operating experience at the plant of concern or at other similar plants. SRRA evaluations should use realistic input for loads and stresses and for occurrence rates of plant transients.

It should be noted that calculated stress levels in piping stress reports are generally based on conservative analysis assumptions, it is appropriate in the evaluations to treat such calculated stresses as upper bounds on uncertainty bands f or the actual operating stresses, with expected values being lower than those cited in stress reports. The exception may be stresses due to internalpressures which are subject to less uncertaintyin calculations than other stresses such as the stresses from restraint of thermal expansions.

Loads end transi$nts should be based as much as possible on actual operating experience rather than on design or bounding conditions. Loadings having low estimated probabilities of occurrence should not be neglected but should be addressed explicitly in a probabilistic manner in the evaluations. Given the computation effort of probabilistic calculations, the loading cases should be limited to those that have the largest potential contributions to component failure probabilities, insights from engineering calculations along with bounding estimates of loading frequencies and conditional f ailure probabilities should be used to eliminate from consideration those load cases and/or transients with little potential contribution.

A1.3.2 Vibrational Stresses Uncertainties associated with high cycle f atigue stresses, swh as from mechanical vibration and thermal fatigue, should be given special consideration in calculating f ailure probabilities.

High cycle f atigue applies whenever the number of stress cycles is su'ilcientlylarge such that

racks grow through the pipe wall thickness within a small portion of the desiqMifJ, given that the cyclic stress levels exceed the threshold AK for f atigue crack growth.

The following f actors govern the growth of such cracks:

Threshold AK In applications of the pc PRAISE Code, published data have been used to estimate appropriateir.r ts for AK,for stainless steels (4.6 ksi/in for an R-Ratio = 0.0; whereas AK, = 0.0 has been assumed for ferrew steels in accordance with the ASME Section XI. .

R-Ratio The structural mechanics models and inputs to these models should account for the impact of mean stresses on reducing the governing values of AKm.

Vibrational Stress Levels Because vibrational stresses are random in nature, the levels of these stresses are difficult to estimatein practice. Such stresses tend to be greatest fot smaller pipe sizes. The guidelines developed on the pilot application of risk-informed inservice inspection to the Surry 1 plant provide an acceptable basis for A1-3

estimating vibrational stresses, as follows, where the cyclic stresses are given in terms of a stress amplitude (i.e., % (0,n.. c.):

Pipe Diameter Upper Bound Median Cyclic inch Cyclic Stress, Stress, ksi ksi 1.0 6.0 3.0 5.0 2.5 1.25

> 10.0 1.0 0.5 l Occurrence Rate In most cases the probability that the vibration stress will occur is relativelylow, and also the duration of these stresses may be limited to the time periods of interm.ittentoperationof vibrationalsources such as pumps. It is acceptable to adjust calculated failure probabilities to account for these uncertainties.

A1.3.3 Residual Stresses l

Residual stresses can be the major f actor in the growth of cracks by the mechanism of stress corrosion cracking, and can also enhance crack growth by fstigue by increasing the level of mean stress as characterized by the calculated R Ratio. Guidelines developed on the pilot applicatlan of risk informed inservice inspection to the Surry 1 plant provide an acceptable basis for estimating residual stress levels. These guidelines recommend a lognormaldistribution with maximum stresses distributedby two stendard devlations, conesponding to 90 percent of the material flow stress.

These guidelines quantified the uncertainties in welding residual stresses, and addressed the possibilities that residual stresses can attain yield strength levels or can be essentially zero in other cases. Statistical distributions to describe uncertainties in residual stresses should be truncated at the material flow strength (average of yield and ultimate strengthe). Levels as high as 90% of the flow strength should have ralatively low probabilities corresponding, for example, to a 90* percentile of a lognormal distribution.

A1.3.4 Preservice inspection The off acts of preservice inspections by such methods as ultrasonics and radlography should be included either explicitly or implicitly in the calculation of failure probabilities. In most cases, such inspections are addressed implicitly through their effects on the estimated number and sizes of initial f abrication flaws, in such cases, the simulation of preservice inspection in the structural mechanics modells inappropriate since such a simulation would result in double counting of the effects of preservice inspections.

A 1 -4

A1.3.5 Proof Test it is recommended that the effects of proof tests performed after f abrication but before plant operation be included in the probabilistic structural mechanics calculations. Simulated f ailures

- that occur during such proof tests should not be included in the f ailure probabilities addressed by the inservice inspection program.

l A1.3.6 Leak Detection In calculating pipe degradation (leaks to ruptures) probabilities, the effects of leak detection from through wall flaws should be addressed, and pipe failures that would be detected by observations of leakage should not be included in the calculation of leak / rupture probabilities.

Leak detection can be due to explicit leak monitoring measures, or to detection of leaks by plant staff in the course of plant walkdowns or system testing. Leak rate calculations and leak detection threshoius used in the calculations of pipe fsilure probabilities should be documented and justified. The leak rate model in (Ref.1) is an acceptable basis for predicting leak rates from through well cracks.

A1.3.7 Fellure Modes (Leak Versus Brook)

= Failure probability calculations should address the failure modes of concern to the risk-categorization process, and should include the categories of smallleaks (through wal cracks),

large leaks that disable a system (labeled as a doeMnp Asat), and pipe breaks. The leak rate for the disabling leak category should be based on the consequences considerationsidentified in the plant PRA and safety analyses reports.

The methodology identified in Ref erence 1 is an acceptable basis f or predicting leakage through cracks for use in calculations of large leak probabilities and for simulating the impact of leak I detectionof pipe fallure probabilities. An example of an acceptableimplementationof this leak prediction methodology is currently part of the pc PRAISE Code.

A1.3.8 Servios Environment

- The service environments that affect both cucrosion rates and crack growth rates should se addressed in the SRRA rnodels. Such envronments are often described in the SRRA models in terms of discrete categories such as air versus water or high versus low oxygen environments. The selected environmants used in each SRRA calculation should be documented along with the rationale for the selections. Data bases used to devalop distributions of crack initiation and crock growth ratos should represent the range of operatir.g (,onditions expected for the structural component being addressed by the SRRA models in those cases for which the service environment is subject to large uncertainties and variations, the SRRA models can be structured to simulate these variations, and to use the models to simulate the effects of these variations on the resulting failure probabilities.

A1.3.9 initial Flew Size Dietvibutions Stresses at most pipe locations are sufficiently low such that the calculated f ailure probabilities are essentially zero, unless there is an initial fabrication flaw present at the structurallocation of concern (e.g., weld). Therefore', SRRA models should simulate the number, A1-5

size, and location of such fabrication flaws. These characteristics a,hould be estimLted and should be described statistically with distributions that are appropriate for the material, wall thicknesses, welding practices, and inspection procedures for the specific location of interest.

The documentaticn o' the SRRA calculations should describe and justify the number and sizes of defects that were assumed. The model developed in (Ref. 2) for simulating fabrication defects is an acceptable method for estimating initial flaw densities and size (depth and length) distributions. Applications of this model to pipe welds and data from detailed examinations of actual welds, suggest flaw densities of one or more defects per weld, but with les than ten percent of these flaws being inner surface connected. The flaw depth distributions from this model can be approximated by a lognormal distribution with the mean flaw depth being on the order of the thickness of one weld bead.

A collection of flaw distribution calculations has been performed with the modelin Reference 2 to support a pilot applicaan of risk informed inservice inspection for the pilot plant. These calculations addressed a wide range of welds, and the results provide an acceptable basis for estimating the numbers and sizes of flaws in most cases of piping welds. A future report will describe details of these calculations along with trend curves that describe flaw densities and l flaw depth distributions as a function of pipe wall thickness, material (stainless versus ferritic steel), and post weld inspection (i.e., with or without radiographic examination). The results indicated the following trends:

. Flaw densities are best characterizedin terms of flaws per unit length of weld rather than in terms of flaws per unit volume of weld material. This measure of flaw density can be conveniently described by curves giving flaw density as a function of pipe wall thickness. / }'5 (

+ Most fracture mecharlcs i models conservatively assume that all flaws are surface breaking flaws at the pipe inner surface. Therefore, only a small fraction of the total flaw density should be-irEluded in the flaw density used in fracture mechanics calculations, in order to account for the fact that buried defects are less likely to cause failures than surface breaking defects.

. Radiographicinspection has a significantimpact on the number (density)of flaws, but relatively little impact on the size distributions of the flaws.

. The number (density) of flaws is similar for stainless and ferritic steels, b'it the probability of a very deep flaw being present is greater for welds in ferritic steel piping.

+ For the cases of manual metcl arc and tungsten inert gas welding processes, the number of flaws and the sizes of these flaws are insensitive to the particular process used to

_ make the weld.

+ The modelin Reference 2 addresses generalized basis for estimating the number and sizes of flaws in pipes, and is a method that covers a wide range of pipe sizes and f abrication practices. The final selection of the number and sizes of flaws has to be documented and submitted for NRC review.

A1-6

A1.3.10 Flaw initiation Operating experience shows many cases whereby flaws have initiated during service due to such mechanisms as stress corrosion cracking or f atigue associated with cyclic stresses (e.g., thermal f atigue). Unless service induced cracks can be justified to be negligible contributors to f ailure probabilities,the SRRA models for components should account f or the potentialcontributions of in!tiated cracks to failure probabilities. These contributions should be added to the contributions from initial fabrication cracks. Documentation of SRRA calculations should describe and justify the explicit or implicit approaches taken to address crack initiation.

Various direct and indirect approaches can be used to account for crack initiation. The pc-PRAISE Code provides an approach for simulating the initiation of IGSCC cracks. SRRA models for the mechanism of f atigue, including pc-PRAISE, do not yet simulate the contributions of f atigue crack initiation, although such of fects may be approximated through inputs regarding the number and sizes of very smatlinner surf ace defects. For example, (Ref. 3) assumed each weld had one small inrser surf ace flaw with the depth described by a uniform distribution ranging from 0.002 to 0.010 inch.

A1.3.11 Crack Growth Rates The prediction of crack growth rates by f atigue and by stress corrosion cracking is a critical step in the calculat.on of piping f ailure probabilities. Large experimental efforts are required to perform erack growth tests, and to develop predictive equations that correlate data bases from t laboratory tests it is recommended that probabilistic structural mechanics codes make use of l recognized and accepted correlations.

The correlations described in the documentation for the pc-PRAISE Code provide an acceptable basis for predicting crack growth rates for stainless and ferritic steels. These equations should be applied only f or the relevant materials and service conditions. Other crack growth relationships should be used to address materials and service conditions outside the scope of the equations developed for pc-PRAISE Such equations should be justified on the basis of measured crack growth rate data, the offects of mean stresses or R Ratio (i.e., KdK.), and should address threshou AK levels.

A1.'3.12 Mate-ial Property Variability Variability and uncertaintiesin material properties can be simulated by the SRRA models. Only those properties that have significant variability and/or for which the failure probabilities are particularly sensitive need to be simulated. Other properties can be treated as deterministic inputs. Typical variables that should be simulated in the probabilistic model include material strength levels, fracture toughness, and crack growth rates due to f atigue and/or stress corrosion cracking. Documentation for SRRA calculations should state which material property inputs were treated as deterministic parameters, and which parameters were simulated in the probabilistic model. The bases for assigning mean values, standard deviations, and distribution functions should be documented.

A17 o

)

i A1.3.13 Comparison with Service Experience The numerical estimates of f allure probabilities from SRRA models should be compared with the service experience for the structural components being addressed. In most cases the predictions will give very low leak and rupture probabilities. Calculations should be compared for consistencywith the plant specific expe6ence regarding leaks and dete':ted degradation. Since the f ailure probabilities for specific structural locations are almost alweys too small to permit meaningful comparisonc, it is recommended that comperisons of calculations with service experience also be made for the total fsilure probability for all components for each system. Data on pipe rupture occurrences will seldom, if ever, be available. Therefore it is more likely that data on leaks and detected material degradation will provide evidence that the ccmponent designs l and/or operational conditions are sufficiently severe to enhance the probability for pipe  !

ruptures, industry wide experience for similar materials, designs, and operating conditions should also be used as an additional basis to check the credibility of SRRA calculations.

A1.3.14 Effects of inservice inspection (CDF vs importance Measure Calculations)

As documented in the body of this report, one acceptable approach to RI-ISI programs consists of two components. The first component is the quantification of the total CDF (or ACDF) that results from the proposed change in the ISI program. The second component is to categorize a pipe segment as high or low safety significant.

For calculating the total CDF (or ACDF) from changes to the programs, the calculated pipe f ailure probabilities should be consistent with the operations and procedures of the plant. That includes effects of the inservice inspection programs.

However, when calculating iallure probabilities for use in establishing risk importance measures to be used in component categorizationscheme, the analyses should assess both the offects of implementing inservice Inspection programs (ISI) and the offects of no inservice Inspection programs.

To support the development of effective ISI programs, SRRA modeling should also be applied with the simulations of inspections to evaluate alttunative inspection strategies. .Two critical inputs to such SRRA calculat' ns are the inspection method (as characterized by a probability of detection curve), and the time interval between the inservice inspections. Inputs f or detection probabilities should be relevant to the materials, component geometries, and degradation mechanisms for the structural location being addressed, inputs for detection probabilities should be documented and justified.

A1.3.15 Cumulative Effects of Repeated / Periodic Inspections Failure of an inspectionto detect a particular flaw is often due to physicalfactors such as crack tightness, crack orientation, etc. Such factors can prevent detection regardless of how many inspections are performed. Calculations of the benefit of inservice inspection should assume that nondetection of a particular flaw in one trial will be correlated with the outcome

' (nondetection)during a subsequentinspection. Overly optimistic estimates of ISI effectiveness can be predicted if the alternative assumption of independent outcomes is assumed.

A1-8

A1.3.16 Review and Treatment of Uncertainties Uncertainties in modeling assumptions and inputs to calculation should be identified and quantified. Figure A1.2 identifies parameters that should be reviewed for their impact on the ,

calculated uncertainties. The use of conservative assumptions and inputs to address uncertainties c%uld be avoided since inflated values of failure probabilities can give unwarranted inspection priority to components at the expense of other components that may actually have greater safety significance. The uncertainty distributions for the calculated failure probabilities should be addressed in the PRA analysis.

< n - , .; s,a,o ., , <

~

FLAW W" lh/ WALL

/. >

f.p .g . ; ,

,,n CRACK GROWTil DEPT" 5 fA,7 TillCKNESS  ;,g ,

i: ' - y ,. -

'o -

, , ,, .q ,

.. V ,. ; ,

FL..W ASPECT ,. PIPE FLOW RATIO RADIUS STRESS

+ n a; '

i. , ,

ULTIMATE ~~# <:f. .en "

DEAD STRESS ,

PRESSURE LOAD

- s!bg 6 !.

J'

' > a;3,, . ri , (

p, . 4 . ; . ,

TIIERMAL NUMBER OF CYCLIC STRESS CYCLES ;g _ LEVEL STRESS ,

.. n 1

Figure A1.2 Example Of Major Parameters That Can influence Caloidated Pipe Failure Probability A1.3.17 Realistic Versus Conservative Calculations .

Structural reliability calculations should be based on realistic considerations rather than assumptions and inputs that ensure conservative estimates. The introduction of conservatisms on a selective and/or nonuniform basis for particular components or particular f ailure mechanisms will have the undesired ef fect of biasing the importance categorizations. The result can be inappropriatelylow categorizations for some pipes that are truly more risk significant. The use of conservative assumptions (to address uncertainties)should be part of the sensitivity studies.

Results of such sensitivity studies should go through a rigorous quality essurance (QA) process A1-9

. . )

l

)

or an expert panel as a potential basis for adding locations to the category of high safety-significant ISI locations.

Although there may be large uncertainties in the estimated failure probabilities, the relative values (e.g., from location to locationin a given system) are generally calculated with a higher level of confidence. However, even relative values can become increasingly uncertain, when comparisons are made from one system to another (due to different failure mechanisms, pipe sizes, materials /f abricationpractices, and operating environments), and for comparisons of different failure mechanisms within a given system. Sensitivity studies can be useful in evaluating potential impacts on risk categorizations due to systematic blasing of estimated failure probabilities from one system to another.

A1.3.18 Consideration of Failure Mechanisms The f ailure mechanisms of most concern for reactor piping are the initiation and growth of fatigue and/or stress corrosion cracks, and wall thinning by erosion corrosion. Each of these mechanisms will be addressed by separate structural mechanics models, either within a single computer Code or by separate computer codes. The mechanism of fatigue is a concern for both ferritic and stainless steel piping. Stress corrosion cracking is limited to stainless steel piping, whereas erosion corrosion needs to be addressed only for ferritic steels having susceptible material compositions and operating under specific flow conditions.

Calculations of f ailure probabilities are contingent on the availability of a computer Code that addresses the dominant failure mechanism for the piping segment of concern. The first decision, before any calculations are performed, ist,that,,o{ the adequacy of the selected Code to model the identified failure mechanism (s). The model mnt.not only address the relevant f ailure mechanisms, but the scope of the model must cover the specific material type and grade, and the relevant operational conditions 1 temperature, chemical environment, flow velocities, material heat treatment, etc.). ..

Inappropriate applications of structural mechanics models will result in calculated failure probabilities of no value for risk informed purposes. Submittals should provide justification that the scope of sdected computer codes addresses the components, operating conditions, and failure mechanisms of concern. Alternative methods should be used to estimate failure probabilities when there are no applicable computer codes.

A1.3.19 Ulaterials Considerations The governing f ailure mechanisms and associated failure probabilities are impacted by the particular types and grades of materials used to f abricate the pipe of concern. Some material considerations, such as yield and ultimate strength levels, are addressed by user provided inputs to the probabilistic calculations. Because materials related inputs are seldom known with precision, computer codes must simulate the uncertainties in these input parameters which are associated with the scatter in material properties.

Probabilistic structuralmechanics codes must address material parameters that are beyond the knowledge base of the expected Code users. For example, predictions of growth rates for f atigue and stress corrosion cracks are a challenge even to researchers working in this specialized area of fracture mechanics.Therefore, the users of SRRA codes must usually rely on the validity of A1 10

e .

def mult or hardwired values for erack growth parameters, or ute the guidance and/or examples given in documentation for the computer codes.

Acceptable SRRA computer codes should provide technically sound and documented approaches to predict crack growth rates. Applications of crack growta relationships should not require specialized knowledge of fracture mechanics, but should permit sufficient flexibility to permit more knowledgeable users to refine predictions of fracture mechanics models.

A1.3.20 Consideration of Component Geometries Probabilistic structuralmechanics codes are generally based on Monte Carlo simulations, which involve repeated deterministic calculations to calculate f allure probabilities. The large number of calculations dictates that the models be limited to relatively simple geometries, such as straight lengths of pipes with circumferential or axial cracks. Applications of the simplified models to more complex geometries involves assumptions and approximations. For example, inputs can specif y stres.ses for simplified models to numer!cally approximate the level and distribution of stress from a more detailed stress calculation performed with a finite element Code outside the framework of the probabilistic model.

Acceptable SRRA codes should address appropriate geometric considerations for the f ailure mechanisms of concem. For f atigue and stress cortosion mechanisms, the models should address internal surface circumferential cracks, with the ability to approximate the axial crack case.

Erosion corrosion models should address piping f ailures associated with enhanced levels of hoop stress due to wall thinning.

A1.3.21 Deterministic Structural Mechanics Models Since probabilistic rnodels are based on the repeated application (e.g., Monte Carlo simulations) of deterministic models, the validity of predicted failure probabilities depends on the correctness of the underlying deterministicmodel. As indicated above, deterministic models in probabilistic structural mechanics codes are generally limited to relatively simple structural geometries, with effects of more complex geometries addressed through suitable manipulations of the inputs that prescribe the levels and distributions of the stresses.

The critical features of the deterministic fracture mechanics models are as follows:

• calculation of crack t'; stress intensity factors as function of crack depth, crack length, crack orientation, applied stress level, through wall variation in stress, and residual stresses

• models for predicting subcriticalcrack growth (or wall thinning) as a function of stress intensity f actors, material properties, and operating conditions (temperature and chemical environment)

• models for predicting critical crack sizes and critical depths of wall thinning that correspond to piping f ailure by leaks or breaks A1 11

j i

A1.3.22 Selection of Probabilistic Variables l l

Once the deterministic structural mechanics model has been dsfined, it is then necessary to select those variables that will be simulated in the probabilistic calculations as opposed to those variables that will be treated as single valued deterministic parameters.

Variables selected for simulation should be limited to those with the most significant uncertainty due both to lack of knowledge and/or limited base of data or due to known variability (as indicated by scatter in data), in probabilistic structural mechanics calculations a typical division between deterministic and probabilistic variables is shown in Table A1.1.

Table A1.1 Deterrnination vs Probabilistic Variables

_ Deterministic Parameters Probabilistic Parameters Pipe Diameter Stress Level Initial Pipe Wall Material Strength Thickness Fracture Toughness Location of Fabrication Crack Growth Rates Flaws Number of Fabrication (Surface or Buried) Flaws Chemical Environmem Sizes of Fabrication (Air, Water, Oxygen Flaws Content, etc.) (Depth and Length)

Operating Temperature in many cases it will be necessary and appropriate to address certain probabilistic variables outside the framework of the structural mechanics Code. For example, the probabilities or f requencies of loading cases (e.g. pressure temperature transients for pressurized thermal shock accidents) may be the subject of ongoing detailed -valuations. Such decomposition of the failure probability calculations into a set of conditional failure probability cases can also facilitate sensitively calculations and the independent reviews of failure probability estimates.

Documentation f or probabilistic structural mechanics codes shcald clearly state which variables are treated as deterministic parameters, and which variables are simulated in the probabilistic calculations. The documentation should also state the distribution function (sl used to describe each simulated variable, along with user defined parameters (e.g. mean, standard deviation, truncation of distribution tails, etc.) and any distribution function that has been " hardwired" as part of the probabilistic model.

A1.3.23 Numerical Methods The accuracy and computationalefficiency of computer codes are impacted by the numerical approaches used to implement the probabilistic structural mechanics model. The most commonly used approach is that of a Monte Carlo simulation, since it has general applicability to complex physical phenomena involving interactions between variables and discontinuous behaviors. A Monte A1-12

i l

Carlo approach is also relatively straight forward to program and does not require advanced I mathematicalknowledge of probabilisticand statisticalmethods. Resulting computer codes will be relatively robust, but may lack in the numerical efficiency desired for ths calculations where i very low values of failure probabilities are of interest.

There are a number of acceptable numerical techniques to enhance the speed of f ailure probability '

calculations. For example, the pc PRAISE Code (Ref. 4) uses stratified sampling, and the Westinghouss structural mechanics Code (Ref. 5) uses importance sampling, in both cases the more i sophisticated sampling procedures are used as an enhancement to the underlying Monte Carlo simulation.

Care must be exercised in applications of enhanced sampling methods to ensure that the methods are correctly implemented and are not applied to model situations with complex probabilistic structures. For example, stratified sempling is precluded in the pc PRAISE Code for stress corrosion crackir., because pc PRAISE models multiple crack initiation sites and treats crack Interactions and coalescence, in all cases, the validity of enhanced sampling methods and their implementation should be verlfled by comparisons of numerical results with those from conventional Monte Carlo simulations.

The documentation for the computer codes should include guidance on selecting the user inputs that control sampling proceduros. Complex sampling procedures should be avoided if an unreasonable level of statisticatinsight is required on the part of new, occasienti, and inexperienced users of the Code.

A1.3.24 Assignment of input Parameters The user of a probabilistic structural mechanics codes has the responsibility of assigning the inputs for the calculations that address particular pipe segments. This task has as large an impact on the credibilityof the f ailure probabilityestimates as the developmentof the computer Code itself. Much of the discussions in this appendix bears directly or indirectly on issues related to the inputs for the calculations, it is not the intent here to repeat or summarize guic' nce provided elsewhea in this Regulatory Guide. However,the following steps will further the objective of consistent values for the leout parameters.

• Documentation for the Code should provide detailed guidance for assigning input parameters.

• Example calculations should be presented along with a narrative describing considerations used to assyn input parameters and the sources of data that support the assigned numerical values.

• Developers of the codes should provide training sessions for new users of the Code, should be available for consultation, and should organize workshops to permit interactions among the Code users.

• The Code documentation should provide guidance of a more prescriptive nature for those input parameters (e.g. flaw size distributions, crack growth equations, fracture toughness A1-13

. = - - . - --

I correlations, etc.) that are either outside the expected knowledge base of the Code users or where the expected variations in jud Cments made by several users could result in differing / inconsistent inputs.

+ To further the objectives of thu above bullet, a consensus process should be followed to develop the guidelines on suitable numerical values for the more difficult to definelnput parameters used in the structural reliability calculations. The objective would be to enhance the level of uniformity and consistency in the calculated f ailure probabilities that are used to support risk informed inspections.

A1.3.25 Supporting Data Bases Certain inputs for probabilistic calculations are outside the knowledge base of expected users of the SRRA codes. Examoles of such inputs are flaw density and size distrioutions and material characteristics related to crack growth rates and erosion corrosion rates. An essential part of developing a Code is to make a selection of suitable inputs available to the Code user, either as a menu of " hardwired" options or in the user documentation as recommended def ault values for consideration by the user.

A major part of developing a probabilistic structural mechanics Code should be the compilation of data bases for use in quantifying parameters of the model. An equally important task is the development of statistical correlations of the data into such a form that it is suitable for the computation models. Documentation of computer codes should describe the data and statistical correlations used to support the model along with the approaches used to derive the statisticd correlations. , ,,,,,,.

A1.3.28 Documentation and Peer Review Probabilistic structuralNe~chanics computer codes should be documented and subject to peer review prior to widespread disseminationand applicationto risk informedinspection. The scope of the recommended Code documentation is addressed throughout this appendix. Documentation is essential to permit peer reviews of the technical basis for the structural mechanics codes, and is also essential to pom)it correct and appropriate applications of the Code by the user community. Part of the peer review proces: should be trial calculations by independent outside users of the codes.

Such npplications will result in improved intilghts regarding the strengths and limitations of the computer codes and their associated documentation.

A1.3.27 Identification of Code Limitations it is essential to identify limitations of structural mechanics models to avoid inappropriate applications or f alse levels of confidence in calculated failure probabilities. Guidance should identify situations for which the codes ara e::pected to give the most accurate absolute values for failure probabilities, as well as other situations for which the calculations should be used as indication of relative f ailure probabilities.

The Code documentation should state the assumptions made in the structural mechanics models, and the expected impacts of these assumptions on the calculated failure probabilities. Limitations should be specifically stated regarding f ailure mechanisms addressed along with the applicable operating conditions in terms of temperatures, operating environments, material tynes.

A1 14

A1.3.28 Benchmarking with Other Computer Codes The predictions of probabilistic structural mechanics codes should, whanever possible, be benchmarked against results from other computer codes that have gone through peer review and validation, such as the pc PRAISE Code. Differences in calculated f ailure probabilities should ,

l be identified, and the reasons for any significant differences in the numerical results should be reconciled, Acceptence of a particular Code in the light of numericaldiffererces should be technically justified,if these dif ferences are due to improved modeling approaches or improved sources of supporting data.

Advances continue to be made in the field of probabilistic structural mechanics. Therefore codes will often not be available to support benchmarking of new and improved computer codes. In these cases, other approaches can accomplish the benchmarking objectives as follows:

• A matrix 6f demonstrationcalculationsto cover a wide range of input parameters which result in predicted failure probabilities covering the range from very high (i.e.

approachinguni ty) to very low (e.g less than 10 ' over the design life of the component),

. Sensitivity calculations covering all input parameters to demonstrate that changes to input values result in consistent changes in calculated failure probabilities, e belected benchmarking calculations that address consistency with operating experience in accordance with the 6scussion of Section A1.3.29 below. These calculations should cove both normal or design conditions, and also cases of actual (but unanticipated) operating conditions that have resulted in component f ailures or service related degradation.

A1.3.29 Consistency with Operating Experience Failure probabilities for most structural components are very low, such that f ailures are not expected to occur over the intended operating life of individual components. Few (if any) f ailures are expected to occur evan if a large population of similar components is considered.

This sparsity of data on actual fcitures, provides the incentive to use probabilistic structural mechanics models as a method to estimate failure probabilities. In this regard, probabilistic models predict component failure probabilities making use of the better known data on the individual variables (e.g. flaw occurrence rates, flaw sizes, crack growth rates, material strengths and fracture toughness properties) that govern the component failure probabilities.

However, there are large uncertaint!es regarding the assumptions and input data. Therefore, predictionsfrom probabilistic structural mechanics models should be compared for consistency with trends from operating experience.

The following toproaches are recommended for establishing the consistency of model predictions with the limited amount of data regarding faileres available from operating experience:

a in many cases there wil! be no reported f ailures corresponding to the conditions addressed by the structural reliability calculations. The calculations can be validated in the sense that the predicted f ailure probabilities are indeed very low, and are shown not to be inconsistent when no f ailures have occurred for a known population of components over a defined span of operating years.

A1-15

o e i

While operating experience may show no f ailures by the mode of pipe rupture, the data may j indicate other more common occurrences of pipe leaks and/or of detected cracks. Such data l should be used for consistency checks of calculated probabilities for pipe leaks and for crack growth to detecteblo depths. The occurrences of stress corrosion cracking and erosion corrosion at nuclear power plants have been relatively frequent, and can provide a basis for validating predictions of structural mechanics codes.

There are documented cases where unanticipated operating conditions (e.g. thermal fatigue and erosion corrosion) have caused reactor pi;x s to become severely degraded (cracking and wall thinning) over relatively short periods of operation. Such reports of service experience can be used to test the ability of a probabilistic structuralmechanics models to predict component performance under limiting situations of severe operating conditions.

• The literature documents studies in which piping specimens have been tested under conditions of fatigue and stress corrosion cracking. Such data can be used to evaluate the capability..of ths structural mechanics models to predict the conditions that result in relatively'high probabilities of failure.

A1.4 Formal Process for Validating and Updating SRRA Codes Ai, previously stated, this regulatory guide does not require or endorse any particular SRRA computer code. However, if such codes are used, a formal process for validating and updating the codes should be in place to ensure they rrpresent, and continue to represent, the best engineering fracts te mechanics knowledge available at the time of their use. The procus will also contribute to the uniformity and consistency of estimated failure probabilities for identical or similar components as calculated by different codes and/or by different organizations, and thereby enhance the credibility of the ranking and selection methodology. While the specifics detailing the formalized process for va'idating and updating an SRRA code are the responsibilityof those owning the code, the forrnalized process should contain the following general attributes.

The primary means of code validation should be by direct comparison of the code's rvsults with cpplicable historical and experimenteldata (both generic and plan specificMor each failure mechanism modeled in the code. Implicit in this is that such a source of historical data exists, collected, periodically updated as new information becomes available, and that muchanism specificf ailure probabilities have been determired or can be determined from the data.

• A secondary means of code validation is to compare a code's results with other codes that have already been successfully validated.

• As new information becomes available, either additional failures for known f ailure mechanisms, f ailures attributable to here-to fore unknown f ailure mechanisms, or new calculational techniques, this information should be incorporatei into the code in a timely fashion such that results from the updated code once again reflects the best current knowledge basis in the areas of fracture mechanics and numerical quantification.

The code's documentationidentifying the failure nicchanisms modeled, describing the underlying analytic /engineeringmodels, identifying the parameters that are simulated as random variables, describing the input ior these variables, and describing the numerical A1-16

e .

methods (e.g., Monte Carlo simulation) used to calculate f ailure probabilities should be updated as new information, models, or techniques are incorporated into the code.

A1.5 References for Appendix 1*

1. " Evaluation and Refinement of Leak Rate Estimation Models," USNRC, NUREO/CR-l

$128, Revision 1, June 1994

2. O.J.V. Chapman," Simulation of Defects in Weld Construction," PVP Vol. 251,

" Reliability And Risk in Pressure Vessels and Piping," The 1993 Pressure Vessels And Piping Conference, Denver, Colorado, July 25 29,1993, American Society of Mechanical Engineers,1993.

3. M.A. Khalect and F.A. Simonen,"A Parametric Approach to Predicting the Effects of Fatigue on Piping Reliability," ASME PVP Vol. 288, pp. I17125, Service Erperience and Reliability improvement: Nuclear, Fossil and Petrochemical Plants,1994.

4. D.O. l{arris and D.D. Dedhia," Theoretical and User's Manual for pc PRAISE, A Probabilistic Fracture Mechanics Computer Code for Piping Reliability Analysis,"

USNRC,NUREO/CR 5864, July 1992.

5. B.A. Bishop and J.11. Phillips,"Prioritizing Aged Piping for Inspection Using a Simplified Probabilistic Structural Analysis Mode," ASME PVP Vo. 25, Rellability and Risk in Pressure Vessels and Piping, pp. 141-152, American Society of Mechanical Engineers,1993.

' Copies of Commission policy statements. EPRI and WCAP reports referenced herein are available for inspectior' or copying for a fee from tt NRC Public Document Room at 2120 L Street NW., WanNngton, oC; the PDR's mailing address is Mail Stop LL-6, WanNngton. DC 20555; teleptene (2021634 3273; f an (202)634 3343.

Copees of NuREGs are available at current rates from the u.S. Govemment Printing office, P.o. Box 37082. Washington, oC 20402-9328 (telephone (202)512 2249); or from the National Technicalinformation Service by wrmng NTIS at 5285 Port Royal Road.

Epringfield, VA 22161. Copies are available tot inspection or copymg for a fee from the NRC Pubhc oowment Room at 2120 L Street NW. Washington. DC; the POR's mailing address is Mail Stop LL 6, WasNngton, oC 20555; telephone (2021634 3273; f ax (202)634-3343.

Requests for single copies of draft or active regulatory guides (which may be reproduced) or for placement on an aute natic distribution list for single copies of future dratt guides in specific divisions should be made in writing to the u.S.

Nuclear Regu'atory Commission. Washington. DC 20555 0001, Attention: Prietting, Graphics and Distribution Branch, or by f ax to (3011415 5272.

A1 17

a .

I Appendix 2: USNG PHATO EVALUATETif CHANGE N RSK ASSOCMTID WRH CHANGES TO AN ISI PROGRAM This section discusses the wharacteristics of a PRA that are acceptable for use in developing risk informedlSI programs. The PRA provides the basis for calculating the impact of structurd failures on the CDF and other risk measures, and theraby provides a risk basis for establishing appropriateISI programs. TraditionalPRA approachas are generally suitable for this evaluations with some added refinement to address the passive failures of pipes.

The general methodology for using PRA in regulatory applications is discussed in draft Regulatory Guide DG-1061 with reference to draft NUREG 1602 (Ref.1), which provides guidance on the minimum requirements that a PRA must satisfy to be suitable for risk informed regulatory applications.

General PRA ssues specific to the development of a risk informedlSi program are discussed in Section 4.2. Detailed discussions on an acceptable quantitative approach are provided below.

The development;of risk informed ISI programs consists of two major elements. The fitst element quantifies the total risk impact that result from the proposed changes to the existing design basis ISI programs. Once the total change to public risk is evaluated, compared with the acceptance guidelines (decision metrics), and found acceptable, the second element will then incorporate risk insights (e.g., by use of importance measures)in the selection of pipe locations for inspection. Since the selection of pipe locations to be inspected is required to calculate the change in total risk impact, the process, by its nature, is iterative. One acceptable approach for performing the PRA analyses to assess the impact of the risk informer) ISl programs is shown in Figure A2.1. The procedural steps to accomplish this include:

. Determine Scone -- This defin'es th% bchpe of piping to !nclude in the plant PRA model.

(See Section 4.2.1 for guidance'6a~this step.)

+

. Develon PRAWlodel- This defines acceptable spproaches for modifying PRA models to include models foi passive components and their associated leak and break probabilities.

(See Section 4.2.2 through 4.2.5 forgeneralguidance.) More dettsiled discussions are provided below.

. Develoo Risk imonet of ISI Chanags - This determines the collective impact on risk from changes to inspectionin 3rvals, locations and methods for the plant piping. The risk calculated using the revised inspection programs is evaluated according to the decision guidelines discussedin Section 4.4 to determine if the revised inspection propr ms are acceptable. (See Section 4.2.6 forgeneralguidance.) More detailed discussions are provided below.

As noted in draft Regulatory Guide DG 1061, one principle that must be met to demonstrate the acceptabilityof a risk-informedsubmittalis a comparison of the plant's risk with the acceptance guidelines (decision metrics) contained in draft Regulatory Guide DG 1061. Thus, at a minimum, the licensee must perform an analysis that is capable of showing that any increase in the calculated risk is consistent witn those guidelines. The licensee also has an option of performing a Level 2 and a Level 3 PRA to demonstrate compliance with the decision matrix if such an analysis would prove useful to the risk informed ISI program.

A2-1

. a 3

Changes to the ISI progtam are not expected to have an impact on the accident progression analysis l or the perfermance of the containment structure. However,ISI program changes could af fact failure probabilities for piping in containment systems (containment sprays, etc.) and containment bypass probabilities (failure of inter facing piping). However, these can be modeled ,

simply by assigning new f ailure probabilities to the affected piping. Thus, changes to the ISI program do not irnpact the performance of the Level 2 analysis except to address the f ailure probabilities assigned to pipes. Furthermore, the methods for performing a Level 3 analysis are net affected by changes to ISI since the objective of a Level 3 analysis is to estimate the consequences of events modeled during a Level 1 and Level 2 analysis. Thus, Level 2 and Level 3 methodologies ere not further discussed in this document. Those ISI-related changes that impact the Level 1 PRA are discussed below.

DETERMINE SCOPE

• Identify Systems /Piplag to include .

• Identify lattiators to laclude DEVELOP PRA MODEL

• Develop PRA Models for Passive Components

• Assess LRellbood of Passive Consponent Failures ASSESS RISK IMPACT OF ISI CHANGES

• Asses: Change in Risk from Collective ISI Changes

• Perform Sensitivity / Uncertainty Studies t

Figure A2.1 Process for probabilistic analysis for risk informed ISI.

For the PRA to provide proper insights to the decisionmaking,there should be a good functional rnapping between the piping associated with ISI and the PRA basic event probability quantification.

Part of the basis for the acceptability of any RI ISI program is a demonstration by use of a qualified PRA that established risk measures are not significantly increased by the proposed extension in inspection intervals or reduction in the number of inspections for selected pipes ~, To establish this demonstration,it is necessary that the PRA includes models that appropriately account for the change in reliability of the components as a A2-2

e o i i

function of inspection interval (or frequency), the number of elements inspected, and degradation mechanisms. When feasible,it iri also desirable to model the of fects of an enhancedinspectim method. For example, enhanced inspections might be shosvn to improve or maintain componont reliability, even if the intervalis extended or the number of inspections reduced. That is, a better in=pection method might compensate for a fewer number of inspecions and/or longer interval betweeninspections. Licensees who apply for increasesin inspectionintervaland/or decreases in the number of inspected elements are expected to address this area,i.e., to proactively seek improvements in inspections that would comperssate for the increased intervals under consideration and/or decreased number of elements inspected. Licensees are erwouraged to employ enhanced inspection techniques to improve detection of degraded components. This includes both conscious efforts to improve inspections accord!ng to state of the art guidance, and, for licensees who wish to invoke credit for detecting degraded components, improvements in reliability modo!!ng of a basic event probability as a function of the inspection progaams.

As part of developing the risk impact of an ISI chango, the following steps should be performed:

(1) Identify all Rl ISI systems, and components.

(2) Identify all affected cut sets and AlISI related basic events.

(3) Review the method used to assess each affected basic event. Most fundamentally,the process should consider the effect of inspection strategy (interval and inspection method) on unavailability.

(4) Assess the effects that the <:hanges have on the base case CDF and LERF.

(5) Address degradation mechanisrns.

(6) Address uncertainties.

(7) Address NRC's defense-in-depth considerations.

A2.1 Modelho Passive Systems in PRA Pipe leaks and breaks are traditionally modeled as initiators in PRAs (e.g., loss of coolant accidents (LOCAs), feedwater line breaks, floods), but the f allures are not normally modeled in detail. The PRAs focus on the system responses necessary to prevent core damage, rather than a detailed treatment of the probability of the initiator occurring. That is, they do not usually modelindividualpipe segments or the structuralelements within the pipe segments. However, since the goal of risk informed ISI is to detect ficws so that failures are averted in those structural elements that have a significant impact on plant risk, it will be necessem to use models that are more detailed than traditional PRA models. The PRA will need to be modified so that a more detailed treatment of the probability of pipe failures and the influence of such f ailures on other systems are incorporated into the model. Acceptable approaches for addressing pipe f ailures in a PRA are summarized in this section and illustrated in the flow chart shown in Figure A2.2.

A2.2 Determ!ne Consequences of Pipe Failures The direct and indirect effects of pipe f ailures need to be charecterized so that the appropriate failure mechanisms and dependencies can be incorporated into the PRA model. One acceptable means for incorporating pipe f ailures in a PRA is to consider three types of postulated pipe f ailures:

(1) leak, (2) disabling leak, and A2 3

9 0 (3) break.

Each f ailure mode has a likelihood for degrading syrtem performance through direct and/or indirec+

elfects. For example, leaks can result in moisture intrusion through jet impingement, flood, and sprays. Disabling leaks (larger break area than for leaks) can result in similar damages as described for leaks,in addition to an initiating event and loss of system function. Breaks can resultin all of the above mentioneddamages, including damages resultin'g from pipe whips. For each break sire, the analyst calculates a f ailure probability and consequences resulting from the postulated failure. A f ailure modes and effects analysis (FMEA) with system walkdowns identify the f ailurms required for the PRA calculations. The f ailure probabliity changes (decreases) as the break area increases (in tr.ost cases). Fracture mechanics computer models can be used to calculate failure probabilities. Acceptable methods

. PttFORM FMEA TO DETtkWINt E CONSEQUENCtl 0F PIPINO FAILUEE8

!$!!ET.'!3$7*M$"""'"

R$tAtt.18H PIPE SEOWENTS/ BOUNDARIES

. Po,tnee er P4Pe R.e fee bkb F.ne e et Aoy Pet.t Okse Se.e

• Y'SI!.U,.*,:.~r;',':Tr%L','.***"*"~

OFTION i OFTION 2

'r,.;..tJ;^,.n

c,, s w . . c.. . ...

,,.,,.,.,.,.1,.,

e.t,.*....

-. r =4 --- > a. .- -

Figure A2.2 Process for Modifying PRA to include Passive Components, for calculating f ailuia probabilities of pipes are addressed later in this report.

Examples of direct effects that can result from pipe f ailures include:

• f ailure that causes initiating events such as a LOCA or a reactor trip,

+ f ailure that disables a single tialn or system,

• f ailure that disables multiple trains or systems, and l

• failures that cause a combination of the above situations, i

Table A2.1 illustrates direct consequences postulated for several pipe segments, considering possible operator actions and their impact on the consequences for the plant examined in Reference 2.

A2-4 l

I 2

Indirect effects include f ailures to additional equipment (including equipment in other systems) as a result of pipe whip, jet impingement, or flooding An examination of indirect effects must also include a determinationof how operator actions can be affected by improper instrument indications that could result from equipment f ailures/malfunctionscaused by a pipe failure. A 4

FMEA is an acceptable structured approach that can be used to catalogue these possibilities. The evaluation should also consider the potential actions that plant personnel can take to recover

. from a pipe break event. An example FMEA, adapted from (Ref. 2), is summarized in Table A2.2.

I Additionalsources of information regarding the of fects of pipe breaks that should be considered include the plant hazard evaluations performed to meet requirement: of NRC's Standard lieview Plan (Ref. 3), and any intemal flooding analysis that has been performed at the plant"'.

1 Table A2.1 Examples of direct consequences from pipe segment failures.

, Segment ID Segment Description Postulated Consequence Postulated Consequence

, lwithout operator action) (w!th operator action)

ECCSO RWST to flow spht to LPSI, Loss of refueling water Loss of HWST HPSI, and Charging MOVs storage tank (RWST) 8812A,88128 LCVs 1120, 112E, V8884 and MOV 88o6 ECCS1* From CV8819C and Loss of RWST' Loss of all RHR and HPSI CV8818C to CV8847C .' ***'

ECCS 5' Flow from SI CV 8847A and Loss of RWST' Loss of all RHR, HPSI and

. ACC CV 8956A to join to one accumulator CV 8948A RCS 7 LPSI conndtion from Loop A Large LOCA with loss of HPSI Large LOCA with loss of cold leg tee to CV 8948A LPSI, and ACC injection to HPSI, LPSI, and ACC 4

one cold leg injection to one cold leg FWS1 Main feedwater f;ow from reedline break initiator Feedline break initiator MOV35A to gate valve FCV51o

• The onQ operator action that could be taken would result in closure of MV8835 (no HPSI to any paths) and Asure of MV8809A or B (loss of two LPSI paths). However, given the short time available to take operator actions following a LOCA where LPSIis required, no operator action could be credited with ckung MV8809A or B to save two injection paths. However, closure of MV8809A (or B) does result in preventing a loss of RWST.

' Dunng the ISI team of expert meetings, the postulated consequence (without operator actbn) was changed to a loss of RWST inside containment resulting in an earliar transfer to recirculation and the loss of one injection path.

A.9 operator recovery action could not be taken due to limited time and the difficulty in diagnosing the actual locatie of the break during a LOCA.

'Section 2.2 of draft NUREG 1602 describes the attributes of a traditional flooding analysis. The major difference between an ISI analysis and a traditional flooding analysis is that in the ISI analysis the direct and indirect efTects of each pipe segment must be considered and incorporated into the PRA model--no screening of flooding sources or propagation paths takes place.

A2-5

l l

Table A2.2 Example FMEA (Adapted from (Ref. 4))

Pee Segment FaBure Mechanism Failure Recovery Action Remarks (location arvi consequence pipe sire)

RWST to Vals s

• Concern with

• Loss of HPl + Cross Tie to e RWST is the primary source 1 CS-26 chloride SCC Mode Unit 2 RWST for the LPI and HPl systems (all locations) during injection mode

• 6 Welds

• Loss of Low e Follow EOPs e Movement of Head Sl Pump

• 2 Elbows j tank during Suction seismic event (16' diameter) (at o; bow e Loss of RWST nearest to tank)

A plant walkdov'n is required to assess the potential for indirect effects. Prior to a plant walkdown, exisuag documents (e.g., flooding analyses, etc.) that can provide insights l'ito possible indir6e+ effects should be examined. Possible sources of Indirect effects can be obtained from the olant's equipment qualifiustion program, hazards review program, and other documents that exaraine local effects of pipe breaks ior the systems in the ISI progrra. Systems and trains affected by a break in the area should be identified. The plant layout drawings, for areas not covered by tae documentation review, should be examined. Plant areas for which documentationwn not clear or specific equipment not listed should be identified and resolved.

One good practice for pre walkdown preparation is to develop summary sheets that examine the ef f ects of spray v,0tting, flooding, temperature, pipe whip, jet impingement, rot! ting machinery, and pressure bounda y ejected missiles. Fivelopment of such summary sheets should take advantage of the experiences yeineJ from the ASME's Validation and Verification pilot programs (e.g., Code Case N577 Virvnle Pc wer's Surry plant). The hazards evaluation should include the examination of the emergency estety features building, the auxiliary building, the diesel generator building, the fuel building, the recirculating and service water pump house, the turbine building, the containment bul. ding, and the. hydrogen recombiner building.

The personnel performing a walkdown thould include representatives from the following organizations or groups:

. FRA

. Piping

• ISI

. Operations

. Engl.ieering The following is an example of the results from a walkdown performed for the reference plant Reference 2:

"The walkdown of the turbine building resulted in several areas needing further consideratior for the PSA modeling. The turbine building component cooling water A2-6

l has a small surge tank and virtually any pipe break / leak will eventually fail the system which will I;ad to reactor trip. The three plant air compressors are i located side by side near the condensate pump discharge header. A postulated break in the header could potentially f ail all three compressors which would cause a reacter trip. The location of the motor driven and 2 turbine driven pu.nps makes the system susceptible to losing all pumps due to a pipe break."

l

" Hazards evaluatior concludes pipe break will not target cable trays, but shouki l further investigate effects of losing cable tray. No additional interactions i found. Train B valves located away from postulated break locations. Pipo break  !

will only offect FWA Train A. Need to consider the CCP interaction for inclusion in the segments analyzed."

An example of a walkdown worksheet documenting the information gathered is presented in Table A2.3.

A2.3 Pipe Segments One acceptable method for modeling a run of pipe in a PRA is to divide (segment) the pipe-run such that a f ailure at any point in the pipe segment results in the same consequences. Disti.ict segment boundaries are identified at branching points or size changes where a significant difference in consequence (e.g., where pipe materials change), or the break probability is expected to be markedly different due to environment or other factors.

An example of a system and some of its defined pipe segments is shown in Figure A2.3. In this example, ECCS pipe segment #1 is defined as a pipe-run between check valves 1 SI 241,1 SI 235, and 1 SI 79. Failure / break,of this pipe segment is postulated to result in the loss of the inventory of the refueCng water storage tank (RWST)inside containment. Similarly, ECCS segments 2, and 3 are defined for the other injection points into the RCS cold legs.

Another example of a pipe segment shown on Figure A2.3 is LHI pipe segment #1. This segment is defined as a pipe-run between check valves 1 SI-468,1-SI 47, and 1 SI 50. Failure of this pipe segment is postulated to result in loss of RWST nutside containment,resulting in the loss of all injection and recirculation.

The number of pipe segments defined for an ISI analysis will be plant specific. For the apoumiondescribedin Reference 2, the total number of segments defined and the systems are shevr 'n Table A2.4.

Givan that system boundaries involve system functions and may also involve interactions between different systems, the definition of these boundaries requires a careful, logical approach. All interf aces must be identified to ensure that there is consistency between the defined boundaries, when viewed from the systems on either side of each boundary, and that no safety functions ure overlooked.

A2-7

9- .

Telde A2.3 Example of walkdown worksheet. Adaptedfrom TaMr 3.4 2 of Reference 2 INDNIECT EPPECTS WALXDOWN WonKsHSET llam.f2 5 Buildnqi: ESF CuhlalalArea: 011 EsMaks 21*

• 6' indrent rtfinet of Cannernt Loos of Train A equipment due to any pipe break in area (aux. foodwater euction or d6scharge piping), including a CCP pipe.

ComponenteJSquipment in Cuhlale/Aeos System Cor. ,. Type lag. No. Train Needed for Safe Support System?

f Shutdown?

FWA Pump 3FWA'PA A Y N FWA Valve 3FWA'HV31D' A Y N FWA Valve 3FWA*HV31 A'- A Y N FWA Valve 3FWA'V48 A Y N FWA Valve 3FWA* AV81 A8 A Y N FWA Valve 3FWA*AV23A8 A Y N FWA Valve 3FWA'HV31 CO* S Y N FWA Valve 3FWA'HV31 C* 8 Y N-FWA Valve 3FWA'AVS20* 8 Y- - N ,

Commenta Cable troy numbers listed in Hazards Evaluation did not match those marked on the overhead trays in the room. Addetional checke needed.

Concluniana Apparent discrepancy with cable tray identifiere noted. Hasard Eval. concludes pipe break will not target cable traye, but ehtaald further investigate effects of losing cable troy. No additional interactions found. Train 5 valves located away from postulated break locations. Pipe break will only affect FWA Train A. Need to consider the CCP interaction for inclusion in the segmente analysed.

1. Located at for side of room from unisolable break-

2. Near pump

3. Located at postulated break location 4.' Located at far end of room away pump and postulated break A2-8

b 9 6

4 4

5

• -5 '

! I ]-

A j!

jf 4]I2 lA1A {4

~

f ' Al '

abh I

iii i

'E e::

l 22:

4- A' 1A

1 i 1

I 4.j.dji 4l'E -,'.g j ,' I .

a N

.,6 g_2- <

y4 n

~

g g i

4 O'> -

, S'yQ.- o ,

" ^

W $

'i,

+ .N. "_

,f,H.

k ab t[3j{ ! = b 5to a a s -

h f $ 4- . -

H- II.gR

!i  : t v' g

.....r ,

9 y

>, -- g-l>

u>

1 I I i

5

• E *K 2

x < .

e

> k i

l x, ' e l z

Table A2.4 Example list of piping segments 1 system Number of Segments

BDG (SG Blowdown) 4 CCE (CHS Cooll 2 CCl ($1 Cool) with SlH CCP (CCW) 14 l CHS (CVCS) 23 CNM (Condensate) with T WS DTM (Turbine Plant Drains) with MSS ECCS' 9 EGF (DG Fuel) 4

FWA (Aux Feed) 15 FWS (Feedwater) 19 HVK (Control Bldg Chilled . latori 1 MSS (Main Steam) 30 OSS (Quencht 5 RCS 66 RHS (RHR) with FIL RSS (Recirc) 1 '.

SFC (Fuel Pool) 4 SlH (HPI) 10 SIL (LPl: 13 SWP (SW) 29 TOTAL 259

• ECCS system was created to capture piping common to several systems including SlH. OSS and SIL.

' A2.4 incorporate Pipe Segments into PRA Model To adapt the PRA model for risk informed ISI, the initiators will need to be refined to reflect the direct and indirect effects of pipe breaks, if such breaks introduce new initiating events.

Similarly, events for pipe breaks that occur subsequent to an initiator should also be analyzed.

The effects of inservice testing of standby systems should also be addressed. These refinements can be made through various approaches. One acceptable approach involves direct modeling of the pipes in the PRA' fault trees (Option 1 in Figure A2.2). An acceptable alternative (used in (Ref.

A2-10

1 4

4)) involves using " surrogate components" that capture the of fects of the pipe f ailures (Option 2 in Figure A2.2).

, if Option 1 is used, new initiators may need to be added to the PRA model to reflect f ailures of the piping segments if such f allures introduce new initiating events if the pipe segment f ailure yields the same consequences as some other initiator already included in the PRA (e.g., a large LOCA), it could be accounted for by increasing the frequency of the initiator that is already included or by directly incorporating the pipe segment into a model (i.e. fault tree) of the initiating event. The importance of the pipe segmente can be separated out at the end by considering the fraction of the initiator frequency due to that particular pipe segment failure

or by grouping all cutsets with a particular pipe segment basic event. If the FMEA for the pipe segment identifies effects not included in any other initiator (e.g., spray effects that fall additional systems), then a new initiating event should be incorporated into the PRA. E.ent trees will need to be constructed for any new initletors that are added. Guldance for identifying initiating events and developing appropriate event trees is provided in draft NUREG 1602.

j When selecting Option 1, the PRA fault trees should be modified to model events corresponding to pipe segment f silures. The segment f ailure events can be included 2' as basic events in the f ault

. trees, i.e., incorporated as additional f ailure mechanisms for the event (s) impacted by the pipe segment failure.

I When using the second option to address pipe segmsnt failures in a PRA, the PRA is not actually modified, but instead the impact of pipe segment felures is calculated by modifying the results

, of an existing PRA. For this approach, surrogate components are identified whose f ailures capture

the effects of pipe segment failures. The risk ccrresponding to a revised ISI plan la then i calculated by adjusting the frequencies of sequences or cut sets containing these surrogate components. Section A2.6 discusses the calculations that are performed to obtain these results. <

Pipe f ailure frequencies will need to be determined for each pipe break initiator included in the PRA. Simil2rly, pipe segment f ailure probabilities will be needed for events included in the system models. These failures can reflect either f ailure pro %bilities (on demand) and failure rates (per heur or per year), and care must be taken to ensur' '5at the correct units are applied, i Acceptable methods for calculating failure prWbilities foi piping are discussed in Section A2.5.

i Pipe segment failure rates for normally operating systems are analogous to active component failure rates used in PRAs, where the rate is the number of observed failures divided by the number of years of operation. A f ailure rate is used for events such as initiating events (e.g., LOCAs and steam line breaks) and for systems that are continuouslyoperating (i.e., not demand based, such as a pump failure to run for a desired mission time).

The demand based piping failure probability is analogous to the active component failure probabilities that are used in PRAs, where the probability is the number of observed failures over

the number of demands (such as a pump failure to start on demand). The demand-based piping fsilure e

• Some PRA codes allow the user to transform an existing fault tree basic event into the original event plus some combination of other basic events (e.g., pipe segment failures). Use of such a Code feature is an acceptable alternative to actual fault tree modification.

A2-11

, .,_,,-, ,wr 3 -- _ _ -, n., -_-,v - - . , . . ...% - .-.. _.- .+- ,.,-~ ,-- .. - r

e e probabilityis used Ior events in which a piping segment /systemis in standby and is called upon to function given an event.

A2.5 Piping Failure Potential

. The process of estimating component f ailure probabilitie.. is at the heart of a quantitative risk-informed ISI program. Failure probabilities and f allure rates of pressure boundary components j are required as inputs to the calculation of CDF and risk, it should be noted that quantificatlan

.of failure probabilities (i.e., estimating the impect of ISI on reducing failure probabilities) is also part of developing a risk informed ISI program.

A2.5.1 Overview of Estimation Procedure ,

t Figure A2.4 shows the process for estimating f ailure probabilities. The steps are described as follows:

i e idhntify locations of high failure probability and their associated failure l

modes / mechanisms. The f ailuru probability should be for a break size that can j degrade a system from fulfilling its mission, it may be a leak that results in secondary f ailures, such as an electrical bus, a disabling leak, and/or a break.

• Review and revise the initial selections for high f ailure probability locations as well as the f ailure modes / mechanisms for these locations. This review may make use of a technical group (i.e., a panel) of individuals with specific areas of expertise in plant operations and maintenance, fracture mechanics, and PRA.

. Assemble the detailed data needed to estimate failure probabilities, including piping design data, loadings, materials, and operating experience, j . Estimate f ailure probabilities of criticallocatiants) for each pipe segment using historical failure rate data, structural reliability computer codes, or expert

judgment elicitation, if expert judgraent elicitation is required, then it should be performed generically through the A9ME or industry group and incorporated into the structural reliability computer Code. (NRC should be informed of such activities.!

a b

A2-12

e e l

Identify locations and failure modes 4

Review locations / failure modes Assenble data

~

Estimate failure probabilities for criticallocations l

1 Estimate failure probabilities for other locations I

. .[' -

.[ *i Calcu'e. , fal. ore

, ,, w probabilities 1

, Review probability l estimates l

1 Flaalize probability

, estimates I

l Perform sensitivity studies Figuru A2.4 General process for estimating failure probabilities.

A213

• Estimate relative f ailure probabilities for other less critical locations within

the piping segments using the probability estimated for the critical location (s) as the reference value.

• Calculate the overall failure probability for each system and tne combined probability for all plant systems.

• Review calculated f allure probability estimates. This review could be performed by the ISI team or by an independent panel.

+ Tabulate final estimates of f ailure probabilities for use in PRA calculations to estimate the CDF and/or risk associated with each pipe segment and/or structural element.

. Perform sensitivity studies to evaluate potential impacts of modeling and input data uncertainties in iallure probability estimates on estimated failure probabilities.

Detailed considerationsthat should guide the failure probability estimation process are provided below.

4 A2.5.2 General Guidance on issues t RealisticVersus Conservative Estimates- The objective of risk-informed calculationsis to make realistic estimates of failure probabilities rather than conservative or non-conservative estimates. The introduction of conservatism on a selective and/or nonuniform basis for particular components or particular failur4 mechanisms will have the undesired effect of biasing the CDF or risk estimates and the inspection fountions.

Effects of ISI - For CDF and/or risk calculations (LERF, ACDF), pipe segment f ailure probabilities should be estimated assuv. tM t ISI is performed during the plant's licensed period (e g.,40 or 60 years). Structurain ser a < alculations should include eff acts of inserviceinspections.

For segment categorization (disussedin this Chapter), no credit for ISI should be taken, in the application of historicaldata from operating reactor experience,it can be assumed that past ISI proscems for most components have had only modest impacts (if any) because the selection criteria focused on locations of high-stress /high fatigue usage (among other criterion) on component fa!!uro probabilitiu, while at the same time leading to unnecessary personnel exposure to radiation. One exception would H a situation where augmented ISI programs have been implemented (e.g., inspections for stress corrosion cracking of BWR piping, and inspections of piping for 4 erosion corrosion for both PB Rs and BWRs).

Aging Effects - The effects of aging mechanisms on failure rates should be included in estimating failure probabilities. Specific aging mechanisms known to be of concern to nuclear pressure boundary components are irradiationinduced embrittlementf or teactor pressure ves.sels and for vessel internal components, and thermal aging for cast stainless steel.

it should be noted that statistical analyses have not identified increasing failure rate trends, based on cc,mponent f ailure data, as a function of component age (Ref 5) and (Ref. 6). Such trends are consistent with results of computer calculations. Structural Reliability / Risk Acsessment (SRRA) rnodels of fatigue and stress corrosion cracking for typical operating conditions have indicated that f ailure rates should be very low, and that aging will not increase A2-14

O t f ailure rates until well beyond the design life of the components. H swever, aging affects should be considered ior those locations at which service induced structunt de:;p adation (cracking or wall thinning) is present.

Credit for Leak Detection Leak detection can provide advance warning of pipe degradation prior to break. For calculating the change in core damage frequency that results from changes to the inspection program, leak detection should be credited. However, when calculating the relative risk importance of a segment, leak detection should not be credited. The present defense in depth process includes ISI programs, operator walkarounds, leak detection systems, system tests, and pressure tests. These should not be credited in the importance measure calculations used for classifying a pipe as high- or low safety significant.

Failure Probability Calculation - Applying the guidelines outlined above (including additional criteria addressed later in this report), the failure frequency is normally calculated as a cumulative failure probability over the 40 or 60-year license of the plant (as justified) and divided by the number of years (40 or 60 ) to obtain the average rate of f ailure in any one year.

This process addresses aging effects calculated by the computer Code and results in an average failure rate on a per year basis. (See Section A2.5 for additional implementation details.)

Failures on Demand Versus Failure Frequencies - The term "f ailure probability" refers to both demand-related and time-relatedprobabilities. Section A2.6 of this RegulatoryGuide addresses

! the use of these measures of failure probability in the calculation of CDF and/or risk, and I

recommends methods for relating demand-related probabilities to f ailure frequencies.

Fisrc af components in standby systems will have safety consequences only if the piping fails er u > a failed state during the limited time periods when the system is required to mitigate an accident or to otherwise maintain the plant in a safe condition. Failure probability estimates should be apportioned to exclude pipe failures that occur and are detected during other periods, such as standby and testing modes, and are subsequently repaired, However, structural integrity evaluations should account for structural degradation (e.g., corrosion) that can develop during these non-demand penods, because such degradation can =%mtly lead to failures when maximum loads are applied to the degraded components for a demand situation.

Evaluations of standby systems should establish the likelihood of piping f ailures during periods of demand as opposed to f aiiures during standby periods or during periods of operabili9 Msting for which failures will not impact plant safety. It can be assumed that structural failures d' iring standby periods or during testing will be detected, such as by visual observation of gross leakage, and that the failed components are promptly repaired. The failure mechanisms and frequency should be compared with the calculated results.

Identificationof Failure Mode and Mechanism - As stated above,it is important to identify the appropriate f ailure mode (leak, disabling leak, or full break) for each individual component, so that the failure mode corresponds to the consequence addressed by the probabilistic risk assessment. In most cases a pipe break is the failure mode of concern, although in some cases a pipe leak (for jet impingement) or a disabling leak (for loss of system function) can also have safety consequences. While failure modes corresponding to a pipe leak may not be of concern from the s"mdpoint of safety consequences, such modes would be of concem from the standpoint of plant availability, economic impacts (which are outside the scope of this regulatory guide), or public perception (safety concern).

A2-15

i .

Operating experience on leaks md cracking, as well as other dete rtable modes of degradation, are significant to the risk informed ISI process. Such observations are often associated with conditions (i.e., design and material deficiencies, fabrication errors, unanticipated stresses, aggressive environments, etc.) that could cause a pipe break at another location in the system and/or during future periods of operation. This information should be used for estimating pipe failure probabilities.

Information on observed degradation mechanisms should also influence inputs to structural reliability calculations and used for benchmarking, such as done for the computer Code, pc-PRAISE (Figure A2.5). For example, structural reliability models predict (in addition the pipe break probability) probabilities of leaks and significant crack growth and/or wall thinning.

Uncertainties regarding inputs and modeling assumptions can be addressed by calibrating the structuraireliability codes to the trends of service experience, for example as has been done for modeling of stress corrosion cracking with the pc PRAISE Code (Ref. 7), and (Ref. 8).

10' . . - -

-g,,,

1e p "' N. ,c,, ,..n to.3 ,,,-

• s' .

i / s.* N n u 2 #

/ .t*

i 2 10 f,g. ,

/

s..a me ss e i i i

3 a . . .

24 26 32 36 40 4 8 12 16 20 O

Plant Age, Years Figure A2.5 Example Code -vs- Service Experience.

The estimation proct. dure should address each component (e.g., pipe segmer'.) and structural element (e.g., weld), and should assign:

. a dominant failure mechanism (e.g., fatigue cracking at the inside surface), and

. a numerical value for the f ailure probability, identification of failure mechanisms is a significant step. This information is an important input to the subsequent step of developing inspection strategies, since different failure mechanisms will dictate different inspection methods to detect the presence of structural degradation and damage.

A2-16

1 Common Cause Failures - Special situations that can result in CCFs should be identified as part of the f ailure probability estimation process. For example, extending the inspection intervals could make CCFs more important. CCFs are of concern only if the f ailures occur within the same 1 time period, as for example, during the course of a given accident scenario. The method of '

segmentation of pipes and requiring one element be inspected in each segment that is categorized as high safety-significant can reduce the likelihood for CCF by detection.

Situations that could result in CCFs that occur within the same time period include:

+ Piping that is not subject to routine pressure testing to verify its integrity. l Such piping could experience long term degradation (corrosion / wall thinning),

resulting in multiple failures when it is suddenly pressurized during a critical demand period of an accident scenario.

. Degraded Wping that is subject to routine pressure testing to verify its integrity, but is subject to over pressure conditions (e.g., interfacing system LOCA or waterhammer loads) during a critical <*emand period of an accident scenario.

. Degraded piping subject to severe loads from external events such as a seismic event.

• Multiple pipe f ailures caused by indirect effects from pipe breaks (e.g., a broken pipe swings and impacts an adjacent pipe causing the impacted pipe to break).

Undefined Failure Mechanisms - In some pipe run locations it can be difficult to identify any failure mechanism (either from plant sedice #klierlence or from SRRA calculations) that can result in other than very small failure probabilities. The arbitrary assignment of a zero failJre frequency is unrealistic and.could bias the ISI process by eliminating from consideration locations that have relatively'high consequences of failure. The technical approach should include a procedure for ehfimating zero frequencies (i.e., approximately 10'8 - 104 failures per year) for such locations to account for modeling limitations associated with very low values of calculated probabilities, and/or to account for uncertainties regarding unidentified failure mechanisms. The eesignment of such low failure frequencies is consistent wrth an expectation that plant operation is unlikely to experience significant material degradation. A potential failure mechanism should also be assigned to these locations to provide a basis for developing inspection strategies.

Failure Probabilities for Other Locations - Given the number of structural elements within each pipe segment,it is not practicalto perform detailed evaluations for each location (e.g., element or weld). The recommended approach is to identify the critical location (s) within each pipe segment which has the highest expected failure probability, and to focus the detailed evaluations on these locations. It may not always be clear withat detailed evaluations which of the structural location: within a segment has the greatest failure probability. In these cases, detailed structuralmechanics evaluations should be performed for each location. Additional evaluations can also establish relative differences in failure probabilities within the segment, and thereby provide an improved technical basis to assign probabilities.

A2-17

{

Having estimated the range of expected failure probabilities for critical structural elements within a segment, the failure probabilities can be estimated for the other less critical-locations. Typical estimates in pilot applications (Ref. 9) have assigned at least 50% (and typically 90% or'more) of the overall segment failure probability to a critical location. It is ,

important to make f ailure probability estimates for the other structural locations to determine  !

if a large number of small contributions from such locations contribute significantly to the overall failure probability of the segment.

Total _ Failure Probabilities for Systems A total failure probability is calculated for each system based on the probabilities estimated for the individual segments that make up the systems.

The total f ailure probability for pipe segments within a system is the sum of the individual pipe segment failure probabilities.These totals should be reviewed by the licensee to f acilitate the review of the failure probability estimates. Such system level information is more readily benchmarked with the limited data regarding pipe fsilures from plant specific and industry wide experience. Unreasonably large or small system level probabilities, when compared to data, should be cause to moddy the inputs and/or assumptions used to estimate the segment level f ailure probabilities. Total system level failure probabilities should also be reviewed to look for reasonable and consistent trends regarding relative contributions of particular systems and failure mechanisms to overall plant wide failure probabilities. All assumptions in the calculations should also be reviewed and revisions made as appropriate.

A2.5.3 Methods for Estimating Failure Probabilities This regulatory guide describes three acceptable methods for estimating f milure probabilities for piping, it is recommended that these methods be used in combination. - In typical applications, some aspects of all three methods will usually be used although one method may be the primary method. For example, while the primary method may be application of atructural reliability computer codes, some inputs to the computer model will be based on experts where data is lacking.

Similarly, experts make use of available data, including results from computer models..

Furthermore fsilure probability estimates,- from both experts and computer models, are always subject to " reality checks" by comparisons of the estimated probabilities with plant specific failure experience and industry wide historical data on failure rates. The degree to which one-relies on one method or another is predicated on the availability of experts and applicable structural reliability models.

Approaches for estimating failure probabilities include:

Historical Data _ Studies by Bush (Ref.10)(Ref.11)(Ref.12), Jamali (Reference 5), Thomas (Ref.

13), and Wright, et al. (Ref.14) have estimated break probabilitiesfor systems and components based on data from the few documented occurrences of pipe breaks aiong with additional knowledge

of the relevant number of years of plant operation. While such data bases will not fully reflect plant specific factors (e.g., operational conditions, service experience, materials selection, design features, etc.) needed for an individual plant evaluation, the information can serve as useful baseline data to guide estimates. Table A2.5 lists a number of sources of failure data that can be used to guide the estimation of piping failure probabilities.

A2-18

Table A2.5 Sourcas of Failure Data That Can Be Used to Guide Estimation of Failure Probabilities, oe(.ba.e Narreov. do.cripeon comm.nt R.f.r.ne.

NPRDS Computerized database maintal.ed Contains component hardware rehabihty. -

on behalf of electric utihty Covers exponence on maintenance, industry by INPQ inspection and repair of nuclear plant components LERs Computerized database maintained Contains information submitted by -

by NRC operating plants. Small fraction of reports deal with component / structural degradation and fsilure. Extensive screening required to locate information relevant to maintenance and inspection Plant records Maintained by individual plant and Useful information. Contains inspection, -

vendors of plant operating maintenance, and repair information.

experience Accessing this information involves commitments of time and money for

• visits to plants Expert Developed by NRC and national Contains f ailure probabilities and rates (Ref.15) elicitation laboratories. Provides useful of pressure boundary components and (Ref.16) information on undocumented field structures. Contains estimates of (Ref.17) experience important safety parameters useful for performing PRAs NPAR Summary (4 Wusion of NRC Describes service f ailures and (Ref.18) research on av *)egradation of degradation at operating plants i pressure bound.ry components

, Assessment of Utility industry prepared through identifies degradation potentially -

plant hfe NuMARC. Each rsport addresses important to plant safety extension issues for a particular type of component (e.g., pnmary coolant i system componental AsME Task Grous Special AsME, section XI Task A comprehensive review of operating (Ref.19) on Fatigue Group report. Reviews f atigue of experience, and describes occurrences nuclear power plant components of cracking and makes recommendations to AsME, section XI.

NRC Pepe Crack Formed by the NRC to evaluate the identifies potential solutions for (Ref. 20) causes of unexpected cracking of eliminating or mitigating reat tor piping (Ref. 21) reactor piping systems systems cracking y EPRI EPRl-sponsored study on material Contains information relating to (Ref. 22) degradation and environmental f ab% tion processes that contribute to effects on components for plant life degradation, identifies flaws in LWR extension components l

EPRI Computer software developed by Widely used by utihties (Ref. 23)

EPRI to predict piping locations sub,ect to erosion / corrosion EPRI A compilation of data on nuclear includes estimates of generic f ailure (Ref. Si piping failures. probabilities for particular systems.

INEL Summary of pipe break accidents. Inforraativ intended to use in (Ref.14) probannianc risk assessments Ref. 24)

Bush Review and interpretation of data Author brings perspectrve of Code and (Ref. 10) on piping f ailures and service regulatory issues. (Ref.11) related degradation (Ref. 12)

(Ref. 25)

(Ref. 6)

SRRA Calculations- StruCtura! reliability risk analysis (SRRA) computer codes use models based on probabilistic structural mechanics methods and can be applied to estimate failure A2-19

o .

l -

probabilities for important components. SRRA estimates can take into account a higher level of component specific information than methods based on historical data or expert elicitation. SRRA models can be particularly useful for estimating relative values of failure probabilities to

l. . permit locations within a system with higher values of failure probabilities to be identified,

SRRA models also predict the progress of degradation and/or crack growth as a function of time while quantitatively accounting for the impact of random loadings, such as earthquakes. These results can be useful for. selecting appropriate intervals over the service life of the components l~

i for periodic ISI examination. Section A2.5,4 of this Regulatory Guide provides example guidance

! on the application of SRRA models to the development of risk informed inspection programs.

The following steps should be applied in application of SRRA models for estimating failure

probabilities l . Select a structural reliability model(s) that addresses the materials, operating conditions, and failure mechanism (s) that apply to the structural location of i- concern 4

4

. Gather detailed data needed as input to the SRRA model including pipe dimensions, 1 materials and welding parameters, operating temperatures, operating pressures,

~

cyclic loadings, chemistry / flow rates for fluids, and operating stresses for i normal and upset conditions. ,

. Use design basis stress analysis as a source of stress data, i . Use plant operating staff knowledge to-address input parameters such as i susceptibility to IGSCC, wall thinning, and thermal high cycle fatigue.

l

. . Neglect effects of inservice inspections when defining inputs to the SRRA

. ' calculations which will estimate the f ailure probabilities to be used in the PRA.

4 i .

Review finalinput data for an appropthte SRRA, and follow guidance provided in Section A2.5.1 of this regulatory guide.-

i

. Calculate the failure probabilities.

f

. Assess values for calculated failure probabilities for consistency with operating experience and expert judgment. Identify inconsistencias in predicted probabilities for detectable degradation, leak probabilities, and break probabilities. Benchmark SRRA calculations with operating experience and expert input.

. - Document SRRA calculations by providing details of input data, modeling assumptions, and resulting values of calculated failure probabilities.

3 Expert input - Elicitation of experts has gained acceptance as a means to quantify input to PRAs i and risk based studies. A systematic procedure, as described by References 9,16, and (Ref.15),

has been developed for conducting such elicitations to address major industry safety issues.

Application of the procedure has been demonstrated in a research program that estimated failure A2-20

.- -..m.---,-- - . . ,,.--, . - - . .- - , , - , - .- y-. - . y--  ;-----~r-->m, - .

e i l

1

- probabilities for use in a pilot application of PRA methods to inservice inspection (Ref. 26) and Reference 6. (See Appendix 3.)

i The expert elicitation process is (as a generic methodology) applicable to any issue where there

! are large uncertainties, data are lacking, or predictive models are not well validated. As such, j the . methodology need not be applied directly to make estimates of structural failure 1: probabilities, but can be applied to address needed inputs to structural mechanics models. A full l scale expert judgment process as described in References 16 and 25 can be laborious and normally requires staff' and expertise outside utility capabilities. Therefore, if expert judgment j elicitation is required, it should be performed generally through the ASME or an industry group -

and incorporated into the structural reliability computer Code. (AaSanoe and conchahms Amm

. ' an eJrport eBoNeelenprogram shouWbe doownentedkr a Roannee's submNtalto the NMC.) For

example, inputs for crack growth rates, loading conditions, and flaw distributions could be addressed through an elicitation process, with full documentation of the process and results.

f- A2.5.4 Structural Reliability Computer Codes i

i Structural reliability computer codes are useful tools for estimating failure probabilities of l' poing components. These codes make use of probabilistic structural mecharucs methods to model the uncertainties and variabilityin such parameters as material properties, mechanicalloadings, operating environment variables, and flaw distributions. Some of the benefits of using such codes

are

I . The subjective nature of estimating failure probabilities is decreased. The

! judgmental aspect of the estimation process is reduced to a series of smaller

.- decisions regarding some sp#bific inputs to a structural mechanics model rather l than being combined into a singfe judgment needed to assign a f ailure probability.

l _

.(

i . A greater level.of consistency and uniformity to the process of estimating failure

! probabilitieris achieved. This adds credibility to the risk ranking process.

l' Regulatory reviews of failure probability estimates are facilitated since the

methodology and associated computer codes need only be reviewed once thereby I limiting reviews of plant specific evaluations to address only the inputs used for j- calculations.

[ . Structural mechanics mcdelt;, by simulating the range of uncertainties in governing l input parameters, provide an improved technical basis to conclude that pricula-5:

failure ' mechanisms can only make relatively small contributions to failure -

j probabilities.

. l Structuralmechanics codes modelthe physicalinteractionsof the various factors ll that impact failure probabilities. As such, the calculations can give good i predictions for relative numerical differences in failure probabilities from I segment to segment within a given system, and thereby enhance the credibility of j the categorization process (see Section A2.7).

. It has been demonstrated that structural reliability calculations can be performed -

l

relatively efficiently. Therefore, the time and costs to estimate failure probabilities can be significantly reduced compared to alternate approaches such l as with the_ formal conduct of an expert judgment elicitation.

! A2-21 l.

l

4 4

. Structural reliability computer codes provide reproducible results by independent parties.

. Knowledge gained from plant operating experience regarding observed degradation mechanisms and f ailures by leak or break (or lack of such observations) should be incorporatedinto the structuralreliability computer codes on a continuous basis.

There are limitationsto structuralmechanics computer codes, which must be recognized by the user:

. A structural mechanics Code may not be available to address the particular failure mechanisms or materials of interest. Inappropriate application of existing codes could give misleading predictions of failure probabilities. Code users must be i fully aware of the Code's limitations and resort to other estimation methods, as needed. The new estimates should be validated,incorporatodinto the Code, and reported to the NRC.

. There can be a lack of information to assign inputs to the computer codes. This means that expert judgment will be used in assigning input parameters to calculations rather than in a direct manner to estimate failure probabilities. The results of the experts should be fully documented, incorporated into the Code, and reported to the NRC.

. As with any techrucal computer program, a f alse sense of confidence can be attached to calculated f ailure probabilities, since many of the physical assumptions and numerical parameters used in the calculations are not evident to most users. For example, most users will have little basis to evaluate the applicability and reasonablenessof parameters associated with crack growth rate correlations and density and size distributions for flaws. A quality assurance program should be in place to ensure the proper selection of input parameters.

. There are uncertainties in the modeling of structural f ailure mechanisms and the quantificationof the inputs to the models. Therefore, a review of the estimated failure probabilities should be performed to determine if the probabilities are consistent with plant specific and industry experience regarding expected contributions from specific systems and f ailure mechanisms.

The applicability of the available structural reliability Code models should be cvaluated along with the feasibility of adequately defining the needed inputs to the model on the basis of available plant specific data. In those cases where none of the proposed modeling approaches are capable of calculating credible results, other methods for estimating failure probabilities, based on historical experience and/or expert judgment, should be performed, incorporated into the Code and reported to tne NRC.

It is recommended that calculations of failure probabilities with structural reliability models be performed when suitable models are available to address the component of concem. A number of suitable codes based on probabilistic fracture mechanics codes have been applied in the past, such as the pc-PRAISE Code (Ref. 27) and (Ref. 28). Simplified models (e.g., SRR4 computer Code) have also been developed (Ref. 29) and (Ref. 30). In general, these simplified models have been built from more detailed models, such as the pc-PRAISE Code.

A2-22 a.

. e c  :

a Appendix 1 provides a detailed discussion of structural reliability codes. The following

• summarizes the criteria for evaluating the acceptability of computerized structural reliability l codes for estimating failure probabilities of piping components: -

- Addresses the failure mechanisms under consideration.

t i l '* Addresses the structural materials under consideration, j

• Structural mechanics model based on suitable engineering principals and the

approximations used in the model are appropriate.

1 i-

• Probabilistic part of the structural mechanics model addresses those parameters -

with the greatest variability and uncertainty.

l-

• The inputs to the codes must be within the knowledge base of the experts applying j th,e Code.

I e Internally assigned parameters and probability distributions are documented and -

- supported by available data and knowledge base.

• Documentation of technical basis of modelis available for peer review. ,

j = Limitations of Code are identified and cautions provided for cases when alternative j structural mechanics models and/or estimation methods should be utilized.-

L j = Benchmarked with codes considered acceptable by the NRC such as pc-PRAISE. .

[

• Benchmarked with applicable data and operating reactor experience.

i

! = The development of the computer Code, documentauon and applicaten was conducted

in accordance with approved quality assurance procedures, i

A2.5.5 Screening end Sensitivity Studies for the Purpose of Categorizing Pipe Segments '

Screening and sensitivity studies should be performed to eliminate pipe segments from further

' consideration and evaluate the change in the calculated failure probability estimates and their l - potentialimpacts on the pipe segment prioritization or categorization process. Uncertainty in the calculated piping segment failure probabilities will contribute to uncertainties in the

[ ' calculated CDF and LERF. Thus, while performing the sensitivity calculationsidentified in (Ref.

j- 2) are necessary, additenal calculations should focus on those aspects of estimating pipe segment

! failure probabilities and other PRA related activities which could.significantly affect the

[  ; categorization of pipe segments, thereby impacting the estimate of a plant's CDF and risk.

, Particular emphasis should be placed on identifying and understanding the screening and

[: sensitivity studies that would move a segment from a lower risk category to a higher risk category and vice versa.

i- . -

i The objective of the screening and sensitivity calculationsis to remove from consideration pipe I

segments to-be included in the list of high safety significant segments. The following

?

I A2-23 i

i i

~ . - - - - - - - - -

t 4-I i

calculations can provide usefulinsights on how pipe segment categorizationcan be affected by j changes i_n a pipe segment's estimated failure probability. Other screening calculations should j be considered as appropriate.

. In some cases the calculated failure probabilities for pipe segments will be, for all practical purposes, zero -(incredible events). In such cases, a small

probability will be assigned to account for unknown / undefined f ailure mechanisms, i

! This is 'done to ensure that a pipe segment is accounted for in the PRA and

. categorization calculations. In the Westinghouse Owners Group study (Ref. 2), tSis  ;

4 minimum (bounding in the sense that no degradation mechanism can be identified)  ;

probability for pipa segments was taken to be a cumulative probability of 104 for l l a pipe rupture over the 40-year design life of the plant. Screenir'g calculation t should be performed to address the issue of truncation limit affects on categorization by assigning an even lower failure probability. This lower i pro %bility can be based either en the actual calculated probability (assuming that j- ' the numencal approximations gave a non zero number), or on an assigned probabelsty i with a lower value (say by f actor of 100 lower). If the results confirm a low risk

!' from these segments, categorize as low. -

j . Because estimated probabilities for certain failure mechanisms could be i- systematically high or low, a number of screening calculations addressing

[ systematic biases in estimating pipe segment failure probabilities should be performed. To perform these calculations, the failure probabilities should be l increased by a factor of 100 for all affected pipe segments, and the probabilistic l

model could be recalculated to eliminato the problem of truncation owing to the i increased failure probability. The following areas of concern have been J- identified:

i e Segments for which erosion corrosion is the failure mechanism of concem, i

• Segments consisting of small pipe sizes,

[ .- Segments containing ferritic steel, and

= Segments exposed to a common set of environmental conditions.

l If still low risk, categorize low, i

l .- Estimates of leak probabilities (through wall cracks) can be made with higher. level

'of confidence' than the corresponding estimates of pipe break probabilities.

' Probabilistic structural mechanics codes calculate- both leak and break probabilities. Therefore a sensitivity calculation should be performed that ~ s i replaces all disabling leak and break probabilities for each pipe segment with the

-leak probability for the segment, in _ addition,. leak probabilities could be

selectively used for segments governed by degradation mechanisms that tend to i promote the development of leaks (e.g., intergranularstress corrosion cracking).

! If still low, categorize low.

• Because operator actions can be important in mitigating the effects of a pipe break, sensitivity calculations should be performed that remove credit for all

[. operator actions incorporated into the PRA in response to specific pipe segment failures (e.g., operator terminates inventory loss from the reactor water storage i tank). . Additionally, a sensitivity study should be performed that increases the i

A2-24 i

i l

t

g failure probability by a factor of 10 of all operator actions to account for the possible additional stress associated with responding to a pipe failure, if still low, categorize low. 1 i -- *- If the initial pipe segment failure probabilities were cair.ulated assuming no '

2' credit for ISI programs, then a sensitivity study should be preformed where credit ,

is taken for these programs, if low risk, categorize low.

{

!. The effects of the above screening and sensitivity studies should be integrated the decision-j making process for categorizing segments as high- or low safety significant

+

1~

[ A2.8 Risk Impact from Proposed Changes to the ISI Program

1. e

! Applying a PRA model des loped in accordance with the guidelines outlined in this chapter, the j risk impact of the-proposed changes in the ISI program can be evaluated. The acceptability of the

[ change in risk due to the change in the ISI program is addressed in Section 4.4. To aid in that

, assessment, uncertainty and sensitivity analyses will be needed. General guidelines for these -

i analyses are provided in draft Regulatory Guide DG-1061 and draft NUREG 1602. ISI specific j- uncertainty and sensitivity analysis guidelines are addressed in the following sections of this

! document, p

! When using the first approach (Option 1, Figure A2.2) for incorporating pipe segment failures into >

the PRA (i.e., incorporating basic events representing pipe segment failures into the fault L trees), the risk correspondingto a revised ISI plan is calculated by simply requentifying the PRA j using pipe segment failure probabilitie's/frsQencies appropriate to the revised ISI plan. For j the second approach (Option 2), using surrogate components, the risk is calculated by adjusting the base PRA results to reflect the new initiators and events that simulate the consequences of  ;

j a postulated pipe failurer This Option 2 process is outlined in Figure A2.6. The calculations l- and the equations requirsa by this' approach are described later in the section (Ref. 2).

l-l In order to evaluate the risk impact from proposed changes to the ISI prog sn, one first uses the l

~

Option 2 approach 'vith the pipe f ailure rates calculated with credit for the current ISI program, and then with the proposed changes to the ISI program. The risk impact is the difference between j the sum of the piping failure contriLations to the core. damage frequencies as calculated with the j two different ISI programs. Realistically one should consider, when considering the risk impact F from proposed changes to the ISI program, the appropriate operator recovery actions for 3"lating

!' . the~ pipe breaks, with the appropriate human error probabilities.

The equations used in the Option 2 approach can also be used to find the contribution to the core

! damage frequency from each piping segmere for prioritization or risk categorization purposes.

l- For this case, the pipe failure rates without the inspections one is considering climinating

!' should be used, but other inspections can be included. The following discussicn provides additional clarification on this subject.

i Estimation of Failure Probabilities for Risk Categorizations l When using fracture mechanics codes to estimate failure probabilities,the fc!!owing conditions are used for risk categorization calculations:

i-

A2-25 i

{-

___ ._. _ _ _ . _ _ __. . ~. . ._. __ __ _ . . - . . .

. For piping segments that are included in augmented programs (such as erosion-corrosion and stress corrosion cracking programs), the calculated failure i

probabilities with ISI but without leak detection are used.

• For other piping segments, the failure probability without ISI and without leak detection are useo, amnis for Not Creditina Leak Detection & Operator Walkarounds in Risk Cateaorization l

Most fracturo mechanics codes can calculate a f ailure probability which credits leak detection at the defined leak rate entered as an input to the model. This leak detection assumes immediate detection of the leak and subsequent repair / shutdown, in addition, operator walkaround can also be ciedited to identify leakage.

However, the purpose of RI-ISI programs is to identify degradation prior to leakage and/or rupture. Theref ore, taking credit for these f actors would mask important piping segments that shou!d require non-destructive examination (NDE) inspection to identify the degradation prior to l

failure. Leak detection systems and operator walkarounds are recognized as additional mechanisms that ensure defense-in-depthin maintaining the pressure boundary prior to piping f ailures that j lead to initiating events or mitigating system failures.

Yes o rip. nr t c. o.h .. taie=*s it + Use Initiating Event Eqa. A21 CDFaw= FRaw

• CCDPaw 1 f No ye, n.m Pip. St..k Anut 0 4 MWs.m g syswet

+ Use Mitigatlag System Eqa. A2-2 CDF, = FP,

• CCDF,,

g .,a c. 1 is. a u me..e : + Use IE/ Mitigating Systems Equ. A2-3 y CDF,. = FR,

• CCDrawi.

pNo Pettern

. . . . ,S.e.hteWy

, ..y A..hsis t. De*-rei Care g SpeCISI Cases 1

Figure A2.6 Core damage frequency calculation process (adapted from Figure 3.6-2 of Reference 7,2).

A2-26

E 3

L CDF Calculations for Surrogate Component Approach initiating Events:

I For a pipe whose failure is an initiating event, the portion of the PRA model that is impacted is  :

the initiating event and its frequency:

CDFi c,% = FR ,% *CCDP.,% (EON _ A21)

where, CDF w = CDF_ from initiating event associated with failures of pipe segment I (events per year)

FRe g = pipe segment I failure rate (events per year) that results in the initiating event, assuming _ the appropriate ISI for the given case: for risk f prioritization, as discussed above in the paragraph entitled " Estimation of Failure Probability for Risk Categorizations"; for the current ISI program, the failure rates with the current ISl; and for the revised ISI case, the failure rates with the revised ISI program.

CCDP.,% = Conditional core damage probability for the initiator for pipe segment I (determined from the accident sequences and associated minimum cut sets given the pipe failure as the initiating event.)

FR % , the pipe segment failure frequency (in events per year), is normally calculated using an appropnate SRRA computer Code, such as PRAISE, or other applicable codes, for the appropriate ISI case. However, the SRRA codes typically provide cumulative failure probabilities over a specified time interval (40 or 60 years for this application). To obtain the failure rate, one only needs to divide the cumulative failure probability by the numbe of years the plant is licensed:

FR w =FP % /EOL where, FP,g,% = pipe seament failure probability that results in the initiating event for the appopriate ISI case EOL = number of years the plant is licensed (e.g.,40 years.- If remaining yects of plant license is <40 years, such as 20 years, then 20 years may be used as long as it accounts for aging / degradation effects over the 40 years of plant operation)

The conditionalcore damage probabilityis determined from existing PRA results or from solving the PRA model-if necessary to minimize truncation problems (see draft NUREG-1602). '

Mitigating Systemis) Consequence:

For pipe failures that cause only mitigating system (s) degradation or loss, the core damage frequency for the pipe segment is determined by the following equation: _

CDF,, = FP,,

• CCDF,, (EON. A2-2).

where, A2-27

_ _ . . _ _ . - - _ . . _ _ _ _ _ _ _ _ _ _ _ _ . _ _ _ _ ~._._

T 4 .

CDF_ from a pipe f ailure (events / year)

CDFm FPm = . Pipe break failure probability (dimensionless), for the appropriate ISI case

CCDF = Core damage frequency (CDF),in events / year, given that the segment is f ailed (PB- 1), minus the CDF, given that the segment is not failed (PB =0)

CCDF.,=-CDFm.,-CDF ..

When calculating the pipe failure probability, FPm, the contribution of inservice testing of pumps should be addressed. An exposure time'should be evaluated for a pipe segment and incorporated into the analysis. Exposure time is defined as the down time for the failed

= systems / trains, or the time the systems / trains would be unavailable before the plant is shutdown. . ,

it is a function of the test interval, the detection time, and allowed outage time (AOT). Two ,

types of pipe f ailures may be distinguished,for which tests of active components may be useful ,

- in thek detection in the first type of failure, the pipe fails while the system is in standby, l but the pipe f ailure is not detected until the next test. In the second type of pipe f ailure, the -

pipe degrades to the point where, on the next demand, either true demand or test demand, the pipe

f ails. in this second case one can call the pipe degradation occurring between tests a

• latent" f ailure. The pipe does not fail until the stresses caused by the test or true demand occurs, in addition, pipe failures may be detected immediatelyin certain cases, and not require a test to reveal the failure. Examples are normally operating systems, such as the charging pump system.

The key attributes in determining the exposure time are the system states when the pipe f ailure is expected to occur (standby, test, or real demand), and the time required for the break detection (means available to detect diversion of the flow) (Ref. 31). The f ailure may be detected by different types of tests, and this should be taken in to consideration. For example, some piping f ailures will be deucted by monthly or quarterly pump surveillance tests; others will be detected only by full flow system tests occurring during refueling. The exposure time, when multiplied by

, the pipe f ailure rate, gives the probability that an accident sequence initiating event, occurring -

at a random time, will occur with the pipe failed, or in a latent failure condition, so that it will f ail on demand. There is a second contribution to the increase in core damage frequency.

caused by a pipe break. Here, an initiating event occurs, and tnen the pipe break occurs _during the mission time for the mitigating system (say, 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />). The probability of the pipe break hcre is the product of an operating system pipe f ailurc rate times the mission time. The pipe break failure rate when the syste lis operating may oe different then the pipe break failure rate w on the system is in standby. -

- Two cases are distinguished, in the first case the system is normally in standby, and detection

_ occurs during a test of an active component in the system. In the second case, the system is normally operating; detection is assumed to be immediate.

Piping Failures in Standby Systems Here, one obtains CDFm~= (FPm / EOL)

• Twow

• CCDF.

. where A2-28

FP -is the cumulative failure probability over the number of years the plant is .

licensed to operate for the appropriate ISI case. I EOL is the number of years the plant is licensed to operate (e.g.,40 years) ,

Tax,osun, = 0.5

• Tw. m .n,,, + OT The term OT (outage time) here may refer to the Allowed Outage Time (AOT), if the plant would, for the particular piping failure be maintained at power for the allowed outage time, but this term may also be ths mean repair time for the piping segment,if the pipe is repaired in less than the AOT, or it may be only the time necessary for a controlled shutdown, if this is what would be done for the particular piping failure. The contribution of the pipe failure during the system mission time, after an initiating event has occurred,is here omitted. Because the mission time is short compared to the test interval, this term will have a small contribution.

To calculate the CCDF , a surrogate component (basic event or set of basic events, such as a pump or valve) that is already modeled in the plant PRA is identified in which the consequence or impact on the CDF matches the postulated consequence for the piping f ailure. The surrogate component is assumed to fail with a failure probability of 1.0 and the PRA model is solved to obtain a new total plant core damage frequency. This is the conditionalplant core damage frequency, given that the pipe is failed, denoted by CDFm.i. One also needs the plant core damage frequeTy, given the pipe is not failed, denoted by CDF .o, However, since the piping corr.ponent was not modeled in the i PRA (very likely), this is just the base case PRA, so that CDFm.o = CDF In any event, even if the pipe failure probability is in the base case PRA, its contribution is likely very small, and the CDF obtained is little different than the CDF with the pipe assumed not to fail. Therefore,

m., s.

CCDF = CDFm., - CDF. '-

Alternately, one can calculate,CCDFm by isolating the cutsets associated with the pipe segment, and quantifying them (with'the condition that the pipe segment failure probability equals unity).

The second method, the method of isolating the cutsets, permits one to perform an uncertainty analysis directly. If Instead, one calculates CCDF as CDFm., - CDFm.o, then, in performing an unce: tainty cnalysis, one must take into account the correlations between CDFm., and CDFm.garising from fact that the same basic evt.its occur in both calculations, and, although there may be uncertainty in the values of the failure probabilities for these events, the uncertainty distributions are completely correlated: for example, even though the failure probabili+" of a high pressure injection pump may be uncertain, it has exactly the same f ailure probability in both cases. The correlations ;an be taken into account by performing correlated Monte Carlo calculations.

Systems Continuousiv Onoratina:

For systems that are continuously operating before an initiating event occurs and are required to respond to the initiating event, the unavailability calculation may be calculated as:

FP,, = FRm * (T,n + 0T)

Where:

A2-29

0 4

! FP. is the failure probability for the appropriate ISI case 4

FR is the failure rate (in events per unit time)

T. is the total defined mission time (e.g., 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />)

L- OT, the outage time, is defined as for standby systems From the fracture mechanics comr%er calculations, the failure rate (in hours) is estimated by: )

i

{ FR = FP,x / (EOL years

• 8760 hrs / year)

) This equation can also be applied to piping segments that are continuously under constant static

pressure and are attached to storage tanks. Thus, the failure is identified by alarms and the i segment unavailability is immediately recognized, thereby eliminating the need to consider -

4 detection time; the exposure time consists only of OT, the time between detection and repair or shutdown. ,

i .

The distinguishing characteristic of continuously operating systems is the immediate detection of the pipe break. Also, since the system is continuously operating,it is legitimate to identify

the operating failure rate as the pipe failure probability at the end of lifetime, divided by the

plant lifetime. For standby systems, which spend most their time in standby, and not operation, l It may not be possible to do this. For such systems, as was done above, the standby failure rate l_ !s the failure probability at the end of life, divided by the plant lifetime, and it would be more difficult to estimate the operating failure rate. However, as mentioned above, the term involving

the contribution of the pipe failure during the system mission time is, for a standby system, i small, and the difficulty in. estimating the operating failure rate for such a system does not

+ introduce any real difficultyin estimating the contribution to the core damage frequency of a

pipe break in a standby system.

Initiatina Event ,and Mitimatina System

Dearadation Consecuence:

l For piping f ailures that cause on initiating event and mitigating system degradation or loss, core L damage sequences involving both events simultaneously must be evaluated. To evaluate this case, the event tree for the initiator which is impacted by the piping segment failure is requentified F with the surrogate component for the mitigating system assumed to be f ailed (that is, with a

-. failure probability of unity).- For piping failures that cause an initiating event and system degradation, the following equation is used

f 4

L CDF. - FFic.

• CCDP.,s, 3.o (EON. A2-3) i

- where,

- CDF . = Core damage frequency from a pipe failure (events per year) f' U FR.- = Pipe failure rate (events per year)

CCDP., 3.o = Conditional core damage probability for the initiator with mitigating system component assumed to be failed i

l The conditional core damage probability for the initiator is determined by the f ollowing equation:

CCDPm.s .i.o

= CDF.,,,,.i.o / FREO.

A2-30 f'

j ie o '

l p '

' where,:

k

- CDF(,,,,,.c = CDF from the initiating event with segment failed J

FREO. = lnitiating event frequency ,

Recall that the failure probability calculated with an approved fracture mechanics Code is

!( cumulative for the licensed period of the plan, and that the f ailure rate, for the appropriate ISI case, is therefore calculated as: l l_

i l FR,, = FP,, / EOL

!' annalai Cases l When applying surrogate ce wpo6 61 methodology, cases may arise where not all of the pipe break j: locations fit into the three categnrios described above and on Figure A2.7. Each pipe segment is  ;

j analyzed separately to determine the best calculational method. Some pipe locations may fall into L several of these categones depending on the circumstances. For example, a failure in the piping i segment in the charging system is postulated to result in a reactor trip and subsequent loss of l RWST. This segment has two separate cases consulered that are then added together to obtain the

total core damage frequency for the segment. First, the segment is modeled as a reactor trip and L . loss of RWST using equation A2 3; then the segment is modeled as a loss of RWST for the romaning j initiating events using equation A2 2.

Total Pressure Boundary CDF i

Each piping segment within the scope of the program is evaluated to determine its CDF due to piping -

i failure. Once this is computed, the total pressure boundary CDF is calculated by summing across . ,

l each individual segment. This provides the baseline from which to detemiine the risk importance i

measures of the segments that can then be used to categorize the segmsnts within ISI-issue. The I . total pressure boundary CDF provides a measure of the risk associated with the ISI program. The

- difference between the CDF calculated using the existing licensing basis program and the Rl ISI program describes a measure of the change in risk. For consistency, the base PRA should include the realistic pipe f ailure rates established for the RI ISI pipe segments.

A2.7 Selection of Locations to be Inspected OWNER

" DB EmBLE

. This section provides guidelhes and describes an M1URE &S g

! acceptable approach for selecting pipe segments snouswT rusencTion - LocATiow and . structural elements (e.g., welds) for ** * *"

l ' inspection in accordance with the risk-informed o g y n ,7,, ,t,, ,

inservice inspection programs. The selection of LO*-'^ituna ranssums TsSi iwsrscTiow l locations should be - based on the following EuE *E a ssYs**' o"w '

i considerations: EXAMINATiow PRoCBSS -

+ = The selected group of pipe segments Low-3AFETY HIGH SAFETY l and structural elements identified SloNIFICANT Slow 1FicANs*

I in the ISI programs should continue * * " " ** ""

l to meet the intent of all existing determ,nistic i requirements for ELEMENT 2 (Continued) j A2-31

O 4 structuralintegnty, such as defined by 10 CFR 50.55a, Appendix A to 10 CFR 50, and

[ the ASME Pressure & Vessel Code,Section XI.

l

• The propused inspection program, including the set of selected ISI locations,-

should meet the probabilistic criteria as described in Section 4.4.

i To meet the intent of existing requirements, the program should identify a set of inspection locations for which:

i

• Failures will have greatest potential impact on safety, and l

• There is's greater likelihood of detectable degradation and consequently a greater

potential for identifying piping degradation prior to failure.

}

!, Section A2.7.1 d - cribes one acceptable method for classifying pipe segments. Section A2.7.2 1 describee guidelines for categorizing structural elements within pipe segments based on the j likelihood for failure and safety classification associated with each pipe segment. Section

!' A2.7.3 discusses one acceptable strategy for inspections based on performance measures.

)

i A2.7.1 Methods of Selecting Pipe. Segments for inspection To maintain consistency with the intent of current regulatory criteria for inservice inspection

: programs, the selected pipe locations for inspection should address:

i Locations where f ailures would have greatest potential impacts on safety, and Locations where detectable degradation and consequently potential piping failures

[

are more likely to occur f 9st, . .

-For some segments, welds in nortain locations are known to be more vulnerable to developing flaws l

! or increasing the flaw size than other welds.' If some welds are known to be more vulnerable than E

others, the welds with the higher conditional probabiby or frequency for a flew growing to a leak 3

should be sampled first [e.g.,in a straight run of pipe, the degradation and fluid conditions may j- be similar for all elements, or welds. However, structuralmechanics analyses may be ab:. to

! identify.a subset of the elements as exhibiting relatively. greater stresses and'potentially greater (though still minimal) likelihood for identifying degradation when compared to all the

' elements in the segment]. While this procedure is biased compew with random sampling,it is biased in a conservative direction, provided only that the average flaw probability of the welds l

in the sample is larger than the average flaw probability of all the welds in the segment. If

there are some welds which are never sampled because they are inaccessible,the bias hat is introduced _ by this constraint can still be conservatlie, provided that the average flaw probability condition stated above still holds, i

Risk importance and Categorization - This section identifies an acceptable approach to incorporate risk insights for selecting inspection locations. Quantitative calculations of risk l~

contributions, as. identified in previous sections, are used to demonstrate that the risk

. contribution criterion is satisfied.

To augment engineering calculations and engineeringjudgment tr# ionallyused by licensees to select pipes fer inspection, this section identifies one acceptable approach to incorporate A2-32 l

L

a o I

) . quantitative risk insights in. categorizing pipes in terms of failure potential and safety l significance. These guidelines are based on quantitative information from PRAs and calculated i failure probabilities- for pipes. The calculations. provide the input needed to apply risk importance measures, which prov:de a means for categorizing pipe segments and structural elements in terms of their associated risk to the public. This regulatory guide does not imply that-

licensees can only base the selection process on calcutated ri

,k importance, although the use of

such measures can facilitate the selection of an optimum set of ISIlocations commensurate with risk.

1-For ISI prioritization or categorizing, a modified Fussell Vesely (FV) importance measure (FV. ,

) ca.n be used to categorize components (i.e., pipe segments) selected for ISI examination. Use

, of importance measures generally requires the determination of the total CDF or LEhF. For ISI l importance measures, the total COF or LERF used in calculating the modified FV importance measure I should be determined by summing the contributions of all pressure boundary failures in the plant l

piping systems. This ent"'es that the categorization of the pipe segments for ISI consideration is focused, such that the ISI programs developed from this categorization will ensure that

important pressure boundary failures in plant piping systems do not become major contributors to total plant risk (i.e., CDF or LERF) as a result of unexpected or age degradation mechanisms.

! -- Failure Potential Estimation - In this method, historical or service data, deterministic insights

(e.g., material, fluid chemistry, loadings, and inservice experience from the pant and industry),-

expert judgment, and/or structural reliability / risk assessment calculations are used *o estimate pipe segment and structural element failure probabilities. The preferred approach is to use structural reliability codes validated with applicable data. As highlighted in Section A2.5.3, if an expert judgment elicitation process is required, then it should be performed generically j through the ASME or an industry group an4 incorporated into the structural reliability computer j Code. Use of aapert adoNeelen abouW As superteId to the ARC florMorrnealon. The guidance of j' Section A2.5.3 applies to the estimation of failure probabilities. The use of conservative

[ assumptions in estimating failure probabilities (to address uncertainties) should only be used i as part of sensitivity studie's'to assess the impact on categorizing components. Results of such L sensitivity studies should be addressed in the decisionmaking process.

G f .importance Measures - General guidelines for risk categcdzation of components using importance

j. - measures and other information are provided in Appendix A to draft Regulatory Guide DG-1061.

These general guidelines address sceptable methods for carrying out categorization and some of L

the limitations of this process. The basic elements to be considered when implementing importance j measures include:

a.- Truncation Limits i b. Different Risk Measures

c. Comoleteness of Risk Model

d. Consideration of.all Allowable Plant Configurations and Maintenance States p e.. Sensitivity Analysis for Component Data Uncertainties

!- f. Sensitivity Analysis for Common Cause Failures i g. Sensitivity Analysis for Recovery Actions

- h. Multiple Component Considerations

- 1. - Relationship of importance Measures to Risk Changes

} j.- SSCs not included in the Final Quantified Cut Set Solution i

i 1~

f j A2-33 l

_ . -_ - - _ _ . -_ -. = - ---. - . - - - -_

-0 4 in calculating risk importance measures for the categorization process, the f ailure probabilities used for each pipe segment should not credit ISI inspections or leak detection, except for those in an augmented inspection program. (Note, this is not the case when evaluating the change in the CDF and LERF, as addressed in Section 4.2.) Guidelines that are specific to the ISI application are given in this section. As applied here, risk categorizationrefers to the process for grouping ISI components into LSS and HSS categories.

Risk importance measures from the PRA may be used as one of the inputs to the categorization process. Some components of interest to RI-ISI may not be addressed in the existing PRA, and so there is no quantified risk importanceinformation f or these components. When feasible, adding these componentsto the PRA should be considered by the licenree. In cases where this is not feasible, detailed discuens should accompany the application request that addresse how traditional engineering analyses and judgment (e.g., integrated decisionmaking process) were applied to determine if a component should be categorized as LSS or HSS.

In addition to cornponent categorization efforts, the determination of safety significance of components by t'he use of PRA-determined importance measures is important for several other reasons:

• When p. . formed with a series of sensitivity evaluations, it can identify potential risk outliers by identifying ISI components which could dominate risk for various plant configurations and operational modes, PRA model assumptions, and data and model uncerta .7 ties.

• Importance measure evaluations can provide a usef ul means to identify improvements to current ISI practices during the risk-informed application process.

• System levelimportance results can provide a high level validation of component level results and can provide guidance for categorizing ISI piping not modeled in the PRA.

While categorizationis an essential step in defining how the RI ISI program will be implemented, it is not an essential part of ensuring the maintenance of an acceptablelevel of plant risk. The sensitivity of risk importance measures to changes in ISI strategy (i.e., proposed for RI-ISI) can be used as one input to the overall understanding of the ef fect of this strategy on plant risk.

However, the traditional engineering evaluation, augmented with the calculation of change in the overall plant risk, provide the major input to the determination of whether the risk change is acceptable or not.

Criterion for Selection- Table A2.6 summarizes the guidelines used in the identification of high-safety significantpipe segments to be used in making the final selection of inspectionlocations.

The total CDF or LERF in the risk significance ovaluation should only account for those contributors associated with pressure boundary failures in piping systems. Pipe segments that exceed the FVi s,importance measure guideline range

• in Table A2.6 are classified as having a high safety significance. (Note: for this application,the denominatorin the FV importanceis limited

%c criterion in Table A2.6 is provided as guidance. Other criteria can be proposed by a licensee. If such criteria are proposed, the licensee must provide sufficient justification to ensure that important pressure boundary failures in plant piping systems do not become mejor contributors to total plant risk as a result of unexpected or age degradation mechanisms.

A2-34

s v I

only to the cumulative contribution of all pipe segments. It does not include contributions from

, other systun components.) Those segments with a value less than the range given in Table A2.6 are classified as having a low safety significance (LSS). The risk measures are then supplemented by sensitivity studies to provide estimates in the variability of these measures, The final categorization into HSS and LSS is performed using additional deterministic and qualitative insights and information. Plant design and operating features and their relationship to component categorization should be explored and understood;in some cases, this will result in changmg a component's ranking or category from what it might otherwise have been if based solely on the PPA results, and allow categorization of components not analyzed in a PRA.

Table A2.6 Approach to Overall Risk Significance Determination for Akernative Risk-Informed Selection Process for Inservice inspection f

Criteria

• Risk Importance Measure Pipc Segment

Quantitative Measures

Modified FV Importance Maasure (FVs,) > 0.001 - 0.005 j i The utility's submittal should identify a RAW value such that if RAW a a utility defined value for either CDF and LERF, the pipe segment could be Risk AchievementWorth considered as important (RAWi If RAW < the defined value, then the pipe segment could be considered as less important Sensitivity Studies Uncertainties items to be considered in the establishment of qualitative criteria mm

• Level of Redundancy

• System Trains i

• Groupings of Components into Supercomponents for modeling Qualitativo input purposes

• Truncation limits during quantification

• Operational Histories

• Others These example criteria apply to the use of a total CDFm or LERF,,,,o which is the total CDF or LERF attributed to pressure boundary failure in plant piping systems. A range of values is provided. The basis for the final selection criterion used in the submittal should be justified.

! A2-35 l

e a The use of the Risk Achievement worth (RAW) is an important measure that provides the risk impact from a pipe segment failure. It is the conditional core damage probability or conditional core damage frequency calculated for the pipe segment depending upon whether the pipe f ailure causes system unavailability degradation or an initiating event. The RAW identifies pipe segments whose f ailure has high risk impact and high safety impact and which needs consideration.

The categorization, where the judgment of the ISI team of experts is needed, is reached by consensus. Although most decisions of the ISI experts will be reached by 100% consensus, there 4 will be times when differing professional opinions will exist. These differences must be documented.

4 The process uswi to categorke the segments should be documented in a licensee's submittal to the NRC.

Cumulative Risk C~1tribution-In addition to the criterion of Table A2.6, the approachidertified in this regulatory guide requires a supplemental calculation at the pipe segment level. This calculation should demonstrate that the risk informed analysis of piping identified the piping that contributed 95% of thu plant risk CDFnne AND LERFnne. Figure A2.7 is provided as an illustration of a cumulative CDF risk diagram for a plant's piping.

100 4

80 o.

E 60 o

a / /

o ( ,/

1. '~ #

20 -

/

0/ ...........o. . . . . . . . .

Pipe Systems i

Risk-informed Inspection Program

--- Current Section XI Requirements Figure A2.7 Cumulative Risk Contribution of a Plant's Piping Engineering Corsiderations- While risk importance can guide the selection process, there are other deterministic considerationsthat should be integrated into the decision making process to ensure that the results of the selection process continue to meet the existing criteria, such as 10 CFR 50.55a and the ASME Section XI.

A2-36

4 9 1' '

?" Such engineering considerations includei Earfy Detection of Degradation Mechanisms - A goal of inservice inspection is the early' '

detection of new and unexpected degradation mechanisms. Accordingly, the selection of ISI

. locations should include locations where degradationis first expected to develop. These

locations may or may not be the same locations with the greatest risk contributions as

- ' identified by calculations of risk importance based on estimated consequences of failures i and break probabilities.

1 e

f The risk selection process should include a san.ple of representative locations within each j piping system identifit.1 as contributing to risk, thereby enabling the detection of j degradation mechanisms that may be active within the system. These locations should, in i part, correspond to locations for which the probability of degradation is considered greatest, independent of the calculated risk importance parameters.

i j:

• Leak Versus Break Probabilities - The selection process, including the calculations of.

risk impohnce, should use leak probabilities. Consideration of leaks is appropriate l since the risk importance it only intended for use in the categorization and selection process to indicate priorities based on the relative benefits to be gained from inspectirg

! a particular location.

Use of leak probabilities to augment the selection of inspection, locations is also

consistent with the stated objective of early detection of degradation mechanisms. In

! this context a pipe leak criterion serves to establish a definition for a significant level

{ of degradation.

. ~ m, s . .

! It lo also acceptable to use le'ak probabilities because the uncertainty for calculated i- leak probabilities is less than the uncertainties for calculated break prcbabilities.

Similarly there is.less uncertainty in the estimation of leak probabilities versus break

'~

probabilities. ,-.

+

Structural mechanics models often calculate very low probabilities that through wall

~

defects will result in breaks rather than pipe leaks. However, the associated fracture l mechanics calculations are based on many uncertain modeling assumptions and inputs (i.e.,

!- .. inputs for the defect sires, defect growth characteristics, and leak detection

!' capabilities) which can significantlyimpact the likelihood for pipes to break rather than

, - to leak. _ The use of leak probabilities in the categorization and selection process-

! minimizes the effects of this issue.

l If the calculated leak and break probabilities are similar for a pipe segment and the pipe segment is not found to be important from a risk viewpoint, but is on the borderline, then consideration should be given to add the pipe segment to the list for inspection due to non l probabilistic considerations.

i

~

- Operational insights - Reviews of the selected pipe segments should ensure that the proposed inspection program includes insights from operational and maintenance experience, using both information from the plant and relevant information from other j plants.

i l

l' A2-37

e. o

• Defense-in Depthi Reviews of the selected pipe segments should identify any proposed i relaxations of inspection requirements from prior practices and assess that effect on plant safety.

4 Relationship to Augmented inspection Programs Mandated programs for augmented piping

' ird.pections (e.g., boiling water reactor piping for stress corrosion cracking and balance of plant 4

piping for wall thinning by erosion / corrosion)should be taken into considerationwhen selecting i locations for inservice inspection. It is_ acceptable to coordinate otherwise independent I intpection programs by selecting common locations to the extent possible. This regulatory guide

does not eliminate the need to comply with the requirements of existing augmented inspection programs in effect at the plant.

i A2.7.2 Structural Element Selection Within Pipe Segments l The plant ISI engineering team reviews all pertinent information and determines the final safety 4

classificationfor'esch pipe segment included within the scope of the risk-informed ISI program.

[ The team uses qualitative and quantitative information associated with PRA and failure i probability calculations in cambination with classic engineering insights and design basis

' informetion to' develop the final classification categories of high-safety-significant and low-

, safety-significantpipe segments. This informationis then used to develop a matrix to assist in t

the selection of structural elements for examination, as shown in Figure A2.8, for all pipes included in the risk-informed ISI program.

l The criteria for determining how many structural elements should be selected for examination are

based on the safety significance of the segment and the failure likelihood within tnat segment.

The risk calculations used to support the safety significance determination involve combining consequences w ti h pipe failures that are initiating events and/or with pipe failures that occur on demand as a result of a plant event.' Engineeringinsights and design basis information also provide input to the classification of a segment as high-safety-significant.- In addition, the process is well established for the plant's engineering team, or expert panel (if used), to .

confirm that the segments were properly classified as either high- or low-safety significant.

The probability for pipe f ailure directly drives the need for an effective examination method (s).

- This attribute is categorized by a demarcation of "high-failure-potential" (HFP) versus " low-4 failure-potential" (LFP) (see Figure A2.8) using the following definitions:

Nigh FeihirePbrent/al- As determined by the engineeringteam," a segmentis of high f allure potentialif it has either an active f ailure mechanism that is known to exist, which may be currently monitored as part of an existing augmented inspection program, or altemativelyis

• Ihe engineering team, which is sometimes called the " engineering subpanel, the ' component ISI team" or focused structural element expert panel," consists of the following expertise b

i . Inservice inspection program 1 . Non-destructive examination methods

• Piping stress & materials

. Plant / industry failure, repair & maintenance experience A2-38

4 o 1

l analyzed as highly susceptible to a failure mechanism, w'iich could,in the future, lead to a leak or bresh The ISI team app:les engineeringinsights such as material, fluid chemistry, loadings, and inservice experience from the plant and industry experience to make this determination. Examples of failure mechanisms that would typically result in this classification are excessivo thermal fatigue, corrosion cracking, primary water stress corrosion cracking, intergranular stress corrosion cracking, microbiologically influenced corrosion, erosion-cavitation, high vibratory loadings on smell diameter pipes, and flow-accelerated corrosion.

HIGH FAILURE OWNER SUSCEPTIBLE POTENTIAL SEGMENT DEFINED ELEMENT ELEMENT LOCATION (Degradation mechanism INSPECTION PROGRAM -(100% inspection or usuaNypresent) (incorporates Augmerited NRC Approved Owner Pa > 10-' - 10* or inspection Programs) Inspection Program)

P.,,, > 10* - 107per 40 , war operating life 3 1 ONLY ELEMENT INSPECTION LOW FAILURE SYSTEM PRESSURE LOCATION SELECTION POTENTIAL SEGMENT TEST & VISUAL ELEMENT PROCESS (Oegradation mechanism EXAMINATlON (or NRC Approved not usuaRy present) Ownerinspection Program) 4 2 LOW SAFETY HIGH-SAFETY SIGNIFICANT SIGNIFICANT SEGMENT SEGMENT Figure a2.8 Structural element selection matrix Low Failure Potential- As determined by the engineering team, a segr.ient meeting this descriptionwould not meet the above criteria for a high f allure potential segment. Examples that would typically result in this classification would have no known failure mechanisms other than fatigue based upon ncimal and design basis loadings.

Probabilistic insights from SRRA results are used to confirm the engineering team's determinations. A segment should be considered to have a "high failure potential" if at any element in that segment exceeds any one of the two following criteria:

(1) P, > 10 5 - 10d per 40 year operating life (2) P,nux > 10 104 per 40 year operating life A2-39

- .. -- .- .. - - .-_-- ~ - - . -

e e SRRA sensitivity sadies have been performed which have shown that pipe locations with failure probablities below these values are essentially benign. Piping systems that do not exhibit a leak before break attribute could exceed the above break probability criteria even if the leak probability is determined to be less than the leak probability criterion. /n such cases, the break criterion would dictate that the segment be classified as "Ngh failure potential."

Figure A2.8, Ilustrates a four-region matrix for identifying locations for periodic examinations. The safetysignificancematrix is based on the probabilisticcategorizationof the pipe segments. The f ailure potentialmatrix applies SRRA tools, as appropriate. Each of the four regions has an examination rule base as follows:

Region 1 All susceptible locations in the segment identified by the engineering team as likely to be affected by a known or postuleted failure mechanism, must be incpected. Exceptions include existing augmented programs *' or other inspection prnnran a approved by the NRC,

! Region 2 TNe engineering team selects locations for examination in these segments based on the guidance provided in Section A2.7.3.2. In this region, a low f ailure potential was identified. In most cases, fatigue is anticipated to be the f ailure mechanism.

Based on the guidance provided, portions of the pipe segment that would expenence

{ the highest loads or highest degradation potential, would generally be. selected

^

for inspection, if the degradation potential is equally dispersed among the elements in a lot, then a random element (s) may be selected. At a minimum, one element will be examined to account for uncertainty and unknown degradation mechanisms in the segment or lot, and to guard against CCF. The NFC wi# consider i other owner inspection programs, as justified.

Region 3 All susceptible locations in the segment identified by the engineering team as likely to be affected by a known or postulated failure mechanism, and that are not already in an augmented program, will be examined in accordance with an Owner Defined Program and reported to the NRC (if not already reported).- While f ailure of these segments would have a minimal safety impact, the impact on plant operations may be significant in terms of unplanned outage time, repair costs, and other consequential impacts.

Region 4 Only system pressure tests and visual examinations are required for segments of low failure potential and low-safety-significance.-

System pressure tests and visual examinations are performed for pipes in Regions 1, 2, and 3, as well.

'While the initial categorization of pipe segments is based on probabilistic considerations, the utility is free to increase the safety significance of any pipe segment for reasons of their own choosing.

' Segments with failure modes that have established augmented programs (e.g., flow-assisted corrosion, intergranular stress-corrosion cracking) would be inspected in accordance with that existing program.

A2-40

j GM " .es for S '-h of I ~ =da..s in R-+-.s 1 and 2 The risk informed selection process includes assessments and evaluations of the pipe structural g elementsin each of the high safety-significantpipe segment. These structuralelements include i- the following examination items: ,

i +

all pipe welds, including those to nozzles, valves and fittiags such as elbows, tees, .

{- reducers, branch connections, and safe ends I .

areas and volumes of bau material and examination zones such as weld counterbore areas i and fitting material, as appropriate.

Welded attachments and pipe supports are not included in the assessment and evaluations.

For the high safety significant pipe segment exhibiting low-failure potentials, at a minimum, one location in each pipe segment must be inspected The number of inspection locations is based l on a statistical sampling technique outlined in Section A2.7.3.2 and Appendix 4.

4

]

^

Should a pipe segment (megorized as high safety-significantand high-failure-potentiaMegion

1) consist of several elements (e.g., welds), of which the majority of the elements exhibit low-f ailure-potential then the licensee may consider separating the elements into two lots. One lot requiring 100% inspection (HSS and HFP lot) and the other lot (HSS and LFP lot) requiring an inspectim program similar to that required for Region 2. Such separations should be justified and documented in the RI-ISI submittal to the NRC.

Srnplified P&lDs showing the segment boundanes are reviewed along with poing isometncs, plant and industry operating experience, the previous pipe segment evaluations performed to determine the high safety-significant pipe segments and system design, fabrication, and operating

. conditions. Based on the postulated failure mechanism and the loading conditions for the pipe segment, the areas in which this failure mechanism is most likely to occur are identified

' considering the following factors:

Configuration Dependent. This factor considers the effect of piping layout.and support arrangement. For example, piping with low flexibility for thermal expansion will experience high bending moments which, in turn, can drive crack growth.

Component Dependent. F~ 3xample, socket welds have low resistance to sustained vibratiori Elbows or piping immediately downstream of valves, which add turbulence to the flow, are locations susceptible to erosion-corrosion-wear.

Materia /s/ Chemistry Dependent. Intergranular stress corrosion cracking (IGSCC) and dissimilar metal welds are examples of how materials and chemistry can play a role. -

Loads Dependent. An example of this is the number of cycles seen by the piping segment.

Another example is piping where inadvertent operation may lead to water hammer events.

Seismic events are also included in this category.

Determination of the inspection location (s) within a pipe segment is dependent on the above factors. In general; A2-41 m___. __.____ _ __ _ __ _ __ _ _ _ _ _ _ _ _ _ _ _ _ _ _ -

_}

l l

Component dependent f ailure modes are usually localized to a single or small number of  !

locations.

Materials dependent or operations dependent mechanisms are of ten present throughout the segment, in such cases, interactions with other offeets must be considered for determinirg the location (s).

Load dependent f allure modes typically involve undetected preexisting flaws or degradation that could f all under high loads. The high loads could arise from dynamic (seismic, water hammer) events, large thermal expansion loads (configuration dependent), or external loading.

Locations where such losds could have the greatest impact can often be determined.

Tabla A2.7 provides some additionalinsights based on postulated f ailure mechanisms that assist in identifying the tusceptible areas of pipes.

A2.7.3 Inspection Strategy Reliability and Assurance Program The previous sections focused on: assessing the changes to public risk by modifying existing ASME Section Xl Isl programs with risk informed ISI programs; and categorizing pipe segments as high-and low selety significant with high and low f ailure potential. An acceptable structural segmen? :-lortion matrix guideline is illustrated in Figure A2.8. Once a pipe segment is categorito via the selection matrix guideline, d!fferent inspection programs are applied based on their safety significance. As illustratodin Figure A2.8, the order from most to least safety significanceis: Region 1,2, 3, and 4. This section addresses Region 2, a segment categorized as high safety significant with low f ailure potential.

Any proposed inspection strategy should:

1. Define a rallability goal for piping systems;

2. Define a method that strives to meet the reliability goal;

3. Quantify the existence of a flaw or probability for a leak in a weld;

4. Consider that the inspection technique is not perfect;

5. Consider that not every weld will be inmected

6. Consider the implicatim for calculating confidence or assurance that the inspected sample contains non of the defective welds in the lot; and

7. Demonstrate that the final results provide reliability and assurance that the reliability goal will be achieve.

The target reliability goals are addressed later in Section A2.7.3.3.

One acceptable method for addressing the above seven elements le discussed in Appendix 4. This method is consistent with the ASME Code Case N577, Case A. The method integrates statistical techniques with input from fracture mechanics calculations and/or data for flaws, a

A2 42

e .

1 l

i l

Table A2.7 Insights for identifying inspection Locations c

Failure Mechanism General criteria Susceptible Areas Thermal Fatigue Areas where hot and cold fluid mix, areas of IJozzles, branch pipe rapid cola or hot water injection, areas of connections, safe ends, potentialleakage past valves separating hot welds, heat affected zones, and cold water base metal, areas of concentrated stress CorrosionCracking Areas exposed to contamination and areas with Base metal, welds, and crevices; high stresses (residual, steady- heat affected zones

. state, pressure), sensitized materiel (304 SS) and high coolant conductivity are all required; lack of stress relief or cold springing could also lead to residual stresses Microbiologically Areas exposed to organic material or Fittings, welds, heat-infIuenced untreated water affected zones, crevices corrosion Vibratory Fatigue Configurationssusceptible to flow induced Welds, branch pipe vibration and flow striping or for vibratory connections resonance with rotating equipment (pump) frequencies 5tess Corros!on Areas of high oxygen and stagnant flow Austenitic steel welds and Cracking heat affected zones Flow accelerated Areas of low chromium material content, high corrosion moisture content, and high pH, high pressee drop or turning losses '

Low cycle f atigue Areas with high loads due to thermal Equipment nozzles and other expa..sion for heat up and cool 4own thermal anchor points, n.ar cycling. snubbers, dissimilar metal joints Others? ,_

A2.7,3,1 Risk-Informed Lot Selection and Element Selection for Inspection in the previous sections, seven elements were identified for consideration when developing a statisticalinspection sampling program. One acceptable application of a weld sampling technique was identifiedin Appendix 4. This sampling process is used in Region 2 of Figure A2.8 matrix, where the ISI engineers are unable to differentiate the elements (welds) within a pipe segment as having significantly different probability for degrading. How does one inspect a pipe segment categorized high-safety significantand high failure-potentialwhere only one element (weld) in the segment experiences an active degradation mechanism, and the balance of the welds have similar A2-43

• s low failure potential? One acceptable method is to place the outlier element in one lot, requiring 100% inspection, and subsume the balance of the elements in a separate /or for statistical sampling, as described in the previous sections.

The concept of a lot can be broadened into more than one pipe segment. That is, several pipe segments with similar elements (e.g., same low failure potential, no known degradation mechanisms, same environmental conditions, etc.) may be subsumed within one lot for purpose of statisticalinspections. An example may be all welds attaching the cold legs to the reactor vesselinlet nozzles. Any collapsing of segments or elements within a segment into one lot wiu require NRC review and approval.

A2.7.3.2 Sequeential Sampling This section addressris the guidance for additionel examinations should an inspection identify unacceptable degtadt. ion .o a pipe. The Assurance Level Sampling or Global method, addressed in Appendix 4, identifie ; the number of welds that should be inspected. The RI-ISI engineers select the limiting weld or the weld most likely to degrade first, as the first weld to be inspected.

Presumably, this wwld be the weld that was used in the classificationof the segment as a low failure potential. Next, the failure frequency attributed to this limiting weld is then conservatively asser ned to apply to all the other welds in the lot, so that a conservative estimate of vssurance (by urti of the binomial distribution) is generated. The only time a random selection of a weld would occ ur is when engineering analysis can offer no guidance as to which element is most likely to degtsde, if the inspection uncovers a flaw, then the "AdditionalExaminations" requirement of Section XI (IWB 2430, page 132) would still be appliegpicaphrased):

• If no flaws areiound in the first sample (s), then stop (note that this implies a "zero defect accept'ahc,e, criterion" as discussed in Appendix 4).

• If one or more flaws are found, then take another sample equalin size to the first sample.

• If one or mere new flaws are found, inspect the rest of the lot.

The risk informed process is cons. tent with the experience gained from the ASME Code. One acceptable perf ormance guideline is striving for a 95 percent probability that the occurrence of a leak would not exceed a frequency of 1E-06/yr/ weld. If that performance guideline is ' met, then a root cause analysis is performed and the inspection period and number of locations will be recalculated based on the new information, implementingthis approachin the eight element examplein Appendix 4,if only one of the eight elements has a high f ailure potential, then that one element is allocated its distinctive lot and the balance is combined into a separate /or for inspection purposes. Thus, the one-elementlot will be inspected (Section 1 of Figure A2.8 100% inspection or NRC approved owner program) and the remaining seven elements (if not combined with elements from other segments) will be sampled based on the guideline of a 95% probability that the development of a leak will not exceed a frequency of 1E-06/yr/ weld.

A2 44

4 0 l

A2.7.3.3 Historical Failure Data and Target Reliability Matrix Guideline Criteria l Studies performed by Dr. Spencer Bush indicate that the frequency of leaks from pipes at nuclear plants has shown some decreasing trends over the years of plant operations. For the exiting ,

population of plants in the U.S. (approximately 110), the industry observes a total of about 100 I leaks per year. These leaks are primarily from the balance of plant systems, such as corrosion type failures due to poor quality water in copper nickel tubing. In safety related systems (including the RCS) the small number of f ailures appeared to be focused at small diameter branch piping, such as a vent line near an RCS pump whose f ailure mechanism is vibration f atigue. The ratio of leaks to breaks is a function of the failure mechanism involved, among other factors, and can be as large as 1:1 for erosion /corrosionto 1000:1 or less for intergranular stress corrosion cracking.

On the average, there are about 10,000 welds (or structural elements) in pipes at a typical plant.

From this estimate, a leak frequency of (100 leaks per year)/(110 plants)/(10,000 welds / plant) or ~ 1E-04 leaks'per weld per year can be calculated. This would include pipes of all sizes, all systems and all failure mechanisms.

The RCS pipes (Class 1), however, have experienced lower leak rates than the overall leak rate for all of the plant's pipes. Estimates for pipe f ailures for a PWR RCS are less than 1E-08 per weld per year. This performance standard is a conservative representation of the operating experience for Class 1 pipes under the existing ASME requirements and is one acceptable target goal for RI-ISI application for high safety significant pipe segments.

Applying the above data, the following trends for pipe leak frequencies have been observed:

All pipes -

1E 04 per weld per year RCS pipes -- < 1E 06 per weld per year Further analysis of nuclear power plant operating experience has led to categorizing detectabb piping leak rates, as identified in Table A2.8.

Table A2.8 Operating Experience Insights to Leak Frequencies LEAKS - 1965 1996 .

MAIERIAL PIPE SIZE ' - LOF_EAILURES LEAK.EREQUENCY OsaklyrareWF Sealaneessteel. . 51 -lach 54C 18 E-46 ,

Ferrie Steel $ 1 4eeb 414. 13 E 46 Stolenes Steel >I $ 4 294 10 E-46 =

Ferrie Steel '>154 136 4 E-46 ,

$talaleesSteel >4 170 5 E-46 Ferrie Steel . >4 253 8 E-46 A2 45

• 4 Referring back to the statistical sampling technique described in Appendix 4, Table A2.0 provides l an example of a potential matrix guideline for implementing RIISI programs on high safety-s/gn/ficantp/ pes. It is anticipated that these goals such as these would be achieved with a 95%

l assurance level for only that part of the system categorized as high safety significant. For example, if a system consists of 20 segments,10 of which are categorized as high safety significant, the leak target goal would only apply to the 10 segments as a system. A licensee should identify and justify the leak target goals it intends to monitor.

Table A2.9 Target Detectable Leak Frequency Goals 1

" LEAK TARGET GOALS ,

fl,y ~ . NRIhL ~ '

'EIEEJg a .j$ TARGET LEAK ,3 a '<, Egggggg@pq#

1. ' * . , DeaklyL.WDid)

$~

I Stoness Steel 51. loch <1 E 45

% a w ,v. . - . ,

. Ferric Steel, ..s 1 -leek

<1E45 -

6 Stainless Stool -. >15 4 <1 E 45

- Ferris Steel >1s4 *< < < <1 E ,

Stateless Steel >4 '

U< 1 E-e6 - .

, Ferrie Steet >4 <$E

~' u- n w , , -46x,

, , y.. , .y As addressed in Appendix 4, an input for the binomial distribution in the Assurance Level Sampling Method is the probabiUty of a flaw. One acceptable definition of a flaw is to apply the ASME definitioni e.g., a flaw whose depth exceeds about 10% of the wall thickness (a/t ~0.1)]. This does notimply that the flawis unstable and willlead to a through the wallcrack, it is a flaw that requires additional analyses. For example, a typical probability for an unacceptable flaw for a large pipe in a PWR RCS may be on the order of 3E-03/yeartweld. For a weld containing such a flaw, the probability of a detectableleak is on the order of 4.3E-08 per year per vd.', for a disabling leak it is 5.1E 10 per year per weld, and f or a break it is 3.0E 13 per year per weld.

The probability of a flaw is calculated with the structural mecharics model, discussed in Appendix

1. Application of the sampling model should account for the uncertainties in the calculated probability of a flaw per weld per year, and account for that part of the system categorized as HSS, using appropriate goals for each segment to achieve the system performance target goal.

The above matrix guidelineis conservativein that a detectableleak is used as the figure merit.

Meeting these guidelines maintain, as a minimum, the current level of safety provided by the existing ASME Section XI Code, and would likely result in increased safety as the RI process expands the regulatory scope of inservice-inspection to other systems not currently addressed by Section XI, and potentially a decrease in radiation exposure to plant personnel..

A2.7.3.4 Inspection Location Summary A2 46

4 .

This section addressed one acceptable method for pipe segment classification (high versus low safety significant classification; high versus low failure potential; etc.), it discussed the use of a statisticalprocedure for selecting the number of welds to be inspected (e.g., the Assurance Level or Global method for high safety significant with low failure potential), it addressed (through reference to Appendix 4) one acceptable method for incorporating uncertaintlesin the inspection techn que (probability of detection), and it addressed sequential sampling where the initial testing identified potential flaws.

Focusing our attention on the high safety significant with low f ailure potential elements, once the number of locations to be inspected (among the total number in a given log) has been established, the next step in the procedure is to select the actual inspection locations. It should again be noted that all locationa (M l' r, lots of interest will have low f ailure potentials, and that the number of sample locations m y etetage basis will be small. The objective for the sample inspections is to detect degradativ,i 2.lg a strategy that inspects those locations where degradationis fir" most likely to occur, alon(1 with inspections of different types of structural elements (weldsf fittings, etc.), thereby providing diversity to the sample set.

The estimated failure probabilities for the low failure potential elements will typically have been assigned to a common small value (e.g., the limiting element in a lot) for purposes of risk-categorization calculations. Nevertheless, the selection of sample locations for inspections should be based on a location where degradationis most likely to occur. These evaluations can be based on consideration of f actors such as identified in the previous sections, as well as the failure mechanisms and susceptible areas listed in Table A2.5. Results of probabilistic structural mechanics calculations and data from operating experience can also guide the selection. When f atiguais the failure mechanism of concern, the criteria from ASME Section XI can also provide useful guidance by directing attention to terminal ends, locations of high calculated stress and fatigue usage factors, and dissimilar metal welds.

For high safety significant elements with high failure potential,100% inspection or an NRC approved owner's program is required. An exernple of an NRC approved owner's program is the erosion-corrosion program.

Final Selection Process It is the responsibility of a licensee to ensure that the categorization of elements and the location of inspections are performedin accordance with sound engineerirg practiceo and licensing remirements. This re vulatory guide does not endorse one method . ver another, in other risk informed programs (i.e., maintenance, inservice testing, technical specifications, graded quality assurance, etc.), the industryincorporated the use of an expert panel for providing plant management the information it requires to render its decision. Whether an expert panel is used or not, the issues that an expert panel addresses need to be addressed in the process. These issues include:

• Concurrences that the systems included in the scope of the program are correct and that no other systems should be included / excluded

. Verification that the system boundaries are adequate

. Verificationthat the consequences assumed for each piping segment are accurate (both direct and indirect effects)

A2 47

e 6

+ Concurrence that shutdown risk, containment performance, operational historo, etc. have been appropriately considered in the analysis e Verification that appropriate operator recovery has been considered (i.e., consideration of available indicetions, timing, and alternate actions)

+ Upgrading the safety significance of a pipe segment bast.d on economic or other considerations that are outside the regulatory program through a consensus process and ,

documenting the basis for such an upgrade

. Concurrence that the structural elements selected for examination and the type of examination method selected meets the requirements of the program

+ Integrate the insights from othe. risk informed programs for consistency and proper coverage. ,

A review group or panel cannot downgrade a high safety significant pipe to a low safety-significant (LSS) pipe if it comports with the guidelines in this report.

In rendering the final decision, the licensee ensures that the program solicits experts in the areas of PRA and engineering disciplines to develop a finallist of high safety significant pipe segments. As indicated above, the licensee can select to inspect pipes for f actors other than the decision criteria identified in this chapter. Such f actors might include economic consideratiors I

that have no safety impact or other non safety considerations as deemed appropriate by the utility. Inspections based on non-saf ety considerations ( upgrading pipes no ranked high-safety-significant), are not considered underthisvreyalatory guide.

For consistent application o,f risk-informed programs, it is recommended that the licensee l

' incorporate the insights-gained from the Maintenance Rule and other risk-informed programs at the plant. The licensee shoukfisolicit its experts in the areas of:

+ plant engineering, operations, maintenance, and maintenance rule coordination; e plant work. planning, and control; e piping design and stress analysis;

• Inservice inspection;

. NDE;

+ structural design and support engineering;

. welding and materials test engineering;

• industry failure, repair and maintenance history; e safety analysis; and a probabilistic safety assessments.

! The licensee should build upon the industry's documentation format developed for the Rl ISI pilot demonstration plants. These documents help lead the ISI teams to consider the major issues for l each step of the program.

l A2-48

s e I

A2.8 References for Appendix 2m

! 1.

USNRC, draft NUREO 1602,"The Use of PRA in Risk Informed Applications," June 1997.

2. K.R.Balkey et al.," Westinghouse Owners Group Application of Risk Based Methods to Piping insenice inpsection Topical Report," WCAP 14572, March 1996.

l

3. USNRC, Standard Review Plan, NUREO-0800.

4. _ ASME Research White Paper, " Risk Band Alternative Selection Process For laservice Inspection of LWR Nuclear Power Plant Components," American Society of Mechanical Engineers Center for Research and Technology Development, Suite 906,1828 L. Street, N.W., Washington, DC, November 9,1995.

5. K. Jamali, '! Pipe Failures in U.S. Commercial Nuclear Power Plants," EPRI TR 100380, l Prepared for Northeast Utilities Service Company and the Electric Power Research Institute, Palo Alto, California, prepared by Hallburton NUS, Onithersburg, MD.,1992. l

6. T.V. Vo, F. A. Simonen, B. F. Oore, and J. V. Livingston, "Exped Judgement Elicitation on Component Rupture Probabilities for Five PWR Systems," PVP-Vol. 251, " Reliability and Risk in Pressure Vessels and Piping," pp,115-140, American Society of Mechanical Engineers,1993.

7. D.O. Harris, D.E. Dedhia, E.D. Eason, and S.D. Patterson, " Probability of Failure of BWR Reactor Coolant Piping: Probabilistic Treatment of Stress Corrosion Cracking in 304 and 316NO BWR Stainless Steel Piping Weldnents," USNRC, NUREO/CR-4792, H Vol. 3, December 1986.

8. M.A. Khaleel, F.A. Simonen, D.O. Harris and D. Dedhia, "The Impact ofInspection on Intergranular Stress Corrosion Cracking for Stainless Steel Piping," A3ME PVP Vol.

266/ SERA Vol.3, pp. 411-422, " Risk and Safety Assessment: Where is the Balance,"

1995.

9. 'American Society of Mmhanical Engineers," Risk Based Inspection . Development of Copies of Commission solicy statements, EPRI and WCAP reports referenced herein are available for inspection or copying for a fee from the NRC Pubhc Document Room at 2120 L Street NW., Washington, DC; the PDR's mailmg address is Ma61 Stop LL 6, Wash,ngton, DC 20555; telopnone (202)634 3273; f an (202)634-3343.

Copies of NUREGs are available at current rates from the U.S. Govemment Printino office, P.o. son 37082. Washington. DC 20402 932s tielephone (2021512 2249); or from the National Technical Information Service by writing NTIS at 5285 Port Royal Road, Springfield, VA 22161. Copies are available for inspection or copying for a fee from the NRC Public Document Room at 2120 L Street NW., Wuhington, DC; the PDR's mailing address is Mail Stop LL-6. Washington, DC 20555; telephone (202)634 3273; fax (202)634 3343.

Requests for a6ngle copies of draft or active regulatory guides (which may be reproduced) or for placement on an automatic chetnbution list for single copies of future draft guides in specific divisions should be made in wnting to the U.S.

Nuclear Regulatory Comminion, Washington, DC 20555-0001. Attention: Printing, Graphics and Distribution Branch, or by f ax to (301)415 5272.

A2-49

-o e Ouldelines, Volume 2 Part 1, Light Water Reactor (LWR) Nuclear Power Plant Components," CRTD-Vol. 20 2, ASME Research Task Force on Risk Based Inspection Guidelines, Washington, D.C.,1992.

l 10. S.H. Bush, " Reliability of Piping in Light Water Reactors," Nuclear Sqfety, Vol. 17, No.

17 Sept. Oct.,1976,

11. S.H. Bush," Statistics of Pressure Vessel and Piping Failures," Journal offressure Vessel l Technology, Vol. I10, pp. 225 233, August 1988.

12. S.H. Bush, " Failure Mechanisms in Nuclear Power Plant Piping Systems," Journal Pressure Vessel and Piping Technology, Vol. 114, pp. 389 395, November 1992,

13. H.M. '!homas," Pipe and Vessel Failure Probability," Journal of Reliability Engineering.

Vol. 2, pp. 83124, published by Elsevier Applied Science, London and New York,1981,

14. - R.E. Wright, J.A. Steverson, and W.F. Zuroff," Pipe Break Frequency Estimation for Nuclear Power Plants," USNRC (prepared for NRC by Idaho National Labors:y),

NUREO/CR-4407, May 1987,

15. USNRC," Severe Accident Risks: An Assessment for Five U.S. Nuclear Power Plants, Final Sununary Report," NUREG 1150, December 1989.

16. T.A. Wheeler et al., " Analysis of Core Damage Frequency from Intemal Events: Expert Judgment Elicitation," NUREO/CR-4550, Volume 2, USNRC (prepared by Sandia National Laboratories), April 1989.

17. T.V. Vo, P. O. Hensier, S. R. Doctor, F. A. Simonen, and B. F. Oore, " Estimates of Component Rupture Probabilities: Expert Judgment Elicitation," Nuch Tachanlonv, Volume 94(1), American Nuclear Society, La Grange Park, Illinois,1991,

18. V.N. Shah and P. E. Mcdonald, " Aging and Life Extension of Major Light Water Reactor Components,' Elsevier Science Publishers, New York,1993.

19. American Society of Mechanical Engineers, " Metal Fatigue in Operating Nuclear Power

- Plants-a review of Design and Monitoring Requirements, Field Failure Experience, and A2-50

4 .

4 1

P Recommendations to ASME,Section XI Actions," American Society of Mechanical  !

l Engineers, New York,1990.

20.

USNRC, " Pipe Crack Experience in Light Water Reactors," NUREO 0679,1980.

j 21.

USNRC, " Investigation and Evaluation of Stress Corrosion Cracking in Piping in L Water Reactor Plants," USNRC, NUREG 0531,1979.

i

! 22.

J.F. Copeland et al., " Component Life Estimation: LWR Structural Materials Degradatio

{ Mechanisms " Electric Power Research Institute, Palo Alto, California,1987. i 3

23.

V.K. Chexal and J.S. Horowitz, " Flow Assisted Corrosion in Carbon Steel Piping,"

- Proceedings ofthe 4* Symposium on Em tronmental Degradation ofMaterials in Nuclear Power PlantSystesns,1989.

24.

S.A. Elde et al., " Component Extemal Leakage and Rupture Frequencies," EEO SSRE-l

%39, DE92 012357,1daho National Laboratory, Idaho Falls, Idaho, gwed for U.S.

Department ofEnergy,1991.

25.

S.H. Bush, " Wall Thinning in Nuclear Piping Status and ASME Section XI Activities,"

l PNL SA 16973, Pacific Northwest National Laboratory, Richland, Washington, Post

{. SMIRT Conference, Monterey, CA, August 1989.

! 26.

T.V. Yo et al, " Estimates of Component Rupture Probabilities: Expert Judgment t

Elicitation," Fatigure, Fracture, and Alsk, PVP Vol. 215 The American Society of

{

t Mechanical Engineers,1991,  ;

27. <

D.O. Harris, E.Y. Lim, and D.D. Dedhia, " Probability of Pipe Fracture in the Primary l Coolant Loop of a PWR Plant, Vol. 5: Probabilistic Fracture Mechanics Analysis,"

, USNRC, NUREO/CR 2189, Volume 5, August 1981.  :

! 28. -

D.O. Harris and D. Dedhia, " Theoretical and U.sers Manual for pc-PRAISE, A i

Probabilistic Fracture Mechanics Comp ..ter Code for Piping Reliability Analysis,"

I 4

USNRC, NUREO/LR-5864, July 1992.

l 29.-

O.J.V. Chapman, and O.A. Davers, " Probability Risk Ranking," Transactions ofthe 9*

(

s T

3 l

1 1

A2 51 L

. . . ~ . , ,,,y.m-y.,my, y. , ,, , , , ,, - . , - .v- ,,..e wm, ,- . - , - - -, - ,y ,y , , , , . . ,yr.-,v.,,,,,,,w-.,,- r.,-..,,_,wa , ,-,~ , . ,

International Conference on Structural Mechanics h Reactor Technology, Lausanne, 1987.

30. B.A. Bishop and J.ll. Phillips, "Prioritizing Aged Piping for Inspection Using a Simplified Probabilistic Structural Analysis Model," ASME PVP Vol. 25, Rellability and Risk in Pressure Vessels andPiping, pp.141 1S2, American Society of Mechanical Engiacers,1993.

31. EPRI TR-106706, " Risk Informed Inservice Inspection Evaluation Procedure," interim report, June 1996.

r

• *,s. s 5 4

see A2 52

i e .

1 j Appendix 3fSTIMATION OF FAILURE PROBABILITIES USING EXPERT i

JUDGMENT ELICITATION (Ref.1) l A3.1 Introduction in pilot applications of risk informed ISI methods (Ref. 2) and(Ref. 3), expert judgment was selected as a method for estimating failure probabilities of piping system components. This Appendix describes the elements of the formalized process for conducting an expert judgment elicitation. For_ plant specific applications there are time and cost limitations that will usually preclude application of this process in its entirety. Nevertheless,much of the guidanos provided in this Appendix can be applied to making the many judgmental decisions involved in estimating failure probabilities, whether by application of data bases or by application of

- probabilistic structural mechanics computer codes. In other cases it may be appropriate to  !

systematically apply the expert judgment elicitation process to address generic issues related to structuralreliability. Industryis encouraged to make such generic applications to estimate baseline failure probabilities for particular systems / materials / operational conditions and incorporate that knowledge in the structural nachanics computer codes to increase the consis.tency and uniformity of plant specific failure probability estimates. However, in practice it will be necessary and appropriate to modify any such generic estimates to address plant specific conditions.

A3.2 Smokyound As in any scientific endeavor, expert engineering and scientific judgment (often referred to as expert opinion)is an essential aspect of any method (including application of historic data and structural mechanics computer codes) selected for estimating failure probabilities. In identifying the systems and components to be studied, expert judgment can be used to e precisely define what is meant by a failure e

formulate a mathematical failure mode e identify and assess relevant data e

combine all of these elements to obtain the desired results in a woful format For such tasks, expert judgmm is usually applied, but in an informal and unstructured manner.

For many such problems, this approach yields satisfactory results in an efficient manner.

However, an informal and unstrutured approach may be unsatisfactory when relevant data are sparse or nonexistent, or when t' a issue studied is complex or likely to receive extensive review and criticism. A formal expertjudgment process has a predetermhed structure for the collection, processing, and documentation of expert knowledge. The advantages and drawbacks of using such a process, as opposed to an informal process, are outlined in Bonano et al.,1990(Ref. 4). The advantages include:

• improved accuracy and reliability of the expert judgments

• . a reduced potential for critical mistakes leading to suspect or biased judgments A31

• e

• enhanced consistency and comparability of procedures e improved scrutability and documentation for communication and external review The drawbacks include:  !

• an increase in the resources and time required to carry out the process e a reduction in the flexibility to make changes in the ongoing process e an increased vulnerability to criticism due to the relative transparency provided by a formaldocumentationof theproceduresandfindings,includingdifferencesexpressedby the various experts.

Reference 4 cautions that, while a formal process often requires more resources and time than an ir. formal pocese* initially requires, a faulty process that fails to withstand criticism cr must be redone because of inappropriate design or irnproper execution may end up failing to satisfy the project objectives and cost more in both time and resources. The potential for further costs in an informal study should be considered when eva!uating the need for an formia process.

The formal use of expert judgment has been extensively applied to a number of recent major studies in the nuclear probabilistic risk assessment area ((Ref. 5),(Ref. 6), and(Ref 7)). Although scientific inquiry and decision making have always relied on expert judgment, the formal use of expert judgment as a well<locumented systematic process is a relatively new development. However, because of the many potential pitf alls in using expert judgment,it is essential that analysts be f amiliar with the state-of the art and utilize the services of experienced practitioners in order to avoid wasting time and resources. Useful discussions of potentialpitf alls and approaches to overcoming them may be found in(Ref. 8),(Ref. 9), and(Ref.10).

The expert judgment process used in NUREG 1150 (Reference 5) is prcsonted in(Ref.11) and outlined l

In(Ref.12). This methodology was developed in response to criticisms of the previous Reactor l Safety Study (Ref.13) and an earlier draft of NUREG 1150. The history of this development underscores the importance of basing the expert judgment process on state-of the art techniques and of making use of experienced practitioners in this difficult area.

A3.3 Expert Judgment Elicitation Process A flowchart of the expert judgment process is given by Figure A3.1, taken (with minor changes) from Reference 12. The expert judgment process has 10 steps, outlined below. This process, with some l

modifications,was used to estimate break probabilities for selected components at Surry 1, as i discussed in References 2 and 3. Specific techniques for the elicitation, use, and communication of expert judgrv ent may be found in References [(Ref 3), (Ref. 7), (Ref. 8), (Ref.13), and (Ref.

14)).

l A3-2

m i

$ a l

. . ..mm. , . . mm..... .m .

First Meetsag Second Meeting Selection of

> Esperts -- '> Elicitation - -> Presentation l Training ofTechnical

[ Evidence _l Project , . . . . . . . . . . . . . . . . ,

Q l Staff y '

I Presentation and '

Selection Preparation

~ ' ~ ~ ' ~

> of lasses - ~ ~ ~ ~ ~ > ofissees ~ -'

> Review ofissues l

_._._.._.__.__.._._.._.__.__.._._._.._._.._.._._.l l , . . . . . ... . . . .,

Third Meeting Preparation I Discussion of Elicitation ---

or Analyses. {~ - > lesses and Analyses l

I Final Review by Recomposition 4- - - Aggregatius and 4- ~ - ' ~,

Documentation 4-'- Experts Doceansotation Figure A3.1 Expert Judgment process.

A 3.3.1 Selection of lasues The initial selection of issues should be made by the project staff and is used to guide the selection of the experts. Two primary criteria for the issue selection are as follows:

(1) The issue has significant impact on the risk and/or uncertainty.

(2) Attemative sources ofInformation such as experimentaland observationaldete, or validatsc' computer models are not available.

A3.3.2 Selection of Experts Experts are selected on the basis of their recognized expertise in the areas of interest and chosen to ensure a balance of viewpoints. To addresu the issues of concem to the nuclear power industry, experts from reactor vendors, utilitiet:, the federal government, national laboratories, consultant, and academia should be incl .ted. The goal is to obtain multiple and diverse input so that the issues can be thoroughly ained from many viewpoints.

There are two ways to organize the experts - by panels or by teams. The panel approach was used in NUREG 1150(one panel for each of six groups of relatedissues) and the Lawrence Livermore seismic hazard study (one seismicity panel and one ground motion panel! described in Reference

6. The team approach was use by the Electric Power Research Institute seismic hazard study (six balanced teams, each containing seismicity and ground motion experts) described in Reference 7.

A3 3

o o in addition to the experts to be elicited, substantive and normative experts are needed to facilitate discussions, make presentations, and train the experts. The substantive expert (s) must be knowledgeable about decision theory and the practice of probability clicitation.

A3.3.3 Elicitation Training The purpose of clicitation training is to help the experts learn how to encode their knowledge and beliefs into probabilistic or other quantitative forms. Elicitation training can significantly improve the quality of the experts' assessments by avoiding psychologicalpitialls that can lead to biased and/or overconfident assessments. Training should include information about the methods used to process and propagate subjective belief s,introductionto the assessrrent tools and practice with these tools, calibration training using almanac questions, and an introduction to the psychologicalaspects of probability elicitation. The training should be conducted by a normative expert with assistance by a substantive expert.

For NUREG 1150,the elicitationtraining took place at the first meeting and required a half day.

Depending on their f amiliaritywith elicitationtechniques,some experts may require less or more than a half day of training. It is recommended that training occur at the beginning of the process so that the experts can f amiliarire themselves with the types of assessment they will be making before they decide on the specificissues to be addressed. However, wh the training session takes place, it is important that it not be abbreviated due to time presue.

l A3.3.4 Presentation and Review of issues The initiallist of issues selected by the project staff should be sent to the experts before the first meeting for review. Relevant data sottreet, models, and reports should also be included.

The experts would be invited to propose additions, deletions, or modificationsto the list. When the experts meet, substantivefxperts present the issues to the expert panel. The purposes of the presentation and review are:

. to ensure that o' common understanding of the issues is addressed

. to ensure that the experts respond to the same elicitation questions e to permit unimportant isess to be excluded and important issues to be included a to allow madification or decomposition of the issues e to provide a forum for the discussion of alternative data sources, models, and forms of analysis An essential aspect of issue presentation is issue decomposition, which allows the experts to make a series of simpler assessments rather than one overall assessment of a complex issue. This step should be executed with great ca_re, as the decomposition of an issue can vary by expert, thereby significantly affecting its assessment. Care shot.id also be taken to present the issues so as to minimize potential biases in their assessment.

A3-4

A3.3.5 Preparation of Analyses

The experts should be given sufficient time and resources to analyze the issues before the elicitation session. This step may entall support by the project staff, e.g., by performing computer calculations or other iequested analyses. Some experts may choose to after the proposed decompositions or create new ones. While many calculations necessarily bear on the probability assessments that the experts make in the elicitation sessions, the experts should be cautioned to avoid making any subjective probability assessments until the elicitation. This is necessary to avoid making any subjective probability assessments until the elicitation and to avoid the

psychological bias of anchoring (Reference 8).

A3.3.6 Discussion of issues and Analyses Prior to the elicitation session, the experts should present the results of their analyses and research. The goal of this step is to ensure a common understanding of the issues and the database it is not to reach agreement on the issue decompositions and the elicitation variables.

To take advantage of the diversity of approaches,it is essential that each expert analyze each issue according to his/her own interpretation, and use the decomposition and elicitation variables with which he/she is most comfortable.

A3.3.7 Elicitation The elicitation sessions should be held immediately follow the discussion of issue analyses. An elicitation team should meet separately with each expert. This avoids the pressure to conform and elides the other group interactive dynamics that may arise if the expert judgments are elicited in a group setting. The elicitation team should consist of a substantive expert, a normative i expert, and a recorder, it is also useful to add as a fourth member the person who will prepare the final documentation.

i

, The elicitation sessions serve two purposes. - The first is to obtain the decompositions and quantitative assessments for each issue from each of the experts. insof ar as possible, the uncertainty of each quantitative assessment should also be elicite.J. The second purpose is to obtain the rationales for the decompositions and assessments. The experts should be questioned about their stated beliefs and asked to reflect on and explain the reasoning behind the decompositions and quantitative assessments they have provided.

Much of the documentation of % experts assumptions and reasoning can be completed during the elicitations. However, some follow up work is usually necessary to fill voids in the logic provided by the experts or to obtain missing assessments.

A3.3.8 Recomposition and Aggregation Each expert's assessments must be recomposed by the normative and substantive experts to organize

, them into a common form for each issue. Recomposition is necessary because the assessments for

. the elicitation variables in the decomposition for each issue must be combined into an assessment for the issue as a whole. Since each expert may have employed a unique decomposition, the end result for each expert must be in a common form suitable for aggregation. This will typically be a subjective probability distribution for a parameter of interest.

i A3 5

• e Af ter the recompositionof each expert's elicitation, the results should be aggregated to yield a final assessment for each issue. It is essential that the aggregation reflect the uncertainties as expressed by the experts. There are two general classes of aggregation methods: methods that tend to consensus and methods that tend to preserve the variability among the experts. Genest and Zidek(Ref.15) provide informative reviews on the many proposed aggregation methods.

When variability among the experts is greater than the uncertainty for each expert, a simple aggregation method is sometimes used. Each expert's assessment is replaced by a central value (the realistic estimate) and the central values are plotted. Converting the plot of central values to a box and whisker plot (Ref.16) is a convenient way to summarize the assessments that reflects the uncertainties. This method was used in RWence 2 to estimate component break probabilities.

While consensus methods are of ten easy to implement (e.g., averaging over the experts), they should not be automaticallyapplied without careful consideration. Because one of the primary goals of the exptprt judgment process is to reflect the state of the artuncertainty as expressed l

by the diversity of expert judgments, an aggregation method should not be used if it tends to mask the diversity of expert judgment. For example, consider a case where half the expertsjudge the probability P of a phenomenon to be close to zero while the other half judge P to be close to one.

l Averaging over the experts is equivalent to the case where all experts judge P to be approximately l

%. These two cases, however, are quite difforent since there is no disagreement among the experts in the second case, while there is a great deal of disagreement among the experts in the first case. In the second case, a decision maker would have high confidence that P ts approximately %,

while in the second case, he/she does not know what value to assign to P. If he/she would make one decision when P = 0 and another decision when P = 1, premature averaging in the first case might deprive the decision maker of essentiatinformation, in general, an aggregation method shoulrf be used only if a sensitivity study indicates that it does not destroy information that might significantly affect the options of a decision maker.

A3.3.9 Review by ixperts Following the initial recomposition, aggregation, and documentation, written analyses of each issue should be distributed to each panel expert, substantive expert, and normative expert for review. A substantive (and nonvoting) expert might be an individual from the plant technical staff with detailed knowledge of plant design and/or operations, whereas a normative exP might be an individualwith knowledge of probabdity and statistics who could assist the other experts in translating their engineering knowledge into numerical estimates of f ailure probabilities.

The purpose of this review is to provide the experts with the opportunity to revise their earlier assessments, and ensure that potential misunderstandings are identified and resolved before final documentation. The revised assessments are then recomposed and reaggregated. To prevent an expert from arbitrarily changing his/her assessment so as to influence the aggregated assessment in a preferred direction, the experts should be required to provide a rationale for any significant reassessment.

A3.3.10 Documentation Documentation has a number of important purposes. First, clear comprehensive documentation is essential to ensure that the expert judgment process is accepted as credible. Second, A3-6

e .

i documentation can be used by the experts involved to provide assurance that their judgments are correctly reflected. Third,it can be used by potential users of the process to enhance their understanding. Fourth,it can be used by peer reviewers of the process to provide an informed basis for their review. Finally, documentation can be extremely useful to update the analyses when future research provides additionalinformation.

A3.4 Example Application to Nuclear Piping Systems Since elicitation of expert opinion was recognized as an acceptable means to quantify input to l PRAs and risk based studies, this method was selected for estimating pressure boundary f allure probabilities for use in a pilot application of risk based ISI methods performed by Pacific Northwest National Laboratory (PNNL). The systematic procedure, as described in References 11 and 5, guided the elicitation process. The following paragraphs summarize the procedures as indicated by Figure A3.2 and describe sample results obtained. Detailed discussions of the procedures as we" as the complete results can be found in References 2 and 3.

PNNL conducted two expert judgment elicitation meetings. The meetings addressed only structural failures : hat were perceived as important to plant risk, or that could significantly affect core damage frequencies. The specific objective was to develop numerical estimates for the probabilities of catastrophicor disruptive failures for the selected pressure boundary systems and components at a PWR plant.

Experts at these meetings included specialists in the areas of materials science, structural mechanics, inservice inspection, data bases on service experience, plant operational practices, and plant specific knowledge of the plant. The first meeting on May 810,1990 at Rockville, Maryland addressed f ailure probabilities for the reactor pressure vessel, reactor coolant system, low pressure injection system, auxiliary feedwater system and accumulators (Ref. 2).

The second meeting occurred on February 3-6,1992 in Washington DC. This meeting addressed the high pressure injection system, residual heat removal system, service water system, cornponent cooling system, and power conversion system (Reference 3).

The panel of experts brought to bear a large base of experience with structural integrityissues at operating plants as well as an understanding of the response of structural materials to service environments. The experta consisted of knowiedgeablerepresentativesfrom utilities, veno rs, federal government agencies, and consultants. Prior to the workshop, reference materials were sent to the experts, including data sources, reports, and recent PRA results. Pane! members were asked to study these materials and formulate initial estimates of failure probabilities.

To resolve issues thoroughly from many viewpoints, the elicitation was designed as a f ace-to f ace meeting. A formal presentation was provided for each system of interest. The presentations discussed technical descriptions, historical component failure mechanisms, elicitation statements, suggested approaches, questionnaire forms, and any supporting materials. Tim issues were presented in a manner to avoid preconditioning or blasing responses.

A3 7

• e i p,g g,,, FRA Resolu and i Historical other Rensvest lorormatios Frectere Wheeks l Failure Data (system, tempement priorutsetka.

4,,,y ,,,

L _ ,

system descriptions, etc.)

Y Espert Jodsmeet Additional leforeneties Elicitaties med 4 (additional pleel specias Disconstes laformation, etc.)

Y s.iin.ied Repiere

! P,.6.biia6e.

Figure A3.2 Process for estimating f allure probability using expert judgment.

All experts were encouraged to get invofved'lhlt.uhsequent discussions. Knowledge from experts regarding plant design and operation, f ailure'liistory, and material degradation mechanisms was brought to the discussions. Slpce the process was designed to take advantage of the diversity of the knowledge, each expertprovided an independent estimate. No etfort was made to seek a consensus among the,Mperts on estimated break probabilities. Each expert completed questionnaires addressing location specific break probabilities for the systems of interest.

This data covered realistic estimates of probabilities, uncertainty estimates, and the rationale for these estimate =,

Following the elicitation meeting. I' f ormation provided by the expert pana' was recomposed and aggregated. The written analyses of each system, including the recomposition and additional plant specific data, were then returned to each expert for review. This review provided the expm with an opportunityto revise their earlier assessments, and ensured that potential misunderstandings were identified and resolved and that the documentation correctly reflected the experts' judgment. The revised analyses were then again recomposed and aggregated to provide a single composite judgment for each break probability.

Figures A3.3 and A3.4 are samples of estimated failure probabilities obtained from the expert judgment approach. The probabilities are expressed as failures per year. Because, as in most expert judgment applications, the data set was not symmetric about a single peak, the median was used. Unlike the mean, the median is not influenced by extreme values. The interquartile range (75th percentile minus the 25th percentile) is used to describe variability in the data set.

A3 8

e .

l As shown in the figures, the realistic estimates obtained from the population of experts are summarized in a series of box and whisker plots. These plots of the distribution associated with the expert population display the following features:

l l

(1) the " whiskers" identify the extreme upper and lower bound values; (2) the box is determined by the 25 and 75 percontiles (i.e., the lower and upper quartiles). Its length is the interquartile range (LOR).

(3) the middle 50% of the data points lie within the box; (4) the circles indicate the median of the distributions.

The exporta provide a wide range of responses rcgerding fsilure probabilities. This range is entirely consistent with the large uncertainties associated with the performance of the components being addressed. Since no attempt w.ss made to seek a cons m from the expert panel, the median of the experts' estimates was suggested as a realistic probability for use in the risk.

--based studies. The evaluation should incorporate an uncertainty analysis, as illustrated in -

Figures A3.3 and A3.4.  !

j For the systems selected for study, the extreme values of the f ailure estimates varied between _ --  !

1.0E4g and 1.0E-03 failures por year. For a given component within a particular system, the inter quartile range generally represented variatioim between a f actor of 10 to 100. The component  !

medians within a given system generally very within a factor of 10, with the notable exception of the control rod drive mechanisms and the instrument lines of the reactor pressure vessel.

In summary, the data appeared to be reasonable and generally agree with the PWR plant operating experience. Typical areas of high break probabilities correspond to such f actors as high cycle thermal stresses (e.g., places where mixing of fluids with large temperature differences occur) and places where erosion or corrosion effects are active. A tremendous amount of technical .;

information was gathered from the exchange of information betwoon the experts and the observers, and the olicitation greatly enhanced the realism and credibility of the plant analyses.

• -%d.-

9 A3 9

o e P

83 m PWatlegission Yahe(hF Posen H 9l ,

as e APWPWatlaatstenVah  : 9  :

rbstto aseendlamenen Yahe  ; p _j omnemonem Pensessenm assedlesessen vesse

= e. ,

Pom UdtR APW Punges + i e i fDs Saynens tosseen oenehmen metsmanvehes I e. -

APW Pay 06sshwes Hammere H 9  :  ;

eewnunt t APwa rmem I e  ;

Mo Pm,tuommes  ; e  :

To Pun,onshey i e i i 6  ;

80 to Twains Dmelet TDP APW Pump Cet neman t. hse 3 i nWwnen  ; e  :

MP m 0STt H# "

APWMOP auseen 9  :

wor m csti ;e  ;

I ceti  : o  : -

l l orrimosu .  : e  :

CETI l 9 Emergensy mom APW MD Pumps  ! 9 H ammesnaruu aAPw w Pwes  : 9 h I t I t i i I

. -e -s -7 -4 4 -4 -a l

les to(PetweeNue Figure A3.3 Failure Frequency Estimates for the Auxillery Feedwater (AFW) System Components A310 1

e o Figure A3.4 Failure frequency estimates for the reactor pressure vessel W8W 1 Wed 1 - MW shes W be.emeente shmi

we. ,  % e H C.co e.e,.m wow.

i

. wen s .

i M3 1

' 9 l tage m names wsW 3 Chewiderepeal wow.louer wow 4 , 9 .,

W enes pes == =rer9 i.

! MS >

' 9 9 Weide 4 C W weML en s wow e --CJEH wow...we benemhsse m eaw -

O 'a '

wow r

,,w .

.--.w , > ...

1%"*' .e - e.

I W888 5

. kid . ceased ses e, eve l

w.w to E ""8'****

wow 11 @

, Wed it G l

a Wow 13 @ ^

j wed14 G j we. a a Nosato Foynes . Irdet 3

Naask Fagnes . Oudet C

2 anale mess l veensisnes-Queene -

C i unn wees

• N

, tenerHead  ? H j veneelF)ense 1 -

j Ensen=* Head Finnes D vessag gium. H & w CptMs H 9 b--*

$ tieerumernUne Penetener=

4

! i , i i I ' i

.e 4 -7 4 -4 -4 -3 '

ing to(FeliurneNeer)

I I

i i

4 i

A311 I l

1 1

i . . -

4 A3.5 References for Appendix 3 i ,

1. Risk Based Inspection Development of Guidelines," Volume 2 Part i Light Water i Reactor (LWR) Nuclear Power Plant Components, ASME paper CRTD Vol. 20 2, t

j American Society of Mechanical Engineers, New York NY,1992.

l 2. T.V. Vo, P.O. Heasier, S.R. Doctor, F.A. Simonen, and B.F. Oore, " Estimates of Rupture i j Probabilities for Nuclear Power Plant Components: Expert Judgement Elic!tation," ,

1 Nuclear Technology, Vol. %, American Nuclear Society, LaGrange Park, Illinois,1991.  :

1 I

3. T.V. Vo, F.A. Simonen, B.F. Oore and J.V. Livingston, "Expen Judgemr/ Elicitation on '

l Component Rupture Probabilities for Five PWR Systems," Reliability and Risk in Pressure Vessels andPiping, PVP Vol. 251, pp.127-140, American Society of l Mechanical Engine- s,1993. .

l 4. E.J. Bonano et. al.. ." Elicitation and Use of Expen Judgement in Perfonnance l j Assessment for High Level Radioactive Waste Repositories," USNRC, NUREO/CR-  ;

5411,(Prepared for NRC by Sandia National Laboratories, SAND 89-1821), May 1990.

5. USNRC," Severe Accident Risks: An Assessment for Five U.S. Nuclear Power Plants,

Final Summary Report," NUREO 1150, Volume 1. December 1990.

i

6. D.L.J.B. Bemreuter et al. " Seismic Hazard Characterization of 69 Nuclear Plant Sites l East of the Rocky Mountains," QSNgCJUREO/CR 5250, (Prepared for NRC by Lawrence Livermore National taboratory,UCID 21517), January 1989, i L 7. "Probabilistic SeismicMazard Evaluations at Nuclear Piant Sites in the Centml and i Eastem United StatesrResolution of the Charleston Earthquake Issue," NP-6395 D, Electric Power Research Institute, Palo Alto, Califomia,1989.

8. M.A. Meyer and J.A. Booker, " Eliciting and Analyzing Expert Judgement," USNRC,

NUREO/CR-5424,(i% pared for the NRC by Los Alamos National Laboratory), January 1990, s

9. A. Mosleh et al. " Methods for the Elicitation and Use of Expert Opinion in Risk

. Assessment," USNRC, NUREO/CR-4%2, (Prepared for the NRC by Pickard, Lowe and Garick,Inc., PLO-0539, August 1987.

10. O, Svenson, "On Expert Judgement in Safety Analyses in the Process Industries,"

Journal, Reliability Engineering and System Safety, Vol. 25, pp. 219 256, EIsevier Applied Science, London and New York,1989. ..

. Il-.

T.A. Wheeler et al.," Analysis of Core Damage Frequency form Internal Events: Expert

! Judgement Elicitation," USNRC, NUREO/CR-4550, Volume 2, (Prepared for the NRC

. by Sandia National Laboratories, SAND 86-2084), April 1989.

i A3-12 1-

, .m- - . - , - . , , _ _ . - , - - - _ _ , - . - - . _ - - - . , , _ - , - - _ - . _ . . _ . - - , - . - . - , _ - . _ - , , , - . - - - ~ . - ~ ~

6 O

12. N.R. Ortiz et al., "Use of Expert Judgement in NUREG 1150," Proceedings of the International Topical Meeting of Probability, Reliability and Safety Assessment, American Nuclear Society, LaGrange Park, Illinois,1989.

l

13. USNRC," Reactor Safety Study An Assessment of Accident Risks in U.S. Commercial Nuclear Power Plants," WASli 1400 (NUREO-75-014), October 1975,

14. J.P. Kotra et al., " Branch Technical Position on the Use of Expert Elicitation in the 111gh.

Level Radioactive Waste Program," NUREO 1563, November 19%.

15. C. Genest and J.V. Zidek, " Combining Probability Distributions: A Critique and an Annotated Bibliography," Statistical Science, Vol.1, No.1, pp. I 14 148,1989.

16. J.W. Tukey," Exploratory Data Analysis," Addison Wesley, Reading, Massachusetts, 1977. f A3-13

Appendix 4:lNSPECTION STRATEGY-RELIABILITY AND ASSURANCE PROGRAM The purpose of this Appendix is to illustrate one acceptable method for identifying the number of welds (as $vell as other structural locations) to be inspected in a risk informed inservice inspection program. This Appendix relies on statisticalsampling techniques. As such, certain terms typically used by statisticians should not be confused with those used elsewhere in this regulatory guidanse document. For example, the term "consumerr/sk" or risk, as used in this Appendix , is not to be confused with the plant risk (CDF or LERF) used elsewhere. The plant risk used in the previous sections focused on: assessing the changes to public risk resulting from replacing existing ISI programs with the risk informedlSl programs; and assessing high and low safety significant pipe segments. This Appendix uses the term risk as used by statisticians when applying statistical sampling techniques. Here, risk refers to the probability of experiencing a detectable laak in a pipe (versus a break). Keeping this distinction in mind, the following provides one acceptable process for identifying the number of pipe elements to be inspected in a RI ISI program. ; This process incorporates reliability, confidcmce, and the probability of detection (POD) of the inspection procedures to identify degradatio. prior to leak. This method is extracted from a paper by Perdue (Ref.1) and augmented by Dr. Lee Abramson (from the NRC),

through the ASME Research program on RI ISI. For reference, we will refer to this method as the Perdue-Abramson method. The Perdue-Abramson method focuses on two analyses. The first analysis focuses on flaws and the potential that a flaw exists and develops into a leak. The second analysis focuses on the global operating experience that directly compares observed leak frequencies with the target leak frequency. Combined, the process provides a check and balance.

The following sections will:

. Introduce the concept of statistical sisk for quantifying the adequacy of an inspection plan.

+ litustrate a general method that can be applied to calculate risk for any reliability demonstration under the implicit assumption of perfect ability to detect a flaw given that the flaw % in the sample drawn.

. Incorporate how to address less than-perfect ability of detecting a fla given that the flaw is in the sample.

. Assess the implications for calculating the confidence / assurance that the sampling plan achieves the desired level of risk.

A4.1 The Concept of Statistical Risk Consider a hypothetical pipe segment that consists of eight potentially inspectable elements (welds) that have not been previouslyinspected. Assume further that no risk informedor other informationis available so that, from the plant ISl team's perspective, the eight elements are clones of each another. Asse ning that we stay within the current Section XI rules, one-quarter (25%) or 2 of the eight elementsin this segment can be randomly selected for inspectionin an upcoming outage.

A4-1

e o if we inspect the 2 elements, what confidence can we place that the other elements within the segment are of similar condition? The questionis similar to asking what " risk" is attached to this particular sampling plan? Risk is a concept from the field of statistical acceptance (or inspection) sampling that can be defined as follows. Assume that one specifies that a m/n/mtsn j re//ab//ity leve/ for a lot is X defects. If a sample drawn from that lot is inspected and the whole lot is judged to be " acceptable" if the sample contains no defects, then risk is the probability that the lot will have more than the X permissible defects, whenever the sample contains no defects. Equivalently, risk is the probability that.the inspection plan will let a lot (consisting of the elements of interest) be accepted with an unacceptable level of defects.

Acceptance sampling or reliability demonstration is concerned with developing plans that

" demonstrate" specified levels of risk or, equivalently, " confidence" (= 1 minus risk). To calculate risk, one needs to define:

t

. Lot siza Sarnole si e Flaw or defect i

Acceptance number (i.e., number of flaws found that willlead to rejection of the lot)

. A priori probability that a lot contains X defects

• Minimum allowable reliability level to be demonstrated.

The ASME Section XI can be said to gMie definitions or guidance for all but the last item, the minimum reliabilitylevel to be demonstrated. In particular, the current code implies acceptance number of zero (more about this lateri. As for the minimum reliability to be demonstrated,it is useful to show the confidence associated with various postulated minimum reliability levels.

A4.2 Calculation of Risk The measure of the minimum acceptable reliability level is the failure rate, where 'faPurn' is typically defined as a pipe break. Inspection, however,is concerned with finding " flaws" before they turn into leaks and breaks and, hence, there is a need to translate the f ailure rate measure into an equivalent number of (code-defined unacceptable) flaws. Information for a representative system may indicate, for example, that only four out of every 100 repairable flaws can be expected

. to propagate to a leak and only 1 in 1000 of the latter to a rupture over a 40 year interval. Such information, which is potentially obtainaae from the combined exercise of struct ral reliability and risk assessment models, and probabilistic encoding of engineering judgment, can be used to translate a specified failure rate into an equivalent number of flaws or vice versa.

For illustrative purposes only, returning to the simple hypotnetical example of 8 elements in a pipe segment, the following assumptions are made:

. Probability of a flaw exceeding 10% of the pipe wall thickness in any one of the eight welds = 0.0065 1

• Conditional frequency that a flaw will grow to a leak lyr/ weld is 3E 5 Given a probability of .0065 that any element will turn up flawed, the b/nomia/ distribution for N = 8 and p = .0065 can be used to calculate the probabilitythat 0,1,2, et cetera flaws will exist in the lot of 8 pdor to insoection. This is illustrated in column 3 of Table A4.1from spreasheet model (Ref.1, where, for example, the probability of precisely zero defects in the lot is 95%,1 defect = 5% and so on.

A4-2

e e Column 2 of Table A4.1 contains the failure rate for each number of flaws as calculated by fractue mechanics methods. Thus, given that one flew has 3E 5/yr chance of becoming a leak, then 2 such flaws have about 6E 5/yr chance of producing a leak and so on.

Column 4 contains the cumulative counterpart of the binomial distribution in column 3. Thus, for example, the valus of .999 in column 4 = 0.949 + 0.0497 from column 3 and can be interpreted as "the probability of observing 1 or less flaws-or, equivalently, the anahaWrty of a Anah Anneuemey af X-05 arJennerla SS.9E" This cumulative distribution is dubbed the Pre /S/ Probability Curve. It indicates, for example, that there is a 99.9% chance of finding one or fewer flaws or, squivalently,that there is a 99.9% probability that the f ailure rate would be no more than 3E-5/ year in the absence of inspection. This, of course, implies a 0.1 % chance that the probability of a leak would be i.eore than 3E 5/ year. This 0.1 % is the risk in the absence of inspection.

Interpreted within the context of Beyes' theorem, the distribution in column 3 of Table A4.1 can l be called the " prior to inspection" distribution. Column 5 is called an " operating l

characteristic" or OC curve in acceptance sampling. For purposes of Bayesian reliability L

demonstration, however, it can be interpreted as a "likelihoo:i" function because it shows the L likelihood _or probability of accepting the lot-glean that said lot has the number of flaws

" indicated in Column 1. Like any OC curve, this one is calculated by using the hyperpoometric

- distreut/on, which is tabulated in (Ref. 2) and is also built into a number of software packages (e.g., EXCEL). Keep in mind that the specified acceptance number for this example is zero; that is, the lot will pass only if zero flaws are found in the sample of 2 elements. Thus, referring to the second row in column 5, for a lot size N = 8, sample size n = 2, number of defects in lot k

= 1, the hypergeometric distribution can be used to calculate that the probability of finding x

= 0 flaws is 0.75. The analogous probability.for k = 2 and x = 0 is 0.536 and so on. If the acceptance number had been, say,1 flaw, therktbec=Mations would use x= 1 and proceed to find the probability of (8,2, k,1) for diffe' rent valesi of k. If a different sample size, say 3, had been used then the probability to look up would have been ( 8, 3, k, x).

Given the prior and thElikelihood function, the noxt stop in the application of Bayes Theorem is to simply multiply the tvdo columns (i.e., column 3 times column 5) to get column 6. The latter column is not itself a proper probability distribution because it does not sum to unity. This is fixed by summing column 6 and then dividing each of its elements by the column sum to get the

" post Inspection" probability distributi onin column 7. The cumulative counterpart of the latter distribution, called here the "Pbst /S/ Assurance" distribution is column 8.

To examine the effect of the target leak frequency goal, assume that the minimum allowable reliability is associated with a failure rate of 1E 6 per year for the lot (not per elemviit but rather for all 8 elements that make up the lot). Assume further (for the moment) that if a flaw appears in the sample, the inspectors will see it (POD = 1). Column 8 of Table A4.1 indicates that if the sample passes the inspection (i.e., if no defects are found), then une Aswa 28.2% annaninnt umy 3, ,, p. m _ _ . - -

- ; _ - ,,,, ,, . gy, Equivalently,the " risk" probability associated with this inspection plan is 1 .962 = .038 or 3.8 percent. Once a specified level of " risk" is defined, different inspection strategies can be evaluated by the above method until one is found that meets the goal.

A4-3

1 i

i

! Table A4.1 Evaluation of Risk for N =8, n= 2, and Zero Defect Acceptance Criterion

. . . . . _ . A s u .i ._ .. :

2 No. of Conditional Dinomial Pre-ISI (i.e.. OC Curve Col. 3 x Post.

I Tlaws (k) Leak Frequency Probability of k No ISI) llypergeometric Col. 5 nspection l inn Leak /yr/ Lot Flaws in the lot Probability of k Distnbution Prol;sbility

! Elements ( .ven a Flaw (Prob. of a flaw > or Fewer Flaws That k Flaws

>0.1 Wall 0.1 Thickness of in The Lot Probability 1 hat 0 are in the 141 1 Thickness The Pipe Wall a Flaws are in the and Given l 6.5E 3/ weld) Sample of 2. None are in Conditional on k the Sample riswsin the Lot (Col. 6 /

, (0,L.2.8) Sum Col.6) i

O O 0.949 0.949 I .

g 0.962 j

1 0.00003 0.0497 0.999 0.750 g 0.0377 2 0.00006 0.00114 1.000 0.536 0.00062 10]006

, 3 0.00009 0.00001 1.00000 0.357 5.3E 06 S.4 E-06

) 4 0.00012 0.00000 1.00000 0.214 2.6E-08 2.6E-08

5 0.00015 0.00000 1.00000 0.107 6.8E-11 6.9E-11 i Col. 1.00000 0.987 Total Key

N = Lot (population) size (8) n = Sample size (2)

! k = Number of defects in lot (18) l x = Number of defects in sample (0) 1 1

A4.3 Correction For imperfect Detection Table A4.1's OC curve in column 5 implicitly assumes that the nondestructive evaluation (NDE) techniques used to find flaws are perfectly accurate i.e.,if a flaw ends up in the sample, then it will be detected and properly sized. The OC curve can be corrected to reflect any hypothesized or real NDE level of accuracy (usually expressed as the probability of detection or POD).

Figure A4.1 illustrates the logic for an imperfect detection process where it is assumed that one flaw exists in a lot. The outcome of a sampling process could:

1. detect the flaw if it is in the sample, and reject the lot,

2. not detect the flaw even if it is in the sample (due to the inaccuracy of the detection process), and accept the lot, or

3. accept the lot because the flaw was not in the sample selected for inspection.

It is assumed that there are no f alse detections,i.e., NDE never calls an item defective when it is net.

A4-4

r o l

h;@QdNjdf%hf9fS SAC < EU (Mhc s4 p:y njj g Q h: & % M l. M **:M';e.L3* .  % b**L%: . p

$46tkowys a# pig QQ hlb?& WWW h&@$h[@O@@M@&i4'?R$ MD. d  % A W h iNIN $l} W M

.mionesyairJyA ,e W ys N dlI+-. ash hopi / Ms p

e g.

. lf.'

?W *py g.

U mn; i .%,s.1 lRW $ 5 %1meO M m M hH n t:ak@ W w n + -

dN '

-v g

Figure A4.1 Single Sample Plan Logic Only for the case:where the flaw was within the sample and detected, would the lot be rejected.

The lot would be accepted if the flaw was in the sample and not detected or if the flaw was not in the inspection sample. Thus, the probability of detection can have an important role in the analysis and needs to be addressed in the analysis.

The probability of a':cepting a lot, given that one flaw exists in the lot, is the sum of the probability of all the paths identified in Figure A4.1. Applying the hypergeometric distribution function to this process, the probability of accepting the lot is:

HYPGEOMDIST(0,2,1,8) + HYPGEOMDIST(1,2,1,8)*(10.65)

Where: HYPGEOMDIST(0,2,1,8) signifies the probabi!ity of getting zero flaws in a sample of 2, given that the lot has one flaw in a lot consisting of eight elemerits, and HYPGEOMDIST(1,2,1,8) is the probabilityof getting one flaw in a sample of 2, given that the lot has one flaw. The term (1-0.65) is the probability that the flaw will not be detected by the detection technique (1-probat-,ty of detection). Note that in practice, the probability of detection depends on both the mechanical detection technique as well as on the capability of the inspector performing the inspection.

The existing Section XI of the . .NE Code calls for a double sarr.pling plan. As an example, a double sampling plan can be summarized as follows: Take a sample of 1 tnd accept the lot if no flaw is found in that sample. Otherwise,take another sample of 1 and reject the lot if a flaw is found and accept the lot if no flaw is found. In general,if a flaw is detected in the sample, then take another sample of equal size, if a flaw is found in the second sample, then reject the entire lot.

The logic for this is more complex, as illustrated in Figure A4.2.

Let us follow an example for the case leading to accepting the lot. The application of the hypergeometricdistrioutionfunction takes on the following representation for 2 flaws in a lot with an initial sample of 1:

HYPGEOMDIST(0,1,2,8) + (HYPGEOMDIST(1,1,2,8))*(1-0.65) +

(1 -HYPG EO M DIST(0,1,2,8))

• 0.65 ' HY?G EO M DIST(0,1,2- 1,8 1 ) +

(1 -HYPG EOM DIST(0,1,2,8))

• 0.65 (1 -0.65) * ( 1 -HYPG EOM DIST(0,1,2-1,8-1 ))

A4-5

e

• Detect Fisw

, b. . Reject Let Flaw le 2nd Sample Detect Flow [ Dee's Detect Flan Accept Let j Flaw le let Sa m.ple \ No Flaw le 2ed Sample Accept Let; Dee's Detect Flaw Ateept Let sNo Flow la let Sample Ateept Let Figure A4.2 Double Sample Plan Logic The results of the above hypothetical example are listed in Table A4.2.

A4.4 System Assurance - Example Calculation The methodology described above (applied to select a sampling plan for a single lot or Segment) can be applied to provide a suitable level of confidence that a target leak frequency would not be exceeded. The NRC finds 95% confidence or assurance that the target leak frequency goal will be met as an acceptable objective for the system in question (e.g., summatiw. 9f all the HSS '

segments in a system). However, achieving a 95 percent confidence for each segment of a system does not insure 95 percent confidence that the system itself will meet the target leak frequency, it is important to remember that selecting a single segment sampling plan on the basis of achieving a confidence of atleast 95 percent will often necessitate choosing a sampling plan which yields considerably more than 95 percent confidence. This is demonstrated in Table A4-2, which adapts.

results from the Surry pilot plant, presented at a public meeting of February 12,1997 (Ref 3).

Two segments, RC-41 and RC-42,43, could achieve the 95 percent confidence level only with 100 parcant of the elements were inspected; thus producing (to 5 decimal places) 100 percent coniidance in each segmrt that the leak frequency will be greater than or equal to the ter.et rate. Suppose that none of the remaining nine segments are inspected because, in each case, their '

" Pre-ISI Confidence meets or exceeds 95 percent (this is " Plan A" in the second column of Table A4-2). The resulting RC SYSTEM l

i A4-6

m.... . . _ _ _ _ _ _ . _ _ . . . . . _ . _ _ . . _ . . . . _ . _ _ _ _ _ . . . . . _ _ _ _ _ _ _ . _ _ _ _ . . _ _ _ _ . . _ . . _ _ _ _ _ _ . _ _ _ - _ _ . _ _ _ _ _ _ _ . . . _ _ _ _ . _ _ _

Table A4.2 Evkluation of Risk Using Bayes Theorem for Perfect (POD =1) and Imperfect (POD =0.65) Probability of Detection Cases .

i, 9 11 12 13 14 1 3 1 1 1 Single Sample Binomial Pre-ISI (i e, OC Cur /c Col.3 s Post- Double OCCerve Col 3 x (Pbst-ISI No. of implied Col. 5 Inspection Sampic (double. Ist Col.9 Inspection (POD =I)Preb Ilaws Leak /yr/ Lot Probability of No ist)

Probability of Probability (each sample =2) Probablity) of k or Fewer (k) kI' laws in a le of 8 k or Fewer iCol. 6 / Surri sample'l Col.lof Flaws Flaws Col.6) ) Prob.of Sam Col.10 I

k or i

Few)r i; A -

Flaws *

• 0 949 0 949 0 949 0 949 1 0 949 0.949 0.962 O O O949 -

1 4 -

t 0.00003 0 0497 0.999 1 -0497 0 0.0497 0.998 1 0 0497 0.0497 0 999 1.000 0 985 0.00112 0 00112 1.000 0.925 0.00105 0.0010 1.

2 0 00006 0 00114 1 000 0 955 0.00001 0.00001 1.000 O s50 13E45 13E-0 3 0 00009 0.00c01 0 718 8.7E-08 1.

4 0.00012 0 00000 1.000 0 909 0.000

-0_00000 _I.000 _8.70-08 1.000 0.849 0.000 0.00000 1.000 0.566 3 6E-10 3.6T-1 1.

5 0 00015 0 00000 1.000 1.00000 1.000 Col. 1.00000 Total .- -

i i

a

w-

• confidence level actually demonstrated is the probability that no segment will excer d its target  ;

leak frequency / and this is equal to the product of the individual segment confidence '

probabilitics in the third column: '

SYSTEM Confidence = [](Segment Confidence Probabilities)(Equation A41) ,

which comes to 98.3 percent. Thus, even though no single segment is required to demonstrate more than 95 percent confidence, the resulting RC system confidence exceeds 95 percent (for the " safety i significant" segments of interest). This will not always be the case, but the system resuit can  :

always be checked by taking the product of the segment confidences associated with the sampling plans actually chosen. '

Tabis A4 2: Surry RCS Segment Results Segment (with # Plan A: Number of Plan A: Confulence Plan B: Number of PlanB: Confulence of elements in Elemens laspected (probability leak Elements inspected (probability leak

- the Segment) frequency below frequency below target) target)

RC-44,45,51 0 1.000 1 per segment 1.000 (42)

RC-41 (3) 3 1.000 3 1.000 -

RC-42,43 (6) 3 per segment (= 6) 1.000 3 per segment 1.000 RC 18 (7) 0 1.000 1 1.000 RC 16.17 (14) 0- 1.000 1 per segment 1.000 RC 37,38,39 0 0.999 1 per segment 1.000 (17)

RC-19 (7) 0 1.000 1 1.000 RC-27,28,29 0- 0.984 I per segment 1.000 (51)

RC 10.11.12 (6) 0 1.000 1 per segment 1.000 RC-13,14,15 0 1.000 1 per segment 1.000 (12) '

RC.07,08.09 0 1,000 1 per segment 1.000 j (30)

RC SYSTEM- 9 0.983 31 ,

1.000 Amauring an Accentable System Confidence ,

Assume that the system product falls short of the 95 percent threshold (or assume that the product of all relevant systems falls short of the required Plant wide confidence). " Plan B" in the Table could represent a second iteration in which the licensee would return to augment Plan A by selecting a minimum of one element to inspect from each segment. This produces an increase in RC l system confidence to essentially 100 percent. Plan B is in fact the approach actually recommended

' for the Surry RC. Based on this analysis,' the following process can be used to assure acceptable system confidence:

i'

1. Select a sampling plan for each segment that achieves at least 95 percent confidence (no more than 5% risk of exceeding target leak frequency), subject to the constraint mat at j

least one element willbe inspectedin each high-safety significant segment..

A4-8 ,

i

• e

2. Calculate system confidence as the product of the segment confidences associated with the sampling plans initially chosen. If system confidence is below 95 percent, then rank-order the segments and proceed to augment inspection plans in the worst segments until the requisite system confidence (that no lot will exceed its target leak frequency) is achieved.

A4.5 The Global Analysis The following presents the global analysis of the Perdue Abramsonmethod for calculating the number of inspections and for monitoring adherence to the leak frequency targets or goals. The global analysis assures that a specified target leak frequency is not exceeded for a given system of high-safety significant/ low failure potential pipe segment. The target leak frequency is specified in terms of the frequency of leaks per year per weld. The analysis consists of the following steps, as shown in the flow chart in Figure A4.3.

1. Calculate the leak frequency for the given system without inspection.

2. If the calculated leak frequency does not exceed the target leak frequency, then no inspection is necessary, except for one weld to satisfy the defense in depth consideration.

3. If the calculated leak frequency exceeds the target leak frequency, then some inspection is necessary. Specify an inspection plan and recalculate the leak frequency.

4. If the recalculated leak frequency is less than the target leak frequency, then implement the inspection plan.

5. If the recalculated leak frequency exceeds the target leak frequency, then a more stringent inspection plan is necessary. Modify the inspection plan in step 3 and recalculate the leak frequency.

6. Iterate through steps 4 and 5 until the inspection plan results in a leak frequency which is less than the target leak frequency.

Assuring the Target / Goal by the Global Analysis The target is to assure a maximum acceptable leak frequency per weld in a system consisting of N welds. For most cases of interest, this leak frequency is sufficiently small so that the chance of more than one leak in the system in a year is negligible.

Therefore,it is assumed that at most one leak will occur. (The methodology can be extended if this assumption is not valid.) Accordingly, the leak frequency for the system of N welds is simply the probability that one of the welds will develop a leak. Denote the.

maximum acceptable leak frequency per weld by r, Then the maximum acceptable leak frequency for the system is Nr, Equivalently, the maximum acceptable probability of a leak in the system is Nr, A4-9 l

e ,

l I

i

,.,,.,g,c.

.,c.

.,_.,5 ,, . ,. ,. . , -. .

y. .,,,.9 i

, l l

1. S*

c NM. l f.

! k%%ct, ., -

i e '

s l

i Figure A4.3 i

The purpose of inspection is to assure that the maximum acceptable leak frequency toor Nro is not l exceeded. The inspections considered here attempt to identify flaws which, if not repaired, have 1 l the potential to develop into leaks. For any given system, its leak frequency depends on the number of flaws remaining after inspection and the probability that a itaw will develop a leak, in the discussion below, it is assumed that all welds in the system have the same probability of (i) having a flaw, and (ii) having the flaw result in a leak. We will then show how the analysis

can be generalized to the case where these probabilities are not constant.

i First, consider the case where no inspection is performed. Let i

p = Prob $ a weld has a flaw}

f, q = Prob! a flaw will develop a leak}.

A4-10 "

L

Then the probability that any given weld will develop a leak is pg. The leak frequency for the i system is the probability that one of the welds in the system will leak and is equal to Npq. {

Comparing this with the target of Nro , we conclude that:  !

If pq s r ,o no inspection is necessary to meet the target goal, if pq > r , oinspection is necessary to meet the target goal.

If inspection is performed, then the leak frequency will depend on the initial distribution of flaws and on the probability that one or more flaws will escape detection. Let k be the number of flaws in the system. Then k has a binomial distribution with parameters N and p. Conditional on k and on an inspection strategy S, let Gs(k) = Probl no flaws are detected l k , S f.

Denote the leak frequency for the system by R. Then R #= Prob lone leak in the system}

Prob (k) G,(k) Prob (leakW) 2.o N f \

=[

s.o g k ,

p * (1 p)"~' G,(k), kg

+.

=q[ p(l-ji)#~'G (1)+N(N-1)p'(1

, 3 p)n-2G,(2) +...] (1)

As an example, woda a system with N = 8 welds andp = 0.0065. Let S = { inspect 2 out of 8 welds and accept the lot if no flaws are found in the sample of 2}. Then Prob {k) and G 3(k) are given by the binomial and hypergeometric distributions, rer,3ectively, k Prob {k} Gs {k}

O O.949 1.

1 0.0497 0.750 2 0.00114 0.536 3 0.00001 0.357 A4-11

, n Substitution into Equation 1 yields:

' R = 0.0385 g (2)

This must be compared with the maximum acceptable leak frequencyo Nr = Br, Accwdingly, the l inspection scheme S meets the target provided q s 207.8 to (3)

For example, if to = 104, then any q < 2.1 x 104 meets the target.

Generalization of the Global Analysis P

in many cases, the probability of a flaw and the probability that a flaw will result in a leak may differ from weld to weld, if there are N welds in a system, let i

l p, = Prob { weld / has an unacceptable flaw}

i q, = Prob { weld / will result in a leak, given that weld Ihas an unacceptable flaw) o for /= 1., 2, .. . , N.

If no inspection is performed, the leak frequency for the system is:

u R,=[ p,q,.

est Comparing this with the target of Nro, we conclude that:

If Ro s Nr o, no inspection is necessary to meet the leak frequency target, if Ro > Nr , oinspection is necessary to meet the leak frequency target.

If inspection is necessary, set p* = - max { pu p2, ... , p,) and q * = (max q , q , ... , q ), A conservative approachis to assume that all welds have the same probability, p* , of having an unacceptable flaw and the se...e probability, q' , that the flaw will result in a leak. Equation ;

can then be used to calculate an upper bound, R* , on the leak frequency by replacing p by p *and q by q' . R*can then be compared with Nro. If R *s Nr , othen the inspm: tion strategy S meets the target.- Otherwise, a more stringent inspection strategy is needed to meet the target.

A4.6 References for Appendix 4

1. R.K. Perdue,"A Spreadsheet Model for the Evaluation of Consumer Risk Associated with Inservice Inspection Plans," attached to USNRC," Meeting Summary - ASME Research Meeting on Risk-Informed ISI: Statistical Sample Method of WELDS," January 8,1997.

A4-12

< v l

2. G.J. Lieberman and Owen, D. B., Tables ofthe Hypergeometric Probability Distribution, .

Stanford University Pres.= Stanford CA,1%1.

3. A. McNeill et al.," Example Applications of WOG RI-ISI Process to Surry RCS,"

USNRC, Attachment to Meeting Summary," Meeting Summary - ASME Research -

Meeting on Rbk-Informed ISI: Pilot Plant Preliminary Results," Feb. 25,1997, t

i i

A4-13 o

, o Appendix 5: RISK-INFORMED INSPECTION PROGRAM DEVELOPMENT The methods discussed in Chapters 3 and 4 can be applied to support the development of improved inservice inspection p;ans (e.g., what to inspect, where to inspect, when to inspect, and by what method) by integrating risk insights into the program, in this regard, the development of a risk-informed inspection plan can be viewed as a three step process:

Step 1 - Selects the particular structurai elements or locations that will be inspected; this sele tion should be made to ensure that the selected piping locations are those with higher failure probabilities, with greater impacts on plant safety, and those locations not expected or anticipated 30 years ago during the original design of a plant but identified through operating experience.

Step 2 - Define inspection strategies for the selected locations, such that the NDE methods and inspection frequencies provide desired levels for detection of degradation and reductions of failure prsbabilities.

Step 3 - Augment steps 1 and 2 to accommodate defense-in-depth review for unexpected degradation mechanisms.

The risk categorization study and the element selection process, described in Chapter 4, focuses on the first step. These methods can be applied to evaluate various inspection strategies to iden9y combinations of inspection methods (e.g., POD, sizing accuracy) and frequencies at selected locations that can be effective in maintaining or reducing the failure probabilities of passive reactor components. To accomplish this target, the inspection strategies must address the failure mechanisms of concern, and have sufficiently high probabilities of detection and sizing accuracy so that the expected damage e.an be detected (given various frequencies of inspection) and the components reprired before s tructural integrity is impacted. When analyzing the piping networks for failure degradation mechanisms, it is useful for the analyst to have a checklist table of degradation mechanisms, idtntification of materials susceptible to those degradation mechanisms, potential locations that a e susceptible to the degradation mechanisms, and the contributing causes. The checklist, such .is illustrated in Table AS.1, provides added confidence that the analysis takes into consideratit n the various degradation mechanisms and potentiallocations. The analyst also needs to consmer acceptable approacnes for determining the number of locations to be inspected (sizo of insp3ction sample) and the desired relial lity and frequency of the inspections to be performed at these locations. Since several potential inspection strategies may provide the desired maintenance or reductions in f ailure probabilities, the final selection can be based on other important considerationsincluding man-rem exposures to inspection personnel and cost effectiveness.

AS-1

Table A5.1: Check List of Degradation Mechanisms for Inspection of Piping Systems Susceptible Materials Cusceptible Iocations Contributing carses Degradation Mechanism -.

Low Cycle Fatigue All materials Terminal ends Operating transients Dissimilar metal welds High thermal expansion stresses Near snubbers Stress concentrations Near component nozzles ' 'e Conscruction defects I Fittings l I

Mixing of hot and cold fluids valve leakage ,

Thermal ratigue All materials ,

t Hot or cold water injection Thermal stratification  !

i, valves (downstream from leakage) l t

'2 reedwater nozzles Counterbores Horizontal lines Small diameter piping ( < 2-inch) Rotating equipment vibratory Fatigue All materials 4

, Terminal ende Socket welds Welds Elevated temperatures Intergranular Stress Stainless steels l High coolant conductivity Corrosion Cracking 8 Heat affected zones

- Sensitized base metal materials High carbon grades of SS BWR piping Elevated oxygen levels PWR piping (CVCS systems) Residual stresses Cold springing stresses Stagnant fluids .-

Bolting High carbon or low carbon materias Transgranular Stress Stainless steels Iron-nickel-chromium alloys High oxygen corrosion Cracking High welding stresses Severe cold working Presence of chlorides or sulfates Brackish environment Insulation materials with chlorides Crevice Corrosion Cracking Stainless steels Iron-nickel-chromium alloys Primary Water Stress Iron-nickel.-chromium alloys corrosion Cracking Intergranular Attack I. wn-nickel-chromium alloys A5-2 .

I ____

[_ _ _ _ _ _ __ _ _ _ _

Degradation Mechanism Susceptible Materiale Susceptible '.x> cations Contributing Causes

.-----2:_-- Mm Flow Accelerated Corrosion Ferritic steels Elbows Wet steam (erosion / corrosion) Reducers Single phase (water) flow Tee fittings Low alloy content W oxygen High Ph

'* , High flow velocities  !

l Slurry Erosion All materials Raw water systems Sand or solids in raw water Cavitation Wastage All materials Pumps and valves Phase change Highly localized areas Droplets Microbiologically A.1 materials Buried piping (external surfaces) Exposure to organic materials Influenced Corrosion (MIc) Other piping (internal Surfaces) Exposure to raw water Welds Lack of coatings Fittings Lack of cathodic protection Heat affected zones

\ crevices General Corrosion Ferritic steels Secondary systems Galvanic / electrolytic corrosion Austenitic steels (occasionally) Service water systems Crevice corrosion Dissimilar materials (galvanic effects) Acid attack Raw water Salt water corrosion Brackish water corrosion Boric Acid corrosion Ferritic materials Primary systems Leak of boric acid solutions Pitting Ferritic materials PWR feedwater nozzles Leakage at thermal sleeves / joints Structural Damage All Materials Small diameter piping Water Hammer Compression fittings Impact Crushing

, Over Pressure l Maintenance errors AS-3 L----__---_-_

h l; An inservice inspection strategy can be defined by the following elements:

Element 1: Sampling Strategy.

p

~

' The sampling strategy is defined by the selection of structural elements that are proposed for l inclusion in the inspection program. The selection of structural elements should be guided by the calculations of risk categorization and should include additional elements to address defense ird .

depth for lower risk components, and to address unanticipated generic failure mechanisms that have not been detected or that have not yet occurred. The strategy should include immediate expansion of the sample when flaws are detected dunng an ISI through sequential sampling based on feedback from ISI findings and operating experience.

The structural elements (or locations to be inspected) should be appropriately defined, such that the defined volume of metal for the elements includes the critical Accations where degradation

/s mostlikely to occur. Structural elements will be the basis for the " examination volumes" to be addressed byJhe detailed NDE procedures, in many cases, the structural elements should include base metal locations well removed from the weld heat affected zones to ensure that the NDE covers locations of stress concentrations, such as weld counter bores.

Element 2: Inspection Method inspection methods are selected to address the degradation mechanisms, pipe sizes and materials of concern. The inspection method includes the basic technique itself (e.g., ultrasonics) along i with the particular equipment and the procedures to be applied for detecting and sizing flaws.

Candidate inspection techniques for piping include ultrasonic testing, surf ace examinations with dye penetrants (or magnetic particles), visual examinations, and radiography. In a larger context, monitoring methods such as leak detection, thermal transient monitoring, and acoustic emission monitoring can be used to supplement or replace pondestructive testing methods. Detailed aspects of equipment, procedures, and personnel qualifications are significant factors that govern the reliability of the inspections. - The risk-informed inspection concept requires that

.the reliability of the inspection method be established in order to justify the selection of a

_ particular inspection strategy. Based on materials, environments, loads, and degradation mechanisms, probabilistic fracture mechanics calculations can establish the probability of detection, the sizing accuracy, and the frequency :f inspection needed to meet targets for passive reactor component failure pbabilities (see Chapter 4).

Element 3: NDE Reliability and Performance Demonstration Qualification of the NDE system (personnel, procedure and equipment) is an important element of an inspection program. Inspection systems with known reliability are needed to achieve the desired ievels in f ailure probabilities consistent with the goals of the risk-informed inspection process. A risk-informed inspection program should justify the inspection reliability using data from performance demonstration programs.

Element 4: Time of Inspection The inservice inspection strategy must define when the inspections are to be performed. In most cases inspections are performed periodically at regular intervals such as with the 10 year interval of the existing ASME Section XI. A risk-informedinspection program will identify the appropriate inspection intervals, such that the inspection program provides the desired A5-4

, w maintenance or reductions in component failure probabilities, inspection intervals must be sufficiently short so that degradation too small to be detected during one inspection does not

! grow to an unacceptable size before the next inspection is performed.

This chapter discusses one approach for determining the appropriate examination methods, frequency, and level of qualification for the structural elements selected for examination in Regions 1 and 2 of Figure A2.9. As mentioned previously, SRRA tools have been and can be exercised to evaluate the effectiveness of a given examination method, frequency, and level of performance.

l %9serees Chapter 4, Se; tion 4.3 of this reputatoryguide focused on the selection ofpke segments f and the number of structuralelements to be inspected, tMs chapter addiresses the senectian of l .'.4 :f, stretspies. Guidance is provided to ensure that inspections are performed in a manner ll that ensures that the failure probabilities of passive piping components remain acceptably low.

! To accomplish this objective, the inspection strategies must address the failure mechanisms of

! concern and have a sufficiently high probability of detecting the expected damage before j structural integrpy is impacted.

Section A5.2 discusses acceptable approaches for determining the reliability of the inspections to be performed at these locations, and the frequencies of the inspections. Since several potential inspection strategies could provide a desired reduction in failure probabilities, the final selection by licensees can be based on other important considerations such as cost effectiveness and man-rem exposures to inspection personnel. As mentioned previously SRRA tools have been and can be exercised to evaluate the effectiveness of candidate inspection strategies.

A5.1 Elements of Inspection Strategies An inservice inspection strategy may be comprised by use of the inspection strategy table in Figure A5.2. This is accomplished by selecting one option within each category identified in Figure A5.1 (Ref.1). The following address some of the major categories identified in Figure A5.1.

Inspection Niethod - Inspection methods are selected to address the degradation mechanisms, pipe sizes, and materials of concern. The inspection technique includes the basic technique itself (e.g., ultrasonics) along with the particular equipr.. ant and the procedurc: to be applied for detecting and sizing of flaws. Appropriateirapaction techniques for piping include ultrasenic testing, surf ace en amin 6t.uns with dye penetrants (or magnetic particles), visual examinations, ,

and radiography, in a larger context, monitoring methods such as leak detection,- thermal l

- transient monitoring, and acoustic emission monitoring can be used to supplement or replace l

nondestructive testing methods.

Detailed aspects of equipment, procedures, and personnel qualifications are significant factors that govern the reliability of the inspections. The risk informed inspection concept requires that the reliability of the inspection method be establisned in order to justify the selection of  !

a particular inspection strategy.

Time of inspection - The inservice inspection strategy must define when the inspections are to be performed. In most cases, inspections are performed periodically at regular intervals such as with the 10-year interval of ASME Section XI. The risk-informed inspection program wil! identify appropriate inspection intervals, such that the program provides the desired component f ailure probabilities (consistent with the PRA assumptions). Inspectionintervals must be sufficiently ,

l A5-5 l

. - - .I

1 o

f I s5 ort so that degradation too'small to be detected during one inspection does not grow to an unscceptable size before the next inspection is performed.

Some techniques (e.g., acoustic emission monitoring) perform the inspections on a continuous 7

<  ; rather than periodic basis, in other cases, the strategy may require inspections only after an unanticipated or a significantloading event has occurred, such as a severe thermal shock or a water hammer. Some inspections may be performed on a one-time-basis, as for example, to venfy that_a degradation mechanism experienced at a similar plant is not occurring at the plant of i

concern, or to otherwise support continued plant operation, such as part of a license renewal

process, i

NDE Qualification - Qualification of NDE (method, procedure, and personnel) is an important l-element of an.inapoction program, particularly for those components having high failure i

- probabilities or safety significance. For such components, highly reliable inspections may be needed to achieve the desired failure probability goal.

A risk informed inspection program should have a technical basis for the inspection reliability l

[-

inputs that are used in structural reliability calculations of estimated failure probabilities for prannaart inspection stratepes. Such a basis can be provided by NDE performance demonstration

< programs. Generic data from studies of NDE reliability can also be useful. Such generic data are available from NDE round robin exercises. The reliability of any inspection is dependent on the

- specific qualifications and skill level of the inspection personnel. In addition, the reliability

- can be enhanced by the use of inspection teams havmg qualifications that meet industry codes and i

standards, and by the use of methods and procedures with accepted capabilities. -

ii Ngk w6 .

e 4

1 i

l~

i l

l l

h i

AS-6 p

j

l Figure A5.1 Inspection strategy table.

Development of NDE Methods - This element of the inspection strategy, as indicated in Figure A5.1, laspecties Time of NDE l_ocations Development Sampling Delivery Methods laspectios Qua!!Gestion of Strategy Method NDE Methods VT.I 10 Years Personnel Welds Customization 100 % TV Cameras Cracking / Visual Surfaces Qualification Bolts New Various Divers l'hnique opuons Vr.3 Refueling h 'w..a.cc Dexures . rom of1,2.& 3 Submannes Orons 12 24 Demonstrauon Scratch Below Damage / months Surfaces / Remote Tools Surfaces Hisaoncal Interfaces None No Cqntimsous Data Sequential in-Situ Remose/ -

Support Strategy Enhanced Systems Removed Visual License Whasever from Renewal Dowel is Vessel Ultrasonic Pins Accessible Testing After Significant Unspecirwd No inspection Event Known Monitoring Based on Degradauon Neutron Performance Noise ooal Parts objectives 1) Initial size

2) Sequential Remote Rule Replication 3) Choice ofSampling Mechanical location /

Measurements Period Metallurgical Examination y addresses the possible development of new and improved NDE methods to achieve levels of NDE reliability which are consistent with the goals of the risk-informed inspection program identified in Section 4.3 (e.g., frequency of a leak < 1E-06per wekf year). In most cases, special development effort will not be needed, since existing NDE methods can be utilized or adapted. As indicated by Figure AS.1, sa,. activities as the industry-funded Performance Demonstratio..

Initiative (PDI) can be considered an appropriate development ef%rt, since it serves to enhance NDE reliability.

Sampling Strategy - In the context of this regulatory guide the sampling strategy is defined by the selection of an appropriate number of structuralelements as described in Section A2.7 and Appendix 4. Expansion of the sample size (i.e., through sequential sampling) is addressed in the implementation of risk-informed inspection through feedback of ISI findings and other information on structural degradation pained from operating experience. Such information should impact the estimates of component failure probabilities, and will result in appropriate changes to the inservice inspection programs.

AS-7

Delivery Method - The effectiveness of an ISl strategy can be enhanced by the use of improved methods that provide better access to the selected locations, improved access and the use of remote systems can also provide benefits in terms of reduced radiation exposures to the employees.

A5.2 Failure Probability Considerations An inservice inspection program should ensure appropriate f ailure probabilities for the inspected structural elements, thereby minimizing their contributions to the risk as measured by core damage frequency or by other risk measures. The licensec should justify the basis for the selected sample size, of locations to be inspected and justify the effectiveness of the inspections at these selected locations.

l l Inservice inspection programs for piping, in accordance with ASME Section XI and/or other l requirements, are performed to maintain confidence in the structural reliability of pipes. In I terms of risk-informed inspection one objective of inservice inspections is to maintain the f ailure probabilities to an acceptable low value.

This section describes how considerations of quantitative goals can guide the development of risk-informed inservice inspection programs. For example, it is proposedbelow that a factor of ten reduction in calculated failure probability (over the probability of no inspection) can be used as a guideline to identify effective inspection strategies. Such a goal also helps to eliminate l ineffectiveinspection strategies for which the sampling plans, NDE methods, and inspection frequencies are inadequa'e to deal with the components and degradation mechanisms of concern, in other cases candidtte strategies may be marginal in achieving the goal, in which case modifications to the N)E methods or to the inspection frequencies can be identified.

Service experience provides specific examples to demonstrate that inspections can reduce f ailure probabilities. There are cases of large and growing cracks, and of aress of wall thinning whereby inspection programs have provided timely detection of the damage such that repairs were performed before the defect sizes became critical. On the other hand there are other examples whereby ineffective inspection programs have failed to detect large defects which have eventually resulted in pipe leaks or pipe breaks. Such ineffectiveinspections, performed at considerable expense and often exposing personnel to radiation exposures, have not contributed to piping reliability.

While service experience identifies many examples of direct benefits from inspections whicn have provided examples of the timely detection and repair of piping, inservice inspections also provide other important indirect benefits which are more difficult to quantify. For example, the detection of ongoing degradation at a specific location not only impacts the f ailure probability for the inspected location, but also provides valuable information to the plant technical staff (and the industry in general) regarding materials performance issues and the structuralintegrity of similar piping locations.

Therefore,the finding of degradationduring a particularinspection can have a significantimpact toward reducing failure probabilities for a population of similar pipe locations, in such cases, the findings of a single inspection can be a key f actor that leads to important corrective actions (e.g., additional inspections in accordance with requirements for expanded or sequential sampling, improved operational practices to reduce stress levels, replacement of pipes using improved materials and designs, etc.).

AS-8 i

I j

~- - -. - - . . - - - - - -. - - - -.- _ - _ _.- -

p ., s i

i At a minimum, an adequate sample size includes sufficient representative locations within each

. piping systems to permit the detection of degradation mechanisms that may be operating within the system._ These locations should, in part, correspond to locations for which the probability of l

l . degradation is consider greetest, independent of the calculated risk Importance parameters. '

For the selected locations, the ISI strategy should be based on an appropriately specified level j of ' effectiveness for detecting structural degradation. An effective inspection strategy is a one j that detects degradation before it grows through the depth of the wall. Licensees should identify the level of inspection effectiveness adopted as a criterion for the development of its proposed .

inspection programs.

. As an example, the following is an acceptable rationale for adopting a criterion of a factor-of-

ten reduction in calculated failure probabilities for the goal of the candidate inspection l strategies.

l SRRA calculatiorg mdicate that if pipe failure probabilities are estimated assuming no impact from ISI (e.g., no inspection) and then calculated assuming ISI has an impact (i.e., accounting l for the probability of detection of defects and the subsequent repair or ree !acement of the l affected pipe), reductions -in the failure probabilities (i.e., ratio of failure probability

! _ without ISI over failure probability with ISI) are about a factor of 10 (Ref. 2), (Ref. 3), (Ref.

- 4), (Ref 5), (Ref. 6), and Reference 8. Calculated reductions of f ailure probabilities, greater L than a factor of 10, can often be difficult to justify, due to the limitations and uncertainties in NDE flaw detection probabilities, and the need for relatively frequent inspections for cases where cracks can grow relatively quick between inspections.

j- Inservice inspection locations for piping in ASME Section XI, are defined for individual i

structural elements. However, it is recommended that the desired reductions in failure

! - probabilities be established in terms of total contributions from groups of. the structural

! elements being addressed. This approach minimizes the impacts of uncertainties in the estimated

. probabilities for individual structural elements. A graded approach for reducing component j failure probabilities is considered appropriate, such that the most aggressive inspection i strategies focus on the top contributors from the risk categorization, with reductions short of

_the f actor of 10 being acceptable for the less critical structural elements.

l

! A5.3 Integration of Pruoabilistic Structural Mechanics Calculations The selection of an inspection strategy for a structural element requires that the effectiveness

of the candidate strategies in detecting structural-degradation and reducing the failure

probability of the structuralelements be estimated. The effectiveness is governed by several

! factors including the NDE reliability (e.g., probability of detection),~ inspection frequency, and i crack growth rates. 'In this regard, limited historical dcta on piping failures provides little

information on the impacts of inspections on these probabilities, and it is therefore necessary

, to apply structural mechanics models to quantify the expected benefits of proposed strategies. -

j- Furthermore, the inspection strategies of interest are usually ones that will be newly

, implemented, and therefore'an extended period of future operating experience would be needed

{- before the f ailure rate data could indicate the effectiveness of a proposed strategy. Even then, j data on structural failures will be very limited, because actual failures (with or without inspections) are expected to occur only very infrequently.

AS-9 L

Efforts to calculate inspection related reductions in f silure probabilities should compliment ar.d

. build on the knowledge gained in recent years from ongoing work within the nuclear power industry by specialists in the area of NDE technology. This work has quantified the ability of NDE methods to detect and size defects in piping, and has resulted in new and improved requirements for performance-based demonstrations of the NDE methods, procedures, and personnel which are used to

_ qualify the pipe inspections performed at nuclear power plants. Applications of probabilistic structural mechanics calculations, as described below, are an extension on the current industry studies of NDE reliability. The calculations integrate considerations of NDE reliability (i.e.,

as measured by probabilities of flaw detection and sizing errors) with considerations of degradation mechanisms and inspection intervals. The calculations model the degradation mechanisms of concern to pipe reliability, and use probabilistic fracture mechanics methods to simulate the effects of periodic inservice inspections. Results of these calculations provide a basis for screening candidate inspection strategies and identify the strategies that are the most effective in detecting growing flaws bef oiw such flaws become through wall cracks and/or cause pipe breaks or large leaks.

Structuial roliabiby models can be used to address the various factors that govern the ability of ISI to detect degradation and reduce f ailure probabilities. For some situations, knowledge of only the probability of flaw detection for the proposed inspection method may be sufficient to estimate the effectiveness of a proposed strategy. However, this is seldom the case because the following additional f actors govern the effectiveness of ISI:

Detection probabilities are a function of flaw size. If small flaws are important to structural integrity, many NDE methods will lack the_ needed sensitivity.

Therefore the expected sizes of f abrication and service induced flaws must be addressed by the structpral,,r,el,iahility models.

. Flaws can grow in size over time when active degradation mechanisms are present.

~

A structoral reliability model must simulate the flaw growth rates, predict the sizes oTgro, wing flaws, and simulate the detection probabilities for the flaw sizes that are likely to exist when the periodic inspections are performed.

. Small detected flaws need not be repaired if they are less than the acceptable sizcz, as defined by the ASNIE codes. Some of these unrepaired flaws will contribute to pipe f ailures.

. In some cases there can be errors in measurements of flaw sizes, such that oversized flaws which should have been repaired are allowed to remain ir. ..tvice;

Structural reliability models should simulate the above factors to evaluate the~ benefits of ,

inservice inspections. The'models should simulate initial distributions of fabrication flaws in terms of their numbers and sizes, and also consider the possibility that degradation mechanisms can initiate new flaws during the service life of components at locations that were originally

' free of defects. For example, the initiation of new flaws should be addressed for those cases that y

calculations indicate that failures can occur for even the smallest sizes of the. fabrication flaws. The structural reliability model should simulate the population of flaws of various sizes over the service life of the component, and predict the flaw sizes that could be present at the times when inservice inspections are performed. If particular flaws are detected and repaired, 1

the model should then assume that these detected flaws no longer contribute to the feilure probability.

A5-10

i -,-

Probabilistic models of inservice inspection should address the following:

• The primary considerationis a representationof a probability of detection curve that corresponds to the specific NDE method / procedure / personnel, degradation mechanism, material, pipe size, and cwt +onent geometry of concem. Section AS.6 provides guidance on estimating the parameters for the curves for probability of detection (POD) as a function of flaw size.

Consistent with the realistic approach used by the structural mechanics codes to simulate other parameters, the POD curve used to simulate ISI should be based on realistic curves without consideration of confidence levels in POD values.

Separate uncertainty analyses can deal with concems regarding confidence levels.

-The combined effects of a sequence of periodic or repeated inspections should be i

appropriately simulated. The detection (or nondetection) of a given flaw by successive inspections, or by inspections using different NDE methods are not us'ually independent events. Those random f actors (excluding flaw size) which prevent detection for one inspection will also tend to preclude detection for the next inspection. For conservative calculations,the combined effects of repeated inspections can be bounded by taking credit only for the inspection having the greatest likelihood of detecting the flaw (e.g., the periodic inspection correspondmg to the maximum size of a growing flaw, or the NDE method with the maximum POD capability).

The simulations can address the effects of pre service inspections on failure probabilities by treating this inspection as an inservice inspection performed at t'une equals zero within the service life of the component. However, the simulation of preservice inspections should be consistent with the assumptions made in estimating the distributions of initial fabrication flaws in the component, because pre-service inspection is a consideration in estimating distributions of initial flaws. Double counting of pre serviceinspection effects can result if the simulated pre-serviceinspection was already addressed in estimating the initial flaw distribution. Pre-serviceinspections should be included in the calculations only if the inspections are in addition to those used as part of the fabrication process, and then only if the NDE method provides an enhanced level of NDE reliability.

The simulatior of inservice inspections should address the fact that detected flaws (more specifically small flaws) are not repaired if these flaws are smaller than ASME code flaw acceptance criteria.

The structural reliability calculations can be performed using the same computer code as used to estimate failure probabilities for the PRA calculations and risk importance measures, in many cases the benefits of proposed inspection strategies can be estimated by reference to prior_

generic calculations (e.g., from the literature) for the f ailure mechanisms, component designs,

- operating conditions and inspection strategies of concern (References 2,3,4, 5, and 6).

One potential benefit from risk-informedinservice inspection programs is the possible reduction of radiation exposure to personnel from reduction in the number of locations of inspections of -

. radioactive pipes. Applying the NRC's ALARA and defense-in-depth principios, the NDE method used A5-11 l

in locations where the number of inspections was significantly reduced should be optimized in terms of its' probability of detection capabilities. Part of the steps to identify optimum

.4 detection methods' include:

• Select a. structural mechanics model that addresses the component, failure i mechanisms, and inspection strategies of concern;

• Define the reliability of the candidate inspection methods;

• Calculate the failure probability of a component assuming no inservice inspections are performed:

• Calculate the failure probability of a component for each of the candidate inspection strategies:

• Calculate effectiveness of candidate inservice strategies as the ratio of failure probabilities, with the baseline being either no inspection or the current inspection strategy.

The calculations described above should make use of leak probabilities where the leak probabilities are used as a measure of inspection effectiveness, and as a surrogate for estimating the effects of ISI on reducing the probabilities of pipe breaks. The application of leak probabilities have significantly less uncertainties and is consistent with the regulatory philosophy of preventing breaks. It also avoids a large number of assumptions and uncertainties  !

associated with calculations of pipe break probabilities. The numerical difficulties of calculating very small values of probabilities for pipe breaks can also impose excessive computationaldemands, which are largely avoided if the focus is directed to calculating leak probabilities.

One acceptable approach is to quantify the benefits of inspection strategies in terms of a relative failure probability, which can be expressed by various terms such as " factor of improvement" and ." inspection efficiency" as follows:

Factor of impovement = P /P Inspection Efficiency = 1 - P/P.

P. = Failure Probability with baseline inspection strategy (e.g., no inspection)

P = Failure Probability with inspection Strategy of Interest These calculations of relative failure probabilities, that compare alterative inspection strategies, have been found to be relativelyinsensitive to such f actors as uncertainties in the operating stress levels that govern the absolute values of failure probabilities, if the baseline strategy is no inspection, the values of inspection efficiency can range from between 0.0 and 1.0 with a value of 0.0 corresponding to no ISI or a totally ineffective ISI strategy (i.e., the same as no ISI). A value of 1.0 corresponds to perfect inspection. Inspection A5-12 j

efficiency is roughly correlated to the POD of flaws, and becomes the same as POD for the limiting case for which:

the POD that is independent of flaw size, and e

all flaws are repaired without regard to their measured size.

l The values for a factor of improvement can range from between 1.0 and infinity with a value of 1.0 corresponding to a totally ineffective ISI strategy (same as no ISI), and a value of infinity corresponding to a perfect inspection.

4 A5.4 Example Probabilistic Structural Mechanics Calculations The selection of inspection program requirements for key locations in piping systems can be supported by SRRA evaluations. The literature provides many examples of such calculations, including the wor 3 of Khaleel and Simonen in Reference 5. This particular study was performed with the pc-PRAISE computer code as a series of sensitivity calculations for piping systems impacted by fatigue crack growth degradation. In this section we will present the results of both the individual SRRA calculations, and trend curves derived from the 7verall series of calculations. We will also describe how a selected inspection strategy (method and frequency) can be supported by the example trend curves.

Table AS.2 provides input parameters for the baseline case (no inservice inspection)of a 6 inch i

diameter pipe subject to fatigue cycling, which results in a calculated leak probability of only 6.0E-08 (cumulative probability per weld at 40 years). This modest level of fatigue cycling corresponded to a "Q-Factor" of 1.0, where the Q-Factor is a measure of the magnitude and number of stress cycles for the piping location being addressed. The series of failure probability calculations of Reference 5 covered a wide range of Q Factors corresponding to more severe conditions of stress cycling giving results as follows:

Loading Condition O-Factor Leak Probability Low 1.0-10' = 1.0x104 Medium 102 1os = 1.0x104 High 10'-10' = 1.0x104 i

s q

AS-13

i L 4

- Table A5.2 PRAISE model of LPI system: baseline case Flaw Depth Distributum Exponential (Mean Depth = 0.06 inch)

Flaw Aspect Ratio - Lognormal(Parameter = 0.689)

I Stress Through Wall Thickness Uniform Tension j Cyclic Stress Amplitude 15 Kai / 5 cycles per year da/dN Curvas- As given in pc-PRAISE Documentation Threshold AK for da/dN 0.00 f- Normal (Mean = 43 ksi, C.O.V * = 0.0977)

E Flow Stress i Pipe Inner Radius 2.75 inches j Pipe Wall Thickness 0.562 inch '

j_ Pressure 2.250 kei Dead Weight Stress 3 ksl

[ 10 kai Thermal Expansion Stress

1 . , _ m ,,, w m ini

,~ '

C.ON. - Coefficient of vanatum = standard deviation / mean l The low O-Factor should relate to all piping segments in Region 2 of Foure A2.g. The medium and

[ high Q Factors should relate to susceptiblelocations in pipe segments Region 1. The remaining locations in those Region 1 segments should have low Q-Factors, as for segments in Region 2.

f Required inspection frequencies can be established using the trend curves such of Figure A5.2 which were developed from a set of probabilistic structural mechanics calculations as described l in Reference 5. For example,let us assume that a licensee wants to reduce the probability of a l

leak by a factor of 10. The curves of Hgure A5.2 are for an ultrasonic inspection method designated "very good," with a probability okdetection curve (POD) having a 50% probability of l

! detecting a crack with depth 10% of the wall-thickhess and a probability of 90% in detecting flaws j greater than 50% of thgwall thickness. The objective is to determine the time interval between j inspections that will detect 90% of the growing cracks which could become through wall depth before the end of the 40-ynr design life, f

N The curves of Figure AS.2 indicate that an inspection frequency of 10 years with the first l inspection at 5 years (5/10) can achieve the factor of ten reductionin failure probability. This i reduction applies to a wide range of cyclic stress conditions (Q factor from 1.OE +0 to about 1.OE+3 corresponding to 40 veer leak probabilities of 1.OE-7 to 1.OE-1). The inspection l

efficiency decreases for higher values of f ailure probabilities, because the rates of crack growth -

I are so high that the 10-year interval between inspectionsis inadequate. For very low values of l

the O-Factor, the failure probabilities are also very low, because those failures that oo occur are very early in life and are due to large f abrication defects which are not detected with the -

[ normal post weld inspections. These defects are best addressed by a high quality preservice i

j; inspection.

I j The results of Figure A5.2 show that improved NDE methods (that is, methods having the ability to j detect smaller defects) can justify the use of longer time intervals between periodic inspections, j Application of such improved NDE methods, even with longer inspection intervals, can decrease failure probabilities compared to less sensitive NDE method. The reduced number of inspections i can also reduce radiation exposures to the workers performing the inspections.

1 A5-14 l

O +

f .

4

. The relationships and/or tradeoff s between detection capabilities and inspection frequencies can

, be explained in terms of the sequence of events that lead to structuralf ailures. This sequence a

consists of the initiation of small cracks, an extended time period of slow crack growth, and a final period of rapid crack growth.-

! An effective inspection program detects small cracks before the crack growth rates increase to

! . unacceptably high levols. The maximum allowable time interval between inspectionsis dictated by consideration of the crack growth rates. This time intervalis governed by the difference l

, between the smallest crack size that can be detected and the larger critical crack size that ca.i

result in a structural failure, with the optimum inspection interval corresponding to the time l period needed to grow from the undetectable sizt, to the critical size.

For many cycle stress levels the small cracks at the detection threshold will not grow to critical

- size over the plant operating life, in such cases one high quality inspection early in life is the most effective strategy, in cases of high cyclic stresses,- the growth rates for these small cracks will be much greater. Therefore, depending on the crack growth rates, i.everal inspections before during the plant life are required to ensure that cracks do not grow to critical size.

In summary, these results can give an indication of what type of program may be necessary to achieve an improvement Factor that maintains the failure probability of a given pipe segment below an acceptablelevel. For those elements that have estimated leak probabilities above acceptable threshold values (e.g.,1x10 5per weld lifetime for small leaks and/or 1x10~' per weld lifetime for disabling leaks), inspection programs can be defined that will yield the necessary improvement Factors.

50 .

ns ,

O o o est iti j 40 -

O

$ ist 2/2 i 5 a 1 30 -

0 O 0 ist ses 0 I c

gp _

E

! 20 -

e.

a. '

i O

5 l 0

1815/10 0 O n l 0 8 i

0 2 3 4 10 10' 10 10 10 10 Q-factor

- Figure A5.2 improvement factors for four inspection interval (NDE performance level for POD =

"Very Good").

AS-15

i

' in terms of defining an oppropriate examination method (s) for various geometries and postulated i failure modes, Table 4.1 1 in (Ref. 7) provides a comprehensive place to start in selecting  !

- appropriate examination methods.- l

l. -

• A5.5 ' Additional Considerations for Selecting Strategies i

5 - -

Additionalf actors should be addressed by licensees during the selection of inspection strategies  !

beyond those related to effectiveness of the inspection methods to achieve goals for failure l probabilities. Considerations related to safety and structural reliability are as follows: j e Exposure of inspection personnel to hazardous environments, including man-rem exposure from radiation (reactor coolant system piping and fittings), hazardous materials, dangerous heights or climbing of scaffolds and unsteady platforms, rotating equipment or machinery, and f alling objects. Man-rem exposure has the potential to not only impacts personnel health and safety, but also impaus on the overall costs _of performing the inspections. Al. ARA cor.siderations should be followed to develop strategies that reduce man-rem levelr. In some cases, it may be justified to reduce the number of inspections that have marginal impacts on risk but with large contributions to man-rem exposure.

• Damage to components can occur as a result of the inspection itself.- In some cases the inspection requires that equipment be taken apart to gain adequate access to permitinspectionsof the structurallocations of concern. The degree of success in reassembling systems and components that have to be taken apart or taken off- '

line to do the inspection (e.g., reactor vessel closure studs, steam generator manway covers, piping supports and attachments, pumps, valves, turbine generator-casings) should be a consideration.

. Movement of large equipment or structures (e.g., reactor vesselinternals, reactor closure heads, large pipe supports, and restraints) can damage adjacent equipment and structures.

Concems with dise:sembly or movement of components will not be a factor for most piping inspections. However, when such situations do occur, inspections should be coordinated with other mainanance needs that require the . eeded disassembly or movement operations. In other cam, it may be prudent to minimize such inspections unless the ISI locations are from the highest categories of the risk categorization scheme.

A5.6 Quantification of NDE Reliability Evaluations of inservice inspection strategies require quantitative inputs to describe the reliability of NDE methods to be used. A primary input is a POD curve for the piping locations that are to be inspected. Other considerations include flaw sizing accuracies and the flaw -

acceptance criterin governing which sizes of flaws must be repaired versus flaws that are permitted to remain in service.

Factors Goveming NDE Reliability - The POD curves and flaw sizing accuracies are related to the particular NDE method / procedure /perso. inel, degradation mechanisms, materials, pipe sizes, and A5-16

i

+

l i

component geometries being addressed. This section describes acceptable approaches for

. estimating POD curves and other parameters of the inspection process. Additional information on

! these topics is available in the literature, and has been summarized in Section 11 of the

'- Probabilistic Structural Mechanics Handbook (Ref. 7), i l -

l In estimating the reliability of a candidate inspection strategy the following factors should be j - addressed:

j .

NDE Method - Visual examination, liquid penetrant testing, magnetic particle

! testing, radiographic testing, eddy current testing, ultrasonic testing, acoustic i- emission monitoring 1

j . Flow Dimensions - Depth, length, opening / crack tightness j . -

Flaw Orientation - Normal or parallel to surface j /

I . Material Type - Stainless steel, ferritic steel, cast or wrought, fine grained or I- coarse grained

j. . Access to inspection Location - Inside or outside surf ace, near or f ar side access to welds, presence of physical obstructions, need for disassembly

. Surface Conditions - Surf ace roughness, contamination / deposits, weld deposits, j cladding -

{

. Extraneous Signals - Large grained materials, geometric reflectors, weld roots, j counter bore geometries

. Human Factors - Inspector experience and training, motivational factors, low 7: ' tolerance for false calls, time restraints, hostile environments (heat, humidity,

, poor lighting, confined spaces, protective clothing) f . Qualification /PerformanceDemonstration- Equipment, procedures and personnel, l ASME Appendix Vill, detection and sizing capabilities

! NDE Relistety Studies - There have been ongoing research efforts on a national and intematiorial j level to develop data to better characterize .the reliability of NDE methods for detecting j representative service-type deiocos (cracks). Such efforts have included a number of round robin b studies to determine the reliability of NDE as practiced in the nuclear power industry, and to take i actions to improve NDE reliability, i

Table A5.2 lists studies of NDE reliability which have provided information on the probabilties l_ of detection for flaws in nuclear piping and other components (Ref. 7). These studies cover a

! ' range of components, inspection methods, and damage mechanisms. Early findings showed a

! relativelylow level of NDE reliability, even though the inspection methods were often consistert j 'with the minimum standards of existing codes as published by such organizatior.s as the American

. Society of Nondestructive Testing (ASNT) and the ASME. 9%M efforts have produced changes l in codes and standards which were directed to improving the reliability of NDE as applied at i . nuclear power plants. .

I A5-17 5

Table A5.3 Reliability studies of NDE for inspection of nuclear piping and other components.

Component inspection Method Demage Mechantem Responelbee Organisetten Rosebig.y of Method Reference Ultrasonics using manuel Cracking embedded within PtSC-1 (Ptete Inspection Steermg Detecticn cepobihty was merginal. Much (Ref. 8)

Beithne of Reactor Pressure procedures and past ASME thickness of plate Committeel. European Orpenization for less rWieble then for the procedros used Vesset Section XI practices Economic Cooperation and CnL., . .: In the subsequent PISC-Il triale Uttresonics Near eurface cracking PtSC-p (Propom for inspection of Stebl Detection roNebdity relatively good. (Ref. 9) setttine and norries of PWR caused by disposition of Components) Europoon Organization for sizing copebility relatively poor Reactor Pressure Vessete weld claddmg. welumetric Economic Cooperation and Development weld defects, voids. and with perticipation of other porosny organirstions including U.S. Nucteer Rogdetory Commission Ultrasonics. using methods Crects near vesset inner Rtsley Nucteer Laboratories. Risley. Effective 6 taction retietslity and (Ref.10)

Bettfine/ Plates of Reactor Pressure Vesset proposed es sufficiently reli- surface. and within United Kmodom - Defect Detection Triels good sizing cepetzlity were demonstrated able for British regulatory cladding (DDT) requirements Ultrasonica Fetigue cracking Pacific Northwest Laboratory for U.S. Very good renobiety (POD > 90%) (Ref t u PWR Primary Cootent P6 ping.

Nuclear Regulatory Commiesion - P5 ping demonstrated by e5 poeticipeting teams Carbon Steel  !

inspection Round Robin Uttresonics intoryonuter stress Electric Power Research Institu's Early results of en ongomg effort showed (Ref.12)

BWR Piping, Wrought Steinless corrosion cracking poor siring cepobisty Steel Ultrasonics intergrenuier stress Pacific Northwest Laborotory for U.S. Ordy the best teems demonstrated edeque e(Ref.13)

BWR Ptping. Wrought Steintess corrosion cracking Nucteer Reguietary Commission - Mini performance in detecting fle ws; the Steel Round Robin mejority of teams bed unacceproble performance. AE teems were unreliable in sizing flowe PWR Primary Coolant Piping. Ultrasonics Fatigue crecking Pacific 14orthwest Laboratory for U.S. None of the particapeting teems demon- Reference 12 Centrifugetly Cast Steinless Nucteer Reguietary Commission strated reGebte detection for the coorse greined meteriet Steel Eddy Current (ET). Also Pitting, well therung. Pacific Northwoot Laboratory for U.S. Relatively good rebebdety for detection (Ref.14)

Steam Generator Tubing uttresonics and profilometry to denting end cracking Nucteer Peguietary Commission and sizing of weg thinnmg and petting.

Emited extent Relettvely poor rehebility for cracking Steam Generator Tubing Eddy Current Stress corrosion cracking. PtSC.m (Propom for enepocilon of Mutti-year effort with round robin testeg intoryonular attack, Steel Components! Eurcpeen Organizatio'i underwey weetage, pitting for Economic Cooperation and DeveWnt Steam Generator Tubing Eddy current Well thinnmg. pitting. Doctric Power Research Institute Future dote wiB be based on a Round Roba i denting, cracking, etc. interpretation of ex5 sting ET signets from

• actuet steem generator inspections Pacific Northwest LetrSretory for U.S. I ? Mde range of reiiebiltyin detection Ultrasonics Cracking, steg inctusions. (Ref.15)

Vertous nucteer and norwiucteer er# iring is indicated by date in tfus components machined notches and ottw Nucleet Rago! story Commission types of defects comprehensrve surves report (Atresonics Cracks et festener holes Lockheed - Georgia Corrpeny with Best teams demonstrated effecteve Aircraft structures with participaticce of Air Force memtenance inspections. but to go teem-tedeem

• emphasis on f astener joints facikties. Alarge scale inspection variations were re:ed round robin popularly known as " hove cracks wiB travel".

A5-18 .

, w e 1

1 4

_ The usual approach in NDE reliability studies has been to use specimens with representative ,

d- service-type defects (i.e., cracks) for training and for demonstrations of capability. The round b robin data have shown large team to- team variations in the detection and sizing of flaws. As j shoiiceisse have been noted, the nuclear industry has responded with steps to strengthen minimum

! requirements such as in the ASME Code to improve the inspection of reactor pressure vessels and -

F piping systems.

, Performance Demonstrations - ASME Section XI has adopted Appendix Vill (Ref.17) which follows

a performance demonstration approach, through which inspection organizations must qualify the

[ performance of equipment, procedures arH personnel, in the new approach, inspecten teams must l achieve passing scores in tests of their capabilities to detect simulated service-type flaws in

--~

a matrix of samples that simulate conditions in reactor pressure vess61s and piping. A passing l score requires detection of a statistically s!anificant fraction of the flaws in the sample set,

while maintaining an acceptably low frequency of false calls. The performance demonstrations also i require that a team attain passing scores on flaw sizing capability.

i Performance der strations provide a basis to identify those NDE methods that are most reliable,

- and those whose reliability is unacceptable. However, current performance demonstrations in the i ASME Section XI Code require only a specified POD level for the collection of flaws in the sample j set. . The sample sets have a range of flaw sizes, beginning with the smallest size that is considered to be structurally significant. As now practiced, performance demonstrations are not

designed to generate a full POD curve as a function of flew depth as is needed for purposes of

! probabilistic structural mechanics calculations. To obtain a statistically based POD curve,

additional detection data beyond the muumum demanded by current performance demonstration tests j are required. Lacking such a complete set of data, POD curves for field inspections must be

!' estimated based on engineering judgment and by making use of the currently available base of

{ detection data as generated from inspection round robins and performance demonstration efforts.

I Modeling of NDE Uncertainties- Consistent with the practice for simulating other parameters in

probabilistic structural mechanics calculations, the POD curves used in simulations of ISI should be selected to represent mean values of POD without consideration of confidence levels. Arbstrary conservatism should not be applied in estimating the POD curves to be used in the probabilistic

! = structural mechanics calculations, because such conservatism, if not applied uniformly, could l improper!'; bias the selection of inspection strategies. While realistic mean values of PODS

should be used as input te the structural reliability code, the uncertainties associated with the l POD should be accoumr. for in any calculation.

Characteristicsof POD Curves- Prc5 ability of detectionis defined as the ratio of the nu'mber of

flaws actually detected to the number of flaws that wo9d be detected given a perfect NDE system.

l An example of a POD curve that has been used in probabilistic fracture mechanics calculations with l the pc-PRAISE code (Ref.18) is shown in Figure AS.3. This schematic form is typical of POD curves

[ that have been described in a number of other studies including (Ref.19). As indicated, flaws

• l must have some muumum size or threshold before detection becomes possible. Above this threshold b size, detection increases rapidly as the size of the flaw becomes larger. The POD curve eventually

} attains a maximum value at which non-detection is govemed by other factors (e.g., human errors)

[ that come to dominate the detection processes.

l Example POD Curve - The specific functional form used in pc-PRAISE is given by

[ -

P (a) = c + % (1-c) erfc (v in (A/A'))

AS-19

[

t 1.0 0.g -

8 0.8 I v.g.w 0.7 0.6 Wo w i 0.5

... 0.4 0.3 0.2 f .1 0

Q- ' ' ' ' ' ' ' ' ' ' ' ' ' '

0.0 O.0 0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.g 1,0 Crack depth / wall thickneas (alh) 9 pure A5.3 Example POD ourve used in pc PRAISE.

where P. ls t, probability of non-detection, A is the area of the crack, A* la the area of ct.ick for 50% P., e is the best possible P. for very large cracks, and v is the " slope" of P. curve.

Based on measured performance for PNNL's mini round robin teams (Reference 13), a range of estimates for A'(crack area for 50% POD) was provided by the NDE experts. (Hof.18) aneumed that the " slope" parameter v is 1.6. Several POD curves from PNNL studies were analyzed, and it was determined that a value of v = 1.6 is both reasonable and consistent with published curves. While the assigned value of the slope parameter v was held constant, the actual slope of the plotted curves becomes more steep for better POD curvas. Thus, the slope of the POD is correlated to the detection threshold parameter A*. The value of e was assi0ned such that 3 emeller value of A *also implies a smaller value of c.

Example Parameters for POD Curve - An approach taken for the evaluations of candidate inspecuon strategies has boon to consider a range of POD curves that bound the range of performance expected from inspection teams that might actually perform inspections in the field (Ref. 5). This range of POD curves was established in consultation with NDE experts with extensive knowledge of the trends of NDE reliabit;ty studies and the performancolevels needed to be successfulin meeting the criteria of performance demonstrationtesting. The basic premise was that all teams had passed the ASME Section XI Appendix Vill performance demonstration it should, however, be recognized that a population of inspection teams (all of which have passed the performance demonstration) operating under either the testing envirorsent of performance demonstration rial or under field conditions can still exhibit a considerable range of POD performance, even tho igh all such teams have successfully completed a performance demonstration. The performe ice demonstration serves to ensure a minimallevel of NDE reliability.

A5 20 i

J

% 0 The NDE experts were asked to define POD curves by estimating parameters for the specific form of a POD function used in the pc PRAISE code given by the above equation. Three POD curves with increasing levels of performance were defined as indicated in Table AS.4:

• Level 1 Performance: This curve corresponds to a team that has a level of performance needed to pass an Appendix Vill perforraance demonstration.

+

Leve/2 Per/ormance: This curve corresponds to the best teams. Such teams significantly exceed the minimum level of performancs r,,eded to pass the test.

Level 3 Performance: This curve correspondJ to a team that has a level of performance significantly better than expected from any teams that have to date passed an Appendix Vill type of performance demonstration.

Table A5.4 Parameters of POD curves for three performance levels, inspection Performance e (% alt) c v Level 1 40% 0.10 1.6 Level 2 15% 0.02 1.6 Level 3 l 5% .005 1.6 i A5.7 Altemative Strategies to Reduce Failure Probabilities it may be determined in some cases that none of the candidate inspection strategies can provide an adequate reduction in f ailure probability, or that strategies cther than inservice inspection are more cost effective. Some degradationmechanisms can develop unexpectedly, and cause structural tailures within time periods shorter than the proposed inservice inspection intervals.

Examples are vibrationalf atigue and thermal fatigue. New sources of Worationalstresses can develop due to imbalances that develop in rotating equipment or due to changes in the effectiveness of piping supports. Thermal fatigue stresses from the mixing of hot and cold fluids nan develop over the life of a plant due to new sources of leakage at valves and thermal sleeves.

The needed frequencies for inservice inspections can become unreasonable to detect impending structuralf ailures associated .;th such new sources of f atigue related stresses, in these cases the most effectiva strategy can be to monitor the systems for piping vibrations and/or for temperature conditions that indicate the development of thermal fatigue stresses.

Continuous methods involving acoustic emission monitoring or leak monitoring can be used to supplement or replace periodic inservice inspections as a means to detect the progress of degradationin piping system components. Such methods are particularly useful when concem becomes focused on one specific location where degradation is known to exist, and the objective is en early indication that degradationis growing. Such continuous monitoring avoids the need to perform inspections et unreasonably small intervals, such as when calculations and/or measurements of damage (e.g., stress corrosion cracking or erosion / corrosion) indicate potentially high rates of degradation. ,

A5 21

e r l

A5.8 References for Appendix 5*

1. K.R. Balkey et al.," Demonstrated Application of Risk Based Technologies for Development of a Nuclear Reactor Internals inspection Program," ASME SERA Vol.1, Safety Engineering and Risk Analysis, American Society of Mechanical Engineers,1993.

2. D.O. liarris and E.Y. Lim, " Applications of a Probabilistic Fracture Mechanics Model to the influence ofin Service inspection of Structural Reliability," Probabilistic Fracture Mechanics and Fatigue Methods: Applicationsfor Structural Reliability and Maintenance, ASTM STP 789, pp.19 41,1983.

3. F.A. Simonen, "An Evaluation of the Impact ofInservice Inspection on Stress Corrosion Cracking of DWR Piping," In Codes and Standards and Applicationsfor Design and Analysis ofPressure l'esselandPiping Components, pp. 187193, ASME PVP Vol.

I86,1990,f

4. F.A. Simonen and li.ll. Woo, " Analysis of the Impact ofInservice Inspection Using a Piping Reliability Model," NUREG/CR-3869, (Prepared for the USNRC by Pacific Northwest Laboratory), August 1984.

5. M.a. Khaleel and F.A. Simonen, "The Effects ofInitiel Flaw Sizes and Inservice Inspection on Piping Reliability," PVP-Vol. 288, Service Erperience and Reliability improvement: Nuclear, Fossil, and Petrochemical Plants, American Society of Mechanical Engineers,1994.

6. F.A. Simonen and M.A. Khalect, "A Model for Predicting Vessel Fail.re Probabilities Due to Fatigue Crack Growth," ASME PVP-Vol. 304, Fatigue and Fr.acture Mechanics in Pressure l'essels and Piping, pp. 401-416 American Society of Mechanical Engineers, 1995.

7. F.A. Simonen, " Nondestructive Examination Reliability," Probabilistic Structural Mechanics dandbook, C. Sundararajan, editor, Chapman and Hall, New York, pp. 238-260,1995.

8. PISC, " Analysis of the PISC Trials Results for Alternative Procedures." Plate Inspection Steering Committee Report No 5. EURATOM Report No. 6, EOR 6371 ED, Published by the Commission of the European Communities, Directorate-General XII, Information Technologies and Industries and Telecommunications, Luxembourg,1980.

9. R.W. Nichols and S. Crutzen, Eds., Ultrasonic Inspection ofHem'y Sectlon Steel

' Copies of NUREGs are available et current rates from the U.S. oovernment Printing office. P.o. Box 37082. Washington. DC 20402 9328 (telephone (2021512 2249); or from the National Technicalinformation Service by wnting NTis at 5285 Port Royal Road.

Springfield. VA 22161. Copies are available for inspection or copying for a fee from the NRC Pubhc Document Room at 2120 L Street NW., Washington. DC; the PDR's maihng address is Mail stop LL.6, Washington. DC 20555; telephone (202)D34 3273; f ax (202)634 3343.

A5 22 4

- - ~ ~

Components: The PISC !IFinal Report, Elsevier Applied Science, London and New York,1988.

10. B.K. Watkins et al.,"Results Obtained from the Inspection of DDT Plates 1 and 2," Paper i presented at UKAEA DDT Symposium, Silver Beach Conference Center, Birchwood, Warrington, U.K., October 7 8,1982.  ;

11. O.J. Dau, "Ultraronic Sizing Capability of JGSCC and its Relation to Flaw Evaluation Procedures," Electric Power Research Institute (NDE Center), North Carolina,1983.

12. S.R. Doctor and ". O. Hensler, "A Pipe inspection Round Robin Test," Proceedings of the 6* International Cortference on NDE in the Nuclear Industry, American Society for Metals Metals Park, Ohio,1984.  !

13. P.O. licaster et d., " Ultrasonic inspection Reliability for Intergranular ctress Cwslon Cracks: A kound Robin Study of the Effects of Personnel, Procedures, Equipment and Crack Characteristics," NUREG/CR-4908 (Prepared for the USNRC by Pacific Northwest Laboratory), July 1990.

14. R.J. Kurtz et al., " Steam Generator Tube Integrity Program / Steam Generator Group

- Project-Final Project Summary Report," NUREO/CR 5117 (Prepared for the NRC by Pacific Northwest Laboratory, PNL-6446), May 1990.

15. S.H. Bush, " Reliability of Nondestructive Examination," USNRC, NUREG/CR 3110, Vol,13,(Prepared for the USNRC by Pacific Northwest Laboratory),1983.

16. B.W. Boisvert et al., " Uniform Qualification of Military and Civilian Nondestructive Inspection Personnel," LG81WP7254-003, Lockheed Georgia Company,1981.

17. D. Cowfer, " Basis /Dackground for ASME Code Section XI Proposed Appendix Vill:

Ultrasonic Examination Performance Demonstration," In Nondestruct/ve Evaluation:

NDE Planning and Application, pp.1 5, ASME NDE . Vol.5, American Society of Mechanical Engineers, New York,1989.

18. D.O. Harris and D. Dedhia," Theoretical and Users Manual for pc PRAISE, A Probabilistic Fracture Mechanics Computer Code for Piping Reliability Analysis,"

USNRC, NUREG/CR 5864, July 1992.

19. W.D. Rummel, " Considerations of Quantitative NDE and NDE Reliability Improvement," Review ofProgress in Quantitative Nondestructive Evaluation Volume A5 23

. . .. - .-. _ . . ._. =- _ _- _- _ - -- . _. __ _. -. - _. .

o ,

2A. ed. D.O. nompson and D.F. Chimenti, pp.19 35 Piemuu Press, New York,1983.

A5 24

l l

l Appedix 6: EXISTING DETERMINISTIC APPROACH AND REGULATORY REQUIREMENTS AS.1 introduction The traditionaldeterministic ISl program requires extensive examination of the reactor coolant pressure boundary (RCPB), a moderate amount of uamination of emergency core coolog and accident mitigation (ECC/AM) systems, and relativelylittle examination of support systems. Each facet of the examination strategy; level of detail required to define the parts examined, examination method, acceptance standard, and the extent and frequency of exa ninstion, is more tightly defined for the RCPB, than for the ECC/AM and support systems. The framework and philosophy of this i approach is very prescriptive and is based on the assumption that the RCPB is more "important,"

l and other systems are progressively less important as one moves away from the RCPB.-

The basic requirements for deterministic lSis for a boiling or pressurized wate.r nuclear reactor ,

f acility,includinginspection intervals, are contained in Section 50.55a, " Codes and Standards,"

of 10 CFR Part 50, " Domestic Licensing of Production and Utilization Facilities" (Ref.1). The requirements specified in 10 CFR 50.55a will remain in effect after dd,w.er,t and implementation of the risked informedmothods. Thus, the latter will provide an optional method for performing inservice inspections. The deterministic method can still be used, if the licensee chooses.

The primary objective of 10 CFR 50.55a is to insure that " Structures, systems, and components shah be designed, fabricated, erected, constructed, tested, and Inspected to quaHty atendards

, commensurate with the importance of the safety function to be performed."

AS.2 Deterministic Decisionmaking Criteria The sources of requirements for deterministiclSis are specified in severaldocuments referenced in 10 CFR 50.55s.- These documents are listed below and described very briefly. For deterministic analysis the decision criteria are referenced by the requirements. For example, the ASME Boiler and Pressure Vessel CodesSection XI provides acceptance standards that are used to determine d the inspection requirements have been met,

s. ASME Boiler and Pressure Vessel Code Section XI of this code provides most of the inspection requirements and acceptance criteria for deterministic ISI.

b. Technical Specification. For some components, the inservice inspection requirements are governed by the plant Technical Specifications rather than the ASME Boiler and Pressure Vessel Code in addition,'the Technical Specifications require amendment if the ISI program revisions required by 10 CFR 50.55a create a conflict.

c. Regulatory Guides In order to implement the requirements of the ASME Boiler and Pressure Vessel Code, " Code Cases" have been developed by the ASME to explan the intent of the code or provide for alternative requirements under special circumstances.

d. Nuclear Regulatory Commission Requirements The Commission may require the licensee to follow an augmented ISI program for systems and cuviper 4. which they decide require added assurance of structural reliability. .

A6-1

. o For nuclear power plant components, conservative design practices have been successful in precluding anticipated modes of f allures. For example, the ASME Boiler and Pressure Vessel Code identifies the following modes of failure:

. excessive elastic deformation, including elastic instability

• excessive plastic deformation

. stress rupture / creep deformation (inelastic)

. plastic instability incremental collapse

+ high strain low cycle fatigue Operating reactor experience has raised the issue that other causes not addressed in the design, by the ASME BPVC calculations or otherwise, are most likely to cause structural failures. Ttw two most common examples are intergranular stress corrosion cracking (IGSCC) of stainless steel piping and erosion corrosionwall thinning of carbon steel piping. Table A6.1 lists a variety of f ailure mechanisms or causes that should be considered.

The licensees abould review industry experience of pipe failures. Available sources of informationinclude NRC documents, EPRI documents, IAEA documents, INPO (Nuclear Plant Reliability Data System), NUMARC (Assessment of Plant Life Extension), ASME BPVC reports, etc.

As this data is generically applicable to risk informed regulatory activities, the industry might want to consider consolidating the information on a computerized system that is updated by Individual utilities as they experience failures, detect service related degradation, and i

identify operational conditions not addressed in the design of the oiping components. Referencing the use of such a data base would provide the NRC assurances that industry experiences are appropriately addressed.

I A6.3 Documents with Deterministic Requirements As stated in Section C.1, the overall requirements for deterministic lSI are specified in Section 50.55a, " Codes and Standards" of 10 CFR Part 50. Section 50.55a, in tum, references the following documents which contain the detailed requirements:

ASME Boiler and Pressure Vessel Code The primary inspect!on requirements and intervals are contained in Section XI, " Rules for Inservice Inspection of Nuclear Power Table A6.1 Example Failure Causes for LWR Nuclear Power Pl ant Components (From Ref. 2) l 1

l ,

i A6-2 l

o. ,

o Stress Conoslon cracking o improper or degraded over pressure protection o Intergranular attack o Operation at loads or pressures o Thermal f atigue cracking related tot exceeding design Ismits

+ stratification of fluids leaking valve seats o Excessive rates of heating or cooling thermal sleeve f ailure (thermal shock) o Vibrational f atigue cracking o Structural damage from external forces o Material or weld defects o improper or degraded supports for o Flow assisted corrosion components lorosion/ corrosion) o Defective snubbers restraining o Cavitation and wet steam erosion thermal expansions o Slurry erosion (raw water lines) o loose parts . wear and impar damage o General corrosion o Loose or missing fasteners o Pitting o Structural damage from maintenance o Corrosion due to leaking boric acid o improper repairs or alterations o Microbe-induced corrosion o improper design and f abrication o Fretting o Embrittlement from neutron o Water hammer irradiation o Over pressure of system due to leaking o Embrittlement from thermal aging or misaligned valves o improper heat treatment (of bolting o Violations of pressure temperature materials) limits Plant Components" Division 1 of this document contains the requirements for light water couied reactors.

Regulatory Guides - To irpplement the requirements of Section XI of the ASME Boiler and Pressure Vessel Code, " Code Cases" have been developed by the ASME to explain the intent of the code or provide for asternative requirements under special circumstances, in some cases the plant Technical Decifications will affect the ISI program.

The (current) deterministic ISI requirements are described in more detail in the following section.

A6.4 inservice Inspection Requirements Plant Components". Division 1 of this document contains the requirements for light water cooled reactors.

A6-3

+ .

Regulatory Guides To implement the requirements of Section XI of the ASME Boiler and Pressure Vessel Code, " Code Cases" have been developed by the ASME to explain the intent of the code or provide for alternative requirements under special circumstances.

In some cases the plant Technical Specifications will affect the lSi program.

The (currentl deterministic ISI requirements are described in more detail in the following section.

Section 50.55a, " Codes and Standards," of 10 CFR Part 50, " Domestic Ucensing of Production and Utilization Facilities," requires, in part, that each operating license for a boiling or pressurized water cooled nuclear power f acility and each construction permit for a utilization f acility be sublect to the conditions in paragraph (g), " Inservice Inspection Requirements," of i 50.55a. Paragraph (g) requires, in part, that ASME Code Classes 1, 2, and 3 cornponents and their supports meet the requirements of Section XI, " Rules for Inservice inspection of Nuuear Power Plant Components," of the ASME Boiler and Pressure Vessel Code or equivalent quality standards.

l l Paragraph 50.55alb),in part, references the latest editions and addenda in effect of Section XI of the Code and any supplementary requirements to that section of the Code.

Definitions of the ASME Code Classes are given in (Ref. 2). Generally, ASME Code Class 1 beludes all reactor coolant pressure boundary (RCPB) components. The RCPB refers to those possure-containing components of BWRs and PWRs, such as pressure vessels, piping, pumps, and valves that are part of, or connected to, the reactor coolant system. ASME Code Class 2 generally includes systems or portions of systems important to safety that are designed for post accident containment and removal of heat and fission products. These systems include the reactor shutdown, residual heat removal, and steam and feedwater systems exterxhng from the steam generators to the outermost containment isolation valve. ASME Code Class 3 generally includes those system components or portions of systems important to safety that are designed to provide cooling water and auxiliary feedwater for the front line systems.

Footnote 6 to i 50 55a references the ASME Code Cases that have been approved for use by the Commission The footnote also states that the use of other Code Cases may be siJthorized by the Commission upon request pursuant to paragraph 50.55a(a)(2)(li)which requires that proposed alternatives to the described requirements or portions thereof provide an acceptable level of quality and safety. The Code Cases applicable to deterministiclSt are contained in Regulatory Guide 1,147, "inservics 'nspection Code Case Acceptability ASME Section XI Division 1."

Paragraph (g)(5)(1) of Section 50.55a requires that the ISI program for a boiling or pressurized water cooled nuclear power f acility shall be revised by the licensee, as necessary, to comply with Section XI of the ASME Code, if this revision conflicts with the Technical Specification for the f acility, paragraph (g)(5)(li) requires that the licensee apply to the Commission for amendment of the Technical Specificationsso that they will conform to the revised program, if the licensee has determined that conformance with certain code requirements is impracticril, the licensee shall notify the Commission per paragraph (g)(5)(lii) and submit, as specified in 5 50.4, information to support the determinations.

A6-4

n-4 s Paragraph (g)(6)(ii) of Section 50.55a states that the Commission may require the licensee to follow an augmented ISI program for systems and components which they decide require added assurance of structural reliability.

General Design Criterion 1, " Quality Standards and Records," of Appendix A, " General Design Criteria for Nuclear Power Plants," to 10 CFR Part 50 requires,in part, that structures, systems, and components important to safety be designed, fabricated, erected, and tested to quality standards commensurate with the importance of the safety function to be performed. Where generally recognized codes and standards are used, Criterion 1 requires that they be identified and evaluated to determine their applicability, adequacy, and sufficiency and be supplemented or modified as necessary to ensure a quality product in keeping with the required safety function.

l 4.

1

' A6 5

l 1

A6.5 References for Appendix 6*

1. Section 50.55a," Codes and Standard ;" of 10 CFR Part 50," Domestic Licensing of Production and Utilization Facilities."

2. USNRC," Risk Based Inspection Development of Guidelines," Vol. 2, Part 1,(Prepared for the NRC by the Arnerican Society of Mechanical Engineers), NUREG/GR-0005, July 1993.

'Copees of NUREGs are available at current rates from the U.S. Government Printing Office, P.O. Box 37082. Washington, oC 20402 9328 (telephone (2021512 2249); or from the National Technicalinforrestion Service by writing NTIS at 5285 Port Royal Road.

Springfeeld. VA 22161. Copies are available for inspection or copying for a fee from the NRC Putdic oocument Room at 2120 L Street NW., Washington oC; the PoR's mailing address is Mail Stop LL-6. Washington, oC 20555; telephone (202)634 3273: f ax (202)634-3343.

A6-6

( .

Appendix 7: Regulatory Analysis I

1. statement of the nroblem i

During the past several years, both the Commission and the nuclear industry have recognized that i probabilistic risk assessment (PRA) has evolved to the point that it can be used increasingly as

) a toolin regulatory decisionmaking, in August 1995 the Commission publisned a policy statement i that articulated the view that increased use of PRA technology would 1) enhance regulatory decisionmaking,2) allow for a more offielent use of agency resources, and 3) allow a reduction l

In unnecessary burdens on licensees. In order for this change in regulatory approach to occur, guidance must be. developed describing acceptable means foi increasing the uswf PRA information in the regulation of nuclear power reactors.

2. Objective To provide guidance to power reactor licensees and NRC staff reviewers on acceptable approaches for utilizing risk information (PRA) to support requests for changes in a plant's current licensing basis (CLB). It is intended that the regulatory changes addressed by this guidance should allow a focussing of both industry and NRC staff resources on the most important regulatory areas while providing for a reduction in burden on the resources of licensees. Specifically, guidance is to be provided in several areas that have been identified as having potential for this application. This application includes risk informed Irw. a inspection programs of piping.

3. Alternatives The increased use of PRA information as described in the draf t regulatory guide being developed for this pu.;ose is voluntary. Licensees can continue to operate their plants under the existing procedures defined in the' CLB. It is expected that licensees will choose to make chang

• 5 in their current licensing bases to use the new approaches described in the draft regulatory guide only if it is perceived to be to their benefit to do so.

4. Consequences Acceptance guidelines included in the draft regulatory guide state that only small increases in overall risk are to be allowed under the risk-informed program. Reducmg the inspection frequency of piping identified to represent low risk and low f ailure potential as provided for under this programis an example of a potentialcontributor to a smallincreasein plant risk. However, the program also requires increased emphasis on piping categorized as high safety significant and high-f ailure-potentialthat may not be inspected under current programs. This is an example of a potential contributor to decreases in plant risk. An improved prioritization of industry and A7-1

• e i

NRC staff resources, such that the rnost important aress associated with plant safety receive increased attention, should result in a corresponding contributor to a reduction in risk. Some l

of the possible impacts on plant risk cannot be readily quantified using present PRA techniques and must be evaluated qualitatively. The staff believes that the net effect of the risk changes associated with the risk informed programs, as allowed using the guidelines in the draft regulatory guide, should result in a very small increase in risk, maintain a risk neutral condition, or result in a net risk reduction in some cases.

l E. Dacialon Rationale It is believed that the changes in regulatory approach provided f or in the draf t regulatory guide being developed will result in a significantimprovementin the allocation of resources both for the NRC and for the industry. At the same time, it is believed that this program can be implemented while maintaining an adequate level of safety at the plants that choose to implement risk informed programs.

6. Implementation it is intended that the risk informedregulatoryguide on inserviceinspectionof piping (DG 1063) be published by early to mid CY 1998.

A7-2 i

e e i

ATTACHMENT - 3 l DRAFT SRP SECTION 3.9.8 RISK-INFORMED INSERVICE INSPECTION OF PIPING i

l 4 e

/ UNITED STATES NUCLEAR REGULATORY COMMISSION ig*' ),,1OFFICE STANDARD REVIEW PLAN

• \ . . . . . , OF NUCLEAR REACTOR REGULATION DRAFT Standard Review Plan I

For The Review Of Risk-Informed Inservice Inspection of Piping Draft SRP Chapter 3,9,8 August 1997 Contacts: S. A. Ali (301) 415-2776 (NRR)

J. Guttmann (301) 415 6561 (RES)

S. Dinsmore (301) 415 8482 (NRR)

D. Jackson (301) 415 5887 (RES)

D. Jeng (301) 415 2727 (NRR)

\ --

Standard Review Plan For The Review Of Risk informed inservice Inspection of Piping l

FOREWORD The U.S. Nuclear Regulatory Commission's (NRC) Policy Statement on the use of probabilistic risk assessment (PRA)in nuclear regulatory activities encourages greater use of this analysis technique to improve safety decision making, reduce unnecessary burden and improve regulatory efficiency. A number of NRC staff and industry activities are in progress to consider approaches for expanding the scope of PRA applications in regulatory activities.

Several activities are ongoing which consider appropriate uses of PRA in support of the modification of individual plant's current licensing basis (CLB) and a number of pilot applications with proposed CLB changes are now under staff review.

This Standard Review Plan (SRP) chapter describes review procedures and acceptance guidelines for NRC staff reviews of proposed plant specific, risk informed changes to a licensee's inservice inspection (ISI) program for piping. The review procedures contained in this SRP are consistent with the acceptable methods for implementing a risk informed ISl (Rl ISI) program described in DG 1063 (Reference 2). Licensees may propose RI ISI programs consistent with the guidance provided in DG 1063, propose an alternative approach for implementing a RIISI program (which must be demonstrated to be consistent with the fundamental principles identified in this standard review plan), or maintain their ISI programs in accordance with the American Society of Mechanical Engineers (ASME) Code as referenced in 10 CFR 50.55a.

It is the NRC staff's intention to initiate rulemaking as necessary to permit licensees to implement RI ISI programs, consistent with this SRP chapter, without having to get NRC approval of an alternative to the ASME Code requirements pursuant to 10 CFR 50.55alal/3/. Until the completion of such rulemaking, the staff anticipates reviewing and approving each licensee's RIISI program as an alternative to the current Code required ISI program. As such, the licensee's Rl ISI program will be enforceable under 10 CFR 50.55a.

The current ASME Code inservice inspection requirements, as endorsed in 10 CFR 50.55a, I have been determined to provide reasonable assurance that public health and safety will be maintained. The individual ASME Code committees concerned with inservice inspection continually review these inspection strategies to develop improvements to the existing l Code requirements. Changes to the ASME Code, either as new Code editions or Code l Cases, are subject to review and approval by the NRC to ensure that the new inspection '

i i

e .

9 requirements maintain an adequate level public health and safety. A risk informed inservice inspection program, if properly constructed, will also provide an acceptable level of quality and safety by evaluating and possibly improving the inspection effectiveness for the high safety significant piping (as identified by the licensee's integrated decision making process) in conjunction with the relaxation of inspection requirements for the low safety significant piping.

i 11

-.-~._n,------ --

l Standard Review Plan 1 i

For The Review Of Risk Informed inservice Inspection Applications TABLE OF CONTENTS 1

l 3.9.8 RISK INFORMED INSERVICE INSPECTION OF PIPING l

REVIEW RES PO NSIBILITIES . . . . . . . . . . . . . . . . . . . . ..1. . . . . . . . . . . . .

1. A R E A O F R EVIEW . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . , , 3 1.1 Element 1: Define the Proposed Changes to ISI Program . . . . . . . . . . . . . 2 l 1.2 Element 2: Engineering Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3 1.2.1 Traditional Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3 1.2.2 Probabilistic Risk Assessment . . . . . . . . . . . . . . . . . . . . . . . . . . 4 1.2.2.1 Scope of Piping Systems . . . . . . . . . . . . . . . . . . . 4 1.2.2.2 Piping Se g m e nt s . . . . . . . . . . . . . . . . . . . . . . . . . 5 1.2.2.3 Modeling Pipe Failures in PRA . . . . . . . . . . . . . . . . 6 1.2.2.4 Pip'ng Failure Potential . . . . . . . . . . . . . . . . . . . . . 6 1.2.2.5 Con . quences of Failure ................... 7 1.2.2.6 Risk .mpact of ISl Changes . . . . . . . . . . . . . . . . . . 7 1.2.3 Integrated Decisionmaking . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 1.2.3.1 Selection of Locations to be inspected ......... 8 1.3 Element 3: Implementation and Monitoring Programs ............... 8 II. ACCEPTANCE CRITERIA . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10 11.1 Element 1: Define the Proposed Changes to ISI Program . . . . . . . . . . . . 10 l1.2 Element 2: Engineering Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10

11. 2 . 1 Traditional Analysis . . . . . . . . . . , . . . . . . . . . . . . . . . . . . . . 11

11. 2 . 2 Probabilistic Risk Assessment . . . . . . . . . . . . . . . . . . . . . . . . . 11 iii m

+ e

11. 2 . 2 . 1 Scope of Piping Systems . . ...............12

11. 2 . 2 . 2 Piping Segments . . . . . . . . . . . . . . . . . . . . . . . . . I l

11. 2 . 2 . 3 Modeling Pipe Failures in PRA . . . . . . . . . . . . . . . 13 II.2.2.4 Piping Failure Potential . . . . . . . . . . . . . . . . . . . . 13

11. 2 . 2 . 5 Consequences of Failure ..................14 l1.2.2.6 Risk Impact of ISI Changes . . . . . . . . . . . . . . . . . 15 l

l l1.2.3 Integrated Decisionmaking . . . . . . . . . . . . . . . . . . . . . . . . . . . 16

11. 2 . 3 . 1 Selection of Locations,to be Inspected ........ 16 11.3 Element 3: Implementation and Monitoring Programs .............. 17 lit. REVIEW PRO CED U RES . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18 l 111.1 Element 1: Define the Proposed Changes to ISI Program . . . . . . . . . . . . 19 lll.2 Element 2: Engineering Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . , , 20 lll.2.1 Traditional Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20 lll.2.2 Probabilistic Risk Assessment . . . . . . . . . . . . . . . . . . . . . . . . . 20 lll.2.2.1 Scope of Piping Systems . . . . . . . . . . . . . . . . . . 20

{ lll.2.2.2 Piping Segments . . . . . . . . . . . . . . . . . . . . . . . . 21 l ll1.2.2.3 Modeling Pipe Failures in PRA . . . . . . . . . . . . . . . 21 lll.2.2.4 Piping Failure Potential . . . . . . . . . . . . . . . . . . . . 21 lll.2.2.5 Consequences of Failure ..................21 lll.2.2.6 Risk Impact of ISI Changes . . . . . . . . . . . . . . . . . 22 lll.2.3 Integrated Decisionmaking . . . . . . . . . , . . . . . . . . . . . . . . . . . 22 ll1.2.3.1 Selection of Locations to be Inspected ........ 22 Ill.3 Element 3: Implementation and Monitoring Programs .............. 23 IV. ELEMENT 4: DOCU MENTATION . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23 V. EVAL.UATIO N FIN DIN G S . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24 VI. IM PLr.:M E N ( ATIO N . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2 6 Vll. R E FE R E N C ES . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2 6 iv M )

cr O Standard Review Plan For The Review Of Risk Informed Inservice inspection Applications 3.9.8 RISK lNFORMED INSERVICE INSPECTION l

REVIEW RESPONSIBILITIES Primary - Civil Engineering and Geosciences Branch (ECGB)

Secondary Probabilistic Safety Assessment Branch (SPSB) for PRA, Materials and Chemical Engineering Branch (EMCB) for Fracture Mechanics

1. AREAS OF REVIEW The purpose of this standard review plan is to describe the procedure that the NRC staff will utilize to review the application of risk informed methods to develop inservice inspection (ISI) programs for piping that are different from the current licensing bases (CLB) at a nuclear power facility. In implementing risk informed decision making, ca licensee must ensure that any proposed change to the CLB or the regulation meets the ollowing key principles:

1. The proposed change meets the current regulations. This principle applies unless the proposed change is explicitly related to a requested exemption or rule change.

2. Defense in-depth is maintained.

3. Sufficient safety margins are maintained.

4. Proposed increases in risk, and their cumulative effect, are small and do not cause the NRC Safety Goals to be exceeded.

5.- Performance-based implementation and monitoring strategies are proposed that .

address uncertainties in analysis models and data and provide for timely feedback and corrective action.

Each of these principles should be considered in the risk inforrned, integrated decisionmaking process. Given these principles of risk informed decision making, the staff has identified four principal elements that form the basis for evaluating proposed changes to a plant's CLB based on risk informed methods.

3.9.8 1

o n l

l The first element involves the characterization of the proposed change. The licensee should identify regulations and licensing commitments that impact the current ISI requirements. Piping systems, segments, and welds that are affected by the change in ISI prograrn should be identified. Plant systems and functions that rely on the affected piping should also be identified. Industry and plant specific information applicable to the piping degradation mechanisms that characterizes the relative effectiveness of past inspections should be documented.

As part of the second element, the licensee should evaluate the proposed CLB change with regard to the principles that adequate defense in depth is maintained, that sufficient margins are maintained, and that proposed increases in risk, and their cumulative effect, are small and do not cause the NRC Safety Goals to be exceeded. This element consists of engineering evaluations, including traditional engineering analyses as well as PRAs. The proposed changes should be examined to verify that they do not compromise existing app!Icable regulations and the licensing basis for the plant. The PRA based assessment of the proposed change should explicitly consider the affected piping segments and develop the impact on the core damage frequency (CDF) and large early release frequency (LERF) due to the potential piping failures. The results of the complementary traditional and PRA methods should be used in an integrated decisionmaking process.

The third element involves developing implementation and monitoring programs. The primary goal for this element is to assess the performance of piping under the proposed 1-CLB change by establishing performance monitoring strategies to confirm the assumptions and analyses that were conducted to justify the CLB change. inspection scope, intervals, and techniques should be clearly defined. The inspection techniques should address all relevant failure mechanisms that could significantly impact the reliability and integrity of the piping.

The fourth e% ment involves documenting the analyses and submitting the request for NRC review and approval. The submittalis reviewed by NRC in accordance with this standard review plan.

The following areas related to the use of RI-ISI program for Inservice inspection (ISI) of piping are reviewed, ld Element 1: Define the Proposed Chanae to ISI Proaram The licensee's RI ISI submittal is reviewed to verify that the proposed changes to the ISI program have been defined in general terms. The submittalis also reviewed to confirm that the plant it designed and operated in accordance with the current licensing basis (CLB)' and that the PRA used in support of the RI-lSI program submittal reflects the actual

'.This standard review plan adopts the 10 CFR Part 54 definition of current licensing basis. That is, " Current Licensing Basis (CLB) is the set of NRC requirements applicable to a specific plant and a licensee's written commitments for ensuring compliance with and operation with in applicable NRC requirements and the plant specific design basis (including all modifications and additions to such commitments over the life of the license) that are 3.9.B 2

)

o a plant. Those aspects of the plant's licensing bases that may be affected by the proposed change, including, but not limited to, rules and regulations, final safety analysis report (FSAR), technical specifications, licensing conditions, and licensing commitments are reviewed. Particular piping systems and welds that are affected by the change in inspection practices are reviewed. Specific revisions to inspection scope, schedules, locations, and techniques are reviewed. Plant systems and functions that rely on the affected piping are also reviewed. The staff reviews available engineering studies, methods, codes, applicable plant specific and industry data and operational experience, PRA findings, and research and analysis results relevant to the proposed CLB change.

Plant snecific experience with inspection program results is reviewed and characterization relative to the effectiveness of past inspections of the piping and the flaws that have been observed is reviewed.

L2 Element 2: Enaineerina Analvsis As part of the second element, the staff will review the licensee's engineering analysis of the proposed changes. The purpose of the review is to determine whether defense in-depth is maintained, sufficient safety margins are maintained, and that proposed increases in risk, and their cumulative effect, are small and do not cause the NRC Safety Goals to be .

exceeded. Regulatory Guides (RG) DG 1061 and DG 1063 provide guidance for the performance of this evaluation.

L2d Traditional Analvsis The engineering analyses are reviewed to determine whether the impact of the proposed ISI changes are consistent with the principles that defense in-depth and adequate safety margins are maintained.

The primary regulations governing ISI of piping are 10 CFR 50.55a and Appendix A to 10 CFR Part 50. The regulations reference other codes and requirements that define the >

elements of defenw m depth and safety margins to ensure that structuralintegrity of piping is maintained. The staff reviews the licensee's assessment of whether the proposed changes meet the regulations. l 10 CFR 50.55a references ASME Boiler and Pressure Vessel Code (BPVC)Section XI for the detailed requirements regarding piping ISI. Inspections required by ASME BPVC Section XI are performed on a sample basis with additional inspections, in terms of docketed and in effect. The CLB includes the NRC regulations contained in 10 CFR Parts 2,19,20,21,26,30,40,51,54,55,70,72,73,100 and appendices thereto; orders; license conditions; exemptions; and technical specifications, it also includes the plant-specific design-basis information defined in 10 CFR 50.2 as documented in the most recent final safety analysis report (FSAR) as required by 10 CFR 50.71 and the licensee's commitments remaining in effect that were made in docketed licensing correspondence such as licensee responses to NRC bulletins, generic letters, and enforcement actions, as well as licensee commitments documented in NRC safety evaluations or licensee event reports."

3.9.8 3

O locations as well as frequency, mandated in response to detection of flaws. Tne objective of the ISI has been to identify conditions, such as flaw indications, that are precursors to leaks and ruptures in pressure boundaries that rnay impact plant safety. The staff reviews the licensee's bases for the assessment that the proposed change meets the intent of the ASME Code requirements.

FSAR and supporting engineering analyses are reviewed to determine whether adequate safety margins are rnalntained by ensuring that the safety analysis acceptance criteria in the current licensing basis are met, or proposed revisions provide sufficient margin to account for analysis and data uncertainty.

I In addition, augmented inspection programs to address generic piping degradation problems have been implemented by the industry. Th:, most notable examples of augmented programs for piping inspections are to eddress intergrannular stress corrosion cracking (IGSCC) of stainless steel piping at bohing water reactors (BWR) (Generic Letter 88 01, Reference 11) and erosion corrosion (EC)in the balance of plant for both pressurized water reactors (PWR) and BWRs (Generic Letter 89-08, Reference 12). The manner in which the augmented inspection programs for piping are addressed is reviewed.

Q2 Probabilistic Risk Assessment The licensee's risk assessment is reviewed to establish that the baseline CDF and LERF values are appropriately calculated. The breadth and depth of the review will depend on the extent that the PRA results are used to support the proposed changes, if the ,

justification for the change is based on well founded traditional arguments supported by l PRA insights, a limited PRA review may be warranted. However, if the justification for l

change is based on complex PRA arguments, then the breadth and depth of the PRA review will be substantially greater.

1,2.2.1 Scope of Pinina Svstems The scope of piping included in the RI 131 program for the purpose of selectino *:ystems for ISIis reviewed. The current ISI requirements for nuclear power plat cir!r,9 are specified in 10 CFR 50.55a which incorporates, by reference, the requirements of ASME BPVC Section XI. The extent to which the RIISI program scope incorporates ASME Class 1,2 and 3 piping syster is currently included in ASME BPVC Section XI program is reviewed.

The RI ISI program should include systems modeled in the plant PRA. The plant PRA usually includes systems that are currently defined as non safety related but they may be risk significant because of their high probability of failure, high consequence of failure, or both. The process by which systems included in the plant PRA model are incorporated into the RI ISI program is reviewed.

The scope of piping included in the ISl program is reviewed for consistency with other risk-insight regulations, such as 10 CFR 50.65, the Maintenance Rule. Paragraph (b) of 10 CFR 50.65 states, in part, that the scope of the monitoring program for the Maintenance Rule is to include safety related and nonsafety related structures, systems, and component 3.9.8-4

+

l (SSC). The process by which safeterelated and nonsafety related systems included in the Maintenance Rule are incorporated into the Rl ISI program is reviewed.

It is expected that the final scope will be determined through the use of a well-reasoned judgement process often involving a combination of engineering skills, with experience in plant PRA, materials engineering, nondestructive examination (NDE), and operations and maintenance of the plant. This activity has typically been referred to in industry documents as being performed by an " expert panel." As discussed in this document, it is the licensee's responsibility to ensure that any licensing submittal to the NRC is accurate and complete. Use of an expert panel or reliance on the ISI group of experts with adequate management attention and quality assurance is the responsibility of the licensee.

l.2.2.2 Pioino Seaments The procedure for defining piping segments within the piping systems for the purpose of modeling a run of a pipe in a PRA or to define its ISI requirements is reviewed. The methods by which the failure consequences such as initiating event, loss of train, loss of system, or a combination thereof, are incorporated in the definition of segments are reviewed. In addition to the failure consequences, the procedure er criteria used to identify the degradation mechanisms that can be present in piping within the selected systems boundaries is reviewed. Identification of the degradation mechanisms should take into account design, fabrication, operational conditions, and industry experience. The degradation mechanisms to be considered include, but may not be limited to, vibration fatigue, thermal fatigue, corrosion cracking, primary water stress corrosion cracking (PWSCC), IGSCC, microbiologically induced corrosion (MIC), crosion, cavitation, and EC.

The procedure by which the location of the pipig in the plant, and whether inside or outside the containment, is taken into account .1 Jefining piping segments is reviewed.

Definition of piping segments should also take into account traditional PRA modeling locations such as flow split or flow joining points. Other considerations for the definition of piping segments include break isolation check valves, motor operated valves (MOV), and air operated valves (AOV).

The selection of piping segments within the piping system boundaries is an iterative process affected by degradation as well as consequence evaluation which is not completed at the time of initial selection of piping segments within the selected piping systems. The procedure by which degradation mechanisms and consequences of piping segment failures are incorporated in the iterative process is reviewed.

1.2.2.3 Modelina Pine Failures in PRA Pipe ruptures are traditionally modeled as initiators and the individual pipe segments or structural elements are not modeled in detailin PRAs. The manner in which PRA, or the PRA results, is modified so that a more detailed treatment of the potential (or probability) of pipe failures and the influence of such failures on other systems are incorporated in the PRA is reviewed.

3.9.8 5

1,2,2,4 Pioina Failure Potential j Segment f ailure potential is characterized as a failure frequency or probability. Failure potential can be a quantitative estimate for each segment, or segmsnts may be categorized into groups based on similar degradation mechanism, environment, and failure modes.

There are three failure modes:

1. Initiating event failures where the failure directly causes a trans ent and may or may not also f ail one or more plant trains or systems. Initiating events failures are characterized by failure frequency.

2. Standby failures are failuren where the failure may cause the loss of a train or system but which does not directly cause a transient. Standby failures are characterized by train or system unavailability which may require shutdown due to ,

technical specifications or limiting conditions for operation. Unavailability is a '

combination of failure frequency and exposure time.

3. Demand f ailures are f ailures accompanying a demand for a train or system and usually caused by the transient induced loads on the segment during system startup. Demand failures are characterized by a probability per demand.

The approach used for the determination of failure potential of piping segments is reviewed. The manner in which past failure data, expert opinion and probabilistic fracture mechanics is considered in determining the piping failure potential is reviewed. The determination of exposure time appropriate to standby failures is reviewed. Wnon data analysis is utilized, appropriateness and completeness of data and whether data is taken over time is evaluated.

Probabilistic structural analysis techniques may be used to estimate a numerical frequency or probability of piping segment failure. This method utilizes conventional structural analysis techniques, such as fracture mechanics analysis, in combination with probabilistic methods, such as Monte Carlo simulation. These techniques are implemented by cornplex or simplified computer codes to estimate failure probabilities as a function of time. The probabilistic structural analysis methodology for the determination of piping failure probabilities is reviewed to determine the appropriate application of fracture mechanics analysis and Monte-Carlo simulation techniques. Benchmarking of computer codes based on comparison with industry standard codes as well as operating experience is also reviewed. The applicant should demonstrate that the methodology is able to identify significant differences in failure frequencies or probabilities.

Alternatively, expert opinion may be used in conjunction with, or in lieu of fracture mechanics analysis to assign each element into a small number of failure potential categories; high, medium, or low for example, in such cases, the process and basis of failure potential determination is reviewed.

For both quantitative estimates and classificason into similar groups, the manner in which f ailure modes, industry experience, piping material, and various other parameters are s considered is evaluated. There are numerous uncertainties involved in performing an 3.9.8 6

a e assessment of component failure potential. The procedures for addressing these uncertainties when predicting failure potential due to component aging and degradation are reviewed.

L2,2 5 Conseauences of Failure The procedure by which direct and indirect effects are characterized is reviewed to verify that appropriate failure mechanisms and dependencies will be evaluated in the risk analysis. Direct effects of piping failures include loss of coolant accidents (LOCA) and consequential loss of systems because of the inability to deliver coolant through the failed piping. Indirect effects include consequential f ailures of additional equipment, including equipment in other systems, because of effects such as pipe whip, jet impingement, flooding, or temperature. The review will determine whether a failure modes and effects analysis (FMEA) has been conducted to provide a structured approach to cataloging these effects.

1.2.2,6 Risk Impact of ISI Channes The methodology used to characterize the change in risk due to the proposed change in the ISI program is reviewed. The review includes scope of piping systems, mapping of piping failures into the PRA models, definition of piping segments, determination of piping failure potential, consequences of piping failure contribution to plant risk, and risk impact of ISI changes.

Part of the basis for the acceptability of any RIISI program is a demonstration that l

i established risk measures are not significantly increased by the proposed increase in inspection intervals or reduction in the number of inspections for selected piping. To l demonstrate this, the process and methodology used to appropriately account for the f change in inspection interval, the number of elements inspected, and when feasible, the effects of an enhanced inspection rnethod are reviewed.

The assignment of pipe elements into safety significant categories is an integral part of the risk informed ISI process. Consequently, the categorization process and any quantitative guidelines used to support the categorization is also reviewed.

L2d Intearated Decisionmakina Integration of the different elements of the engineering analysis discussed in Sections 1.2.1 and 1.2.2 is reviewed. Acceptability of impact of the proposed change in the ISl program is determined based on the review of the adequacy of the traditional engineering analysis, change in plant risk relative to the acceptance criteria, and the adequacy of the proposed implementation and performance monitoring plan.

L2Jd Selection of Locations 10 be insoected Risk measures utilized to characterize and differentiate the risk contributions from the individual piping segments are reviewed. The criteria for utilizing these risk measures to categorize each pipe segment into groups of more safety-significant and less safety-3.9.8 7

significant are reviewed. Consideration of absolute and relative figures of merit is reviewed. Review is focused on the criteria for risk significance determination for ISI at the pipe segment and structural element levels that are used to prioritize inspection locations.

The procedure used to perform review of piping segments and piping structural elements to ensure that no segments are inappropriately ranked as less safety significant is reviewed.

Comparison of ISI program for piping under ASME XI and RlISI prograrr is reviewed.

An acceptable method of classifying piping segments as more safety significant and less-safety significant is to utilize risk importance measures such as Risk Reduction Worth and Rick Achievement Worth. The relative ranking of risk for each segment based on importance measures provides risk insights and supports the classification of all the segments into a small number of categories based on their safety significance. The 1

importance measure calculation techniques, criteria, and the documentation is reviewed.

The criteria and procedure used to define the number and location of structural elements within the piping segments that will be subject to ISIis reviewed. For structural elements exempted from examination, justification is reviewed.

L2 Element 3: lmolementation and Monitorina Proarams The adequacy of the implementation and monitoring plans is reviewed, in particular, the process which ensures that failure mechanisms are detected before they lead :o leaks or breaks is reviewed.

I inspection strategies are reviewed to assure that failure mechanisms of concern have been addressed and there is a sufficiently high probability of detecting damage before structural integrity is impacted, inspection strategies for selected segments are reviewed to determine if leak /b:eak risks from pressure boundary piping failures are maintained beiow appropriate threshold values. The process by which the safety significance of piping segments is taken into account in defining the scope of the inspection program is reviewed, inspection scope, examination methods, and methods of evaluation of examination results are reviewed with the objective of establishing whether the RI-ISI inspection program provides an acceptable level of quality and safety.

The criteria for selecting areas and volumes of more-safety significant as well as less-safety significant piping otructural elements for inspection are reviewed. The methods by which the degradation mechanisms, postulated failure modes, and configuration of pip lng structural elements are incorporated in the inspection scope and inspection locations are reviewed. The manner in which significant stress concentration, geometric discontinuities, and generic as well as plant-specific pipe cracking experience is considered in selecting inspection locations is reviewed. Alternate methods to ensure structural integrity in cases where examination methods cannot be applied due to limitations, such as inaccessibility or radiation exposure hazard are reviewed.

In the context of the RI ISI program, the sampling strategy is defined by the selection of structural elements that are proposed by the licensee for inclusion in the inspection. The reviewer will determine if expansion of the sample size, e.g , through sequential sampling is addressed through feedback of ISI findings and other information on structural 3.9.8 8 v )

degradation from operating experience, inspection methods and acceptance standards utilized in the implementation of the RIISI program are reviewed. Inspection methods selected by the iscensee should address the degradation mechanisms, pipe sizes, and materials of concern. The manner in which the degradation mechanism is taken into consideration in determining the suitability of examination methods such as visual, surface, and volumetric examination is reviewed. The extent to which the RIISI program incorporates inspection intervals, exarnination methods and acceptance standards currently included in the ASME BPVC Sectic .il program is reviewed.

The reliability of any NDE method is dependent on the qualification of the inspection personnel. Al lSI program is reviewed to verify that inspection teams will meet industry codes and standards, and use accepted methods and procedures, implementation plan for the RI ISI program is reviewed to ensure that appropriate modifications of the ISI plan are developed if new or unexpected degradation mechanicms occur. The manner in which the adequacy of the reliability of the implemented NDE methods is monitored is reviewed.

11. ACCEPTANCE CRITERIA The acceptance criteria for the areas of review described in subsection I of this SRP are given below. Other approaches that can be justified to be equivalent to the stated acceptance criteria may be used. The staff accepts the risk informed safety significance categorization of piping systems, piping segments, and structural elements and development of an inspection plan if the relevant requirements of 10 CFR 50.55a concerning ISI are complied with. The relevant requiremonts of 10 CFR 50.55a are:

1. Proposed alternatives to the ISI requirements of paragraphs of 10 CFR SO.55a, which requires compliance with ASME XI for ASME Code Class 1,2, and 3 components, may be used when authorized by the Director of the Office of Nuclear Reactor Regulation.

2. The applicant shall demonstrats that the proposed alternatives would provide an acceptable level of quality and safety.

A summary of acceptance guidelines for engineering evaluations and selected PRA issues is provided in Section 4.4 and a summary of acceptance guidelines for the implementation, monitoring, and corrective action programs is provided in Sections 5.4 of DG 1063 (Reference 2).

JL1 Element 1: Define the Proposed Chanae to ISI Proaram The licensee's RI lSI submittal should have defined the proposed changes to the ISI program in general terms. The li::ensee should have confirmed that the plant is designed 3.9.8 9

~ .

and operated in accordance with the CLB and that the PRA used in support of their RlISI program submittal reflects the actual plant. The licensee should identify those aspects of the plant's licensing bases that may be affected by the proposed change, including, but not limited to, rules and regulations, FSAR, technical specifications, licensing conditions, and licensing commitments. The, particult.r piping systems, segments, and welds that are affected by the change in ISI program should be identified. Specific revisions to inspection scope, schedules, locations, and techniques should also be identified, in addition, plant systems and functions that rely on the affected piping should be identified, industry and plant specific experience with inspection program results should be obtained and characterization relative to the effectiveness of past inspections of the piping and the flaws that have been observed should be described in addition, specific revisions to existing inspection schedules, locations, and techniques should also be described.

IL2 Element 2: Enaineerina Analysis After the proposed changes to the licensee's ISI program have been defined, the licensee should conduct an engineering analysis of the proposed changes using a combination of traditional engineering analysis with supporting insights from a PRA. The licensee should evaluate the proposed CLB change with regard to the principles that adequate defense-in-depth is maintained, that sufficient safety margins are maintained, and that proposed increases in risk, and their cumulative effect, are small and do not cause the NRC Safety

, Goals to be exceeded. S"fficient safety margins are maintained when codes and standards (such as ASME) or alternatives approved by NRC are met, and safety analysis acceptance criteria in the CLB (updated FSAR, supporting analyses) are met, or proposed revisions provide sufficient margin to account for analysis and data uncertainty. Regulatory Guides DG 1061 and DG-1063 provide gudance for the performance of this evaluation.

11.2.1 Traditional Analvsis The tradional engineering analyses conducted should assess whether the impact of the proposed ISI changes (individually and cumulatively) are consistent with the principles that defense-in-depth and adequate safety margins are maintained.

10 CFR 50.55a and Appendix A to 10 CFR Part 50 are the primary regulations governing ISI of piping. The intent of these documents is to maintain the structurut. integrity of piping in a nuclear nower plant. The regulations reference other codes and requirements that define the elements of a defense-in-depth philosophy to ensure structural integrity of piping. For eac.h of the regulations and Fcensing bases relevant to the ISI of piping, the licensee should ensure that the proposed changes to the ISI program do not deviate from the regulations and licensing bases.

10 CFR 50.55a references ASME CPVC Section XI for the detailed requirements regarding piping ISI for safety significant systems. The objective of the ISI requirements of the ASMF Code has been to identify conditior.3, such as flaw indications, that a.e precursors to le 4.M ruptures in pressure boundaries that may impact plant safety, l'he licensee should verity that the proposed changes to the ISI program meet or exceed the intent of the ASME BPVC Section XI to identify conditions that ao precursors to leaks and ruptures and to provide plans for additional and more frequent inspections in response to detection 3.9.8-10

s -

of flaws and degradation mechanisms.-

The nuclear industry has implemented augmented inspection programs to address generic industry wide piping degradation problems such as lGSCC and EC. The licensee should ensure that there is no adverse impact of the proposed changes in the ISI program on the augmented inspection progrems for piping, ll.2,2 Probabilistic Risk Assessment The quality of the PRA should be compatible with the safety implications of the ISI change being requested and the degree that the justification of the change request depends on the PRA analysis. Guidance relating the acceptable breadth and depth of the PRA analysis based on the baseline risk and the anticipated change in risk can be found in RG DG 1061, Section 2.4.2, " Evaluation of Risk Impact, including Treatment of Uncertainties," and SRP Chapter 19.0, Section l1.3.2.4, " Quality of a PRA for Use in Risk Informed Regulation."

The PRA performed shoult' realistically reflect the actual design, construction, and operational practices and reflect the impact of previous changes made to the CLB.

Parameter uncertainty, model uncertainty, and completeness uncertainty should be l

addressed in accordance with the guidelines of DG 1061.

LL2d Scoce of Pinino Systems The piping systems included in the RI ISI program for the purpose of evaluating the impsct of the proposed changes in the ISI program on total plant risk and for the purpose of screening to classify piping systems as more safety-significant and less safety-significant should include all ASME Code Class 1,2, and 3 piping systems currently included in ASME Section XiISI program. To be acceptable, piping systems modeled in the plant PRA should be included in the RI-ISI program, if the PHA is not a full scope PRA as defined in RG DG.

1061, a systematic and documented search for piping systems important to preventing and mitigating initiating events excluded due to the lim'i.ad scope should be defined, justified, and systematically applied.

In addition, various balance of plant non-nuclear ASME Code Class fluid systems determined to be of importance should also be included in the list of piping systems being considered for screening into more-safety-significant and less-safoty-significant systems.

The envelope of piping systems based on ASME XI, PRA and balarice of plant non-nuclear ASME Code Class fluid systems should be compared with the systems included under the scope of the Maintenance Rule to incorporate risk-significant systems in the scope of the RI ISI program.

11.2.2.2 Pioino Seaments An acceptable method for modeling a run of a pipe in a PRA or to define its ISI requirements is to divide the pipe run into segments. Portions of piping within the piping systems having the same consequences of failure should be systematically identified.

Consequences of failure include an initiating event, loss of a particular train, loss of a system, or a combination thereof. The location of the piping in the plant, and whether 3.9.8 11

D inside or outside the containment, should be taken into account in defining piping segments.

Piping sections subjected to the same degradation mechanism should be systematically identified. Most of the degradation mechanisms present in nuclear power plant piping are dependent on a combination of design characteristics, fabrication processes and practices, operating conditions, and service experience.

Piping segment should be defined as portions of piping for which the potential degradation mechanism is the same, and a failure at any point in the segment results in the same consequence. In addition, consideration should be given to identifying distinct segment boundaries at branching points such as flow splits or flow joining points, locations of size changes, is@fion valve, MOV and AOV locations. Distinct segment boundaries should be defined if the break probability is expected to be significantly different for various portions of piping.

11 2 . 2 . 3 Modelina Pioe Failures in PRA Generally, three or four primary system LOCA sizes w,d two steam line rupture locations representing the spectrum of demands on the mitigating systems are modeled in PRAs. An internal events flooding analysis is also included in all PRAs performed in response to .

Generic Letter 88 20. Much of this analysis will be used as a basis for determining the consequence of pipe failures. The review should focus on the robustness of the above -

models and methods in the baseline PRA, and appropriate use of this information to investigate the impact of the change in risk due to ISI implementation.

One acceptable approach is to investigate the change in risk due to an ISI program change is based on developing the pipe elements' f ailure potentials into probabilities, and integrating these probabilities into the existing quantitative PRA framework. The contribution to risk from each piping elements may be ranked and the safety significance of the element determined.

An alternative acceptable approach is based on categorizing each segment's failure potential and the consequences of each segment's failures. These two elements of risk, failure potential and consequences, are then systematically combined to determine the safety significance of each element.

When a pipe segment failure yields the same con ~ sequences as some other initiator already included in the PRA (e.g., a large LOCA or some flooding events), the consequence of its failure may be represented by the conditional core damage and large early release probabilities for that initiator, it may utn be possible to identify surrogate basic events that capture the consequence of pipe element failures which do not directly cause initiating events (e.g., standby and demand failures). In this case, the risk due to the elements failure may be represented by the conditional core damage and large early release rates for the surrogate basic event .

New initiators may need to be added to the PRA model if the greater resolution of the 3.9.8-12

a ,

l l

piping failures introduce different demands on mitigating systems than the generic pipe failures did in the baseline PRA. Correspondingly, when non initiating event pipe f ailure  ;

consequences cannot be captured by surrogate basic event failures, new basic events may )

need to be added to the models. Careful attention should be given to pipe failures which  !

could cause initiating events and, at the same time, fail or degrade mitigating systems l (common cause initiators).

11, 2 , 2 . 4 Pioino Failure Potential The determination of failure potential of piping segments, either as a quantitative estimate or a categorization into groups, should be based on appropriate values of design, operational, and inspection parameters. The evaluation should include a determination of whether the potential failure of each segment is best characterized as a demand failure or a failure frequency and how that determination was reached. The environmental influence, degradation mechanisms, and failure mode determination should match the demand failure or failure frequency characterization. When data analysis is utilized to develop a quantitative estimate, the data should be appropriate and complete. When elicitation of expert opinion is used in conjunction with, or in lieu of probabilistic fracture mechanics analysis, a systematic procedure should be developed for conducting such elicitation. In such cases, a suitable team of experts should be selected and trained.

The assessment of piping failure potential should take into account uncertainties. These uncertainties include, but are not limited to, definition of limiting failure modes, such as loss of function as opposed to loss of structural integrity; design versus fabrication differences; variation in material properties and strength; effect of various degradation and aging mechanisms; variation in steady-state and transient loads; availability and accuracy of plant operating history; availability of inspection and maintenance program data; and capabilities of analytical methods and models to predict realistic results.

The methodology, process, and rationale used to determine the failure potential of piping segments should be reviewed and approved by the experts as part of its deliberations during the final classification of the safety significance of each segment. This process should be justified, documented, and included in the submittal. When computer codes are used to develop quantitative estimates, the techniques should be verified and validated against established industry codes.

Guidance for determination of piping failure probability is provided in RG DG-1063.

11. 2 . 2 . 5 Conseouences of Failure The impact on risk due to piping pressure boundary failure should consider both direct and indirect effects. Consideration of direct effects should include failures that cause initiating events, disable single or multiple components, trains or systems, or a combination of these effects. Indirect effects of pressure boundary failures affecting other systems, components and/or piping segments, also referred to as spatial effects such as pipe whip, jet impingement, flooding, or consequential initiation of fire protection systems should also be considered.

3.9.8-13

, s The direct and indirect effects of pipe failures should be characterized to incorporate appropriate failure mechanisms and dependencies into the PRA model. An acceptable method of incorporating pipe failures is to classify pipe failures as leaks, disabling leaks, and breaks. Each of these failure mode has a specific failure probability and a corresponding potential for degrading system performance through direct and/or indirect effects. Leaks can result in moisture intrusion through jet impingement, flooding, and sprays. Disabling leaks (larger break area than for leaks) can result in initiating events and loss of system function in addition to indirect effects. Breaks can result in damage due to pipe whip in addition to all of the above mentioned damages. The corresponding failure probability or potential decreases as the break area increases.

ll.2.2.6 Risk Impact of ISI Chanaes The guidelines discussed in RG DG 1061, Section 2.4.2, " Evaluation of Risk Impact, including Treatment of Uncertainties" are applicable to ISI change requests. General guidance for reviewing the risk impact from changes to the current licensing basis can be found in SRP Chapter 19.0, Sectic.) 11.3.2.5 " Risk impact including Treetment of Uncertainty."

The liconsee should demonstrate that principle four in DG-1061 and Section Iin this regulatory guide is met. Principle four states that proposed increases in risk, and their cumulative effect, are small and do not cause the NRC Safety Goals to be exceeded, increase in risk caused by changes in ISI program could arise from a decrease in the number of welds inspected, reduced efficiency from simplified weld inspections, or both.

Decreases in risk could arise from inspecting welds not currently being inspected in the program, improved weld inspections, or both. The greater the potential risk increase in the proposed change in the ISI program (e.g., the larger the reduction in the number of welds to be inspected and of replacements of detailed inspections with simplified inspections) the more rigorous and detailed the risk analyses needed. However, the licensees are encouraged to package a group of changes, such that by restricting one area to improve risk, the licensee can propose relaxing others leading to a net gain in operational performance and cost, while providin;; a net decrease in risk.

Principle four may, and for major program changes should, be shown to be met by calculating the expected change in CDF and LERF. The expected change can be calculated using the baseline PRA and before change versus after change piping failure potential expressed as failure probabilities. Due to the large uncertainty on piping failure probability arising from large uncertainties in the fracture mechanics modelling and input parameters, an evaluation of the uncertainty in the results should be performed for all quantitative evaluations.

For some ISI program changes, the licensee may choose to demonstrate that any potential increases in risk is small and does not cause the NRC Safety Goals to be exceeded. A direct evaluation of the fulfillment of principle four should be based on risk importance measures or bounding estimates capable of characterizing plant specific pipe element failure potential and consequences categories, 3.9.8 14 l

l

a e a systematic process to combine failure potential and consequence to determine pipe element safety significance, pipe segment and element inspection selection process which provides for changes in the ISI program based on the safety-significance of the pipe element, and a discussion and evaluation of the aggregate risk impact of the set of changes requested in the ISl program.

11,2,3 Intearated Decisionmakina The results of the different elements of the engineering analysis discussed in Sections 1.2.1 and 1.2.2 must be considered i'i an integrated decisionmaking process. Acceptability of impact of the proposed change in the ISl program is based on the adequacy of the traditional engineering analysis, acceptable change in plant risk relative to the criteria, and the adequacy of the proposed implementation and performance monitoring plan.

For ISI application, traditional requirements are outlined in 10 CFR SO.SSa and the General Design Criteria in Appendix A to 10 CFR Part 50. To be acceptable, the traditional engineering analysis should address all of the relevant regulations and the licensing bases of the plant. The intent of the ASME BPVC to maintain integrity of reactor coolant system boundary by ISI should be preserved under the RI-ISI program.

To be acceptable, the cumulative risk evaluation for all of the proposed ISI program changes should confirm that changes to the plant CDF and LERF are small and in conformance with the guidelines in RG DG-1061. Plant-specific data should be incorporated into the analyses and appropriate considerations should be given to the various types of uncertainties.

Appropriate consideration should be given to implementation and performance monitoring strategies so that piping performance can be assessed under the proposed ISI program change to confirm the assumptions and analyses that were' conducted to justify the ISI program change, ll . 2. 3. 'i Selection of locations to be insoected An acceptable approach for the risk ranking of piping segments and elements is the use of risk reduction worth (RRW) and risk achievement worth (RAW) importance measures.

RRW is a measure of the maximum possible reduction in total CDF due to pressure boundary failures in plant piping systems that can result from making a component perfectly reliable. RAW measures the increase in total CDF when a component in considered to be failed or unavailable. The risk ranking methodology must be able to systematically identify all more-safety-significant pipe segments, regardless of whether the piping is currently covered by ASME XI.

Sensitivity studies should be performed which identify the impact of highly uncertain PRA modelling assumptions and techniques, and the rankings adjusted to minimize the influence of these assumptions on the classification. Emphasis should be placed on insuring that an 3.9.8-15

i eventual less safety significant classification is appropriate. Guidelines for performing sensitivity studies is provided in the RG DG 1063.

The classification of all piping segments should be evaluated to determine if any piping segment is inappropriately classified. Considerations should be given to the limitations of the PRA implementation approach resulting from the PRA structure, PRA scope, and risk importance measures. Operational insights from previous inspection results, industry data on pipe failures, and Maintenance Rule impacts should also be taken into account. Piping that are subject to ISI under ASME XI requirements but have no segments exceeding the piping segment screening criteria should be further reviewed. Each ASME Class coded system should have a minimum program of piping segments selected and categorized as more safety significant.

The criteria for determining how many structural elements should be selected for examination should be based on the safety significance of the segment and the failure potential within that segment. The potential for pipe failure directly drives the need for selecting elements for inspection within a segment and the location to be inspected. The sampling program for the selection of number of elements to be inspected should be fully justified. Guidelines for an acceptable methodology for selection of structural elements for inspection within pipe segments is provided in the RG DG 1063.

JM Element 3: Imolomentation and Monitorino Proorams Careful consideration should be given to implementation and performance-monitoring strategies. The primary goal of this element is to assess piping performance under the proposed RI ISI program by establishing performance-monitoring strategies to confirm the assumptions and analyses that were conducted to justify the changes in the ISI program.

As discussed in Section 5.2 of DG-1063 (Reference 2), performance monitoring encompasses feedback or corrective action that includes periodic updates based on changes resulting from plant design features, plant procedures, equipment performance, examination results, and individual plant and industry failure information, inspection scope, examination methods, and methods of evaluation of examination results for the RIISI program should provide an acceptable level of quality and safety as stipulated in 10 CFR SO.55ala)(3)(i). Inspection strategies should ensure that failure mechanisms of concern have been addressed and there is a sufficiently high probability of detecting damage before structural integrity is impacted. Safety significance of piping segments should be taken irito account in defining the inspection scope for the RI-ISI program. RI ISI program is reviewed to ensure that the inspection strategies for selected segments will maintain leak / break risks from pressure boundary piping failures below failure rates experienced by the industry in the past.

Degradation mechanisms, postulated failure modes, and configuration of piping structural elements should be incorporated in the definition of the inspection scope and inspection locations. The piping segments that are included in the existing plant EC or IGSCC inspection programs, the inspection locations should be the same as in the existing EC or IGSCC programs. For segments not in these programs, inspection locations should be mainly based on specific degradation mechanism and industry as well as plant-specific 3.9.8-16

O e cracking experience. Determination of inspection locations for segments with no known degradation mechanism but high failure consequence should be based on sensitized weld locations, stress concentration, geometric discontinuities,-and terminal ends. Plant specific pipe cracking experience should be considered in selecting inspection locations.

Appropriate justification should be provided for sampling methods used to reduce the number of elements to be inspected. To be acceptable, alternate methods should be specified to ensure structuralintegrity in cases where examination methods cannot be applied due to limitations, such as inaccessibility or radiation exposure hazard. Pressure test and visual examination of piping structural elements should continue to be performed on all Class 1,2, and 3 systems in accordance with ASME BPVC Section XI program regardless of whether the segments contain locations that have been classified as more- or less safety-significant.

Expansion of the sample size, e.g., through sequential sampling as discussed in RG DG-1063 should be addressed through feedback of ISI findiags and other information on structural degradation from operating experience.

The qualifications of NDE personnel, processes, and equipment should be demonstrated to be in compliance with ASME BPVC Section XI. The acceptance criteria for flaw evaluation should meet the requirements of ASME BPVC Section XI For inspections outside the scope of Section XI (e.g., EC, IGSCC) the acceptance criteria should meet existing regulatory guidance applicable to those programs.

The risk-informed inspection program should specify appropriate inspection intervals consistent with the relevant degradation rate, inspection intervals should be sufficiently short so that degradation too small to be detected during one inspection does not grow to an unacceptable size before the next inspection is performed.

Updates to the RI ISI program should be performed at least on a periodic basis to coincide with the ISI requirements in ASME Section XI. Plant design feature changes, plant procedure changes, and equipment performance changes should be included for review in the RI-ISI program update. Leakage, flaws, or indications identified during scheduled RI-ISI program NDE examinations and pressure tests should be evaluated as part of the RI ISI program update. Periodic updates of RI-ISI programs should include individual plant as well as industry failure information.

Appropriate modifications of the ISI plan should be developed if new or unexpected degradation mechanisms occur. The adequacy of the reliability of the implemented NDE methods should be monitored. The adequacy of NDE performance levels and inspection intervals along with the appropriateness of the selected ISIlocations should be considered valid only if the ISI program is successful in detecting degradation before it leads to leakage or rupture of piping.

Ill. REVIEW PROCEDURES The staff reviews the changes made to the ISI program (that could affect the process and results) tu ensure that the basis for the staff's prior approval has not been compromised.

The reviewer ensures that all changes are evaluated using the change mechanisms 3.9.8-17

ve .

( described in existing applicable regulations (e.g.,10 CFR 50.55a,10 CFR 50.59,10 CFR l 50, Appendix B for safety related SSC) to determine if NRC review and approval is required prior to implementation. For example:

Changes to segment groupings, inspection intervals, and inspection methods that do not involve a change to the overall RI-ISI approach where the overall RI ISI approach was reviewed and approved by the NRC do not require specific review and approval prior to implementation provided that tha effect of the changes on plant risk increase is insignificant.

Segment inspection method changes involves the implementation of an NRC endorsed ASME Code, NRC-endorsed Code Case, or published NRC guidance which were approved as part of the RIISI program do not require prior NRC approval.

Inspection method changes that involve deviation from the NRC endorsed Code requirements require NRC approval prior to implementation.

Changes to the Rl ISI program that involve programmatic changes (e.g., changes to the plant probabilistic mode assumptions, changes to the categorization criteria or figure of merit used to categorize components, and changes in the Acceptance Guidelines used for the licensee's integrated decision-making process) require NRC approval prior to implementation.

Piping inspection method changes will typically involve the implementation of an applicable ASME Code or code case (as approved by the NRC) or published NRC guidance. Changes to the piping inspection methods for these situations do not require NRC approval.

However, inspection method changes that involve deviation from the NRC approved Code requirements require NRC approval prior to implementation.

For each area of review, the following review procedure is followed to ensure consistency in review so as to satisfy the requirements of acceptance criteria stated in subsection ll.

111. 1 Element 1: Define the Procosed Chanae to ISI PrQ2 RED The staff reviewer verifies that the licensee's RI-ISI submittal defines the proposed changes to the ISI program in general terms. The reviewer ensures that the licensee has confirmed that the plant is designed and operated in accordance with the CLB and that the PRA used in support of their RI ISI program submittal reflects the actual plant. The reviewer verifies that the licensee has identified regulations and licensing commitments that impact the current ISI requirements. This includes, but is not limited to, rules and regulations, FSAR, technical specifications, licensing conditions, and licensing commitments. Tne reviewer also verifies that the piping systems, segments, and welds that are affected by the change in ISI program are identified. In addition, description of the proposed change is reviewed to verify that plant systems and functions that rely on the affected piping have been identified. The characterization of the proposed change in the ISI program is reviewed to verify that detailed description of the industry and plant specific information applicable to the piping degradation mechanisms has been provided. The description of the proposed change is also reviewed to verify that information that characterizes the relative 3.9.8-18

,; e effectiveness of past inspections and the types of flaws that have been identified has been provided, in addition, the reviewer verifies that specific revisions to existing inspection schedules, locations, and techniques have been described, l!L2 Element 2: Enaineerina Analvsis in the second eicment, the staff reviewer verifies that the licensee's engineering analysis of the proposed changes uses a combination of traditional engineering analysis with supporting insights from a PRA. To be acceptable, the licensee should have verified that defense in depth is maintained, sufficient safety margins are maintained, and that proposed increases in risk, and their cumulative effect, are small and do not cause the NRC Safety Goals to be exceeded. RGs 1061 and 1063 provide guidance for the performance of this evaluation.

Ill.2.1 Traditional Analvsis The engineering analyses are reviewed to ensure that the impact of the proposed ISI changes are consistent with the principles that defense-in-depth and adequate safety margins are maintained in accordance with the acceptance criteria in subsection ll.2.1.

The reviewer verifies that proposed changes to the ISI program do not deviate from 10 CFR SO.55a and Appendix A to 10 CFR Part 50. The reviewer also verifies that the proposed changes to the ISI program meet or exceed the intent of the ASME BPVC Section XI to identify conditions that are precursors to leaks and ruptures and that the ISI program provides plans for adr1tional and more frequent inspections in response to detection of flaws and degradation mechanisms. The reviewer ensures that the licensee has demonstrated that there is no adverse impact of the proposed changes in the ISI program on the augmented inspection programs such as IGSCC and EC.

Ill,2,2 Probabilistic Risk Assessment The PRA performed is reviewed in accordance with the acceptance criteria in subsection l1.2.2 to confirm that it realistically reflects the actual design, construction, and operational practlas and reflects the impact of previous changes made to the CLB. The reviewed verifies that parameter uncertainty, model uncertainty, and completeness uncertainty are addressed in accordance with the guidelines in this regulatory guide and the general guidelines of DG 1061.

lll.2.2.1 Scoce of Pioina Svstems Scope of piping systems included in the RI-ISI program is reviewed in accordance with the acceptance criteria in subsection 11.2.2.1. The reviewer verifies that the piping systems included in the scope of the RI-ISI program take into account ASME Code Class 1,2, and 3 piping in the ASME XI program for the plant, PRA system boundaries, piping systems included in the Maintenance Rule program, and any balance of plant fluid systems of importance in accordance with the acceptance criteria specified in subsection 11.2.2.1 of this SRP Section. In particular, the details of the process utilized to determine the final 3.9.8-19

4 u piping systems scope for the RI-ISI program ic reviewed.

111.2.2.2 Piolno Seaments Criteria and procedures used to establish piping segments within the piping systems are reviewed to determine whether consequences of failure, degradation mechanisms, and segment boundaries are properly considered for defining piping segments in accordance with the acceptance criteria given in subsection 11.2.2.3 of this SRP section. ,

lll.2.2.3 Modellino Pioe Failures in PRA Acceptance criteria for modeling pipe failures in PRA is provided in subsection 11.2.2.3.

Modeling of piping in the PRA model is reviewed to verify whether the sequence of events from new initiators is appropriately developed if piping segment failure introduces new initiating events. If the pipe segment failure yields the same consequences as some other initiator already included in the PRA, the reviewer verifies that the risk from the original initiating event is appropriately represented in the ISI analysis ,

if surrogate components are used to represent the impact of pipe segment failure on plant risk, the component failures are reviewed to insure that the surrogate is an adequa*e representation of the pipe segment failure, and that the resulting risk insights are reflected in the ISI analysis. If surrogate basic events cannot be found, the analysis used to incorporate the new failure events into the PRA models and extract representative risk insights is reviewed.

Ill.2.2.4 Pioino Failure Potential The procedures used to determine the failure potential of piping segments are reviewed in accordance with the acceptance criteria in subsection l1.2.2.4 to verify that the appropriate failure frequency, demand failure, or unavailability mode was used to characterize the impact of failure, and that the determination of the quantitative estimate or group classification is appropriate to the failure mode. Types of uncertainties addressed are

. reviewed for conformance with the criteria given in subsection 11.2.2.4 of this SRP section.

When a computer code is used to develop a quantitative estimate, verification and validation of the computer code that implements the probabilistic fracture mechanics techniques is reviewed. When the failure potential is determined by classifying the failures into groups, the applicability of the classification scheme is reviewed.

Ill.2.2.5 Consecuences of Failure Acceptance criteria for determining consequences of failure is provided in subsection l1.2.2.5. The reviewer verifies that the licensee has considered both direct and indirect effects on the CDF due to piping pressure boundary failure. The reviewer also confirms that failure probabilities and consequences due to leaks, disabling leaks, and breaks in piping segments have been appropriately considered.

3.9.8-20

ra e 111. 2 . 2 . 6 Risk Imoact of ISI Chances Acceptability of risk impact of the proposed change in the ISI program is reviewed for compliance with the acceptance criteria in subsection 11.2.2 of this SRP section. The licensee's risk assessment, including change in CDF and LERF, is reviewed to verify that proposed increases in risk is small and does not cause the NRC Safety Goals to be exceeded. The baseline PRA should be used consistently. It should reflect the current plant ISI program, and risk insights developed should arise from comparing the baseline with the proposed post ISI program implementation plant risk. Risk insights are reviewed to ensure that they appropriately account for the change in the inspection interval, the number of elements inspected, and when feasible, the effects of an enhanced inspection method. The scope of PRA is reviewed to verify that the sophistication of the evaluation depends on the contribution ~ the risk assessment makes to the integrated decisionmaking.

111.2.3 Inteorated Decisionmakino i

Acceptance criteria for integrated dechionmding process is given in subsection 11.2.3.

The process by which the traditional engineering analysis addresses the relevant regulations and the CLB of the plant is reviewed to confirm that the regulation is met and the intent of the ASME BPVC to maintain integrity of reactor coolant system boundary by ISI is preserved under the RI-ISI program. Risk analysis is reviewed to confirm that changes to plant CDF and LERF are small and in conformance with RG DG 1061. After the RI ISI program is approved and initiated, plant performance should be supported by l Inspection and analysis and maintained by programmatic activities goals by comparison l against specific performance goals.

l

! lll.2.3.1 Selection of locations to be insoected 7

Acceptability of selection of locations to be inspected is reviewed for compliance with the acceptance criteria in subsection 11.2.3.1 of this SRP. Risk measures used are reviewed to determine that appropriate threshold values are used to rank the piping into more-safety.

- significant and less safety significant. The risk ranking process is reviewed to insure that it is capable of systematically identifying more-safety-significant pipe segments which are not currently included under ASME XI.

The procedure used to further review piping segments and piping structural elements that may be inappropriately ranked as less-safety-significant is reviewed to verify that PRA limitations, operational insights, industry pipe failure data, and Maintenance Rule insights are taken into consideration. In addition, the procedure used to determine the ISI program for piping that are subject to ISI under ASME XI requirements but have no segments or piping structural elements exceeding the screening criteria is reviewed to ensure that it is in accordance with the acceptance criteria of subsection 11.2.3.1 of this SRP.

Ill.3 Element 3: lmolementation and Monitorino Proorams The reviewer verifies that the inspection strategies address failure mechanisms of concern and there is a sufficiently high probability of detecting damage before structuralintegrity is compromised. The reviewer verifies that the degradation mechanisms, postulated failure 3.9.8-21 l

- w modes, and configuration of piping structural elements are incorporated in the definition of the inspection scope and inspection locations. Selected inspection locations are reviewed to confirm that stress concentratit,9, geometric discontinuities, and terminal ends are considered in establishing the inspection locations. In addition, the reviewer verifies that plant specific pipe cracking experienci has been considered in selecting inspection locations. Sampling methods to reduct the number of elements to be inspected are reviewed for appropriate justification. Yhe reviewer also determines if alternate methods are specified to ensure structural integrhy in cases where examination methods cannot be applied due to limitations, such as inaccessibility or radiation exposure hazard. RI ISI program is reviewed to ensure that pressure test and visual examination of piping structural elements is to be performed on all Class 1,2, and 3 systems in accordance with ASME BPVC Section XI program regardless of whether the segments contain locations that have been classified as more or less safety significant.

Sample selection process is examined to verify that expansion of the sample size is addressed through feedback of ISI findings and other information on structural degradation

- from operating experience, inspection methods selected by the licensee are examined to verify that they address the degradation mechanisms, pipe sizes, and materials of concern. Rl ISlinspection program is reviewed to confirm that appropriate examination methods are used and acceptance standards meet the requirements of ASME BPVC Section XI or existing regulatory guidance applicable to the piping system, inspection intervals are reviewed to determine whether the inspection program provides the desired piping failure probability. The reviewer also ensures that the inspection intervals are sufficiently short so that degradation too small to be detected during one inspection does not grow to an unacceptable size before the next inspection is performed.

IV ELEMENT 4: DOCUMENTATION The reviewer will review the licensee's submittal to assure that it contains the documentation necessary to conduct the review described in this SRP (i.e., the ,

documentation described in DG-1063). The RI-Isl program and its updates should be '

maintained on site and available for NRC inspection consistent with the requirements of TO CFR 50, Appendix B.

The reviewer should also ensure that the cover letter that transmits to the licensee the staff's safety evaluation approving the proposed RI-ISI program (i.e., alternative ISI program to that prescribed by the ASME Code) contains a statement to the effect that

" Failure to comply with the RI ISI program as reviewed and approved by the NRC staff and authorized pursuant to 10 CFR 50.55a/a)(3)[e.g., including scope, inspection strategy, documentation, and other programmatic requirements] constitutes noncompliance with 10 CFR 50.55a and is enforceable".

V EVALUATION FINDINGS The reviewer verifies that sufficient information has been provided and that the evaluation 3.9.8-22

. _u

v  %

is sufficiently complete and adequate to support conclusions of the following type, to be included in the staff's safety evaluation report.

The staff concludes that the proposed RI-ISI program, which provides an alternative to the ISI requirements of paragraphs of 10 CFR SO.55a, provides an acceptable level of quality and safety. This conclusion is based on the following.

The licensee's RI Gl submittal defines the proposed changes to the ISI program in general terms. The licensee has confirmed that the plant is designed and operated in accordance with the CLB and that the PRA used in support of the Rl-ISI program submittal reflects the actual plant. The licensie has identified those aspects of the plant's licensing bases that may be affected by the prc posed change, including rules and reguiations, FSAR, technical specifications, licensing conditions, and licensing commitments. The particular piping systems, segments, and welds that are affected by the change in ISI program have been identified. Specific revisions to inspection scope, schedules, locations, and techniques are also identified. in addition, plant systems and functions that rely on the affected piping have been identified industry and plant-specific experience with inspection program results was obtained and characterization relative to the effectiveness of past inspections of the piping and the flaws that have been observed is described, in addition, specific revisions to existing inspection schedules, locations, and techniques have also been described.

The licensee has conducted an engineering analysis of the proposed changes using a combination of tradit:onal engineering analysis with supporting insights from a PRA. The licensee has evaluated the proposed CLB change with regard to the principles that adequate defense in-depth is maintained, that sufficient safety margins are maintained, and that proposed increases in risk, and their cumulative effect, are small and do not cause the NRC Safety Goals to be exceeded.

The licensee's risk assessment demonstrates that proposed increases in risk, and their cumulative effect, are small and do not cause the NRC Safety Goals to be exceeded. This principle was implemented by assessing the expected change in CDF and LERF.

The PRA performed realistically reflects the actual design, construction, and operational practices and reflects the impact of previous changes made to the CLB. Parameter uncertainty, model uncertainty, and completeness uncertainty have been addressed in accordance with the guidelines of DG-1061.

The scope of the piping systems included in the Rl-ISI program for the purpose of screening to classify piping systems as more-safety-significant and less-safety significant is adequate since it envelops ASME Code Class 1,2, and 3 piping systems currently included in ASME Section XlISI program, systems modeled in the plant PRA, and various balance of plant non-nuclear ASME Code Class fluid systems determined to be of importance under the Maintenance Rule program.

The procedure utilized to subdivide piping systems into segments is acceptable since portions of piping having the same consequences of failure and degradation mechanisms have been placed into the same piping segments. In addition, consideration is given to 3.9.8-23

r w identifying distinct segment boundaries at branching points, locations of size changes, isolation valve, MOV and AOV locations, and pipe break probability.

Typical PRAs consider structural failures to be only small contributors to CDF arid hence give them only a brief treatment. To adapt the PRA model for RI-lSi applications, the model has been modified to reflect the effects of pipe ruptures.

Each segment's potential for failure is appropriately represented as probability of failure on ,'

demand, revailability, or frequency of failure. The procedure utilized is acceptable since the potential for failure is based on systematic consideration of degradation mechanisms, segment and weld material characteristics, and environmental and operating .str, esses. The assessment of component failure potential due to aging and degradation takes into account uncertainties. Computer codes used to generate quantitative failure estimates have been l verified and validated against established industry codes.

The impact on the CDF due to piping pressure boundary failure considers both direct and indirect effects. - Consideration of direct effects includes f ailures that cause initiating events, disable single or multiple components, trains or systems, or a combination of these effects. Indirect effects of pressure boundary failures affecting other systems, components and/or piping segments, also referred to as spatial effects such as pipe whip, jet impingement, flooding or failure of fire protection systems have also been considered.

The results of the different elements of the engineering analysis are considered in an integrated decisionmaking process. The impact of the proposed change in the ISI program is acceptable since it is based on the adequacy of the traditional engineering analysis, acceptable change in plant risk relative to the criteria, and the adequacy of the proposed implementation and performance monitoring plan.

Careful consideration has been given to implementation and performance-monitoring strategies. Inspection strategies ensure that failure mechanisms of concern have been addressed and there is a sufficiently h!gh probability of detecting damage before structural integrity is impacted. Safety significance of piping segments is taken into account in defining the inspection scope for the RI-ISI program, inspection scope, examination methods, and methods of evaluation of examination results for the RI ISI program provide an acceptable level of quality and safety as stipulated in 10 CFR 50.55a/al/3)(i).

Pressure test and visual examination of piping structural elements will continue to be performed on all Class 1,2, and 3 systems in accordance with ASME BPVC Section XI program regardless of whether the segments contain locations that have been classified as more- or less-safety-significant.

VI IMPLEMENTATION The following is intended to provide guidance to applicants and licensees regarding the NRC staff's plans for using this SRP section.

Except in those cases in which the applicant or licensee proposes _an acceptable alternative method for complying with specified portions of the Commission's regulations, the method 3.9.8-24

4 n described herein will be used by the staff in its evaluation of conformance with Commission regulctions.

Vll. REFERENCES

1. Draft Regulatory Guide DG 1061, "An Approach for Plant Specific Risk Informed Decision Making: General Guidance," February 28,1997.

2. Draf t Regulatory Guide DG 1063, *An Approach for Plant Specific, Risk-Informed Decisionmaking: Inservice inspection of Piping," May 16,1997.

3. Draft Standard Review Plan Chapter 19, "Use of PRA in Regulatory Activities,"

dated March 3,1997.

4. Nuclear Energy institute Draft (Draft A) " Industry Guideline for Risk Based Inservice inspection" dated April 12,1996.

l l-

5. ASME Research Report (CRDT-Vol. 20 2, Volume 2 - Part 1), " Risk Based Inspection - Development of Guidelines" dated 1892.

6. Westinghouse Owners Group Topical Report WCAP-14572, " Application of Risk-Based Methods to Piping Inservice inspection," March 1996, 1- 7. EPRI Report TR-106706, " Risk Informed inservice inspection Evaluation Procedure,"

f dated June 1996.

8. ASME Code Case N 560, " Alternate Examination Requirements for Class 1, Category B.J Piping Welds,Section XI, Division 1," dated August 1996.

9. Proposed ASME Code Case N 577, " Risk Informed Requirements for Class 1,2, and 3 Piping (Method A),Section XI, Division 1," dated March 1997.

10. Proposed ASME Code Case N 578, " Risk-Informed Requirements for Class 1,2, and 3 Piping (Method B),Section XI, Division 1," dated March 1997,

11. Generic Letter 88-01, "NRC Position on IGSCC in BWR Austenitic Stainless Steel Piping", U.S. Nuclear Regulatory Commission, January.1988. .

12. Generic Letter 89-08, " Erosion / Corrosion-Induced Pipe Wall Thinning", U.S. Nuclear Regulatory Commission, May 1989.

3.9.8-25

ATTACHMENT-4 ACRS LETTER ON DRAFT RG 1063 AND DRAFT SRP 3.9.8 RISK-INFORMED INSERVICE INSPECTION OF PIPING

s ',, 8

[, ' k 't, UNITED STATES NUCLEAR RECULATORY COMMISSION

{* I ADVISORY COMMITTEE ON REACTOR SAFEOUARDS

,/ CASHIN** TON D. C. 20565

. * .e*

4 July 14, 1997 The Honorable Shirley Ann Jackson Chairman U.S. Nuclear Regulatory Commission Washington, D.C. 20555-0001 Dear Chairman Jacksons SUBJF.CT: PROPOSED REGULATORY GUIDE AND CANDARD REVIEW PLAN CHAPTER FOR RISK-INFORMED, PERFORM / UKE-BASED INSERVICE INSPECTION During the 443rd meeting of the Advisory Committee on Reactor Safeguards, July 9-11, 1997, we met with representatives of the NRC staff to review the proposed Regulatory Guide DG-1063 and Standard Review Plan (SRP) Chapter 3.9.8 for risk-informed, performance-based inservice inspection. Our Subcommittee on Probabilistic Risk Assessment also met on July 8, 1997 with the staff, industry representatives, and other interested parties to discuss these documents and industry initiatives. We also had the benefit of the documents referenced.

We believe~that the approach described in proposed SRP Chapter 3.9.8 and Regulatory Guide DG-1063 will lead to substantial improvements in inservice inspection for piping. In response to our comments, the staff identified changes it plans to make to these documents before they are issued for public comment. We recommend that these documents be issued for public comment subject to incorporation of those changes. The staff also proposed a list of questions regarding issues that arose during our meetings, which it plans to include in the Federal Reaister notice to solicit public comments. We agree with these questions.

Dr. Dana Powers did not participate in the Committee's deliberations regarding draft Regulatory Guide DG-1063.

Sincerely,

. . - x R. L. Seale Chairman

.____________J

.